Retrieve accepted weakness/CWE types for a HackerOne program with automatic pagination to fetch complete results.
Accepted weakness/CWE types of a program. Auto-paginates.
| Name | Required | Description | Default |
|---|---|---|---|
| page_size | No | Max items (default: all) | |
| program_handle | Yes | Program handle (e.g. 'uber') |
Changes observed during successful MCP inspections.
v1.0.0Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses one useful behavioral trait: auto-pagination, which is not obvious from the schema. However, with no annotations provided, the description carries the full burden and does not mention the read-only nature, return format, or potential size of results.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences with no redundant wording. The core purpose is front-loaded, and the auto-pagination note is a meaningful second sentence that earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter read-only tool, the description covers the essential purpose and the main non-obvious behavior. It could say more about what exactly is returned, but the phrase 'weakness/CWE types' plus a fully documented schema gives the agent enough context to invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already documents both parameters fully, including the meaning of page_size and an example for program_handle. The description adds no further parameter-level detail, so the baseline of 3 is appropriate given 100% schema description coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the resource: accepted weakness/CWE types of a program, which matches the tool name and is distinct from report, scope, and profile tools. It lacks an explicit verb and does not differentiate itself from sibling tools like hackerone_get_program_scope, so it falls short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance on when to use this tool versus alternatives such as hackerone_get_program_scope or hackerone_get_program_details. It does not mention preconditions, typical use cases, or exclusions, so the agent must infer applicability from the name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.