Aigis provides 12 security-focused tools with consistent naming (verb_noun pattern: check_*, scan_*, sanitize) and complete input schemas. All tools have descriptions (avg 95 chars, within 10-1024 range). However, descriptions are generic and lack LLM-optimized guidance on WHEN to use each tool vs alternatives. No output schemas documented. Parameters lack type constraints (enums, ranges). Error handling and recovery guidance absent. Tools like check_input, check_output, check_messages appear to duplicate functionality without clear differentiation for LLM selection.

• Consolidate check_* and scan_* tools into a single canonical set. Rename to clarify intent: scan_user_input, scan_llm_output, scan_conversation, scan_rag_context, scan_mcp_definitions. Remove duplicates.
• Document output schemas for all tools. Example: scan_user_input returns {threats: [{type: string, severity: 'low'|'medium'|'high', description: string}], is_safe: boolean, confidence: number}.
• Enhance descriptions with WHEN/WHY guidance. Example: 'Scan user input for prompt injection and jailbreak attempts BEFORE passing to LLM. Use this for untrusted user messages; use scan_llm_output for model-generated text.'
• Add error handling guidance to descriptions. Example: 'Returns {is_safe: true} if no threats detected. If threats found, returns {is_safe: false, threats: [...], recommended_action: "block"|"sanitize"|"escalate"}. LLM should respect is_safe=false and not proceed.'
• Add parameter constraints: text parameter should specify max length (e.g. 100000 chars), encoding (UTF-8), and format (plaintext or JSON). messages parameter should define expected schema: [{role: 'user'|'assistant', content: string}].