Check MCP server packages (npm/PyPI)

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare readOnlyHint and openWorldHint; the description goes far beyond by enumerating the checks (vulnerabilities, malicious versions, typosquats, non-existent names, freshness, install scripts, deprecation, publisher changes) and explicitly disclosing the external endpoints contacted (registry.npmjs.org, pypi.org, api.osv.dev) and that nothing else leaves the machine. That is exactly the exfiltration/consent context an agent needs before invoking a network tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the applicability condition, then a compact but complete enumeration of behavior. No filler and the privacy statement is placed at the end where it has the most impact.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description covers what is checked and the network/consent implications well, which is the critical information for this tool. It stops short of describing result shape or what happens when confirm_network is false, leaving a small gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 75%, so the schema carries most parameter meaning, but the description adds the concrete destination domains behind confirm_network and reiterates that only names and versions are transmitted, which the schema's terse 'must be true' note does not. It also contextualizes scan_images indirectly via the image-pull note in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('checks the package on its registry and in the OSV database') plus the precise resource and scope ('for servers launched with npx/uvx and similar'), and then enumerates exactly what checks are performed. This clearly separates it from siblings like audit_mcp_config or audit_server_tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The opening clause gives a clear trigger condition ('For servers launched with npx/uvx and similar'), which tells the agent when this tool applies, and the confirm_network requirement is surfaced. However, it never names an alternative sibling or states when not to use it (e.g., vs. audit_mcp_config for non-npx servers).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.