run_vulnerability_scan

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must disclose behavioral traits. It states the core action (checks against CVE databases) and implies a read-only operation, but it does not clarify whether files are uploaded, if network access is required, or whether the operation is non-destructive. Lack of detail on side effects or return behavior leaves the agent under-informed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, grammatically complete sentence that immediately identifies the tool's scope. It uses concrete file examples without excess wording, earning a high score.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's low complexity (one parameter, no output schema) and absence of annotations, the description covers the primary purpose but omits key details about the parameter format and the result format of the scan. It is complete enough for a basic understanding but lacks nuance for correct invocation and interpretation of results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema defines a single 'manifestPath' string with no description, and schema description coverage is 0%. The description lists example dependency files, which helps infer that manifestPath likely points to one such file, but it does not specify whether a directory or glob is accepted, requiredness is unknown (required params: 0), or how multiple manifests are handled. This insufficiently compensates for the missing schema documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool checks build dependency files (with specific examples) against known CVE databases, using a specific verb and resource. This distinguishes it from sibling scan tools like run_architecture_scan or run_pentest_scan, which target different concerns.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the use case of scanning dependency manifests for vulnerabilities, but it does not explicitly state when to prefer this tool over alternatives like run_security_scan or how it relates to them. No exclusion or alternative guidance is provided, leaving the agent to infer usage from the dependency-file focus.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.