Single tool with significant definition gaps. Tool is explicitly registered in mcpToolController.js with Zod schemas, but critical quality issues undermine usability: (1) Tool name 'dynamicQuery' lacks a clear action verb, 'query' is ambiguous and doesn't follow verb_noun convention (should be 'search_database' or 'query_database'); (2) Parameter descriptions are minimal and lack formatting/constraint guidance, 'language' and 'tone' are underspecified with only example values, not enums or validation rules; (3) Output schema is partially documented but response structure mixes raw data, masked summary, and AI summary without clear guidance on when/why each is present or how to interpret them; (4) No error handling guidance, code catches errors with generic `err.message` but provides no recovery hints or classification; (5) No pagination, limits, or result capping despite operating against a database, could return unbounded result sets that exhaust token budgets.

• Rename 'dynamicQuery' to 'query_database' or 'search_database' to establish clear action intent
• Replace example values in 'language' and 'tone' parameters with enum constraints: language: enum ['English', 'Spanish', 'French', ...] and tone: enum ['formal', 'neutral', 'casual', ...]
• Add explicit constraints to tool description: 'Returns up to 100 results. Use limit and offset parameters for pagination.'
• Add limit and offset parameters to enable pagination and cap results
• Document response schema clearly: separate sections for data (array of records), masked_summary (string with PII redacted), and ai_summary (LLM-generated summary). Explain when to use each.
• Implement SQL injection prevention: use parameterized queries, validate generated SQL before execution, and log all queries with parameters for audit trail
• Add permission checks: verify user has appropriate database access level before executing queries; return clear permission denial errors
• Enhance error messages: return structured error responses with error code, message, cause, and suggested recovery action (e.g., 'User not found. Try refining your search with more details.')
• Add required_permissions field to tool definition: e.g., 'read:database' to signal what authority is needed
• Log all tool invocations with timestamp, caller identity, query parameters, result count, and execution time for compliance and debugging