lc_list_vulnerability_cves

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description must disclose behavioral traits. It only states that CVEs are listed from sensors, without mentioning pagination, required parameters (oid), or any other behavioral details. The description is insufficient for understanding tool behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is very concise (one sentence) with no waste, but it lacks structure and is too brief to be helpful. It could be considered minimal, earning an average score for conciseness but poor for informativeness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 10 parameters (1 required), no output schema, and many sibling tools, the description is severely incomplete. It does not cover pagination, filtering, sorting, or any usage context. The agent would lack critical information to use the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, meaning parameter descriptions are empty. The tool description does not add any meaning to the parameters (e.g., oid, limit, cursor, search, filters, etc.). The agent receives no help in understanding what each parameter does.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'List' and the resource 'CVEs', and specifies they are 'observed across the org's sensors through ext-vulnerability-reporting.' This distinguishes it from sibling tools like lc_list_vulnerability_cve_hosts, which list hosts rather than CVEs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for listing CVEs but provides no explicit guidance on when to use this tool versus alternatives (e.g., other vulnerability list tools) or when not to use it. No exclusions or conditions are mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.