Critical gaps across all dimensions. Tool definitions lack proper schemas, input parameters are visible but lack type definitions, constraints, and descriptions. Descriptions are minimal (10-50 chars) and do not explain WHEN to use tools or WHAT they return. No output schemas documented. Destructive tools (bash_exec, write_file, edit_file, patch) lack confirmation patterns or dry-run support. No error handling guidance. Tool names are verb-based but lack clarity on mutual exclusivity (bash_exec vs run_shell vs system_command are nearly identical). No parameter validation rules, enums, or format constraints visible. Security concerns: destructive tools accept raw command strings with no injection guards or audit trails.

• Add full JSON Schema input definitions to all 19 tools. Include type, description, enum constraints, and format/pattern rules for each parameter. Example: {"command": {"type": "string", "description": "Bash command to execute. Must not contain pipes to rm, dd, or mkfs. Max 2000 chars.", "maxLength": 2000}}
• Expand tool descriptions to 100 - 200 chars. Include: (1) what the tool does, (2) when to use it vs similar tools, (3) what it returns, (4) any prerequisites. Example: 'Execute a bash command and return stdout/stderr. Use for file ops, text processing, or system queries. Returns {exit_code, stdout, stderr}. Requires bash 4+.'
• Consolidate bash_exec, run_shell, system_command into a single 'execute_command' tool with a 'shell' enum parameter (bash|sh|zsh). Document the distinction in the parameter description.
• Add confirmation gates to all destructive tools. Implement a two-step pattern: (1) tool returns a dry-run preview, (2) agent calls confirm_execution with the preview ID, (3) tool executes. Or use MRTR (Multi Round-Trip Requests) with result type 'input_required' to ask for user confirmation mid-execution.
• Document output schemas for all tools. For list_files, return {files: [{name, path, size, modified_at}], total_count, next_cursor}. For web_search, return {results: [{title, url, snippet, source}], total_results}. Include pagination limits (e.g., max 50 results per call).