The CTI MCP server provides 7 threat intelligence lookup tools with consistent naming (verb_noun pattern: *_report) and reasonable descriptions. However, there are significant gaps in parameter validation, output schema documentation, and error handling. All tools follow a simple, read-only pattern (IP/domain lookups) which limits composition concerns but also means limited complexity. Descriptions are adequate (100-150 chars) but could be more specific about return structures and failure modes. Parameter schemas are present for all tools (ip/domain strings, optional filters) but lack explicit validation constraints (regex, format). No tool annotations (readOnlyHint, idempotentHint) are visible despite all being read-only operations. Error handling is minimal, no guidance on quota/rate-limit recovery, invalid input, or API failures.

• Document output schemas for each tool. For abuseipdb_ip_report, document the structure: {status, data: {abuseConfidenceScore, usageType, isp, totalReports, ...}, errors: [...]}. For VirusTotal, document the response: {data: {id, type, attributes: {categories, last_submission_date, reputation, ...}}}. This enables LLMs to extract and chain results.
• Add explicit parameter validation rules. Change 'IP address to query' to 'IP address to query (IPv4 or IPv6 in dotted notation, required, no CIDR ranges)'. Add regex/format constraints in schema: 'pattern': '^(?:[0-9]{1,3}\.){3}[0-9]{1,3}$|^[0-9a-f:]+$'.
• Include error handling in descriptions. For abuseipdb: 'Note: quota limits apply. If you receive a 429 response, wait 1 hour before retrying. If status is "error", check the errors field for details (e.g., invalid IP format).' This guides recovery.
• Add tool annotations in registration (via fastmcp or code). Register each tool with readOnlyHint=true (no side effects) and idempotentHint=true (safe to retry). Example: @tool(..., readOnlyHint=True, idempotentHint=True).
• Document optional parameters explicitly. For abuseipdb max_age_days and verbose, state defaults: 'max_age_days: optional, defaults to 90 days if omitted; verbose: optional boolean, defaults to false, includes full report text if true.' Make defaults explicit in parameter descriptions.
• Specify which fields are always returned vs. conditional. E.g., 'abuseipdb returns abuseConfidenceScore (always), reports array (conditional on verbose=true), country (always).' Helps agents plan extractions.

Inferred effective spec: 2025-06-18+.

• Relies on Logging (deprecated) - log to stderr or use OpenTelemetry