LemonCrow exposes 12 tools via a static JSON manifest (integrations/claude/plugin/mcp.json), but the source code provided contains only a Makefile with no visible tool implementation, schema definitions, or parameter validation logic. Tool definitions appear to be inferred from the manifest rather than directly implemented in the codebase. Most tools lack detailed parameter descriptions beyond a single field name. No output schemas are documented. Error handling guidance is absent. The bash and edit tools pose severe security risks with no input sanitization or permission gates visible. This server would not pass production code review.

• Document complete output schemas for all 12 tools. Specify field names, types, and what data the LLM should expect. Example: read tool should return {content: string, size: number, encoding: string}.
• Expand parameter descriptions to 50 - 150 characters. Include format constraints, valid ranges, and examples. E.g. 'The bash command to execute (string, max 2000 chars; avoid rm -rf; see bash_safety_guide).'
• Add input validation and error recovery guidance to bash and edit tools. Implement path traversal checks, command whitelisting, and permission verification. Return actionable errors like 'Permission denied: user lacks write:workspace scope. Contact admin.'
• Implement audit logging for all state-modifying tools (bash, edit, memory, tool). Log caller, timestamp, parameters (sanitized), and outcome. Expose via a logs tool or external audit sink.
• Add tool annotations (readOnlyHint, destructiveHint, idempotentHint) to help LLMs reason about side effects. Mark bash and edit as destructiveHint=true; mark read, grep, code_search as readOnlyHint=true.