CampaignRepo exposes 35 tools via Next.js API routes with Zod validation. Most tools have descriptions and basic parameter schemas, but quality is inconsistent. Many descriptions are generic (e.g., 'Update campaign calendar') without explaining WHEN to use the tool or what it returns. Parameter descriptions exist but lack detail on constraints, formats, or dependencies. Output schemas are not documented, LLMs cannot predict response structure. No error recovery guidance. Tool names follow verb_noun convention (good), but several lack clarity: 'ai_chat' vs 'get_ai_settings' conflate concerns. Critical security issue: API keys exposed as parameters (set_ai_settings, set_campaign_ai_settings). No tool annotations (readOnlyHint, destructiveHint). Composition is reasonable, tools chain via IDs, but pagination is missing from list tools.

• Move API keys (apiKey in set_ai_settings, set_campaign_ai_settings, list_ai_models) to server-side environment variables or vault. Remove from tool parameters entirely.
• Add pagination to all list_* tools: accept limit (1-100, default 20) and offset/cursor parameters. Return total_count and next_cursor in response. Document output schema.
• Expand descriptions to 100-200 chars. Include WHEN to use (e.g., 'Call after creating a campaign to invite members'), WHAT it returns (e.g., 'Returns list of pending invites with invite_id and role'), and any prerequisites.
• Add tool annotations: mark read-only tools with readOnlyHint=true (list_*, get_*, login, oauth_start); mark destructive tools with destructiveHint=true (delete_board, reset_user_password, remove_campaign_member); mark idempotent tools with idempotentHint=true (create_user with duplicate email handling).
• Enhance error responses with recovery guidance. E.g., 'User not found (userId=123). Available users: [list]. Try update_user_identity with a valid userId.' Return structured error objects with code, message, and suggested_next_steps.