Server has 5 tools with schemas and descriptions, but quality is inconsistent. Tool names lack clear action verbs (analyze_incident, propose_fix are acceptable; execute_approved, validate_fix, rollback are weak). Descriptions are present but generic (avg ~120 chars, below 194-char baseline). Parameter descriptions exist but lack specificity on constraints, formats, and error recovery. No output schemas documented. Critical security issue: execute_approved and rollback accept 'token' as a parameter, violating secret-injection pattern. Error handling is minimal, no recovery guidance or actionable error messages visible in code.

• Move HITL token from tool parameter to server-side secret injection. Store token in environment variable or AWS Secrets Manager. Verify token server-side before execution. Remove 'token' parameter from execute_approved and rollback schemas.
• Document output schemas for all tools. Define response structure with typed fields (e.g., analyze_incident returns {root_cause: string, metrics: object, alarm_history: array}). Include in tool descriptions or separate schema documentation.
• Expand 'actions' array schema. Define action object structure: {type: enum[kubectl|terraform|aws_cli|ssm|manual], command: string, description: string, undo_command?: string}. Validate action types server-side.
• Rename tools for clarity: execute_approved → apply_fix, validate_fix → verify_fix_success. Update descriptions to state what happens (e.g., 'Applies the approved fix by executing actions and logging to CloudTrail').
• Add error handling guidance to descriptions. E.g., 'Returns 400 if token is invalid (user-fixable: request new approval). Returns 500 if CloudTrail logging fails (retryable). Returns 409 if incident already executed (fatal: check incident status first)'.

Inferred effective spec: <=2025-11-25.

• Relies on Logging (deprecated) - log to stderr or use OpenTelemetry