Export the agent bill of materials

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, and the description still adds material context: the tool is static and local, nothing is launched or sent, and the output deliberately excludes paths, arguments, environment variables and secrets. That last point is exactly the kind of disclosure an agent needs before deciding the output is safe to share or summarize. No contradiction with the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with what the inventory contains and then the format and safety notes. The content enumeration is long but every item adds scope information the schema does not carry. Slightly dense; a list or line break would aid scanning, but nothing is filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, and the description picks up that slack by characterizing both return formats (Markdown overview vs CycloneDX 1.6 JSON). The static/local guarantee and exclusion of secrets complete the safety picture. Missing only is default behavior for `project_dir` and whether unpinned or unendorsed assets appear in the inventory.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is only 33%, so the description carries extra burden. It compensates well for `format`, explaining that summary yields a Markdown overview and cyclonedx a CycloneDX 1.6 JSON document, but `project_dir` has no explanation anywhere, and the interaction between `project_only` and `project_dir` is left unclear. Partial compensation justifies a mid score rather than a low one.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a concrete artifact (a bill of materials) and enumerates its contents precisely: MCP servers, plugins, skills, commands, subagents, CLAUDE.md and hook configs, with SHA-256, pin status, scores and OWASP evidence. That is far more specific than the title alone, and the two output formats are spelled out. It never names a sibling such as audit_agent_context or security_dashboard, so the agent must infer how this differs from those, which keeps it off a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: 'format=summary is a Markdown overview for audits' hints at the audit scenario, and the CycloneDX option hints at machine-consumable export. There is no explicit statement of when to pick this over the other audit/dashboard tools, and no exclusions. The format guidance is useful but stops short of real routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.