Single tool with well-structured schema and clear description. Tool name 'emailable_verify' uses action verb appropriately. Input schema is complete with all parameters typed and described. Description (234 chars) is within optimal range and explains WHAT (email verification), WHEN (check deliverability), and WHAT it returns (state, score, flags). However, output schema is not formally documented, only visible through TypeScript interface VerifyResponse in code. Error handling is present but minimal (only HTTP 401/403 special-cased). No tool annotations (readOnlyHint, etc.) despite being read-only. Parameter '_apiKey' violates secret-injection pattern by appearing as a tool parameter rather than server-side injection.

• Move _apiKey to server-side environment variable injection. Modify callTool to read apiKey from process.env.EMAILABLE_API_KEY instead of args. Update tool description to remove _apiKey parameter and add a note: 'Requires EMAILABLE_API_KEY environment variable.'
• Document output schema explicitly in tool description or as a separate schema field. Example: 'Returns {email, state (deliverable|undeliverable|risky|unknown), score (0-100), disposable, role, free, accept_all, did_you_mean, mx_record, smtp_provider}'.
• Add readOnlyHint: true to tool definition to signal this is a safe, non-destructive operation. Update tool definition: {name, description, inputSchema, readOnlyHint: true}.
• Enhance error messages with actionable recovery. For HTTP 400, parse response and return 'Invalid email format, must be a valid email address.' For HTTP 429, return 'Rate limited, retry in 60s.' For network timeouts, return 'SMTP check timed out (expected for slow servers), try again or disable smtp=false for faster results.'
• Declare transport explicitly. If using HTTP, add transport metadata to package.json or README. If using STDIO, document the protocol handshake. If custom, align with MCP 2026-07-28 spec (stateless requests, _meta with logLevel, structured responses).