GEOScore MCP has 8 tools with complete input schemas and descriptions, but exhibits several quality gaps that prevent a higher score. Tool naming is mostly verb-noun compliant (geo_scan, geo_deep_scan, geo_generate_fix, etc.), which is good. However, parameter descriptions lack depth and actionability. Most critically: (1) NO output schemas are documented for ANY tool, LLMs cannot infer what fields to expect from responses, violating the baseline that 100% of A+ tools have documented return types. (2) Several parameters lack descriptions entirely or are vague. (3) Error handling and recovery guidance is absent. (4) The geo_deep_scan, geo_generate_fix, and geo_check_visibility tools include api_key as a parameter, which violates the critical security pattern of never exposing credentials in tool parameters, these should use server-side secret injection instead. (5) Parameters like 'queries' in geo_check_visibility lack type constraints (should be array of strings with length limits). The server is functional but falls short of production quality baseline.

• Document output schemas for all 8 tools in the code. Example for geo_scan: `output: { type: 'object', properties: { score: { type: 'number', min: 0, max: 100 }, grade: { type: 'string', enum: ['A', 'B', 'C', 'D', 'F'] }, checks: { type: 'array', items: { type: 'object', properties: { name: string, status: 'pass'|'fail', issues: string[], fixes: string[] } } } } }`. This enables LLMs to chain results to downstream tools.
• Remove api_key parameters from tool signatures. Instead: (1) Store the API key in an environment variable (GEOSCORE_API_KEY), (2) Read it server-side in the tool implementation, (3) If a user needs to provide their own key, use MCP's _meta or a separate 'set_credentials' resource endpoint. This prevents credential leakage in logs and traces.
• Add parameter validation rules to domain inputs. Example: 'Domain to scan. Format: hostname or domain name without https:// or trailing slash. E.g. example.com, subdomain.example.com. Will be normalized by the tool.' Also validate and normalize in code: strip https://, remove trailing slashes, reject invalid TLDs.
• Add constraints to geo_check_visibility's 'queries' parameter in the input schema: `minItems: 1, maxItems: 20` (or whatever is API-safe). Update description: 'Array of 1-20 custom search queries to test. If omitted, auto-generates 5 brand-related queries. Each query should be 1-100 characters.'
• Add error handling and recovery guidance to all tool descriptions. Pattern: 'If [error condition], [recovery step].' Examples: 'If domain has never been scanned, geo_scan will return an empty profile. Use geo_scan to generate the first scan.' / 'If API key is invalid or expired, create a new one with geo_create_api_key.' / 'If report_id is not found, try geo_get_profile to list available report IDs for the domain.'