group_critical_by_vuln

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and delivers meaningful behavior: the grouping key rule ('Keyed on CVE where present, else CWE plus title'), the scope ('across every product'), the filter ('actionable CRITICAL'), and the ordering ('Widest blast radius first'). It does not explicitly state read-only/non-mutating semantics or whether results are truncated, which are the remaining gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Four short sentences, each carrying distinct information: grouping scope, key derivation, intended use, and result ordering. The core action and scope are front-loaded, with no redundant restatement of the name.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter aggregation tool with an output schema covering return structure, the description supplies what matters: grouping key logic, actionability filter, and ordering. Minor ambiguities remain, such as what qualifies as 'actionable' and whether products appear once or per finding, but these are narrow.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, and the 100% schema coverage leaves nothing to compensate for. The description adds no parameter meaning because none exists to add, which is the appropriate baseline for a zero-arg tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb and resource: 'Group actionable CRITICAL findings across every product by unique vulnerability.' This distinguishes it semantically from siblings like list_critical_findings and list_findings_by_severity, which enumerate rather than aggregate. It stops short of naming those siblings explicitly, so an agent must infer the contrast.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

A concrete use case is given: 'Useful for filing one tracker issue per vulnerability that lists every affected product,' which tells an agent when this aggregation is preferable to a flat listing. It does not state exclusions or negative conditions (e.g., when to use list_duplicate_findings instead), keeping it short of a full when/when-not guide.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.