nist-mcp

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=true, indicating safe read operations with open-ended queries. The description adds valuable behavioral context about potential 6+ second delays due to rate limiting without an API key, which goes beyond what annotations provide. This helps the agent anticipate performance characteristics.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is appropriately concise with two sentences. The first sentence states the purpose clearly, and the second adds important behavioral context about performance. Both sentences earn their place, though it could be slightly more front-loaded by mentioning the rate limiting earlier.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has annotations (readOnlyHint, openWorldHint) and an output schema exists, the description provides adequate context. It covers the purpose and key behavioral constraint (rate limiting). For a search tool with good annotations and output schema, this is reasonably complete, though it could benefit from more usage guidance.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 50% (two of four parameters have descriptions). The tool description adds no parameter-specific information beyond what's in the schema. With moderate schema coverage, the baseline is 3 since the description doesn't compensate for the coverage gap but also doesn't detract from what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool searches the NVD CPE database for products and platforms, providing a specific verb ('search') and resource ('NVD CPE database'). However, it doesn't explicitly differentiate from sibling tools like 'search_cves' or 'search_controls' that also search different NVD databases, missing full sibling differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. It mentions rate limiting with/without an API key, but this is behavioral context rather than usage guidelines. There's no mention of when to choose this over other search tools like 'search_cves' or what specific scenarios warrant CPE searches.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.