Two tools with clear, detailed descriptions and proper JSON schemas. scan_web_exposure has comprehensive parameter documentation (url, only, timeout_ms) with type constraints and enum validation for 'only'. list_exposure_checks is minimal but functional. Both tools are read-only with no destructive operations. Naming follows verb_noun pattern (scan_, list_). However, output schemas are not formally documented, responses are returned as text blobs containing JSON, not structured tool output. Parameter descriptions are strong but lack explicit format/range guidance for timeout_ms. No error recovery guidance in descriptions.

• Document output schemas formally. Define the structure of scan_web_exposure results (e.g. {findings: [{type, severity, path, evidence}], summary: {total, critical_count}}) and list_exposure_checks results (e.g. {checks: [{id, severity, paths}]}) as JSON Schema in tool definitions or README.
• Add error recovery guidance to descriptions. E.g. scan_web_exposure: 'If the URL is unreachable, verify the scheme (https://) and domain are correct. If timeout occurs, increase timeout_ms or check network connectivity.'
• Constrain timeout_ms with explicit bounds in the description: 'Optional per-request timeout in milliseconds (1000 - 60000, default 10000).' Add min/max to the schema.
• Enhance list_exposure_checks description: 'Call this first to discover available check ids (e.g. git_exposure, env_file) before using the only filter in scan_web_exposure. Returns severity levels to prioritize findings.'
• Add tool annotations to both tools in the TOOLS array: add readOnlyHint: true and idempotentHint: true to signal safety to agents and clients.