binzaar demonstrates solid tool design with consistent naming (verb_noun pattern), comprehensive descriptions (avg 150+ chars), and well-structured schemas. All 14 tools have explicit input schemas with typed parameters and descriptions. Risk annotations (READ_ONLY, WRITE, DESTRUCTIVE) are present but not formalized as toolAnnotations in the MCP protocol. Output schemas are not documented in the visible code. Error handling descriptions are present but lack recovery guidance. Composition is strong, tools chain well (e.g., search_apps → app_details → install_app). No security issues detected in parameter handling.

• Document output schemas for all tools. Add a 'Returns' section to each tool description or expose structured response types in the MCP tool definition. Example: 'Returns: {repo: string, latest_release: {tag: string, assets: [{name: string, url: string}]}, installed: boolean}'.
• Formalize risk annotations as MCP toolAnnotations. Use readOnlyHint=true for get_*, list_*, search_*, verify_*; destructiveHint=true for uninstall_app; idempotentHint=true for tools safe to retry. This enables agents to reason about side effects.
• Add error recovery guidance to tool descriptions. E.g., install_app: 'If asset matching fails, the error lists available assets. Retry with an explicit asset name, or call list_releases() to verify the repo exists.'
• Implement pagination for list tools. Add optional limit (default 20, max 100) and offset/cursor parameters. Return total_count or next_cursor in responses. Document in descriptions: 'Returns up to 20 results; use offset to paginate.'
• Add dependency hints to tool descriptions. E.g., install_app: 'Requires a valid repo slug (owner/name). Call search_apps() or list_catalog() first if you only have a partial name.'

Inferred effective spec: 2025-06-18+.

• Relies on Logging (deprecated) - log to stderr or use OpenTelemetry