dependency_manifest_review

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, non-destructive and closed-world, so the safety profile is covered. The description still adds real value by signaling the analysis is performed on the manifest 'as text' (i.e., pure static analysis of supplied content, not a fetch from a repo) and by listing the categories of findings it produces.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single well-formed sentence, front-loaded with the verb and resource, with the file-type list in parentheses so it does not interrupt the main clause. Nothing is redundant.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return shape need not be described, and annotations cover the safety profile. However, for a three-parameter tool with zero schema coverage, the description leaves gaps that matter to correct invocation: the format/role of filename, how lockfilePresent interacts with the 'missing lockfile hints' check, and what happens with an unrecognized manifest type.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and there are three parameters, so the description must compensate. It only weakly does: 'as text' hints at the content parameter and 'missing lockfile hints' vaguely gestures at lockfilePresent, but neither is explained — the reader cannot tell whether that flag is self-reported or checked by the tool. The filename parameter (whether it is a basename, path, or used for format detection) is never addressed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Review) and resource (dependency manifest) and enumerates the concrete file types it handles (package.json, requirements.txt, go.mod, etc.), which immediately distinguishes it from sibling reviewers like openapi_review or cloudformation_review. It also names the exact defect classes it looks for: unpinned ranges, git/URL sources, wildcard versions, missing lockfile hints.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied by the file-type list — an agent can infer 'use this when you have a dependency manifest as text,' but there is no explicit when-to-use, when-not-to-use, or named alternative (it does not, for example, differentiate itself from the sibling requirements_check).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.