The server has 9 well-structured tools with consistent naming (verb_noun pattern), clear descriptions (150-300 chars), and explicit Zod schemas. All tools are READ_ONLY and properly documented. However, output schemas are not formally documented, responses are returned as plain JSON strings without structure definition. Parameter descriptions are thorough and include format hints (e.g., RFC3339 timestamps, enum constraints). Error handling is basic (catches exceptions, returns error text) but does not provide recovery guidance. Tool definitions are explicitly visible in src/mcp.ts with proper registration via server.tool(). Schemas are complete for all inputs with type constraints and descriptions. Main gaps: (1) output schema documentation, (2) limited error guidance, (3) no tool annotations (readOnlyHint, etc.), (4) passphrase parameter appears in every tool (could use server-level auth instead).

• Document output schemas formally. Each tool handler returns {content: [{type: 'text', text: '...'}]}. Define what fields the JSON response contains (e.g., ui_list_hosts returns {hosts: [{id, name, ...}], total, nextToken}). Add output schema documentation in tool registration or a separate docs file.
• Move passphrase validation out of per-tool logic. Use HTTP header-based auth (e.g., 'Authorization: Bearer <passphrase>') or request-level _meta field. Remove passphrase from tool parameters so it never appears in logs.
• Enhance error messages with recovery guidance. Instead of 'Error: {message}', return structured errors: {error: 'NOT_FOUND', message: 'Host U123 not found', hint: 'Call ui_list_hosts() to discover available hosts'}. Categorize errors as 'RETRYABLE', 'USER_FIXABLE', or 'FATAL'.
• Add tool annotations. Use server.tool(..., {...}, async (...) => {...}, {readOnlyHint: true}) or equivalent MCP SDK API to declare that all 9 tools are read-only and safe to call.
• Constrain pagination parameters. Use z.string().regex(/^\d+$/) for pageSize or convert to z.number().min(1).max(100). Add bounds to descriptions: 'Number of items per page (1 - 100, default 20)'.
• Consider lifting common pagination logic. If all list_* tools share pageSize/nextToken handling, create a shared helper to reduce duplication.
• Add timeout and rate-limit headers. If the UniFi API has rate limits, communicate them in error responses: 'Rate limited. Retry after 30 seconds.'
• Validate passphrase at server initialization. Move validatePassphrase check into middleware so incorrect WRITE_PASSPHRASE fails fast on server startup, not on first tool call.

Inferred effective spec: 2026-07-28+.

• Relies on Stateful initialize / Mcp-Session-Id (removed; protocol is stateless) - make each request self-contained