Three tools with clear verb-noun naming (list_countries, get_states, get_cities) and reasonable descriptions (120-180 chars). All tools have input schemas with type definitions and parameter descriptions. However, output schemas are completely undocumented, LLMs cannot predict response structure. Parameter descriptions lack format constraints (e.g., ISO2 code format, state_code dependency on country_code). The _apiKey parameter violates secret-injection pattern by exposing credentials as a tool parameter rather than server-side injection. No error handling guidance, no pagination support despite potentially large result sets, and no idempotency guarantees.

• Document output schemas for all three tools. Example for list_countries: 'Returns {count: number, countries: [{name, iso2, iso3, capital, phone_code, currency, currency_symbol, region, subregion}]}'.
• Move API key to server-side injection. Remove _apiKey from tool parameters. Accept key via environment variable (COUNTRYSTATECITY_API_KEY) or MCP server configuration. Update tool descriptions to remove mention of _apiKey parameter.
• Add pagination: include 'limit' (default 50, max 250) and 'offset' (default 0) parameters to list_countries. Return {count, total, offset, limit, countries} to enable cursor-based iteration.
• Specify parameter formats in descriptions. E.g., 'country_code: ISO 3166-1 alpha-2 code, 2 uppercase letters (e.g., US, IN, BR)'. Add enum constraint if feasible.
• Add error recovery guidance. Catch API errors and return actionable messages: 'Invalid country code. Call list_countries to see valid codes.' or 'API rate limit exceeded. Retry in 60 seconds.'