Single tool 'mftparse_scan' has a basic description (73 chars) but critically lacks input parameter descriptions. The schema shows only a 'target' parameter of type string with minimal guidance on expected format (path vs directory vs CSV). No output schema is documented. The description does not explain when to use this tool, what prerequisites exist, or what the JSON findings structure contains. No error handling guidance. Tool naming is acceptable (verb_noun pattern) but the implementation lacks the rigor expected for production use.

• Add a detailed description to the 'target' parameter: 'Path to an NTFS $MFT CSV export file or directory containing CSV files. Accepts absolute or relative paths. Example: /mnt/evidence/mft.csv or ./scans/'
• Document the output schema in the tool description: 'Returns a JSON object with keys: findings (array of {id, severity, file_path, timestamp_anomaly}), score (count of anomalies), and metadata (scan_time, files_processed).'
• Expand tool description to 150-200 chars explaining use case: 'Detects NTFS $MFT timestamp anomalies (timestomping) and suspicious file activity patterns. Call this first when investigating potential file system tampering or forensic evidence integrity.'
• Add error handling examples: 'If target is not found, returns error with available directories. If CSV is malformed, returns partial results with line numbers of invalid rows.'
• Add input constraints: 'target must be a valid file or directory path (max 4096 chars). CSV files must follow NTFS $MFT export format with columns: filename, created, modified, accessed, mft_modified.'