npm_audit_deep

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, openWorldHint, idempotentHint, and destructiveHint=false. The description adds value by disclosing the specific endpoint (npm audit v1) and the richer detail level, which are behavioral traits not captured in annotations. No contradiction exists.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the core purpose, then alternative and prerequisite. Every word earns its place; no filler or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description compensates by enumerating return contents (CVSS scores, CWEs, affected version ranges, fix recommendations, full vulnerability metadata). It also covers prerequisite and alternative. Together with strong annotations, it is nearly complete, though it could mention potential latency or auth requirements.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema covers all parameters with descriptions (100% coverage), so the schema does the heavy lifting. The description adds the semantic hint that the dependency map should come from npm_dependencies, but this is a usage note rather than a deeper semantic definition of the parameters themselves.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Full security audit on a dependency set' and explicitly compares itself to npm_audit by noting it uses the npm audit v1 endpoint for 'richer detail'. This clearly differentiates it from the sibling tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives an explicit prerequisite: 'use npm_dependencies to get it first' and names the alternative npm_audit, implying when to choose this tool for richer detail. It does not explicitly list when-not-to-use cases, but the comparison and prerequisite provide strong guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.