Three well-named, read-only tools with clear descriptions and complete input schemas. All tools follow verb_noun naming (search_*, query_*, layer_info). Descriptions are substantive (120 - 180 chars) and explain what each tool does and when to use it. Input schemas include type definitions and parameter descriptions. However, output schemas are not documented, LLMs cannot predict what fields to expect from responses. Parameter descriptions lack explicit constraints (e.g., 'limit: 1-50' is stated in description but not formalized). No error handling guidance or recovery paths documented. Missing idempotent/readOnly annotations. SSRF guard in layerUrl() is good security practice but not exposed to LLM.

• Document output schemas for all three tools. Example: search_datasets returns {total: number, count: number, datasets: [{id, name, summary, org, org_id, record_count, type, url}]}. query_layer returns {features: [...], exceededTransferLimit: boolean}. layer_info returns {fields: [{name, type, alias}], geometryType, recordCount, capabilities}.
• Add JSON Schema minimum/maximum to numeric parameters. E.g., limit: {type: 'number', minimum: 1, maximum: 50, description: '...'}. Formalize constraints so LLMs and validators can enforce them.
• Add readOnlyHint: true to all three tools in the tool definition. This signals to LLMs that these are safe to call without confirmation.
• Provide error recovery guidance in descriptions. E.g., query_layer: 'If the where clause fails, try where="1=1" to sample all records. If the URL is invalid, call search_datasets to find a valid Feature Service url.'
• Shape query_layer response to strip unnecessary ArcGIS metadata. Return only {features: [{attributes, geometry}], count, exceededTransferLimit} instead of raw API response with objectIdFieldName, globalIdFieldName, etc.