npm_package_access

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds useful behavioral context by explaining the interaction between publish_requires_tfa and automation_token_overrides_tfa, which helps interpret the response. It does not mention rate limits or auth, but the annotations reduce the burden.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences: the first states the purpose with the key fields, the second gives a critical diagnostic interpretation. No redundant words, front-loaded with the verb 'Get'. Every sentence contributes value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only tool with one parameter and no output schema, the description is complete. It lists the returned settings and explains their significance for a common failure scenario. No gaps in expected behavior or return payload.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with a descriptive parameter 'name' including an example. The description does not add anything about the parameter itself, but the baseline of 3 applies given the schema fully handles it.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description starts with 'Get package access settings' and specifies exactly what settings: visibility, 2FA requirement, and automation token override. This clearly distinguishes it from mutation tools like npm_access_set and npm_access_set_mfa among siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides a clear context for use: 'Critical for understanding why CI publishing fails' and explains the diagnostic condition. It does not explicitly name alternatives or state when not to use it, but the use case is unambiguous and sufficient for distinguishing from related tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.