Check CVE ID Reservation Status

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already provide readOnlyHint, idempotentHint, and openWorldHint, lowering the bar. The description adds meaningful context beyond annotations: the data source (cveawg.mitre.org), that no auth is required, and that it handles reserved IDs without published records — a behavioral nuance that annotations do not cover. It does not contradict annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a compact two sentences. The first sentence front-loads the core purpose and scope, the second adds data source and auth. No redundant words or filler; every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter lookup with an output schema that covers return details, the description is complete. It states what it does, when to use it (vs NVD), the data source, auth requirement, and that it handles unpublished IDs. No critical information for correct invocation is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the schema already states that the parameter returns state and the assigning CNA even for IDs with no published record. The description repeats this information but does not add any new semantics. Since the schema fully documents the parameter, a baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Check') and resource ('a CVE ID's current lifecycle state'), enumerates the exact states (RESERVED, PUBLISHED, REJECTED), and names the returned CNA ownership. It explicitly calls out that it works for reserved-but-unpublished IDs, which distinguishes it from NVD's published-only indexing. This is a clear, differentiating purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states that NVD has no equivalent (it only indexes published records), giving a clear context for when to use this tool — when you need lifecycle status, especially for unpublished IDs. It does not explicitly name the sibling cve-mitre.cves.record for full records, but the purpose distinction is implicit. This is better than no guidance but lacks an explicit enumeration of alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.