Server has 4 tools with visible definitions, descriptions, and input schemas. Naming follows verb_noun convention (connect_to, get_, generate_, upload_). However, significant gaps exist: (1) No output schemas documented for any tool, responses are strings, not structured objects, violating pattern:response-shaper; (2) Stateful design using module-level globals (_cookidoo_service, _cookidoo_api) violates statelessness principle and creates multi-request coupling; (3) Descriptions are adequate (100-250 chars) but lack WHEN/WHY guidance; (4) Parameters mostly have descriptions and types, but some lack constraints (recipe_id format, time ranges for prep_time/total_time); (5) Error handling returns text messages without actionable recovery steps or categorization; (6) No permission checks, rate limits, or audit logging; (7) No idempotency markers or confirmation patterns for destructive operations (upload_custom_recipe). Per-tool average: 58 (connect_to_cookidoo: 60, get_recipe_details: 55, generate_recipe_structure: 62, upload_custom_recipe: 53).

• Define output schemas for all tools. connect_to_cookidoo should return {session_id, email, status}; get_recipe_details should return {name, id, servings, total_time, ingredients: [], steps: [], url}; generate_recipe_structure should return {validated_recipe: {...}, ready_for_upload: bool}; upload_custom_recipe should return {recipe_id, recipe_name, upload_timestamp}.
• Refactor state management: pass session/authentication context via request parameters or server-side session store keyed by request _meta.userId, not module-level globals. Each request must be independently executable.
• Add parameter constraints: recipe_id pattern '^r\d{5,6}$'; servings min:1 max:20 in schema; prep_time/total_time min:1 max:1440; hints optional string[].
• Enhance error messages with categorization and recovery: 'Not connected [retryable]. Call connect_to_cookidoo(email, password) first.' or 'Recipe not found [unrecoverable]. Available recipe IDs: [r59322, r907015].'
• Add dry-run mode to upload_custom_recipe: accept dry_run boolean parameter; when true, validate structure without creating. Return validation report + confirmation prompt.
• Declare tool permissions in descriptions: 'Requires scope: read:recipes' for get_recipe_details; 'Requires scope: write:recipes' for upload_custom_recipe.
• Add WHEN/WHY to tool descriptions. Example: 'Call this AFTER connect_to_cookidoo. Use it to inspect existing recipes for structure/ingredient ideas before designing your own with generate_recipe_structure.'
• Implement audit logging to stderr (JSON structured logs): {timestamp, tool_name, user_id, input_hash, result, error_code, elapsed_ms}.