Single tool 'sbomx_scan' has a reasonable description (145 chars, within 10-1024 range) but critical schema gaps. Input schema visible with 'target' parameter (string type, description present). However, NO output schema is documented anywhere in the code, LLMs cannot plan downstream operations or extract structured results. Parameter description is adequate but generic. Tool name lacks action verb prefix (should be 'scan_sbom' or 'generate_sbom'). No error handling guidance, no pagination support, no idempotency markers. The tool performs a read-only scan but lacks tool annotations (readOnlyHint) to signal this to clients.

• Add explicit output schema documentation: document that the tool returns a JSON object with fields like 'tool', 'port', 'components' (array of {name, version, ecosystem, purl, evidence}), and 'count'. This enables LLMs to extract component data and chain to downstream analysis tools.
• Rename tool to 'scan_sbom' or 'generate_sbom' to start with a clear action verb, improving LLM intent recognition.
• Add readOnlyHint annotation to the tool definition to signal it is safe and idempotent, reducing unnecessary confirmation prompts.
• Expand parameter description: 'Path to an extracted mobile app directory or .apk/.ipa file. Supports relative and absolute paths. Returns error if path does not exist or file format is unsupported.'
• Add error handling guidance to description: 'If the file format is unsupported, try extracting the app first. If permission denied, ensure read access to the target path.'