Dependency Risk

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description adds specifics about what the tool examines (outdated deps, lock file presence, risky patterns), which is additional behavioral context beyond the annotations. However, it does not mention any potential side effects like network calls, authorization requirements, or performance implications—though these are unlikely for a read-only analysis. Overall, it adds modest value over the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-structured sentence that leads with the verb and resource, then enumerates the specific checks. There is no filler or redundancy; every phrase earns its place. The structure is efficient and front-loaded with the core purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has no output schema, the description should indicate what the tool returns or how the results are presented. It only states what it analyses, not what the agent can expect in the response (e.g., a report, a risk score, a list of issues). This is a notable gap for completeness. The tool is simple with one parameter, so it does not need extensive context, but the lack of output clarification prevents a higher score.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single parameter 'path' is fully documented in the schema with a clear description ('Absolute path to the repository root'). Schema description coverage is 100%, so the baseline is 3. The tool description adds no additional meaning regarding parameter formatting, constraints, or usage examples, so no credit beyond baseline is warranted.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Analyse' and the resource 'package.json', then lists three specific focus areas (outdated dependencies, missing lock files, known risky patterns). It distinguishes itself from sibling tools like cve_scan and secret_scan by explicitly scoping to dependency risk, so an agent can easily tell them apart.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool over its many siblings such as security_scan, risk_assess, or audit_360. There is no mention of use cases, exclusions, or alternatives. An agent must infer that this tool is dependency-specific, but nothing explicitly says 'use this for package dependency analysis' or contrasts it with broader security scans.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.