Two tools with minimal but present schemas and descriptions. hello_world has a basic string parameter with description; whoami has no parameters. Both descriptions are short (under 100 chars) and lack context on WHEN to use them, prerequisites, or what the return value contains. No output schemas documented. No error handling guidance. Tool names are verb-based but descriptions do not explain the JWT scope requirements clearly enough for LLM selection. Missing parameter type annotations in visible code (inferred from description text only).

• Document output schemas for both tools. E.g., hello_world returns {greeting: string, timestamp: string}; whoami returns {user_id: string, email: string, scopes: [string]}.
• Expand descriptions to 80-150 chars. Example: 'hello_world: Greet a user by name. Returns a personalized greeting message. Requires tool:user scope (or no JWT in stdio mode).'
• Add explicit error handling: return structured errors like {error: 'permission_denied', message: 'User lacks tool:admin scope', recovery: 'Contact admin to grant scope'} instead of raw HTTP 403.
• For whoami, clarify what JWT claims are exposed and returned. Document the response schema with user_id, email, scopes, and any other exposed claims from config.jwt_exposed_claims.
• Add parameter descriptions to hello_world.name: 'The name of the person to greet (string, 1-100 chars). E.g., "Alice". Used to personalize the greeting message.'

Inferred effective spec: 2026-07-28+.

• Relies on Logging (deprecated) - log to stderr or use OpenTelemetry