The 'scan' tool has a reasonable parameter schema with types and descriptions, but the tool definition is inferred from a wrapper function (build_mcp_server) rather than directly visible in the source. The actual tool registration, input validation, and output schema are hidden behind the cognis_core.mcp abstraction. Without seeing the explicit tool definition, schema completeness cannot be verified. The description is adequate (89 chars) but generic. No error handling guidance, no output schema documentation, and no evidence of idempotent or destructive operation hints.

• Expose the full tool definition in honeytrace/mcp_server.py. Show the explicit tool registration with input schema, output schema, and error handling.
• Document the output schema for 'scan'. Specify what fields are returned (e.g., findings array, session_id, threat_score, events) and their types.
• Add error handling guidance: 'If service is invalid, must be one of: ssh, rdp, smb, http. If commands array is empty, scan will not execute, provide at least one command.'
• Rename 'scan' to 'simulate_honeypot_session' or 'run_decoy_scan' to clarify the action and distinguish from code-scanning tools.
• Add tool annotations: mark 'scan' as read-only (readOnlyHint: true) and idempotent (idempotentHint: true) in the schema.