Server has 6 tools with basic descriptions and some parameter documentation, but significant gaps in schema completeness, parameter descriptions, and error handling. Tool names follow verb_noun convention (create_forge_app, deploy_forge_app, list_templates, discover_dev_spaces, scaffold_connector, run_static_analysis), which is good. However, most tools lack comprehensive input schemas with type definitions and descriptions for all parameters. Descriptions are present but often generic (e.g., 'Create a Forge app using forge create with non-interactive mode'). No output schemas documented. Error handling is minimal, tools print error messages but do not guide LLM recovery. Security concerns: deploy_forge_app accepts site URL and product as parameters, risking injection; no evidence of input sanitization or permission gates.

• Document output schema for each tool. E.g., discover_dev_spaces returns [{id: string, name: string}]. Include this in the tool definition so LLMs know what fields to expect.
• Add enum constraints to string parameters with known valid values. E.g., deploy_forge_app 'product' should be enum: ['jira', 'confluence', 'bitbucket']. Replace 'format' and 'validate' parameters in list_templates with enum: ['text', 'json'].
• Expand parameter descriptions to include format, range, and validation rules. E.g., 'app_dir: Path to Forge app directory (required, must contain manifest.yml and package.json)'.
• Return structured error responses with recovery guidance. Instead of printing 'Prerequisites missing', return {error: 'MISSING_PREREQUISITES', message: '...', nextSteps: ['Install Forge CLI: npm install -g @forge/cli', 'Verify Node.js version: node -v']}.
• Add input validation and sanitization. Validate URLs (site parameter), file paths (app_dir, output_dir), and enum values before passing to subprocess. Use shlex.quote() or subprocess.run() with list args to prevent command injection.