36 tools with consistent naming (verb_noun pattern: query, exec, list_*, get_*) and descriptions present for all. However, descriptions are terse (avg ~60 chars, well below the 194-char baseline for A+ tools). Input schemas are visible and typed, but lack depth: no enums for constrained values (e.g., 'auth' accepts 'azuread|sql|connstr' but no enum), no min/max bounds on numeric params, no format specs. Output schemas are not documented, LLMs cannot predict response structure. Error handling is absent from tool definitions. Three-tier safety model (tierRead/tierWrite/tierDangerous) is implemented server-side but not exposed in tool annotations or descriptions, forcing LLMs to guess which tools are destructive. Missing idempotent/readOnly/destructive hints.

• Expand tool descriptions to 100-200 chars. Include WHEN to use (e.g., 'Call describe_table first to see column types before writing queries'), prerequisites, and side effects. Example: 'Execute a SELECT query. Returns up to 1000 rows by default. Call describe_table first to see available columns. Useful for data exploration and validation.'
• Document output schemas for all tools. Specify field names, types, and structure. E.g., query returns [{column_name: string, value: any}, ...]. This enables LLMs to chain tools and extract the right data.
• Add enum constraints to 'auth' parameter: {"type": "string", "enum": ["azuread", "sql", "connstr"]}. Add enums to 'environment' parameter: {"type": "string", "enum": ["dev", "qa", "beta", "test", "preprod", "prod"]}.
• Expose safety tiers via tool annotations. Mark query, list_*, describe_*, get_* with readOnlyHint=true. Mark exec with destructiveHint=false. Mark exec_dangerous with destructiveHint=true. This guides LLM planning and prevents accidental data loss.
• Add pagination to list_* and get_* tools that return multiple items. Include limit (default 20, max 100) and offset parameters. Return {items: [...], total: N, has_more: bool} to enable LLMs to iterate safely.