14 tools with consistent naming (verb_noun pattern) and descriptions present. All tools are READ_ONLY, reducing risk. However, most parameter descriptions are minimal or absent. Input schemas exist but lack detail, many parameters have only type and description fields, no constraints (enums, ranges, patterns). Output schemas are not documented; responses are JSON strings without declared structure. Error handling is minimal, no recovery guidance or categorization. Credential redaction logic is thorough (SENSITIVE_KEYS, JWT/URL scrubbing) but not exposed as tool-level security documentation.

• Document output schemas for all tools. Specify field names, types, and structure (e.g., 'Returns {neptunCode: string, sessionTimeoutInMinutes: number, ...}'). This enables LLMs to extract and chain results.
• Add constraints to all parameters: enums for fixed sets (e.g., curriculum_id validation), min/max for numeric ranges (e.g., first_row >= 0, last_row <= 1000), and format hints for IDs (e.g., 'term_id: string, format YYYY-TERM').
• Implement error handling with recovery guidance. Catch NeptunAPIError and return structured errors: {error: string, code: string, retryable: boolean, suggestion: string}. E.g., 'Invalid term_id. Call get_taken_subjects_terms() to list valid IDs.'
• Add pagination metadata to get_received_messages response: total_count, has_more, next_first_row. Document default limit (20) and max limit (100).
• Formalize dependency hints in descriptions. E.g., get_taken_subjects: 'Requires a valid term_id. Call get_taken_subjects_terms() first to discover available terms.'