Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds significant behavioral context beyond annotations: composite fan-out across two services, graceful degradation on partial failures, and the 5-30s first-measurement timeout for bundlephobia. It also names the specific failure field (sources_failed) and that the rest of the result still returns, which is critical for an agent to handle unexpected delays.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but every sentence earns its place: purpose, use cases, return summary fields, per-advisory details, ecosystem limitation, and failure behavior are all covered in four sentences. It is front-loaded with the core intent and organized from 'what' to 'when' to 'details' to 'edge cases'.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description compensates by listing the exact summary block fields (is_latest, license, published_at, advisory_count, bundle_kb_min, bundle_kb_gz, dependency_count, has_esm, tree_shakeable) and additional outputs (per-advisory detail, links, recent versions). It also covers ecosystem scope and timeout behavior, giving an agent a complete mental model of the tool's capabilities and limitations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description does not add extra parameter semantics beyond what the schema already offers (package name, version defaulting). It mentions version behavior indirectly but does not duplicate or expand the schema details, so no bonus is warranted.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific verb+resource: a composite 'should I add this npm package' check using deps.dev and bundlephobia. It distinguishes itself from sibling tools by explicitly naming its singular scope (npm packages) and the two data sources, making it unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit when-to-use guidance: 'Use whenever an agent asks "is X safe / popular / small" or "what does adding lodash cost me"'. It also includes a clear exclusion — NPM ecosystem only in v1, with direction to use deps.dev:version directly for PyPI/Maven/Cargo/Go. This exceeds basic expectations.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.