Three tools with basic schemas and descriptions, but significant gaps in parameter documentation, output schema clarity, and error handling guidance. check_policy and request_approval have incomplete parameter descriptions (context and reason lack detail on format/constraints). log_action is partially visible in source (truncated in index.ts). No tool describes what it returns or how to use results downstream. Descriptions are adequate length (50-100 chars) but lack actionable detail on when/why to call each tool. No error recovery guidance. Security concern: API keys passed as parameters in server.ts (line with apiKey in request body).

• Move API_KEY to server-side environment variable injection. Remove apiKey from request bodies. Use dotenv (already imported) to load SUPRAWALL_API_KEY once at startup, not per-call.
• Document output schemas for all tools. Add 'Returns' section to each tool description listing field names, types, and meanings. E.g., check_policy returns {decision: 'ALLOW'|'DENY'|'REQUIRE_APPROVAL', reason: string, risk_score: number}.
• Expand parameter descriptions with format/constraint hints. E.g., context: 'Object with tool metadata (e.g., {toolName: string, args: object}). Required fields depend on policy rules.'
• Add error recovery guidance. When API fails, return actionable message: 'SupraWall API unreachable. Retry in 30s or contact admin.' Include error classification (retryable vs fatal).
• Complete log_action tool definition in server.ts. Currently only in index.ts class. Register it in ListToolsRequestSchema handler and implement in CallToolRequestSchema switch statement.