The 'scan' tool has a minimal description (67 chars) and an input schema that is present but poorly structured. The schema uses a generic 'object' type with only a description field, no explicit property definitions, type constraints, or parameter-level descriptions. The tool name 'scan' is a generic verb that does not clearly convey the CMMC-specific action. No output schema is documented. Error handling, validation guidance, and recovery paths are absent. The implementation delegates to cognis_core.mcp.build_mcp_server, which is not visible in the provided source, making it impossible to verify actual tool registration details or schema enforcement.

• Rename 'scan' to 'assess_cmmc_compliance' or 'map_cmmc_practices' to clearly signal the action and domain.
• Expand the tool description to 150 - 250 characters. Include: (1) what it does (CMMC Level 2 gap assessment), (2) when to use it (after collecting a technology stack inventory), (3) what it returns (SSP skeleton + POA&M + SPRS score), (4) any prerequisites (inventory must include keys like 'mfa', 'siem', 'fips_crypto').
• Replace the generic 'object' schema with explicit property definitions. Define 'inventory' as an object with documented properties: 'mfa' (boolean), 'siem' (enum: 'splunk'|'elastic'|'other'|null), 'fips_crypto' (boolean), etc. Add descriptions for each property explaining what it controls.
• Document the output schema in the tool description or as a separate schema field. Specify: response contains 'ssp_skeleton' (object), 'poam' (array of findings), 'sprs_score' (integer 0 - 110), 'gaps' (array of control IDs with status). Include field types and descriptions.
• Add error handling guidance: 'If inventory is missing required fields, return a validation error listing which fields are required. If a control cannot be assessed due to missing inventory data, mark it as UNKNOWN and suggest what inventory data would enable assessment.'