This is NOT an MCP server. It is a Next.js HTTP API with 7 endpoints masquerading as tools. No MCP protocol implementation detected. Tool definitions are inferred from route handlers, not explicitly registered via MCP. Schemas are partially visible in code but not formally declared. Descriptions exist but are generic. Critical security issue: claudeApiKey exposed as a required parameter (pattern:secret-injection violation). No error handling guidance, no pagination, no idempotency markers. This would fail production code review.

• Migrate to a proper MCP SDK (e.g., @modelcontextprotocol/sdk for Node.js). Implement tool registration via the MCP protocol, not raw HTTP routes. This enables proper schema declaration, capabilities negotiation, and protocol compliance.
• Move claudeApiKey to server-side environment variable injection. Remove it from the audit tool's input schema entirely. Use process.env.CLAUDE_API_KEY inside the handler.
• Add formal JSON Schema definitions for all tool inputs. Declare types, required fields, enums, and constraints. Example: audit input should have { file: { type: 'file' }, model: { type: 'string', enum: ['claude-3-5-sonnet', 'claude-3-opus'] }, context: { type: 'string', maxLength: 2000 } }.
• Expand tool descriptions to 50-200 characters. Include WHAT the tool does, WHEN to use it, and what it returns. Example: 'Analyzes source code from IPA/APK files against App Store policies. Returns compliance findings, risk assessment, and remediation recommendations. Use this to audit app binaries before submission.'
• Add error handling with recovery guidance. Return structured errors: { error: 'invalid_model', message: 'Model must be one of: claude-3-5-sonnet, claude-3-opus', retryable: false }. Guide LLMs on next steps.