McpToolkit.NET provides 6 tools with explicit schemas and descriptions. All tools have names starting with action verbs (read_, list_, write_, describe_, execute_). Descriptions are present but vary in quality, some are strong (read_file: 'Read the text contents of a file within allowed directories'), others lack actionable context (execute_query lacks guidance on when to use it vs describe_table). Parameters have type definitions and descriptions, but several lack constraints (e.g., execute_query's 'sql' param accepts free-form strings with no injection guidance; 'max_rows' is a string type instead of integer). Output schemas are not documented in the source. Error handling is basic, no recovery guidance or categorization. No tool annotations (readOnlyHint, destructiveHint) despite clear risk levels. write_file is destructive but lacks confirmation/dry-run pattern.

• Add tool annotations: mark read_file, list_directory, list_tables, describe_table as readOnlyHint=true; mark write_file as destructiveHint=true; mark execute_query as readOnlyHint=true with a note that it enforces SELECT-only.
• Document output schemas for all tools. E.g., execute_query returns {columns: string[], rows: any[][], total_rows: number}; list_tables returns {tables: {name: string, row_count: number}[]}.
• Change execute_query's 'max_rows' from string to integer type with minimum=1, maximum=1000. Add description: 'Maximum rows to return (1 - 1000, default 100). Prevents context window exhaustion.'
• Add SQL injection guidance to execute_query's 'sql' parameter: 'SELECT-only queries. Parameterized queries are enforced server-side. Do not concatenate user input into the SQL string.'
• Implement a dry-run or confirmation pattern for write_file. Add optional 'dry_run' boolean parameter (default false) that returns what would be written without persisting, or require explicit confirmation via a separate 'confirm_write' tool.

Inferred effective spec: <=2025-11-25.

• Relies on Logging (deprecated) - log to stderr or use OpenTelemetry