supplyscan exposes 4 tools with basic descriptions and partial input schemas. All tools have descriptions (10-100 chars each), but schema definitions are incomplete: the code shows struct tags for input validation but does NOT register explicit JSON Schema objects with the MCP server. Tool names follow verb_noun convention (supplyscan_status, supplyscan_scan, supplyscan_check, supplyscan_refresh), which is good, but parameter descriptions are inconsistent. The `handleStatus` tool has an empty input struct; `handleScan` and `handleCheck` have rich parameter sets but descriptions are embedded in struct tags (jsonschema annotations), not in the MCP tool registration visible in `registerTools()`. The code snippet shows `mcp.Tool{}` structs with only Name and Description fields, no InputSchema property is visible. This means input schemas are likely inferred or missing entirely from the MCP registration layer, which is a critical gap. Error handling is minimal: `handleScan` returns early on empty path, but most tools lack detailed recovery guidance. No pagination, no output structure documentation, no error categorization.

• Register explicit JSON Schema with every tool via mcp.Tool.InputSchema. Define parameter types (string, boolean), enums (ecosystem: ['npm', 'pypi']), defaults, and descriptions at the MCP layer, not just in struct tags.
• Expand tool descriptions to 50-200 characters following the baseline. supplyscan_status should explain: 'Returns the current scanner version, IOC database update timestamp and hit count, and a list of supported lockfile formats (package.json, requirements.txt, etc.). Call this first to verify scanner readiness.'
• Add output schema documentation. Define what fields supplyscan_scan and supplyscan_check return: result structure, finding fields, vulnerability array schema, etc. This enables LLM planning.
• Implement detailed error handling with recovery guidance. Instead of 'path is required', return: 'Path is required (e.g., /home/user/project or ../relative/path). Provide a readable file system path; the scanner does not accept URLs or encoded paths.' For non-existent paths, suggest 'Use the current working directory (.) or verify the path exists.'
• Add parameter range/format constraints to descriptions. path: 'absolute or relative file system path; must exist and be readable'. version: 'semantic version string (e.g., 1.2.3, ^1.0.0, or >=1.0.0)'. recursive: 'boolean; defaults to true. Set false to scan only the top-level directory'.
• Document when supplyscan_refresh is needed. E.g., 'Call before scanning if the IOC database is older than 24 hours. Requires network access. Can take 30+ seconds. Use force=true to refresh regardless of cache age.'