Scored across 3 tools
The three tools target clearly distinct actions: a single-component scan, a two-version comparison, and rule introspection. There is no plausible confusion about which tool to pick for a given need, and the descriptions reinforce the boundaries (diff explicitly builds on scan's sources).
All three names follow a clean verb_noun pattern (scan_component, diff_components, list_rules) in snake_case with consistent pluralization conventions. An agent can reliably infer the tool's purpose from its name alone.
Three tools is lean but well-matched to a focused static-analysis server: scan, compare, and inspect rules form a coherent minimal surface. It is slightly under-provisioned for things like batch scanning or report history, but nothing is gratuitous.
The core supply-chain vetting workflow is covered end-to-end: scan a component, diff two versions for upgrade review, and enumerate detection rules to interpret findings. Minor gaps exist around retrieving prior reports or scanning many components at once, but agents can work around these by re-scanning.