Narthex provides three well-named, security-focused tools with clear descriptions and complete input schemas. Tool names (safe_fetch, safe_read, inspect) follow verb_noun convention and clearly convey intent. All three tools have descriptions exceeding 100 characters explaining WHAT they do and WHEN to use them. Input parameters include type definitions and descriptions. However, output schemas are not formally documented, responses are wrapped in custom XML tags but the structure is not declared in a machine-readable schema. Error handling returns custom error tags but lacks recovery guidance. No tool annotations (readOnlyHint, destructiveHint) are present despite all tools being read-only operations.

• Document output schemas formally. Define the structure of <untrusted-content> and <narthex-error> responses with typed fields (e.g., body: string, source: string, sanitizer_notes: string[], truncated: boolean) so LLMs know what to expect.
• Add readOnlyHint: true to all three tool definitions to signal that these tools are safe to call repeatedly without side effects.
• Enhance error messages with recovery guidance. Instead of '<narthex-error>fetch failed for {url}: {type(e).__name__}: {e}</narthex-error>', return 'Failed to fetch {url}: {error_type}. Check that the URL is valid and accessible, or try a different source.'
• Add min/max constraints to max_bytes parameter. E.g., 'Cap on body size in bytes (default 1 MiB, min 1024, max 100 MiB)' to prevent LLMs from passing invalid values.
• Restructure sanitization findings as a typed array in the response instead of a comma-separated string in an XML attribute. This enables LLMs to iterate over findings and reason about each one independently.