This server has decent schema coverage and tool naming but suffers from incomplete parameter descriptions, missing output schemas, and no error handling guidance. Of 9 tools, all have names that start with verbs (v2ex_*) and most have basic input schemas defined. However, 3 tools have empty parameter sets (v2ex_member_profile, v2ex_current_token, v2ex_create_new_token missing 'expiration' description), parameter descriptions are minimal (14-72 chars, below the 72-char baseline), and NO tools document their output schema or return structure. Tool descriptions are extremely terse (13-48 chars, well below the 194-char baseline). There is no error handling guidance, no permission declarations, and no indication of which calls are idempotent. The server uses prompts (2 defined) but offers no resource discovery. All 9 tools are statically defined in src/index.ts with explicit Tool objects, so definitions are directly visible, not inferred.

• Expand every tool description to 100 - 200 chars, following the pattern: 'Retrieves [resource] for [context]. Use when [when to use]. Returns [what fields].' Example: 'Retrieves paginated notifications for the authenticated user. Use to check alerts, mentions, or replies. Returns notification list with id, type, title, created_at.'
• Document the output schema for each tool. Include all returned fields, their types, and their purpose. Example: { notification_id: string, type: 'mention'|'reply'|'follow', title: string, created_at: ISO8601 }.
• Add numeric constraints to parameters. For 'page', specify: 'Page number (1-indexed, default 1). Max 100 pages per node. Returns 20 items per page.' For 'expiration', specify units and range: 'Token expiration in days (1-365).'
• Implement error handling and return structured error responses. Catch API errors and return: { error: string, code: 'NOT_FOUND'|'UNAUTHORIZED'|'RATE_LIMITED'|'INVALID_INPUT', recovery: string }. Example recovery: 'Topic not found. Call v2ex_node_topic() to list valid topics.'
• Add permission/scope annotations to tools. For v2ex_remove_notification, add: 'Requires: write:notification'. For v2ex_create_new_token, add: 'Requires: admin:tokens'. This guides least-privilege configuration.
• Replace hardcoded test credentials with environment variable injection. Move V2EX_API_KEY to a .env file (not committed) or a vault. Update package.json start script to reference the variable only, never a hardcoded value.
• Add idempotency hints via tool annotations. Mark v2ex_create_new_token with idempotentHint:false (side-effecting) and v2ex_notification with idempotentHint:true (read-only). If using MCP 2026-07-28, leverage tool annotations (readOnlyHint, destructiveHint).