Single tool with clear naming (scan_extension) and reasonable description (156 chars). Input schema present with Zod validation and parameter description. However, output schema is undocumented, the render() function shows the response structure but it's not formally declared in the tool definition. Error handling is present but generic (timeout, API error messages). No parameter constraints (enums, ranges) beyond the description text. The tool is read-only and stateless, which is good, but lacks structured output documentation that LLMs need for downstream planning.

• Add a formal output schema to the tool definition. Document the response structure: { overall_risk: enum('clean'|'low'|'medium'|'high'|'critical'), target: string, files_scanned: number, summary: string, findings: array<{severity, label, file, line}>, report_url: string }.
• Enhance the 'target' parameter description with format rules: 'GitHub repo URL (https://github.com/owner/repo or github:owner/repo), npm package name (@scope/pkg or pkg), or pasted manifest/skill text (JSON or YAML).'
• Improve error handling with actionable guidance. For timeouts: 'Scan timed out after 90s. The target may be large or the network slow. Retry in a moment or check https://mcpvet.com for status.' For API errors: 'MCPVet service error. Check https://mcpvet.com/status or try again in a few minutes.'
• Document the findings truncation behavior. Add to description: 'Full report with all findings available at report_url. Tool output shows first 25 findings for brevity.'
• Consider adding a 'format' parameter (enum: 'summary'|'detailed') to let agents choose verbosity, reducing token waste for simple scans.