San exposes 11 tools with minimal schema documentation. Tool definitions are inferred from test files and internal code rather than explicit registration with JSON Schema. No visible input schemas, parameter descriptions, or output schemas in the provided source. Descriptions are present but generic (10-50 chars). Critical security issues: Bash tool executes arbitrary shell commands with no input validation or permission gates. Write/Edit tools modify files with no confirmation or dry-run support. Agent/Skill/SendMessage tools spawn child processes or send messages with no documented constraints or error recovery. No evidence of idempotency, pagination, or structured error responses. Composition is poor: tools like Agent and Skill are vague and likely combine multiple concerns.

• Define explicit JSON Schema for every tool input. Include type, description, required fields, and constraints (enums, min/max, patterns) for each parameter. Reference: https://arcade.dev/patterns/tool
• Add 50-200 character descriptions to every parameter explaining what it controls, valid values, and format. Example: 'The file path to read (absolute or relative to current directory, max 4096 chars).'
• Implement confirmation-request pattern for destructive tools (Write, Edit, Bash, Delete). Require explicit user approval or dry-run preview before executing irreversible operations.
• Add permission gates to Bash tool. Validate that the calling agent has 'exec:shell' scope. Log all invocations with command, user, timestamp, and result for audit trails.
• Document output schemas for all tools. Specify return type (object/array), field names, types, and what downstream tools can expect. Include pagination (limit, offset, total_count) for list-returning tools.