WireMCP has 5 tools with complete Zod schemas and descriptions, but quality is uneven. All tools have descriptions (10 - 200 chars, within baseline), and parameters are typed with enums and defaults. However, naming lacks clarity, 'capture_packets' and 'check_threats' combine multiple responsibilities (capture + parse + analyze). Output schemas are not documented; responses are free-text JSON without field definitions. Error handling is basic (returns isError flag but no recovery guidance). No tool annotations (readOnlyHint, destructiveHint). Parameter descriptions are minimal (e.g., 'Network interface to capture from' lacks format/constraint details). Tools 1 - 4 all capture traffic but differ subtly in output mode, risking LLM confusion. Tool 5 (check_ip_threats) is isolated and clear.

• Document output schemas for all tools. E.g., capture_packets returns {packets: [{src_ip, dst_ip, protocol, payload}], count: number, duration_seconds: number}. This enables LLMs to extract fields and chain calls.
• Split capture_packets into capture_packets (raw data) + parse_packets_basic (native Rust) + parse_packets_full (tshark). Each tool does one thing; LLM composes as needed.
• Add readOnlyHint: true to all 5 tools in schema annotations. This signals to LLMs that calls are safe to retry and have no side effects.
• Enhance error messages with recovery steps. E.g., 'Rust binary not found at {path}. Run: cd capture-rs && cargo build --release' instead of bare error.
• Add min/max constraints to numeric parameters. E.g., duration: z.number().min(1).max(300).describe('Capture duration in seconds (1 - 300)'). Add pattern hint to interface: 'alphanumeric, dash, underscore, dot only'.