Single tool 'vendorvet_scan' has a basic description (67 chars) but critically lacks parameter descriptions. The input schema defines 'target' as a string with a description ('Target path or identifier to scan'), which is present but vague. No output schema is documented. The tool name uses a verb prefix (scan) but the description does not explain what 'target' means operationally, is it a file path, URL, package name, or SBOM identifier? No error handling guidance, no pagination, no structured output schema. The implementation returns JSON via to_json(scan(target)), but the response structure is not documented for the LLM. This forces the LLM to guess at output fields and error cases.

• Expand parameter description: 'target: File path to a vendor security questionnaire JSON (e.g., /path/to/vendor.json) or SBOM file (e.g., sbom.json). Required format: JSON object with vendor name, data_classification (public|internal|confidential|restricted), and answers object mapping control keys to boolean values.'
• Document output schema in tool description: 'Returns JSON object with fields: vendor (string), data_classification (string), raw_score (0-100), residual_score (0-100), tier (low|moderate|high|critical), answered (int), total_controls (int), gaps (array of strings). Use residual_score and tier to assess vendor risk.'
• Add error handling guidance: 'If target file not found, returns error with available questionnaire examples. If JSON is malformed, returns error with line number. If data_classification is invalid, returns error listing valid options.'
• Clarify use case in description: 'Use this tool to assess third-party vendor security risk by scoring their responses to a standard control questionnaire. Call this before onboarding a vendor or renewing a contract.'
• Migrate from STDIO to HTTP transport using FastMCP's HTTP support or expose via a REST wrapper for remote accessibility.