CHIHUAUDIT has severe definition quality gaps across all dimensions. Tools lack structured input schemas, parameter descriptions are minimal or absent, and output schemas are completely undocumented. While tool names are reasonably action-oriented (audit, monitor, install, CheckSecurity, etc.), the definitions fall far short of production MCP standards. Most critically, the Check* tools (CheckSecurity, CheckServices, etc.) have empty input schemas `{}` with no parameters documented, and their descriptions, while present, are generic system-check summaries that don't guide LLM tool selection or explain when to use each variant. No error handling guidance, no security considerations, no output documentation. The audit and monitor tools accept parameters but descriptions lack depth about what JSON output contains or what monitoring changes look like. This server reads like a standalone CLI tool converted minimally to MCP format, not a purpose-built agent integration.

• Add explicit input/output schemas to all 15 tools. For Check* tools, define parameters that filter results (e.g., CheckServices could accept a 'service_name' parameter to return data for a specific service, enabling composition). Document output fields: type, description, and expected values.
• Rewrite tool descriptions to be LLM-optimized (50 - 200 chars). Example: 'CheckSecurity → Inspect firewall rules, SSH key permissions, SSL certificate expiry, SUID binaries, and world-writable files. Returns object with fields for each category. Use when investigating compromised host or validating compliance.'
• Add parameter descriptions with constraints. For interval, specify: 'Go duration format (e.g., 5m, 10m, 1h). Minimum 1m, maximum 1d. Shorter intervals increase CPU load.'
• Document what audit --json returns. Create a sample JSON schema showing the structure of the audit results object, including fields for each check type (security, services, resources, etc.).
• Add destructiveHint annotations to install and init-config tools (these write to filesystem and modify systemd state). Per MCP spec 2026-07-28, tools with side effects should declare intent via toolAnnotations.
• Implement error recovery guidance. For each tool, document recoverable errors ('network timeout → retry after 5s') vs. fatal errors ('cannot read /etc/passwd → check file permissions'). Return structured error objects with actionable next steps.
• Add composition support: CheckLogs should accept a 'service_name' parameter (values populated by CheckServices results); CheckStorage should accept a 'mount_point' parameter (from CheckResources); etc. This enables multi-step agent plans.