scout_sbom

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, and the description adds substantial behavioral context beyond that: stdout truncation risk, the exact return dict structure, parse behavior for different formats, and error semantics. This fully discloses the tool's runtime behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but every sentence contributes value: purpose, differentiation, truncation caveat, workaround, error behavior, and a structured args/returns section. It is arguably slightly long, but nothing is redundant or filler, and the front-loaded summary makes it scannable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 3-parameter tool with no output schema, this description is remarkably complete. It covers what the tool does, when to use it, all parameters with detailed options, the exact return structure, and edge cases like truncation and parse failures. A user could invoke or rely on this tool without further documentation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

While the schema provides only names/types, the description explicitly explains each parameter: 'image' is an image reference, 'format' lists the allowed values with default and format details, 'platform' is the image platform. It also documents the return payload structure. This completely compensates for the 0% schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource: 'Generate a Software Bill of Materials (SBOM) for an image.' It clearly distinguishes from the sibling tool scout_cves by stating 'Package inventory only — scout_cves adds vulnerability matching on top.' This differentiates the tool's exact scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit guidance on when to use this tool versus alternatives (scout_cves for vulnerabilities) and warns about potential truncation for large SBOMs with a workaround (run scout sbom -o file.json on host and load separately). It also clarifies error handling: non-zero CLI exit does not raise, but a missing plugin does. This is highly actionable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.