CISA Known Exploited Vulnerabilities

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=true, so the safety and external-data profile is covered. The description adds useful result context ('required action and due date'), but says nothing about pagination, default ordering, limits, or rate behavior for an open-world external catalogue.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

One compact sentence with the resource and scope front-loaded, followed by a colon-delimited list of query axes. No filler, though the clause after the colon mixes filter inputs with result fields, which slightly blurs the structure.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 6 optional parameters, no output schema, and only safety annotations, the description is adequate but incomplete: it hints at returned fields but omits the 'limit' parameter, default result count, and any pagination or empty-result behavior. An agent could call it, but not predict the response shape.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across 6 parameters, so the description must carry the burden. It loosely labels five of them (cveId, vendor, query, lastDays, ransomwareOnly) but leaves 'limit' unexplained and gives no format hints (e.g. CVE-YYYY-NNNN string form, day-range semantics). Partial compensation, not full.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Search) and resource (CISA KEV catalogue), and scopes it precisely with 'vulnerabilities exploited in the wild', which meaningfully separates it from the sibling cve_search. It stops short of naming that sibling, so the agent must infer the distinction from the scope phrase alone.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description lists the query axes (CVE, vendor, keyword, recency, ransomware use), which implies how to invoke it but never says when to prefer it over cve_search or what preconditions exist. Usage is implied rather than stated, and there are no exclusions or alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.