Server has 5 tools with explicit schemas and descriptions. Naming follows verb_noun convention (apply_certificate, verify_dns, deploy_certificate, execute_remote_command, send_email). Descriptions are present and substantive (100-200 chars). However, schemas lack critical details: no output schemas documented, parameter descriptions in index.ts are truncated vs. source files, no enum constraints for action parameter in verify_dns, no validation guidance for sensitive parameters (passwords, SSH keys). Error handling returns generic text responses without recovery guidance. Missing idempotency hints for irreversible operations (execute_remote_command). No tool annotations (destructiveHint, idempotentHint) despite high-risk operations.

• Document output schemas for all tools. Example: apply_certificate should return {cert_pem: string, key_pem: string, chain_pem: string, expiration_date: string, saved_paths?: {cert: string, key: string, chain: string}}.
• Move SSH private key, password, and SMTP credentials to environment variables (SSH_PRIVATE_KEY, SSH_PASSWORD, SMTP_PASSWORD). Accept only non-secret parameters (host, username, port) in tool inputs.
• Add tool annotations: mark execute_remote_command and deploy_certificate with destructiveHint: true; mark apply_certificate with idempotentHint: false (ACME challenges are time-sensitive).
• Enhance error responses with recovery guidance. Example: 'ACME challenge failed: DNS record not propagated. Retry in 30 seconds or verify Aliyun DNS API credentials.' Categorize as retryable|user_fixable|fatal.
• Ensure index.ts tool schemas match source file descriptions exactly. Use the detailed descriptions from applyCert.ts, aliDnsVerify.ts, etc., not truncated versions.