Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. It lists actions (download, scan, check, analyze, verify) but does not mention side effects like network requests, resource usage, or whether it modifies anything. Lacks explicit disclosure of behavioral traits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences front-load the purpose and usage. No superfluous words; every part adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 3 parameters, no output schema, and no annotations, the description fully covers what the tool does, when to use it, and parameter semantics. No gaps remain for an agent to interpret.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, baseline 3. Description adds value by explaining version parameter with example and default behavior ('If omitted, audits the latest version'), and clarifies targetLicense default ('default: MIT').

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states 'Deep security audit of a single npm package' and lists specific actions (downloads tarball, scans for malware, checks vulnerabilities, analyzes install scripts, verifies license). This distinguishes it from sibling tools like depguard_audit_bulk and depguard_audit_deep.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says 'Use when you need full details on a specific package' and provides condition for version parameter. While it doesn't directly mention alternatives, the sibling tool names imply the scope, making usage clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must fully disclose behavioral traits. It mentions input types but does not state whether the audit is read-only, destructive, or involves any side effects, rate limits, or permissions. For a bulk operation, such details are important.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences, no wasted words. The description is front-loaded and efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has moderate complexity (accepts flexible input types) but no output schema. The description does not explain what the return value is, which is a gap for an agent to interpret results. Adequate but incomplete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description does not add meaning beyond what the schema already provides; it merely paraphrases the parameter descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Audit multiple packages in one call,' specifying the verb (audit) and resource (packages). It distinguishes from sibling depguard_audit_project by advising to use that tool when a package.json path is available.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use an alternative: 'Use depguard_audit_project instead if you have a package.json path.' This provides clear context for tool selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. It describes non-destructive audit behavior (crawl, aggregate). While it doesn't explicitly state read-only, the audit context implies no modifications. Adds value beyond schema with depth and aggregation detail.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences: first states purpose, second explains mechanism, third gives usage guidance. No redundant information. Front-loaded with key action.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a transitive dependency audit tool with 3 params and no output schema, the description covers purpose, behavior, and usage context completely. It answers what, how, and when without missing critical information.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema covers all 3 parameters with descriptions. The tool description does not add additional meaning beyond what's in the schema; it merely restates the purpose. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states it audits the full transitive dependency tree, distinguishing from similar tools like depguard_audit (likely direct deps only). The verb 'audit' and resource 'dependency tree' are specific and unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says 'Use when you need to know the total attack surface, not just direct deps,' providing direct guidance on when to choose this tool over siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description must carry the burden. It explains the scanning scope and output (consolidated security report) but does not disclose potential side effects, auth needs, or what happens if the lock file is missing. Adequate but not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three sentences, each with a clear purpose: scope, scanning details, input/output, and use case. It is front-loaded, concise, and contains no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 3 parameters, no output schema, and no annotations, the description covers the essential aspects: what it does, what to pass, and when to use. Minor gaps like missing error conditions or output structure details, but sufficient for typical use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with good descriptions. The description reinforces the 'path' parameter and mentions auto-detection for targetLicense and default for includeDevDependencies, adding slight value beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool audits ALL dependencies in a project, specifying what is scanned (direct, transitive, packageManager field) and expects a path to package.json. It differentiates from siblings like depguard_audit by emphasizing the project-wide scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says when to use: 'when the user asks to review project security or after cloning a new repo.' Does not explicitly state when not to use or mention alternatives, but the context and sibling list imply it's for comprehensive scans.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden and does so well: it discloses the classification scheme (INFO/WARN/HIGH), the FP-averse heuristic policy, and concrete escalation triggers (curl|sh, base64 chains, credential paths). It omits whether the operation is read-only or what permissions it needs, which is the remaining gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the mandatory timing constraint, then the scope, then classification behavior, then the threat rationale. Dense but structured; the final threat-model sentence is motivational context that justifies urgency rather than padding, though it is the most expendable clause.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter audit tool with no output schema and no annotations, the description covers scope, timing, classification output, and heuristics thoroughly. The unstated return shape (findings list, counts) and read-only nature are minor remaining unknowns.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the single parameter ('absolute path to the repository root') is fully documented in the schema. The description adds no syntax or format detail beyond what the schema states, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (enumerates/classifies) and resource (files that auto-execute on workspace open), with an explicit enumeration of the artifact types scanned. However, it never distinguishes itself from the many sibling audit tools (depguard_audit_project, depguard_audit_deep, depguard_audit_bulk, depguard_audit), leaving the agent to infer the boundary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives strong timing guidance: 'call this AFTER cloning ... BEFORE opening in any IDE or running direnv allow.' That is a clear when-to-use condition. It stops short of naming when NOT to use it or which sibling to prefer instead, so it falls short of 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does substantial work: it discloses the exact-version matching rule, the explicit false-positive policy ('clean versions of previously compromised packages are never flagged'), and the reporting contents (on-disk presence, install scripts, tarball download time, remediation steps). It does not state whether the operation is read-only or whether it requires network access to refresh the malicious-package list, which are the remaining behavioral gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the question the tool answers, then scope, then matching semantics, then usage trigger. Every sentence carries information, but the single dense paragraph packs scope, output, and guidance together without visual separation, which slightly hurts scannability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema and no annotations, the description compensates well: it enumerates what is scanned (lock files across five package managers, nested copies, globals, cache) and what is reported (location, on-disk presence, install scripts, tarball timestamps, remediation). Only the operational profile (read-only? network required? runtime cost) is left unstated.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% (paths, maxDepth, includeCache, includeGlobal each documented with types and defaults), so the schema already does the heavy lifting. The description only restates 'under the given paths' and the cache/global scanning scope at a high level, adding no format or semantics beyond the schema. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a precise verb+resource: scanning every lock file, global install, and npm cache and matching exact installed versions against ~35k known-malicious npm packages, framed as answering 'was this machine hit?'. The scope is unusually specific and unambiguous. It does not name or contrast with the many similar-sounding siblings (depguard_audit, depguard_sweep, depguard_verify), so it falls short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use it: 'when the user asks whether they are affected by an attack, or as a periodic check.' That is a clear trigger condition. It offers no exclusions or alternative tools for adjacent needs (e.g. auditing a single project vs. the whole machine), which keeps it from a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does well: it discloses the checks performed (existence, typosquatting, security audit) and the allow/warn/block verdict semantics plus the required handling of negative verdicts. It omits any note on rate limits or repeat-call behavior, which keeps it short of a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the MANDATORY directive, then delivers the checks and the result-handling rule in two dense but fully earned sentences with zero filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No annotations and no output schema, so the description must carry behavioral weight, and it explains the return verdicts and required follow-up. It is largely complete for a pre-install gate, with only minor gaps around latency or failure modes.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both optional parameters and the required 'name' are already documented in the schema. The description implies the verdict relates to a score threshold and license but adds no syntax or format detail beyond the schema, matching the baseline 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States specific verbs (verifies existence, checks typosquatting, runs audit) on a specific resource (npm package pre-install) and names the trigger commands (npm install/yarn add/pnpm add). The scope is unmistakable, though it does not explicitly name which sibling tools it complements among the large depguard family.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says to call it BEFORE any package install and covers the case where the agent decided to install on its own, not just user requests. It also states the downstream action on 'block'/'warn' results, leaving nothing to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Clearly states read-only nature: 'Read-only: never modifies package.json, lockfile, or runs npm.' Also describes internal steps (reads, groups, sorts). No annotations provided, so description carries full burden and succeeds.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Four sentences, front-loaded with main purpose, no redundant words. Every sentence provides useful information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Output is described conceptually (sorted by severity, actionable), but no explicit return format. Given no output schema, a bit more detail on output structure would improve completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so description adds minimal value. It reinforces that path is absolute and that targetLicense is auto-detected, but does not go beyond schema. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it builds a remediation plan for vulnerabilities, identifying which direct dependencies to upgrade. It distinguishes itself from sibling tools like depguard_audit_project by explaining the grouping and sorting behavior.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit guidance: 'Use this when the user is staring at "100 vulnerabilities found"... and needs to know which 5 direct deps to upgrade.' Could improve by mentioning when not to use (e.g., if only raw audit is needed).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description accurately describes the tool's behavior (scans source files, no destructive actions) and lists the types of issues it detects. Since no annotations are provided, the description bears full responsibility, and it adequately conveys that this is a read-only review tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is highly concise with two sentences: the first immediately states when to use it, and the second lists the issues. It is front-loaded and every sentence adds value without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool scans for issues and returns findings (implied by 'fix the findings'), the description does not explicitly state the output format or what the user should expect as a response. This omission limits completeness for a moderately simple tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with both parameters well-described (mode with timing and options, path as absolute path). The description adds a context about the types of issues scanned but does not add new parameter-specific meaning beyond the schema. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: to scan source files for issues after code changes or before commit, listing specific types of issues (console.logs, empty catch blocks, etc.). It differentiates from sibling tools like depguard_audit by focusing on post-change review for introduced issues.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to call this tool ('AFTER making significant code changes or before the user commits') and instructs to fix findings before reporting done. It provides clear context but does not explicitly mention alternatives or when not to use it, though the specific timing implies when it is appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden. It discloses behavior: reads specific files, enumerates components, runs auditProject under the hood for VEX, and notes that includeVex is slower. No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences: purpose, method, usage guidance. No filler. Front-loaded with action verb. Every sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 4 parameters, no output schema, and no annotations, the description is thorough. It mentions the SBOM standard, compliance reasons, and VEX option. Lacks details on return format, but the standard format is implied.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. The description adds meaning for includeVex (explains it's slower, runs auditProject) but does not elaborate on targetLicense or includeDevDependencies beyond schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool generates a CycloneDX 1.6 SBOM for npm projects, specifying inputs (package.json + lock file), content (direct/transitive components, PURLs, hashes), and clearly distinguishes from sibling audit/guard tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit usage guidance is provided: 'Use this when the user asks for an SBOM, a compliance report, or to comply with EU CRA / US EO 14028 requirements.' It also mentions when to set includeVex but does not explicitly state when not to use the tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, description discloses scoring behavior with caps for critical and high vulnerabilities. Adds value beyond basic purpose, though does not cover all behavioral aspects like side effects or authentication.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, front-loaded with purpose, differentiation, and a key behavioral detail. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple two-parameter tool with no output schema, description covers purpose, usage, and a behavioral detail. Could mention output format but overall sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and description adds scoring context but does not directly elaborate on parameter meaning beyond schema. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states it provides a 'Quick 0-100 quality score for a package' and distinguishes from sibling 'depguard_audit' by noting speed advantage for score-only needs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says use when 'you only need the score' and is 'Faster than depguard_audit', providing clear usage context. Does not explicitly mention when not to use or other alternatives, but the guidance is helpful.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. Mentions sorting behavior but does not explicitly state read-only nature or lack of side effects. Minimal disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two succinct sentences: first states purpose, second gives usage guidance. No superfluous words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, but description does not explain return format (e.g., list of packages, scores, pagination). Some information missing for full completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema covers 100% of parameters with descriptions. Description adds only the sorting context, not additional parameter meaning beyond schema. Baseline score applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states verb 'search', resource 'npm packages', and sorting by 'depguard quality score'. Distinguishes from sibling tools which are audit/remediation focused.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit usage context: 'Use when you need to find packages but already know the keywords.' Does not mention when not to use or alternatives, but sibling list shows no similar search tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Describes the full process: checks native solutions first, evaluates npm candidates, and gives recommendations with security and quality data. No annotations, but description fully covers expected behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three concise sentences with no wasted words. Front-loaded with clear purpose and usage guidance.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema and 3 parameters, description provides complete context: when to use, what it does, and the evaluation process. No gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so parameters are well-documented in schema. Description does not add additional meaning beyond what schema provides. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states the tool's purpose: it checks for native Node.js solutions first, then evaluates npm candidates, and recommends install/caution/write-from-scratch. Differentiates from sibling tools which are about auditing/reviewing, not recommending.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says 'call this BEFORE choosing a package yourself' and 'Always prefer this over picking a package from your training data'. Provides clear guidance on when to use and contrasts with alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Without annotations, the description carries the burden of disclosing behavior. It explains the scanning process (source files, package.json, phantom deps) and implies a read-only operation. No contradictions with annotations (none provided).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences with no filler. Each sentence serves a purpose: state action, explain method, provide usage scenario. Efficient and well-structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Lacks description of output format, which is important since there is no output schema. The schema is simple (2 params), and the description covers the tool's purpose well, but omits what the result looks like, which is a gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds context that path must contain package.json, adding slight value beyond the schema. It does not address the includeDevDependencies parameter explicitly, but the context is sufficient.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: finding unused npm packages and phantom deps. It uses specific verbs like 'find', 'scans', 'cross-references', and 'detects', making the purpose unambiguous. The description differentiates from sibling tools by detailing the exact action.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit guidance on when to use ('after a coding session where you installed multiple packages'). While it does not list alternatives or when not to use, the context is clear enough for an AI agent to decide.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. It discloses key behaviors (existence check, typosquatting detection, fast) but lacks details on side effects (e.g., read-only, error handling). Still above average for the simplicity.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with purpose and key differentiator, no wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Tool is simple with one parameter, no output schema, but description explains output (existence + typosquatting). Adequately complete, though could mention network dependency.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% for the single parameter 'name', and description adds no extra semantic meaning beyond what the schema provides. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool checks package existence on npm and detects typosquatting, and distinguishes itself from sibling 'depguard_guard' by being faster for verification only.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly advises when to use: 'when you only need existence verification without a full audit', and contrasts with 'depguard_guard' for efficiency.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.