Single tool 'detect_secrets' has a well-structured schema with proper types, enums, and constraints. Description is clear and security-focused (145 chars), explaining what the tool does and its safety guarantees. All 6 parameters are typed and described. However, the tool lacks error handling guidance, output schema documentation, and tool annotations (readOnlyHint). The description could be more explicit about when to use this tool vs. alternatives, and error cases are not documented.

• Document the output schema explicitly: 'Returns an array of findings, each with: type (string), confidence (number 0-1), key_name (string), position (object with line, column), preview (string, truncated), context_line (string, masked).'
• Add error handling guidance: 'If content is empty, returns empty findings array. If sensitivity is invalid, returns error with valid options: low, medium, high.'
• Add tool annotations to the schema: readOnlyHint=true, idempotentHint=true to signal safety.
• Expand description to include use case: 'Call before committing code or deploying to catch leaked API keys, passwords, tokens, and private keys. Findings are reported with masked context so secrets never leave the scanning machine.'
• Add enum descriptions for sensitivity: low='Reports high-confidence matches only', medium='Balanced detection (default)', high='Reports all potential matches including low-confidence'