cork_get_software_vulnerabilities

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It reveals the output fields and filter intent, implying a read-only listing operation. However, it does not mention pagination behavior, how filters combine (AND vs OR), default sorting, or any access/pre-requisites, leaving some ambiguity for a 12-parameter tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences with no wasted words. The first sentence establishes the core purpose and output, and the second provides actionable filtering guidance. All information contributes directly to understanding or invoking the tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 12 parameters, no output schema, and no annotations, the description is serviceable but not fully complete. It covers primary output and key filters, yet omits the return envelope/pagination structure, sorting behavior, partner_uuid usage, and explicit differentiation from the summary sibling. More detail would be needed for fully confident autonomous invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 75%, with three enum parameters (sort_by, sort_direction, minimum_priority) lacking schema descriptions. The description adds value by grouping risk filters under a common intent ('focus on the highest-risk findings') and naming client_uuid/device_uuid as scoping options. It does not add meaning to pagination or sorting parameters, but those are somewhat documented in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('List'), a clear resource ('individual software vulnerabilities'), and enumerates the output details (CVSS, EPSS, KEV status, impacted version). This clearly distinguishes it from the sibling cork_get_software_vulnerability_summary by emphasizing individual findings rather than an aggregate view.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear usage context: it explains how to filter for high-risk findings via minimum_cvss_score, minimum_epss_score, minimum_priority, or only_known_exploited, and how to scope by client_uuid or device_uuid. However, it does not explicitly name alternatives like the summary tool or state when not to use this tool, so it stops short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.