Critical gaps across naming, descriptions, and schemas. Tool names lack action verbs (recon, osint, analyze, correlate lack clarity on what action occurs). Descriptions are present but generic, most under 100 chars, insufficient for LLM selection. Input schemas visible but sparse: many tools accept only 1-2 params with minimal type info. No output schemas documented. Error handling returns raw text wrapping, not structured recovery guidance. Composite tools (13 registered) are better than individual tools (103 CLI-only), but even composites lack depth. Example: 'correlate' and 'fp_correlate' are duplicates with identical schemas, naming confusion. 'recon' and 'osint' are vague orchestrators without clear boundaries.

• Consolidate 'correlate' and 'fp_correlate' into a single 'correlate_fingerprints' tool with clear naming.
• Rename 'recon' → 'run_full_reconnaissance' and 'osint' → 'enrich_osint_data' to clarify actions and reduce LLM confusion.
• Document output schemas for all 22 tools. Example: scan_ports should return {host, ports: [{port, service, version}], timestamp}.
• Expand tool descriptions to 100-200 chars. Include: what it does, when to use it vs similar tools, and key output fields. Example: 'Scan open ports and detect running services. Use after identifying a target host. Returns port list with service names and versions for further fingerprinting.'
• Implement structured error responses: {error: string, code: 'retryable'|'user_fixable'|'fatal', suggestion: string}. Example: 'Invalid domain format. Did you mean: example.com? Try enum_subdomains(domain="example.com")'