Backchat exposes 8 browser automation tools with basic schemas and descriptions. All tools have descriptions (10-50 chars) and input schemas with typed parameters. However, descriptions are minimal and lack LLM-optimized guidance on WHEN to use each tool or what happens on failure. Parameter descriptions are present but generic ('CSS selector or text selector'). No output schemas documented. Error handling is absent, no guidance on recovery or retry logic. Tool names are action-verb-based (click, type, navigate) which is good, but lack specificity about side effects (e.g., 'click' doesn't clarify if it's a read or write operation in the description). No tool annotations (readOnlyHint/destructiveHint) despite clear risk levels. Composition is reasonable, tools chain well (navigate → getText → click), but no pagination, no batch operations, and no idempotency guarantees documented.

• Add output schemas for all tools. E.g., getText should document: {text: string, charCount: number}. screenshot should document: {dataUrl: string, width: number, height: number}. tabs should document: {tabs: [{id: string, url: string, title: string}], activeTabId: string}.
• Expand descriptions to 100-200 chars with LLM-optimized guidance. E.g., 'click' → 'Click an element on the active browser page. Use CSS selectors (e.g., #button-id, .class-name) or text selectors (e.g., text=Submit). Returns success or error if selector not found. Safe to retry on timeout.'
• Add tool annotations: mark 'click', 'type', 'navigate', 'close', 'evaluate', 'tabs' (new/select/close actions) as destructiveHint=true; mark 'getText', 'screenshot' as readOnlyHint=true. Document idempotency: 'navigate' is idempotent; 'click' may not be.
• Document error modes and recovery in descriptions. E.g., 'click' → 'Fails if selector not found (try getText to inspect page structure first) or if element is not clickable (try screenshot to debug).'
• Add security guidance to 'evaluate': 'Execute arbitrary JavaScript in the active browser. WARNING: Do not pass untrusted expressions; risk of injection. Expressions run in the page context and can access cookies, localStorage, and DOM. Return value must be JSON-serializable.'