26 tools with complete JSON schemas and descriptions. Naming follows verb_noun convention well (create_investigation, add_entity, search_relationships). Descriptions average ~80 chars, meeting baseline minimums but lacking LLM-optimized context (target 50-200 chars per pattern:tool-description). Most parameters have types and descriptions, but many lack constraints (enums, ranges, format hints). Output schemas not documented. Error handling absent, no recovery guidance, retryability classification, or actionable error messages. Security concerns: no mention of permission gates, audit trails, or input sanitization despite destructive operations (delete_investigation, delete_entity, delete_relationship). Composition is sound, tools are single-responsibility and chainable via IDs.

• Document output schemas for all tools. Example: list_investigations should return {investigations: [{id, name, description, status, created_at}], total_count, next_cursor}. Enables LLM to chain calls and extract IDs.
• Add confirmation/dry-run support to destructive tools. delete_investigation should accept a 'confirm' boolean (already present) but also return a preview of what will be deleted before confirmation. Prevents accidental data loss.
• Expand parameter descriptions with constraints. For 'updates' objects, specify allowed fields and types: 'Fields to update: name (string), description (string), status (enum: active|closed|archived)'. For string params, add length/format hints.
• Add scope declarations to tool descriptions. E.g., 'Requires: write:investigation, delete:investigation' for delete_investigation. Enables least-privilege agent configuration and audit clarity.
• Enhance descriptions to 80-150 chars with LLM-optimized context. Example: 'Search entities by name, type, or identifier within an investigation. Returns matching entities with IDs for chaining to update_entity or add_relationship. Call this first if you only have a partial name.'