mcp-framework is a Rust MCP server framework with 11 tools across multiple examples. The codebase shows solid foundational structure with tool macros, parameter schemas via schemars, and type-safe descriptions. However, there are significant quality gaps: (1) duplicate tool names exist (greet appears twice with identical signatures in with_tools.rs, ping and admin_reset appear in multiple files), suggesting either poor deduplication or test artifacts not cleaned from the count; (2) tool descriptions are present but uniformly very short (8-35 chars), below the production baseline of 194 chars; (3) parameter descriptions exist but are minimal ('The name to greet', 'First number'); (4) no evidence of structured output schemas, pagination guidance, or error recovery patterns in the tool implementations; (5) security-critical tool (admin_reset) lacks any permission-checking examples or audit guidance. The framework itself is well-engineered (rmcp 3.1, Streamable HTTP, async/await), but the tool examples do not demonstrate production-grade patterns. Most tools are simple examples rather than production tools, this is appropriate for a framework, but scores reflect actual tool quality, not framework quality.

• Consolidate duplicate tools (greet, ping, admin_reset) into single canonical definitions. Remove or clearly mark test/example variants as non-production.
• Expand every tool description to 50-200 characters. Example for 'ping': 'Returns pong to verify server connectivity. Use to check if the server is alive before making critical calls. Useful for health checks and latency measurement.'
• Document output schemas explicitly. For each tool, add a markdown or code comment showing example return values and field types. For 'add', show '{ "result": 42.5 }'. For 'whoami', document user_id, name, roles, and session_id fields.
• Add permission validation example to admin_reset. Show how to check user roles or OAuth scopes before allowing the reset. Include a dry-run step: first call admin_reset(dry_run=true) to validate permissions, then admin_reset(dry_run=false, confirm=true) to execute.
• Add 'min' and 'max' constraints to numeric parameters (large_response size: 1-10000 bytes). Enforce in schema via schemars JSON Schema generation.
• Add error recovery hints to at least the OAuth-context tools. Example: 'whoami: Returns authenticated user info. If token is invalid, the response will indicate 401 Unauthorized, re-authenticate via the OAuth flow and retry.'
• Document which tools are idempotent vs. destructive. Mark greet, add, ping, whoami, stats, public_ping as read-only (already done in Risk field). For admin_reset, clarify that calling it twice in succession may have different outcomes (first resets, second may fail if no state to reset).

Inferred effective spec: <=2025-11-25.

• Relies on Stateful initialize / Mcp-Session-Id (removed; protocol is stateless) - make each request self-contained