Check CVEs

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does so well: it discloses per-product cache reuse, that the network is touched only for changes, NVD rate-limit pacing on a cold keyed start, background queue draining, and that the `completeness` field must be checked. The only blemish is the internally tense claim 'Never requires the network' immediately followed by network-touching behavior, which muddies an otherwise strong disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The primary action is front-loaded and the sentences are information-dense. There is mild redundancy: the 'read completeness before concluding' caveat is repeated as 'see completeness.status "incomplete"', and the closing sentence partly restates the earlier rate-limit point.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no annotations and no output schema, the description is unusually complete: it names an output field (`completeness`) with a status value and warns about cold-start latency. It still leaves the ToDo list structure and overall return shape unspecified, which keeps it short of a 5.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and both parameters (refresh, with_epss) are documented in the schema, so the baseline is 3. The description hints at cache freshness and source re-download behavior but does not add syntax or mapping beyond what the schema already provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Match the stored inventory against the CVE sources') plus the effect ('fill the ToDo list'), so the agent knows exactly what it does. It implicitly separates itself from cve_detail (bulk per-product matching vs. single lookup), but it never names a sibling explicitly, so it falls short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: run this to populate the ToDo list from stored inventory. There is no explicit when-to-use versus cve_detail/scan_inventory and no stated prerequisites, so guidance is adequate but not directive.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.