This is a security scanner tool that intentionally exposes vulnerable MCP servers for testing purposes. The 12 tools are deliberately designed with security flaws (prompt injection, credential exposure, command execution, SQL injection) to demonstrate attack vectors. Tool descriptions contain malicious instructions (e.g., 'helpful_assistant' includes 'IGNORE PREVIOUS INSTRUCTIONS'), parameter schemas are minimal, and there is no error handling or recovery guidance. While this serves the scanner's educational purpose, it fails every production-grade tool quality baseline. Average tool description length ~80 chars (below 194 baseline); most params lack type constraints; no output schemas documented; no permission gates or audit trails.

• Add comprehensive parameter descriptions with format, range, and constraint details. E.g., 'command (string, required): Shell command to execute. Max 1000 chars. Allowed: read-only operations only (ls, cat, grep). Destructive commands (rm, dd) will be rejected.'
• Document output schemas for every tool. Specify field names, types, and whether results are paginated. E.g., 'Returns {status: string, output: string, exit_code: int, timestamp: ISO8601}'.
• Implement permission gates and audit logging. Every tool should verify caller authority and log who called what with which parameters and outcome.
• Add error recovery guidance. Replace generic errors with actionable messages. E.g., 'SQL syntax error at line 3: missing semicolon. Retry with corrected query.'
• For destructive tools (execute_command, query_database, send_email), add a dry_run parameter and require explicit confirmation before execution. Return a confirmation_token that must be passed to execute the operation.

Inferred effective spec: <=2025-11-25.

• Relies on Logging (deprecated) - log to stderr or use OpenTelemetry