Single tool 'verifyOidcToken' has a basic description but critically lacks parameter descriptions and output schema documentation. The input schema shows only a 'token' parameter with minimal context. No error handling guidance, no recovery paths, and no documentation of what the tool returns or when to use it. The description is generic (194 chars baseline for A+ tools; this is ~80 chars). Parameter 'token' has a description but lacks format constraints (e.g., 'JWT format', 'Bearer prefix handling'). No output schema visible in source. Tool is READ_ONLY (good security posture) but lacks idempotent/readonly annotations in the schema.

• Add comprehensive output schema: document that tool returns JWT claims object with fields like 'sub', 'aud', 'iss', 'exp', 'iat', and any custom claims from auth-service.
• Expand tool description to 150-250 chars: 'Verifies JWT access tokens issued by auth-service via JWKS endpoint. Returns decoded claims (subject, audience, issuer, expiration, custom fields). Call this to authenticate requests and extract user identity. Fails if token is invalid, expired, or issuer/audience mismatch.'
• Add parameter constraints: 'token (string, required): JWT access token in format 'eyJhbGc...' (no Bearer prefix). Must be issued by AUTH_SERVICE_URL and audience must match APP_SLUG.'
• Document error cases: 'Returns error if token is malformed (invalid base64), expired (exp < now), issuer mismatch, or JWKS fetch fails. Suggest: retry with fresh token, check system clock, verify auth-service connectivity.'
• Add readOnlyHint annotation to tool schema to signal to LLM that this is a safe, non-mutating operation.