Assess a finding

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations are all false, so the description carries the full burden of behavioral disclosure. It states the tool creates or updates findings, implying mutation, but does not explain authorization requirements, idempotency, error behavior, or what the output contains. The phrase 'authorized finding' is ambiguous. There is no mention of the output schema, which exists but is unaddressed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences long, which is short. The first sentence packs the core action and required fields. The second sentence 'VRT remains a baseline.' is cryptic and adds little value, making it slightly wasteful. Overall, it is acceptable but not optimally concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 10 parameters, 8 required, 0% schema descriptions, and an output schema that is not mentioned, the description is too brief. It does not explain relationships between parameters (e.g., case_id vs. finding_id for update), the meaning of method or scope_evidence, or the return value. The agent would need significant additional context to use the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It names five of ten parameters (vrt_path, demonstrated_impact, prerequisites, scope_evidence, confidence) but omits case_id, method, title, cve_id, and finding_id. It does not clarify vrt_path is an array with constraints, nor explain the enum values for method and confidence. The description adds partial meaning but is insufficient for the agent to understand all parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool creates or updates an authorized finding, specifying the required components (VRT path, demonstrated impact, etc.) and the version of the VRT. This distinguishes it from sibling tools like research_create_case, which creates a case, not a finding. However, the last sentence 'VRT remains a baseline' is vague and slightly detracts from clarity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool versus alternatives like research_record_evidence or research_import_sarif. The implied use case is for assessing findings, but the description does not provide exclusions, prerequisites, or decision criteria. The agent must infer usage from the tool name and sibling context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.