Single tool 'yararun_scan' has a reasonable description (127 chars, within 10-1024 range) but lacks critical parameter descriptions. Input schema defines 'target' and 'rules' parameters with types (string) but neither parameter has a description field in the schema. The tool description mentions what the tool does and what it returns, but does not explain WHEN to use it or any prerequisites. No output schema is documented, LLMs cannot plan downstream operations. The tool name 'yararun_scan' is clear and verb-based, but the implementation lacks the rigor expected of production tools.

• Add description fields to both parameters in the schema: 'target' → 'File path to scan (must be readable by the server)'; 'rules' → 'Optional custom YARA-style rule-pack source text. If omitted, uses bundled rules.'
• Document the output schema explicitly: 'Returns a JSON object with fields: tool (string), version (string), target (string), size (integer), filetype (string), entropy (float), md5/sha1/sha256 (hex strings), matches (array of {rule: string, severity: string}), match_count (integer), max_severity (string).'
• Expand tool description to include WHEN to use it: 'Use this tool to scan files for malware indicators, suspicious patterns, and file metadata. Call this before processing untrusted files or when investigating potential security issues.'
• Add error handling guidance: 'If the file is not found, verify the path is absolute and readable. If rules are invalid, check YARA syntax. If the scan times out, the file may be too large.'
• Consider migrating from STDIO to HTTP+SSE or Streamable HTTP transport to enable remote access and hosted client compatibility.