Three tools with complete input schemas and descriptions, but significant quality gaps. Tool names lack action verbs (ensureUser, createOrFetchSubscription, listSecrets are acceptable but not ideal). Descriptions are present (40-80 chars) but lack WHEN/WHY context and recovery guidance. Parameters have types and descriptions, meeting baseline requirements. No output schemas documented, LLMs cannot plan downstream calls. No error handling guidance. No tool annotations (readOnlyHint, destructiveHint, idempotentHint). Security concern: token parameter exposed in all tools (should be server-side injected). Composition is reasonable (three distinct operations), but tools lack idempotency guarantees and confirmation patterns for destructive operations.

• Document output schemas for all three tools. ensureUser should return {ownerId: string}. createOrFetchSubscription should return {existing: boolean, subscriptionId: string}. listSecrets should return {primaryKey: string, secondaryKey: string}.
• Move token parameter to server-side injection. Remove 'token' from tool inputs. Instead, read AZURE_ACCESS_TOKEN from environment inside the MCP server and inject it into armRequest() calls. This prevents credential leakage into logs.
• Expand tool descriptions to 100-150 chars with WHEN/WHY context. Example: 'Create or fetch an APIM subscription to a product. Returns subscription ID and keys. Call this after ensuring the user (if needed). Keys are sent as Ocp-Apim-Subscription-Key header at runtime.'
• Add tool annotations: idempotentHint=true for ensureUser and createOrFetchSubscription (both are idempotent PUTs). readOnlyHint=true for listSecrets. This signals to LLMs which tools are safe to retry.
• Enhance error responses with recovery guidance. Instead of 'Create user failed: 403 Forbidden', return 'User creation failed: insufficient permissions. Ensure your Azure AD token has API Management Service Contributor role on the APIM service.'