The CVE Intelligence Server defines 2 tools with strong naming and well-structured schemas. Both tools follow verb_noun naming conventions (search_cves, get_cve) and have clear, action-oriented descriptions. Input parameters are properly typed with JSON Schema (including enums, format constraints, and ranges). However, the server lacks output schema documentation, error handling guidance for LLMs, and does not demonstrate recovery paths for common failure modes. The schema definitions are visible in the source code and properly formatted, but descriptions could be slightly more prescriptive about when to use each tool vs the alternative.

• Add explicit output_schema documentation to both tools. Example: 'Returns an object with results (array of CVE summaries: {cve_id, severity, cvss_score, description (240 chars max), published_date}) and total_found (integer).'
• Enhance error descriptions with recovery guidance. E.g., in search_cves: 'If no results, try broadening the keyword or using only the product name without version. If limit exceeded, results are truncated, consider adding date filters to narrow the scope.'
• Add tool usage clarification: 'Use search_cves to discover vulnerabilities by keyword (product name, CVE family, etc.). Once you have a specific CVE ID, call get_cve for full details including CVSS vectors, affected CPEs, and references.'
• Document pagination behavior: 'Results are returned in relevance order. If total_found exceeds limit, the LLM should refine filters (severity, date range) to reduce results rather than request pagination.'
• For date-time parameters, add timezone examples: 'published_start: RFC3339 format with timezone, e.g., "2024-01-01T00:00:00Z" for UTC or "2024-01-01T00:00:00-05:00" for Eastern Time.'
• Consider returning additional chaining fields in search_cves results. Currently results contain CVE summaries, but if downstream operations need source references, return a references_url or link field to enable tool composition.