Single tool 'GetUserDetailsFromGraph' has critical definition gaps. Input schema is empty object {} with no parameters documented. Description is minimal (28 chars: 'Gets user details from Graph.'), below the 20-char floor for scoring. No output schema visible in source. Tool appears to perform authentication/authorization via Microsoft Graph but lacks parameter documentation, return type specification, and error handling guidance. No evidence of parameter validation, permission gating, or audit logging.

• Add explicit input parameters to GetUserDetailsFromGraph schema. If the tool requires a user identifier (email, UPN, or object ID), declare it as a required string parameter with description: 'The user email or Azure AD object ID to fetch details for (e.g. [email protected] or 550e8400-e29b-41d4-a716-446655440000).'
• Expand description to 100 - 200 characters explaining: (1) what it does ('Retrieves authenticated user profile and group membership from Microsoft Graph'), (2) when to call it ('Call after successful WAM authentication to populate user context'), (3) what it returns ('User ID, display name, email, and group memberships').
• Document output schema with typed fields: user_id (string), display_name (string), email (string), groups (array of strings). Include example: { user_id: '550e8400...', display_name: 'John Doe', email: '[email protected]', groups: ['Admins', 'Developers'] }.
• Move _clientId and _tenantId to environment variables (MCP_CLIENT_ID, MCP_TENANT_ID) or a secure config file. Never embed credentials in source code, they leak in version control and logs.
• Add error handling: document that the tool returns 'Authentication failed: <reason>' on token acquisition failure, 'Graph API error: <status>' on API failure, and 'Permission denied: insufficient scopes' if the token lacks User.Read scope. Provide recovery hints for each.

Inferred effective spec: <=2025-11-25.

• Relies on Logging (deprecated) - log to stderr or use OpenTelemetry