pci_list_vulns

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is known. The description adds behavioral context beyond that: it returns 'compact rows' with no prose fields, explains fetch_all pagination behavior ('Walk every page rather than returning one'), and lists filter semantics. This enriches the agent's understanding of what to expect.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is tight and scannable: a one-line summary followed by a bullet-like list of parameters, each with a succinct definition. The final sentence about prose fields and pci_get_vuln is valuable and not redundant. No noise or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having 10 parameters and no required ones, the description covers all of them with functional meanings. It also explains the output style (compact rows, no prose) and points to the sibling tool for details. Since an output schema exists, return-value details are not needed. The tool description is complete for effective usage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries full responsibility for parameter meaning. The Args section provides a concise, meaningful explanation for each of the 10 parameters, including allowed values for severity and false_positive. This goes beyond the schema, which only provides types and defaults, and gives the agent enough to construct correct calls.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a clear verb and resource: 'List vulnerability findings as compact rows.' It distinguishes itself from sibling tools like pci_get_vuln (which provides detailed prose for a single finding) and pci_list_assets (which lists assets). The function's scope is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use: for listing/filtering vulnerability findings in a compact format. It explicitly states an alternative: 'call pci_get_vuln for one finding's threat, impact, and solution text,' indicating when to switch. However, it does not contrast with other list tools like pci_list_assets or pci_list_scans, leaving some usage context implicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.