mvs_assets_affected_by

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. "Find" clearly implies a read-only query, and the exclusivity constraint is stated, but the description does not disclose pagination behavior, what happens when no identifier is supplied, or whether results are limited by other implicit filters. It is adequate but not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three tight sentences with no filler. The core action is front-loaded, the blast-radius metaphor adds useful framing, and the invocation rule is stated directly. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the output schema exists and the input schema covers 100% of the parameters, the description does not need to explain return values or field semantics. It provides the one piece of context the schema alone lacks: how to choose and combine the identifier parameters. It is complete enough for correct invocation, though it could briefly note that combining identifiers is disallowed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the individual parameters are already described. The description adds valuable selection semantics beyond the schema by stating that exactly one of cve_id, vulnerability_id, or the patch_name/patch_type pair must be supplied. This helps an agent avoid invalid combinations that the nullable schema alone does not make obvious.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific action and resource: "Find every asset affected by a given CVE, vulnerability, or missing patch." It reinforces this with the blast-radius framing, making it clear this is the impact/query tool rather than a generic asset or vulnerability lister. Even without naming a sibling, the "given one finding, what is exposed?" phrasing distinguishes it from sibling tools like mvs_list_assets or mvs_get_vulnerability.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives a clear use case: "This is the blast-radius question: given one finding, what is exposed?" It also tells the agent the key invocation rule: "Supply exactly one of cve_id, vulnerability_id, or the patch_name/patch_type pair." It does not explicitly name alternatives or exclusions, but the context is strong enough to route the agent to this tool for affected-asset queries.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.