Prioritize cached CVEs

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the agent knows this is a safe, non-mutating operation. The description adds important behavioral context about deterministic ordering criteria and a critical security warning that advisory text is untrusted data, which goes beyond what annotations provide. The lack of mention about rate limits or result format is minor given the annotations cover the safety profile.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise, consisting of two short sentences that front-load the core purpose and deterministic criteria. The second sentence adds a critical behavioral warning without redundancy. Every sentence earns its place, and there is no wasted text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's low complexity (2 simple parameters, no required fields, rich annotations, and an output schema present), the description is largely complete. It covers the ordering logic, distinguishes from severity, and includes a safety warning. The only minor gap is the lack of guidance on pagination behavior, but the existence of an output schema and the tool's read-only nature mitigates this.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. While the description does not explicitly describe the limit and offset parameters, it provides strong context for the tool's behavior (deterministic ordering), which indirectly supports understanding the parameters. With only 2 simple parameters (limit with default 20, offset with default 0) and no enums or nested objects, the semantic burden is low, and the description's clarity about the tool purpose adds enough value to give a 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states the verb 'Order' and the resource 'cached CVEs', and details the deterministic criteria (KEV, EPSS percentile, etc.). It also distinguishes the tool's purpose from severity assessment, clearly differentiating it from related tools like vuln_search_cves or vuln_get_cve.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly indicates the tool's purpose for research prioritization, not severity ordering, which helps guide when to use it. However, it does not explicitly mention when to use alternatives or when not to use this tool, leaving some context implicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.