list_security_problems

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint and openWorldHint; the description adds the required OAuth scope, which is useful context beyond annotations. It does not disclose pagination behavior, that next_page_key silently ignores the other filters, or the 500-item page cap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with the action and endpoint, with the auth requirement second. Efficient, though the extreme terseness leaves obvious gaps for a six-parameter paginated tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, so the description would ideally explain the returned shape and pagination flow (nextPageKey, page_size default 50). For a six-param listing tool with hidden defaults like from_time=now-30d, the definition is only minimally sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 67% and the description says nothing about any of the six parameters. The selector syntax and time formats are documented in the schema, so the baseline 3 applies; the undocumented sort and page_size are at least constrained by schema defaults and min/max.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ("List vulnerabilities") and pins the exact endpoint GET /api/v2/securityProblems, so it is distinguishable from list_problems and get_security_problem. It stops short of explicitly naming the sibling used for a single vulnerability.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Adds the prerequisite "Needs securityProblems.read", which is genuine invocation guidance. However it never says when to prefer this over get_security_problem or list_problems, nor what the default 30-day window implies about usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.