VaultCrypt has clear, action-verb naming (encrypt_file, decrypt_file, gen_passphrase) and reasonable descriptions (avg ~100 chars). All 5 tools have input schemas with Zod validation and parameter descriptions. However, output schemas are undocumented, responses are plain text strings with no structured field definitions. Error handling is basic (try/catch with generic messages). No tool annotations (readOnlyHint/destructiveHint). Parameter descriptions lack format constraints (e.g., 'Absolute path' but no validation guidance). Missing idempotency guidance for destructive operations.

• Document output schemas as structured objects. E.g., encrypt_file should return {success: boolean, output_path: string, bytes_encrypted: number, algorithm: string} instead of plain text.
• Add tool annotations: mark encrypt_file and encrypt_dir with destructiveHint=true; mark decrypt_file and decrypt_dir with readOnlyHint=true; mark gen_passphrase with idempotentHint=true.
• Enhance error messages with recovery guidance. E.g., 'Decryption failed: wrong passphrase or corrupted file. Verify the passphrase and try again, or check the file integrity.'
• Add format constraints to parameter descriptions. E.g., 'Absolute path to the file to encrypt (must exist, readable, <2GB)' or 'Passphrase (16+ characters, no newlines)'.
• Implement a dry-run mode for encrypt_file and encrypt_dir. Add optional 'dry_run: boolean' parameter that validates inputs and returns what would be encrypted without writing files.