Scoring was not performed

• Expand tool descriptions to 50 - 200 characters. For 'prioritize_endpoints', add: 'Score and rank endpoints by attack surface and risk. Call this after reconnaissance to focus testing on high-impact targets. Requires a list of discovered endpoints with metadata (method, path, auth, tech stack). Returns sorted endpoints with risk scores.'
• Document output schemas explicitly. E.g., 'Returns: { endpoints: [ { path: string, method: string, risk_score: number, attack_surface: string, reason: string } ], metadata: { total_endpoints: integer, high_risk_count: integer } }'
• Add constraints to parameter schemas: min/max for limit (e.g., minimum: 1, maximum: 1000), pattern or format for engagement_id (e.g., '^[a-z0-9-]+$'), and a $schema reference for endpoints_json or an enum of required fields.
• Document parameter dependencies. Add note: 'endpoints_json is required. If you only have endpoint paths, call reconnaissance tools first to extract method, auth requirements, and tech stack.'
• Add error guidance. Document common failure modes: 'engagement_id not found → verify engagement exists; endpoints_json malformed → ensure each endpoint object has method, path, auth_required, tech_stack; empty queue → call prioritize_endpoints first.'
• Use tool annotations: declare both tools with 'readOnlyHint: true' in the MCP tool definition so clients can enforce read-only semantics.
• Add example values in a separate 'examples' field (not description). Show sample engagement_id, sample endpoints_json structure, sample return values. This separates documentation from usage guidance.