rush_sbom

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must carry behavioral disclosure. It does disclose one important edge case: missing cdxgen results in status='skipped'. It also warns that output must be a safe explicit path. However, it remains silent about the behavior of overwrite, the allow_* flags, or what happens when output_path is null, leaving significant behavioral uncertainty.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with no extraneous words, and the main action is front-loaded. However, for a tool with 10 parameters and no annotations, this level of conciseness is underspecification rather than appropriately sized. Every word earns its place, but the description does not carry enough content for the tool's complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having an output schema and a useful failure-mode disclosure, the description is incomplete for safe and correct invocation. It does not explain the role of the many allow_* parameters, the semantics of overwrite or path, or the conditions under which an agent should select this tool over other rus_* tools. An agent would need to guess at most of the configuration surface.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across 10 parameters, so the description carries the full burden of explaining parameters. It adds context only for output_path ('safe explicit output path'), and it implicitly mentions the cdxgen dependency. The other nine parameters, especially the allow_* booleans, receive no semantic explanation; an agent cannot confidently set them.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Generate') and resource ('an SBOM') and adds the key constraint that it writes only to a safe explicit output path. This clearly identifies the tool's purpose, though it does not explicitly contrast it with sibling tools like rus_license_matrix that could overlap in the compliance/artifact space.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool versus alternatives, nor any conditions or exclusions. The phrase 'only to a safe explicit output path' is a safety restriction, not usage guidance. An agent must infer the appropriate context from the tool name and description.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.