Single tool 'iamlint_scan' has a basic description (89 chars) but critically lacks parameter descriptions and output schema documentation. The input schema defines 'target' as a string but provides no guidance on format, constraints, or expected values (file path vs directory vs glob pattern). No output schema is documented, LLMs cannot predict the structure of returned findings. Error handling is absent; no guidance on what happens if the target doesn't exist, is unreadable, or contains invalid IAM policies. The tool name 'iamlint_scan' is acceptable (verb_noun form) but the implementation is minimal and does not follow production-grade tool patterns.

• Add a detailed output schema to the tool definition. Document the structure of the returned JSON: e.g., {"tool": string, "findings": [{"id": string, "severity": string, "location": string, "detail": string, "remediation": string}], "score": number}.
• Expand the 'target' parameter description to: 'Path to an IAM policy file (JSON) or directory to recursively scan. Accepts absolute or relative paths. Returns findings for AWS, GCP, and Azure policies.'
• Add error handling examples: 'If target does not exist, returns error: "Path not found: {path}". If file is not valid JSON, returns error: "Invalid JSON in {file}: {error_detail}".'
• Increase tool description to 150 - 250 characters. Include: what least-privilege violations are detected, which providers are supported, and when to call this tool (e.g., 'before deploying IAM policies').
• Document result limits and pagination. E.g., 'Returns up to 100 findings per call. For large scans, consider splitting the target directory and calling the tool multiple times.'