Server Quality Checklist

Tool Scores

• find_bdu_by_cveA
  4.3/5.0
  Behavior4/5

  Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

  Annotations already indicate read-only, non-destructive, idempotent. Description adds case-insensitivity, multiplicity of matches, and behavior when no match is found, exceeding the annotation baseline.

  Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

  Conciseness5/5

  Is the description appropriately sized, front-loaded, and free of redundancy?

  Four sentences, no redundancy. Front-loaded with primary purpose. Every sentence adds value without fluff.

  Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

  Completeness5/5

  Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

  For a simple tool with one parameter and no output schema, the description covers input format, case-insensitivity, multiplicity, and edge-case behavior (no match). No gaps.

  Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

  Parameters3/5

  Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

  Schema coverage is 100% with a thorough description, pattern, and examples. The description adds case-insensitivity and contextual usage, but the schema already defines the parameter well.

  Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

  Purpose5/5

  Does the description clearly state what the tool does and how it differs from similar tools?

  Description explicitly states the tool performs reverse mapping from CVE to Russian БДУ records. It provides context for cross-referencing international advisories with local compliance documents, clearly distinguishing it from siblings like get_bdu_stats or search_bdu_vulnerabilities.

  Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

  Usage Guidelines4/5

  Does the description explain when to use this tool, when not to, or what alternatives exist?

  Description specifies when to use (for cross-reference between CVE and БДУ) and notes that one CVE may map to multiple records. It does not explicitly mention when not to use, but the context of siblings provides alternatives.

  Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

• search_bdu_vulnerabilitiesA
  4.4/5.0
  Behavior4/5

  Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

  Annotations already indicate readOnly=true. Description adds that results are from a local SQLite copy with no side effects or network requests, and mentions error handling for mirror unavailability. Adds value beyond annotations.

  Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

  Conciseness3/5

  Is the description appropriately sized, front-loaded, and free of redundancy?

  Description is comprehensive but verbose, containing multiple use cases and error info in one block. Could be more concise by separating into sections. Still front-loaded with main purpose.

  Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

  Completeness5/5

  Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

  Despite no output schema, the description specifies return fields (BDU ID, CVSS, software list, link, snippet) and result limits. Covers error cases and usage context. Complete for a search tool with 7 params.

  Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

  Parameters5/5

  Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

  Schema coverage is 100%, and description enriches each parameter with examples, tokenization details, and practical advice (e.g., 'критический' for critical severity). Significantly adds meaning beyond the schema.

  Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

  Purpose5/5

  Does the description clearly state what the tool does and how it differs from similar tools?

  The description clearly states the tool searches the Russian БДУ ФСТЭК vulnerability database with full-text search and optional filters. It distinguishes from siblings by focusing on general search rather than CVE-specific lookup or stats.

  Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

  Usage Guidelines4/5

  Does the description explain when to use this tool, when not to, or what alternatives exist?

  Provides explicit use cases like searching for CVE analogues and filtering for threat models, and mentions empty query behavior. Does not directly compare to sibling tools but gives enough context for appropriate use.

  Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

• get_bdu_vulnerabilityA
  4.5/5.0
  Behavior4/5

  Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

  Annotations already declare readOnlyHint, destructiveHint, idempotentHint. The description adds useful behavioral context: full record content, error handling, auto-prefix addition, and that it's read-only. No contradictions.

  Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

  Conciseness5/5

  Is the description appropriately sized, front-loaded, and free of redundancy?

  The description is front-loaded with the main action and includes all necessary details without redundancy. Every sentence adds value.

  Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

  Completeness5/5

  Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

  Despite no output schema, the description thoroughly explains what the tool returns (headers, CVSS, severity, CVE, CWE, vulnerable software, dates, solution, exploit status, sources, URL). Also covers error case. Fully complete for a fetch-by-ID tool.

  Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

  Parameters4/5

  Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

  Schema coverage is 100% with description. The description adds value beyond schema: explains format variants (with/without BDU:), examples, and automatic prefix addition. This clarifies parameter meaning further.

  Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

  Purpose5/5

  Does the description clearly state what the tool does and how it differs from similar tools?

  The description clearly states the tool returns a full BDU record by identifier, with specific format BDU:YYYY-NNNNN, and lists many fields. It distinguishes from siblings like search_bdu_vulnerabilities.

  Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

  Usage Guidelines4/5

  Does the description explain when to use this tool, when not to, or what alternatives exist?

  The description provides clear context: read-only, accepts identifier with or without prefix, and returns an error if not found. It implicitly tells when to use this tool (fetch by ID) versus others, but lacks explicit 'use this instead of X' guidance.

  Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

• get_bdu_statsA
  4.6/5.0
  Behavior5/5

  Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

  Annotations already declare readOnlyHint, idempotentHint, and no destruction. The description adds specific behavior: automatic network check and advisory to refresh if snapshot is older than 30 days, and explicitly states no side effects.

  Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

  Conciseness4/5

  Is the description appropriately sized, front-loaded, and free of redundancy?

  The description is informative but somewhat verbose. It effectively conveys purpose and behavior in a few sentences, but could be slightly more concise.

  Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

  Completeness5/5

  Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

  Despite no output schema, the description explains what the tool returns (total records, ID range, snapshot dates). It also covers the automatic check behavior, making it complete for a zero-parameter tool.

  Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

  Parameters4/5

  Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

  The input schema has no parameters, so the description cannot add meaning beyond schema. Baseline score of 4 is appropriate.

  Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

  Purpose5/5

  Does the description clearly state what the tool does and how it differs from similar tools?

  The description clearly states it returns metadata of the current local BDU snapshot, including total records, ID range, and dates. This distinguishes it from sibling tools that focus on individual vulnerabilities or search.

  Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

  Usage Guidelines4/5

  Does the description explain when to use this tool, when not to, or what alternatives exist?

  The description includes context about automatic cache staleness check and advice to run refresh if outdated. However, it does not explicitly compare to siblings or state when to use this tool over alternatives.

  Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.