Audit a whole dependency tree

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden and does reasonably well: it discloses the data source (OSV), the remediation taxonomy (same-line direct upgrade, parent upgrade, override), the deps.dev resolution fallback, and the special GitHub Actions path covering advisories and SHA pinning. It does not mention network/auth requirements (e.g., GitHub token for the Actions check), rate limits, or whether anything is written to disk, which keeps it below a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose and remediation behavior are front-loaded in the first sentence, with input modes and supported formats following logically. The supported-file enumeration is long but earns its place as a validity check for fileName; the trailing GitHub Actions sentence is slightly tacked on but is genuinely necessary scope information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a four-parameter audit tool with no output schema, the description covers inputs, data source, fallback resolution, remediation output, and the Actions special case. What it lacks is return-shape detail (per-finding structure, severity counts) that would otherwise be supplied by an output schema, since none exists here.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3, but the description adds real meaning beyond the schema: it explains why path can be a directory versus a file, and the long supported-format list effectively defines what fileName values are valid. includeDev is left entirely to its schema description, which is the only semantic gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

"Audits every package in a lockfile (direct and transitive) against OSV" gives a specific verb, resource, and scope, and the explicit "direct and transitive" framing separates it from a single-package check like check-package. It also states what the output delivers (a fix per finding), so an agent knows the shape of the value returned.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It clearly states the input modes — project directory, file path, or content plus fileName — and enumerates which manifests/lockfiles are accepted, plus the deps.dev fallback when no lockfile exists. It does not explicitly name a sibling (check-package, check-packages) or say when to prefer those over this whole-tree audit, so routing is left partly to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.