bank-mcp demonstrates solid foundational quality with all 5 tools properly registered, named with action verbs, and accompanied by clear descriptions. Tool naming follows the verb_noun pattern (list_accounts, get_balance, search_transactions, etc.), which is excellent for LLM disambiguation. Descriptions are specific and mention key features like filtering options, date ranges, and grouping parameters. However, output schemas are completely undocumented, the source shows only input schemas via Zod, but no type definitions for what these tools return. This is a critical gap: LLMs cannot plan downstream actions or extract fields when return types are invisible. Parameter descriptions are present and generally actionable (e.g., 'Account UID to list transactions for'), but some lack explicit constraints (e.g., date format is mentioned as YYYY-MM-DD only in one tool, not consistently). Error handling is minimal, no recovery guidance, no categorization of retryable vs. fatal errors. All tools are READ_ONLY (safe retry profile), which is good. Security posture is reasonable given the read-only nature, but no evidence of rate limiting, input validation, or audit logging.

• Document output schemas for all 5 tools. Use Zod to generate JSONSchema for response types and include them in the tool definition alongside inputSchema. Example: 'Returns array of objects with fields: account_uid (string), iban (string), name (string), currency (string, ISO 4217 code).'
• Add explicit error handling guidance. For each tool, document what can go wrong (e.g., 'Invalid account ID', 'Network timeout') and suggest recovery ('Try list_accounts() to confirm the account ID exists', 'Retry after 30 seconds').
• Standardize date parameter descriptions. Every tool accepting date inputs should state: 'ISO 8601 date (YYYY-MM-DD). Example: 2024-01-15.'
• Document pagination behavior. Add to list_accounts and list_transactions: 'Limit parameter defaults to 100. Returns total_count and next_cursor (if available) for fetching additional pages.'
• Clarify accountId format. Change parameter description to: 'Account UID (format: UUID v4 or alphanumeric account ID from list_accounts()).'
• Add field-naming consistency notes. Document that all response IDs use snake_case (account_uid, not accountID) so LLMs know how to chain results into subsequent calls.
• Implement rate limiting and add retry guidance. Describe in tool descriptions: 'If rate-limited (HTTP 429), wait 60 seconds before retrying.'
• Add input validation error examples. For enum params like type: 'debit|credit', show what happens if an agent passes an invalid value: 'Invalid type: got "pending", must be one of: debit, credit.'