Server has 12 tools with complete input schemas and descriptions. Naming follows verb_noun convention (ihg_login, ihg_search_hotels, etc.). Descriptions are present and contextual (avg ~120 chars), meeting baseline minimums. However, critical gaps exist: no output schemas documented, no error handling guidance, no parameter validation rules stated, and sensitive data (credit card fields) exposed as tool parameters. Guest info in ihg_book_room includes cardNumber, cardExpiry, cardCvv, these should never be parameters. Tool composition is reasonable but lacks idempotency guarantees and confirmation patterns for destructive ops (cancel_reservation, book_room).

• Move payment data (cardNumber, cardExpiry, cardCvv) out of ihg_book_room parameters. Store securely server-side and reference via a saved_card_id or token. Accept only firstName, lastName, email, phone, specialRequests as parameters.
• Document output schemas for all tools. For ihg_search_hotels, specify: [{hotel_id, name, brand, address, rating, price_per_night, available_rooms}]. For ihg_get_reservations: [{confirmation_number, hotel_name, check_in, check_out, status, total_cost}].
• Add confirmation pattern to ihg_book_room and ihg_cancel_reservation. Return a confirmation_required response with booking/cancellation summary and ask user to confirm before executing. Alternatively, add a dry_run parameter.
• Enhance error messages with recovery guidance. E.g., 'Hotel not found (hotel_id=INVALID). Call ihg_search_hotels to find valid hotel IDs.' or 'Login failed: invalid credentials. Verify email and password.'
• Convert brand parameter in ihg_search_hotels to enum: ['InterContinental', 'Kimpton', 'Hotel Indigo', 'Crowne Plaza', 'voco', 'Holiday Inn', 'Holiday Inn Express', 'Candlewood Suites', 'Staybridge Suites', 'avid', 'Even Hotels']. Add minLength/maxLength and pattern constraints to date parameters.