Get CWE

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Even though readOnlyHint and idempotentHint already establish the operation is a safe lookup, the description adds important non-obvious behavior: CWE has no CVSS severity, likelihood_of_exploit is the ontology's own rating, related_cves is limited to top 20 with related_cve_count as the true total, and related_cves may be null when the join fails. This volume of field-level caveats goes well beyond what annotations convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense with useful information and has no filler, but it is written as a long run-on paragraph with many embedded caveats, making it harder to parse than it needs to be. It is front-loaded with the core action and purpose, but the structure could be improved with short clauses or separation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only lookup with one parameter and an output schema, the description covers everything an agent needs: input format, available fields, related-tool routing, the CWE-vs-CVE severity distinction, and exceptional return values. No obvious behavioral gap remains.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The parameter cwe_id is already fully documented in the schema with the exact format ('CWE identifier (e.g. CWE-79)'), and the description only repeats that same format without adding normalization rules or boundary cases. Since schema_description_coverage is 100%, the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a precise directive — 'Look up a CWE by identifier' — and distinguishes this from CVE-related tools by explicitly noting that CWE has no CVSS severity and directing severity-seeking callers to related_cves or get_cve. It also names the sibling search_vulnerabilities for a fuller CVE list, so the tool is clearly scoped among its siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives actionable routing guidance: use this tool for CWE details, switch to get_cve for scored severity, and use search_vulnerabilities with cwe=<id> for the complete list of related CVEs. These explicit alternatives and conditions leave little ambiguity about when to select this tool over siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.