The server defines 26 tools with consistent naming and structure, but suffers from critical gaps in schema documentation and parameter descriptions. All tools follow verb_noun or noun-only naming conventions (libraries, library, create_library, item, etc.), which is good. However, the source code provided shows only partial tool registrations, tool definitions are visible in main.go but the actual JSON Schema input definitions are not fully expanded in the code excerpt. Parameter descriptions are present for most tools (base_url, token, and resource-specific params like library_id, item_id), ranging 40-80 characters, which meets baseline standards. However, many optional boolean parameters (items, authors, series, collections, etc.) lack meaningful descriptions, they are too terse ('Include all items in the library' is better than nothing, but doesn't explain WHEN to use them or what fields appear in the response). Output schemas are not documented anywhere in the provided code, the tools return raw JSON from the Audiobookshelf API via mcp.NewToolResultText(string(body)), which means the LLM has no schema guidance for parsing responses. Error handling is present but minimal: errors are returned via mcp.NewToolResultError(err.Error()), but these are generic HTTP error messages without recovery guidance. The create_library tool (WRITE operation) has no confirmation pattern or dry-run capability, which is a security concern.

• Add explicit output schemas for every tool. Document the JSON structure returned, field types, and which fields are always present vs optional. E.g., 'Returns {id, name, items_count, created_at, ...}' with types.
• Upgrade optional parameter descriptions. Instead of 'Include all items in the library', write 'Fetch and include all media items. Note: large libraries may return thousands of results. Use sparingly. Returns items array with id, title, author, duration.' This guides LLM decisions.
• Implement server-side secret injection. Move base_url and token from tool parameters to environment variables or MCP config. Accept only ABS_BASE_URL and ABS_API_KEY at startup, never as params. This prevents credential leakage into logs.
• Add pagination to list tools. Parameters: limit (default 20, max 100), offset or cursor. Return total_count or next_cursor in response. Prevents context window exhaustion on large libraries.
• Add confirmation/dry-run for create_library. Accept a 'dry_run' parameter (boolean). When true, validate inputs and return what would be created without actually creating it. When false, create and return the new library ID.
• Enrich error responses. Instead of 'ABS API returned 404', return 'Library not found (id=xyz). Available libraries: [list]. Try library(library_id=...) with one of these IDs.' This enables agent self-correction.
• Add input validation with actionable error messages. Validate 'icon' against allowed values, 'media_type' against {book, podcast}, 'provider' against {google, audible, ...}. If a value is invalid, return 'Invalid media_type: got "audio", must be book or podcast.'