dns-mcp demonstrates solid definition quality across 25 tools. All tools have explicit descriptions (194-char baseline met). Input schemas are present and well-structured with proper JSON Schema typing for all 25 tools. Domain naming is verb-first and clear (dns_query, check_spf, enumerate_dkim_selectors). Parameters consistently use enums where appropriate (dns_query.qtype, check_dane.proto) and include regex patterns for domain/IP validation. However, output schemas are not documented in the provided source, responses are inferred from implementation but not formally declared in tool definitions. Error handling guidance is minimal; descriptions do not explain recovery paths or next steps for LLM agents. Tool composition is strong, each tool does one thing and parameters chain correctly (e.g., domain parameter reused across 20+ tools with identical pattern matching). No parameters expose secrets; all inputs are read-only DNS queries except reset_stats (WRITE risk noted). Minor issues: descriptions could be more LLM-optimized (some are technical DNS jargon without 'when to use' guidance), and no tool annotations (readOnlyHint/destructiveHint) are visible in schema.

• Document output schemas for all 25 tools. Declare return object structure (e.g., dns_query returns { records: [{type, name, ttl, data}], status, timestamp }). Use JSON Schema in tool definition.
• Expand descriptions to 100 - 200 chars. Rewrite to answer: WHAT does this tool do? WHEN should the LLM call it vs similar tools? WHAT does it return? Example for check_spf: 'Query SPF records to verify email sender authentication policy. Call this first when investigating email spoofing or delivery issues. Returns SPF policy string and pass/fail evaluation.'
• Add recovery guidance to error-prone tools. E.g., dns_query: 'If domain not found (NXDOMAIN), try check_zone_transfer to verify authoritative nameservers. If SERVFAIL, retry after 5 seconds.'
• Add tool annotations to schema. Mark reset_stats with destructiveHint: true (even though it's metadata-only, it signals agent caution). Mark all check_* tools with readOnlyHint: true.
• Tighten rdap_lookup.query validation. Add pattern: '^([a-zA-Z0-9]([a-zA-Z0-9-]{0,61}[a-zA-Z0-9])?(\.…)?\.?|([0-9a-fA-F:.]+))$' to validate domain or IP format. Add description: 'Domain name (FQDN) or IP address (IPv4/IPv6). System resolves to RDAP registry automatically.'
• Add dependency hints for related tools. E.g., check_dkim description should note 'Call enumerate_dkim_selectors first if selector is unknown.' dns_query should note 'Use check_dane or check_tlsa for TLS-specific DNS records.'
• For email security tools (check_spf, check_dkim, check_dmarc, check_bimi), add a summary comparison tool or prompt that guides agents on which to call in what sequence for full email security assessment.

Inferred effective spec: <=2025-11-25.

• Relies on Stateful initialize / Mcp-Session-Id (removed; protocol is stateless) - make each request self-contained