Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, non-destructive, open-world, so the safety profile is covered. The description adds value beyond that by disclosing the fixed result shape (10 items per list), the 30-day publication window for the EPSS list, and field-name parity with search_cves for howExploited — context an agent can't derive from the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The contents enumerate up front in a single dense but well-ordered sentence, followed by two short clarifying clauses about field naming and follow-up routing. Every element carries information, though the long list-within-a-sentence and the terse 'howExploited is as in search_cves' phrasing make it slightly harder to scan than it could be.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, the description needn't explain return values, and with zero parameters there's nothing to specify. It covers what the briefing contains and how to continue investigating afterward; only the terse cross-reference to search_cves' howExploited field leaves a small interpretive gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so there is no parameter semantics to explain and the baseline of 4 applies. The description correctly implies a parameterless snapshot call with no filtering options.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Get a public CVE briefing') and then enumerates exactly what it contains: headline stats, 10 latest KEV additions, 10 latest critical CVEs, 10 highest EPSS in last 30 days. This is clearly distinct from get_cve (single lookup) and search_cves (query), so an agent can route without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Establishes the tool as a dashboard/overview entry point and explicitly routes follow-up work: 'For vendor/product follow-up searches use CPE names from find_product.' It also anchors the howExploited field to search_cves. It stops short of stating when to prefer this over search_cves or get_cve directly, so it's clear context without explicit exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.