Both tools have adequate descriptions (60-80 chars) and clear parameter schemas with types. However, tool names violate verb-first conventions (should be 'generate_form_field_url' and 'generate_global_field_url'), and critical security issues dominate: sign_secret is exposed as a parameter despite claims of local-only computation. Parameter descriptions are present but lack format/constraint details. No output schema is documented. Error handling is absent. The tools appear to be browser-based generators (not server-side MCP tools), which raises fundamental architectural concerns about MCP suitability.

• Rename tools to verb-first: 'generate_form_field_url' and 'generate_global_field_url' to match LLM expectations and Arcade baseline conventions.
• Move sign_secret to server-side configuration (environment variable or vault). Accept only form_token and pairs as parameters. Compute signatures server-side using injected secrets.
• Document output schema explicitly: return {url: string, signature: string, payload: object} or equivalent. Include example response.
• Add format constraints to parameter descriptions: form_token='6-char code', pairs[].key='field API CODE (alphanumeric + underscore)', pairs[].value='string, URL-encoded by tool'.
• Implement error handling: return structured errors with actionable guidance (e.g., 'Invalid form_token: expected 6 characters, got 5. Check /f/ URL.').