The server has 3 tools with basic schema definitions and descriptions, but significant quality gaps prevent a higher score. Tool naming follows verb_noun convention (login, read_posts, create_post), which is good. However, descriptions are minimal (18-95 chars), falling below the baseline of 194 chars. Parameter descriptions exist but are generic. Critically, the login tool exposes password as a required parameter, a severe security violation. The server lacks documented output schemas, error recovery guidance, and parameter constraints (e.g., limit/offset bounds). Tool composition is reasonable (three separate concerns), but schema documentation is incomplete. Output shaping is not visible in the provided source.

• Remove password parameter from login tool. Implement server-side secret injection: read credentials from environment variables or vault before tool execution. Accept only username and return a session token or authentication state.
• Expand all tool descriptions to 100 - 200 characters. Include: (1) What it does, (2) When to call it, (3) What it returns, (4) Any prerequisites. Example: 'Read posts from a specified team\'s feed with optional pagination. Requires login. Returns an array of posts with IDs, content, timestamps, and author info. Use limit (1 - 50, default 20) and offset for pagination. Call list_teams() first if you don\'t know the team name.'
• Document output schemas for all tools. Add a 'Returns' section to each: login returns {session_id, user_id, expires_at}; read_posts returns {posts: [{id, content, author_id, created_at, ...}], total_count, has_more}; create_post returns {post_id, created_at, team_name}.
• Add parameter constraints and bounds to descriptions and schema definitions. read_posts: 'limit: integer, 1 - 50, default 20' and 'offset: integer, >= 0, default 0'. create_post: 'content: string, 1 - 5000 characters, required'.
• Implement error recovery guidance. On team-not-found, return error with available_teams list. On failed login, return 'Invalid credentials' (not 'error'). On create_post failure, suggest: 'Verify the team exists. Call list_teams() to see available teams.'
• Add tool annotations in MCP definitions: mark create_post with destructiveHint=true (creates permanent record), login with idempotentHint=false (session state changes on each call).

Inferred effective spec: <=2025-11-25.

• Relies on Logging (deprecated) - log to stderr or use OpenTelemetry