IoCMCP server provides 8 tools for OSINT lookups (VirusTotal and Shodan APIs). Tools have basic descriptions and visible parameter schemas, but significant quality gaps prevent a higher score. All tools follow a consistent pattern and accept API keys as parameters (critical security issue). Descriptions are present but generic and lack actionable context for LLM selection. Parameter descriptions are minimal (1-5 words each). No output schemas are documented. Error handling returns structured dicts but lacks guidance for recovery or retry strategy. The server uses FastMCP with STDIO transport, which is not remotely accessible.

• CRITICAL: Move API keys from tool parameters to server-side environment variable injection. All 8 tools currently accept api_key as a parameter, which leaks credentials into agent logs and traces. Use os.getenv() defaults only; remove api_key from tool signatures entirely.
• Document output schema for each tool. Add a 'Returns' section to each docstring specifying the JSON structure returned from VirusTotal and Shodan APIs. Include field names, types, and which fields are most relevant for agent reasoning (e.g., 'detection ratio', 'last analysis date', 'open ports').
• Expand parameter descriptions to 50-100 characters each. Current descriptions ('The domain to look up', 'Your VirusTotal API key') are too terse. Add format hints: 'domain: FQDN or subdomain (e.g. example.com)' and 'api_key: 64-character hex string from VirusTotal dashboard'.
• Rewrite tool descriptions to clarify LLM selection. E.g., virus_total_domain_lookup: 'Query VirusTotal for malware detections, subdomain enumeration, and DNS resolution history for a domain. Use this when you need DNS/hosting info; use virus_total_ip_lookup for IP-specific detections.' This helps LLMs pick the right tool from similar alternatives.
• Add error recovery guidance. When an API call fails (HTTP 401, 403, 429, 404), return: {'error': '...', 'hint': 'Possible cause...', 'recovery': 'Recheck API key format or rate limit'} instead of bare error dicts. Pattern: recovery-guide.
• Implement pagination/result limits for shodan_host_search. Add 'limit' (1-100, default 20) and 'offset' (default 0) parameters. Document max results and return a 'total_results' count so agents know if they should fetch more pages.