Generate a vulnerability report

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=false, idempotentHint=false, destructiveHint=false and openWorldHint=false, so the agent knows this is a state-touching but non-destructive operation. The description adds only the format list and SARIF version; it says nothing about whether an artifact is written, where it goes, or whether the target scopes the export. It adds some value but not rich behavioral context beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single tight sentence with the core action and output formats front-loaded. Nothing is wasted, though the extreme brevity leaves room it could have used for the undocumented target parameter.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return-value explanation is not required. However, for a tool whose 'target' parameter is undefined and whose usage timing is unstated, the description is only minimally complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It implicitly covers report_format by naming the four output formats, but says nothing about the 'target' parameter, which is completely undocumented in both the schema and the description. Half the parameters remain opaque.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb (Export) and resource (current findings), and enumerates the output formats, so the agent knows exactly what the tool produces. It does not explicitly distinguish itself from siblings like list_findings or assessment_summary, but the report-generation purpose is unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to invoke this tool versus alternatives such as list_findings, assessment_summary, or the individual analysis tools. It never says whether it should be run after a scan completes, or how format choice should be decided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.