Three tools with destructive/read capabilities, but critical definition gaps across all. Bash and PowerShell have minimal descriptions (under 150 chars) and only a single 'command' parameter with no type validation hints, enum constraints, or format guidance. Playwright has a slightly better description but still lacks output schema documentation. No tool documents return types, error recovery paths, or permission requirements. Input schemas are present but extremely sparse, no minLength, maxLength, pattern, or enum constraints. The approval gate logic is sophisticated but hidden in shell scripts, not surfaced in tool definitions where LLMs can reason about it.

• Add explicit output schema to each tool. Bash/PowerShell: document that output is raw text (stdout/stderr). Playwright: document JSON structure with fields (title, text, links array with url/text).
• Implement dry-run or confirmation pattern for destructive tools. Add optional 'dry_run' boolean parameter to Bash/PowerShell; return what would be deleted/moved without executing. Require explicit confirmation for irreversible operations.
• Enhance parameter descriptions with constraints and examples. Bash: 'Shell command to execute. Blocked: rm/git rm/git mv/mv outside vault on .md files. Allowed: internal moves, external deletions.' Playwright: 'URL to scrape (http/https only, no file:// or data: URIs).'
• Document error responses and recovery paths. Define what happens on command failure, timeout, or blocked operation. E.g., 'BLOCKED: Deletion of protected file. Use approval workflow or move to scratch directory outside vault.'
• Add permission/scope declarations. Bash/PowerShell: 'Requires: shell:execute, file:write, file:delete (within vault boundary). Audit: all commands logged with timestamp and result.' Playwright: 'Requires: http:read. No authentication or cookies stored.'