Server has 7 tools with complete input schemas and descriptions. Naming follows verb_noun convention (aggregate-, create-, delete-, get-, list-, update-, create-upload-url). Descriptions are present and substantive (80-180 chars), exceeding the 10-char minimum. However, several tools lack output schema documentation, parameter descriptions are sometimes generic, and error handling guidance is absent. No tool annotations visible in source despite toolAnnotations=true claim. Composition is sound, tools are single-responsibility and chainable (e.g., list-companies → get-company). Security posture is reasonable (no exposed secrets in params), but destructive operations (delete-company) lack confirmation patterns.

• Document output schemas for all tools. Example: 'Returns {id: string, name: string, account_owner_id?: string, custom_fields: object, created_at: ISO8601, relationships: {contacts: {count: number, truncated: boolean}}}'. This enables LLMs to chain calls and extract required fields.
• Add error recovery guidance to create-company and update-company descriptions: 'If custom_fields are rejected, call crm-schema resource first to validate field codes. Unknown codes will return 400 with the invalid field name.'
• Implement confirmation pattern for delete-company: add a 'confirm' boolean parameter (default false) or a separate 'confirm-delete-company' tool that requires explicit confirmation before soft-delete executes.
• Add readOnlyHint, destructiveHint, and idempotentHint annotations to tool definitions. Mark aggregate-opportunities, get-company, list-companies as readOnly=true; delete-company as destructive=true; create-company as idempotent=false.
• Document or remove the reference to 'upload-file' tool in create-upload-url description. If upload-file exists, add it to the tool list. If not, revise the description to clarify the complete upload workflow.