SBOMの脆弱性スキャン

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden and does an excellent job: it discloses that only SBOM-identifiable dependencies are scanned, that builds/JARs are not executed, that SBOM comprehensiveness/freshness/artifact-match are unverified, and that zero detections do not guarantee safety. These limitations are highly useful for an agent deciding how to interpret results.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact, front-loaded with the core scanning behavior and supported formats, and every sentence adds operational value. It states scope, exclusions, input constraints, and key limitations without redundancy or padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter tool with no annotations and no output schema, the description is quite complete: input format, size, local-file requirement, non-execution behavior, and result caveats are all covered. The main gap is that it does not describe the return value or output structure of the scan, which would help an agent know what to expect after calling it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already defines sbom_path as an absolute path to a CycloneDX/SPDX JSON SBOM file, with 100% coverage. The description adds meaningful constraints beyond the schema: supported format versions, the 16MiB size limit, and that the input must be a local file, which helps the agent validate the parameter before calling the tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('スキャンする') and resource ('CycloneDX 1.4/1.5/1.6またはSPDX 2.2/2.3のJSON SBOM'), and states what is scanned: dependencies identifiable from the SBOM. It is clearly distinguished from siblings like scan_java_project and scan_java_artifact by focusing on an SBOM file input rather than a project or artifact.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description establishes clear usage context: this tool is for scanning a local JSON SBOM file, with a 16MiB size limit, and explicitly says it does not build or execute JARs. It does not explicitly name sibling alternatives or exclusion conditions, but the input constraints and non-execution note make the intended scenario reasonably clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.