Single tool 'authmatrix_scan' has a reasonable description (89 chars) but critically lacks parameter descriptions and proper schema documentation. The input schema shows only a 'target' parameter with type 'string' and basic description, but no constraints, format guidance, or examples of valid inputs. No output schema is documented, the tool returns JSON but the structure is not formally specified. The tool name lacks a clear action verb (scan is acceptable but generic). Error handling is absent from the visible code. The implementation appears to be a simple wrapper around core.scan() with minimal validation or guidance for LLM usage.

• Document the complete output schema: specify that findings is an array of objects with fields 'id', 'sev', 'where', and explain what each field represents.
• Add format and constraint guidance to 'target' parameter: e.g., 'Target path or identifier (string, 1-255 chars, supports absolute/relative paths or resource IDs).'
• Implement and document error handling: return structured errors like '{"error": "Invalid target path", "suggestion": "Provide a valid file path or resource identifier"}' instead of raw exceptions.
• Rename tool to 'test_authz_matrix' or 'analyze_access_control' to more clearly convey the security-testing intent.
• Add result limiting and pagination guidance: document max findings returned and how to handle large result sets.