omniget provides 9 file/shell operation tools with complete schemas and clear descriptions. Naming follows verb_noun convention (fs_read, fs_list, fs_edit, shell_exec). Descriptions are functional and average ~100-150 chars, above the minimum but not LLM-optimized. Input schemas are fully defined with types and descriptions. However, output schemas are undocumented (no return type descriptions for any tool), limiting agent understanding of result structure. Error handling is basic, no guidance on retryability, user-fixable errors, or recovery actions. No tool annotations (readOnlyHint/destructiveHint/idempotentHint) despite having clear risk classes (READ_ONLY, WRITE, IRREVERSIBLE). Security-critical, shell_exec and file write tools accept arbitrary untrusted input; no evidence of sanitization or input validation. Descriptions lack dependency hints (e.g., 'use fs_glob first to discover files'). No pagination for fs_list/fs_grep despite accepting recursive traversal and result caps.

• Document output schemas for all tools. Specify return types, field names, structure, and examples. E.g., fs_read returns {content: string, line_count: int, encoding: string}, fs_list returns {entries: [{name, type, path, size}], total: int}, etc.
• Add MCP tool annotations (readOnlyHint, destructiveHint, idempotentHint) to all tools. Map existing Risk metadata to annotations so agents can infer side effects.
• Add input validation and sanitization. Validate file paths against traversal attacks, escape shell commands or use exec arrays instead of shell strings, validate regex patterns. Return specific error messages like 'Path traversal detected: cannot access ../../../etc/passwd'.
• Enrich error handling descriptions. For fs_read, describe binary file detection behavior and suggest fallback tools. For shell_exec, document timeout errors and retry guidance. For write tools, explain permission errors and suggest permission_check tools.
• Add dependency hints in descriptions. E.g., fs_grep: 'Use fs_glob or fs_list first to discover files, then grep within the result set.' fs_list: 'For pattern matching, consider fs_glob instead if you have a specific file pattern.'
• Implement pagination for fs_list and fs_grep. Add offset/limit params, return total counts, and document token costs. Cap result sizes (e.g., fs_list default limit 100, max 1000) and guide agents on chunking large directories.
• Clarify fs_apply_patch format. Document the V4A envelope structure (or link to aider's specification) with a minimal example patch that agents can follow.