Server has 13 tools with complete schemas and descriptions, but quality is inconsistent. Naming follows verb_noun convention well (peloton_login, peloton_get_profile, peloton_search_classes). Descriptions are present but often generic (avg ~80 chars, below 194-char baseline). Most parameters lack descriptions or constraints, e.g., peloton_search_classes has 'class_type' with only an example list, no enum constraint; 'difficulty' lacks validation. No output schemas documented. Error handling is minimal, responses are JSON strings without recovery guidance. No tool annotations (readOnlyHint/destructiveHint). Credentials (email/password) exposed as parameters in peloton_login, violating secret-injection pattern. Overall: functional but below production baseline.

• Move email/password to server-side environment variables or secure vault. Accept only a session token or use OAuth. Remove credentials from peloton_login parameters.
• Document output schemas for all tools. Example: peloton_get_profile should declare {type: 'object', properties: {id, username, email, ...}, required: [...]}. Include this in tool descriptions or separate schema docs.
• Convert example lists to enum constraints. peloton_search_classes.class_type should be {type: 'string', enum: ['cycling', 'running', 'strength', 'yoga', 'meditation', 'stretching', 'cardio', 'walking', 'bike_bootcamp']}.
• Add tool annotations to inputSchema. Mark peloton_get_* tools with readOnlyHint: true; mark peloton_book_live_class, peloton_join_challenge, peloton_add_bookmark, peloton_login with destructiveHint: true.
• Enhance error messages with recovery guidance. Instead of {success: false, error: 'Invalid credentials'}, return {success: false, error: 'Invalid credentials. Verify email and password, or call peloton_get_profile to check current session.', retryable: true}.