Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. 'Create a new report' implies a write operation, but it doesn't disclose behavioral traits such as authentication requirements (though hinted in schema), permissions, whether creation is idempotent, or what happens on failure. This is insufficient for a mutation tool with zero annotation coverage.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description 'Create a new report' is extremely concise and front-loaded, with no wasted words. It efficiently conveys the core action in three words, making it easy to scan and understand quickly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a mutation tool with no annotations and no output schema, the description is incomplete. It lacks crucial context like what the tool returns, error handling, or how it differs from sibling tools. Given the complexity and missing structured data, more detail is needed to be fully helpful.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema fully documents all 5 parameters. The description adds no additional meaning beyond the schema, such as explaining parameter interactions or constraints. Baseline 3 is appropriate when the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Create a new report' clearly states the action (create) and resource (report), which is adequate. However, it doesn't differentiate from sibling tools like 'update_report' or specify what type of report is being created (e.g., test report, vulnerability report), leaving the purpose somewhat vague.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives like 'update_report' or 'get_all_reports'. There's no mention of prerequisites, context, or exclusions, which is a significant gap given the sibling tools available.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden for behavioral disclosure. It mentions HTML formatting constraints but fails to describe critical behaviors: whether this is a write operation (implied by 'Create'), authentication requirements (only hinted in schema), potential side effects, error handling, or response format. For a mutation tool with zero annotation coverage, this is inadequate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is appropriately concise—two sentences that directly address the tool's purpose and a key constraint. It's front-loaded with the core action and avoids unnecessary elaboration. However, the second sentence focuses heavily on formatting details that might be better placed in parameter documentation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given this is a mutation tool with no annotations and no output schema, the description is incomplete. It lacks information about what happens after creation (e.g., returns created vulnerabilities?), error conditions, authentication requirements beyond schema hints, and how it differs from sibling update tools. The HTML formatting guidance is useful but doesn't compensate for missing behavioral context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all parameters thoroughly. The description adds minimal value beyond the schema—it reinforces HTML formatting rules for the vulnerabilities array but doesn't explain parameter relationships, dependencies, or provide examples not already in schema descriptions. Baseline 3 is appropriate when schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Create one or more vulnerabilities') and target resource ('for a specific report'), making the purpose immediately understandable. However, it doesn't distinguish this from sibling tools like 'update_vulnerability' or 'create_report' beyond the basic verb, missing explicit differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives like 'update_vulnerability' or 'create_report' (which might handle report creation with vulnerabilities). It mentions HTML formatting constraints but offers no context about appropriate use cases, prerequisites, or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It states the action is 'Delete,' implying a destructive mutation, but fails to specify if deletion is permanent, reversible, requires specific permissions, or has side effects (e.g., cascading deletions). This is a significant gap for a destructive tool with zero annotation coverage.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence with zero waste—'Delete a vulnerability by ID'—front-loading the core action and resource. Every word earns its place, making it highly concise and well-structured for quick comprehension.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's destructive nature, lack of annotations, and no output schema, the description is incomplete. It doesn't address critical context like what 'delete' means operationally, potential errors, or return values. For a mutation tool with high complexity implications, this minimal description leaves too many gaps for effective agent use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the input schema fully documents both parameters (bearerToken and vulnerabilityId). The description adds no additional parameter semantics beyond implying 'vulnerabilityId' is used for deletion. Since the schema handles the heavy lifting, the baseline score of 3 is appropriate, with no extra value from the description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Delete') and resource ('a vulnerability by ID'), making the purpose immediately understandable. It distinguishes from siblings like 'get_vulnerability' or 'update_vulnerability' by specifying deletion. However, it doesn't explicitly mention what 'delete' entails (e.g., permanent removal vs soft delete), which prevents a perfect score.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives like 'update_vulnerability' or other siblings. It lacks context about prerequisites (e.g., needing an existing vulnerability ID) or exclusions (e.g., not for creating vulnerabilities). This minimal guidance leaves the agent to infer usage from the name alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden for behavioral disclosure. It states this is a retrieval operation, implying read-only behavior, but doesn't mention potential side effects, authentication requirements beyond the parameter, rate limits, pagination, or response format. The description adds minimal value beyond the basic operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence with zero wasted words. It's appropriately sized for a simple retrieval tool and front-loads the core purpose immediately.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a retrieval tool with no annotations and no output schema, the description is incomplete. It doesn't explain what 'reports' are in this context, what data they contain, how results are returned (list format, pagination), or authentication implications. Given the sibling tools suggest a vulnerability/reporting system, more context would be helpful.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema fully documents the single optional parameter. The description doesn't add any parameter-specific information beyond what's in the schema, maintaining the baseline score of 3 when schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb ('Retrieve') and resource ('all reports'), making the purpose immediately understandable. It distinguishes from siblings like 'get_report' (singular) by specifying 'all reports', but doesn't explicitly contrast with other retrieval tools like 'get_vulnerabilities'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided about when to use this tool versus alternatives like 'get_report' (for a specific report) or 'get_vulnerabilities' (for related data). The description doesn't mention prerequisites, context, or exclusions for usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden for behavioral disclosure. It states the tool retrieves data (implying read-only), but doesn't mention authentication requirements (though hinted in schema), rate limits, error conditions, or what the return format looks like. This is inadequate for a tool with potential auth needs.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence with zero wasted words. It's front-loaded with the core purpose and appropriately sized for this simple retrieval operation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no annotations, no output schema, and multiple sibling tools, the description is incomplete. It doesn't explain what a 'report' contains, how it differs from vulnerabilities, or what the return value looks like. For a retrieval tool in a complex domain, this leaves significant gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents both parameters thoroughly. The description adds no additional meaning beyond implying 'reportId' identifies the report, which the schema already states. This meets the baseline for high schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Retrieve') and resource ('a specific report by ID'), making the purpose unambiguous. However, it doesn't differentiate this tool from its sibling 'get_all_reports' (which likely retrieves multiple reports), so it doesn't reach the highest score.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives like 'get_all_reports' or 'update_report'. It mentions retrieving by ID but doesn't specify prerequisites or exclusions, leaving usage context implied rather than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It states the tool retrieves vulnerabilities but does not describe output format (e.g., list structure, fields), pagination, error handling, or authentication requirements beyond what's implied in the schema. This is inadequate for a tool that likely returns sensitive data.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, clear sentence with zero waste. It is appropriately sized and front-loaded, directly stating the tool's purpose without unnecessary elaboration, making it efficient for an agent to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity of retrieving vulnerabilities (likely a list of sensitive data), no annotations, and no output schema, the description is insufficient. It lacks details on return values, error cases, or behavioral traits, leaving significant gaps for an agent to operate effectively.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema fully documents both parameters. The description adds no additional meaning beyond what the schema provides (e.g., it does not explain the relationship between reportId and vulnerabilities or clarify authentication flow). Baseline 3 is appropriate as the schema handles parameter documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Retrieve') and target ('vulnerabilities for a specific report'), making the purpose understandable. However, it does not explicitly differentiate from sibling tools like 'get_vulnerability' (singular) or 'get_all_reports', which might retrieve vulnerabilities indirectly, leaving some ambiguity in scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. It does not mention sibling tools like 'get_vulnerability' (for a single vulnerability) or 'get_all_reports' (which might include vulnerabilities), nor does it specify prerequisites or exclusions, leaving the agent to infer usage from context alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It states the action ('retrieve') but lacks details on authentication requirements (beyond what's in the schema), rate limits, error handling, or response format. This is a significant gap for a tool that likely interacts with sensitive data.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence that front-loads the core purpose without unnecessary words. Every element ('retrieve,' 'specific vulnerability,' 'by ID') earns its place by clarifying scope and method, making it highly concise and well-structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity of vulnerability data, lack of annotations, and no output schema, the description is incomplete. It doesn't explain what a 'vulnerability' entails in this context, the format of the returned data, or how this tool fits into the broader workflow with siblings like 'create_vulnerabilities' or 'update_vulnerability.'

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents both parameters thoroughly. The description adds no additional meaning beyond implying the 'vulnerabilityId' is used for retrieval. This meets the baseline for high schema coverage but doesn't enhance understanding of parameter usage or constraints.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb ('retrieve') and resource ('specific vulnerability by ID'), making the purpose immediately understandable. It distinguishes from sibling tools like 'get_vulnerabilities' (plural) by specifying retrieval of a single item. However, it doesn't explicitly contrast with 'get_report' or other retrieval tools, keeping it from a perfect score.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives like 'get_vulnerabilities' (for listing) or 'get_report' (for related reports). The description implies usage for fetching a single vulnerability but offers no context on prerequisites, error conditions, or integration with other tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It helpfully specifies HTML formatting constraints (only <p> and <ul><li> tags, no nesting or other elements), which is valuable behavioral context. However, it doesn't mention authentication requirements (though the schema covers this), mutation effects, error conditions, or what happens to unspecified fields during update.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is efficiently structured in two sentences, with the first stating the core purpose and the second providing important formatting constraints. Every sentence adds value, though the formatting details could potentially be moved to parameter-level documentation since they're field-specific.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a mutation tool with 10 parameters and no annotations or output schema, the description provides adequate but incomplete context. The HTML formatting constraints are helpful, but missing are details about authentication requirements, partial update behavior, error handling, and what the tool returns. The schema covers parameter documentation well, but behavioral aspects remain underspecified.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all 10 parameters thoroughly. The description adds some value by emphasizing the HTML formatting constraints for specific fields (goal, scope, summaryDescription, summaryKeyFindings, recommendations), but this information is largely redundant with parameter descriptions in the schema. Baseline 3 is appropriate when the schema does most of the work.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'update' and resource 'report', making the purpose immediately understandable. It distinguishes itself from sibling tools like 'create_report' by focusing on modification rather than creation. However, it doesn't specify what aspects of a report can be updated beyond the HTML formatting constraints mentioned.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives like 'create_report' or 'get_report'. There's no mention of prerequisites, such as needing an existing report ID, or contextual factors that would make this the appropriate choice over other report-related tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. While it mentions HTML formatting constraints, it doesn't disclose critical behavioral traits: that this is a mutation operation (implied but not explicit), what permissions are required, whether changes are reversible, rate limits, or what happens when optional fields are omitted. For an 11-parameter mutation tool with zero annotation coverage, this is inadequate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is appropriately concise with two sentences. The first sentence states the core purpose, and the second provides important formatting constraints. However, the formatting guidance could be more efficiently integrated with the purpose statement rather than as a separate sentence.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an 11-parameter mutation tool with no annotations and no output schema, the description is insufficient. It doesn't explain what 'updating' entails (partial vs. complete updates), what happens to existing fields when optional parameters are omitted, authentication requirements beyond what's in the schema, or expected response format. The HTML formatting guidance is helpful but doesn't compensate for missing behavioral context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all 11 parameters thoroughly. The description adds minimal value beyond the schema - it mentions HTML formatting constraints that apply to some parameters, but doesn't provide additional semantic context about parameter interactions or usage patterns. The baseline of 3 is appropriate when the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose with the verb 'Update' and resource 'vulnerability', making it immediately understandable. However, it doesn't differentiate this tool from its sibling 'update_report' or explain how vulnerability updates differ from report updates, which prevents a perfect score.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives like 'create_vulnerabilities' or 'update_report'. It mentions HTML formatting constraints but doesn't explain the tool's specific use case, prerequisites, or when it's appropriate versus other mutation tools in the sibling list.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.