Server demonstrates good naming conventions (verb-noun pattern, clear action verbs) and comprehensive parameter descriptions. However, critical gaps exist: (1) NO documented output schemas, tools describe results as strings but provide no structured field documentation; (2) error handling lacks recovery guidance; (3) several parameter constraints underdocumented (e.g., HTML escape rules for draft_reply/send_reply); (4) security-sensitive operations (draft_reply, send_reply) lack explicit permission/confirmation patterns despite being WRITE tools. The server returns wrapped plain-text results rather than structured JSON, forcing LLMs to parse unstructured output. Descriptions are good (avg ~150 chars) but output formats are not formally specified.

• Define and document output schemas for all tools. For list_chats, return JSON with fields: [{ chat_id: int, last_sender_name: string, username: string?, msg_count: int, last_ts: int, last_ts_iso: string }]. For search/history, return: { messages: [{ message_id: int, chat_id: int, direction: string, sender_name: string, text: string, ts: int, ts_iso: string, media_type?: string }], total_count: int, has_more: bool }.
• Add per-request error recovery guidance. For 'Invalid date' errors, suggest: 'Use ISO 8601 format (e.g., 2026-07-25T12:00:00Z). If unsure, call list_chats first to see recent dates.' For missing chat_id, suggest: 'First call list_chats to find the chat_id.'
• Implement confirmation flow for send_reply. Return a confirmation tool result instead of direct send: { status: 'confirmation_required', draft_id: int, message: 'Ready to send? Call confirm_send_reply(draft_id).' }. Or wrap in a separate confirm_send_reply tool.
• Document HTML escaping rules explicitly. Add to draft_reply/send_reply description: 'When html=True, wrap text in <pre> or <code> to preserve raw HTML. In body text, escape & as &amp;, < as &lt;, > as &gt;. Do NOT mix plain text < chars with html=True, use html=False or wrap in <code>.'
• Add tool annotations to each tool registration. For read-only tools: readOnlyHint=true. For draft_reply/send_reply: destructiveHint=true (they modify message state). This helps MCP clients enforce safer policies.
• Return structured JSON from all tools instead of plain text. Wrap <<<UNTRUSTED>...</UNTRUSTED>>> markers as a field: { untrusted_sender: string, untrusted_text: string, direction: string } instead of concatenating into a text line. This lets LLMs use structured extraction.