RBTC is a role-based access control library for MCP servers, not a tool provider itself. The 9 tools shown are EXAMPLES across three different deployment contexts (Cloudflare Worker, Node/Express, minimal demo). Tool definitions are scattered across example files and lack centralized, production-grade schemas. Descriptions are present but generic (avg ~80 chars). Input schemas use Zod validation in examples but are not formally documented in JSON Schema format. No output schemas documented. Error handling is minimal. The library itself (src/index.ts, src/resolver.ts) provides RBTC primitives but does not define the actual tools, those are caller-provided. This makes evaluation difficult: tool definitions are inferred from examples rather than explicitly registered in a single source. Per the hard rules, inferred tools cap at 50 overall.

• Create a centralized tool registry (e.g., tools.ts) with explicit McpServer.registerTool() calls for all 9 tools, each with full JSON Schema input/output definitions, not Zod objects.
• Expand tool descriptions to 100 - 200 chars following the pattern: WHAT it does, WHEN to use it, WHAT it returns. E.g., 'Get revenue for a fiscal period (YYYY-MM format). Returns total revenue and breakdown by region. Use this before export_payroll to validate period availability.'
• Document output schemas for each tool. E.g., get_revenue returns {period: string, revenue: number, breakdown: {region: string, amount: number}[]}.
• Add error handling examples: 'If period is invalid, returns {error: "Invalid period format. Use YYYY-MM."}. Retry with corrected period.' Include retryability classification.
• For destructive tools (delete_user, manage_users deactivate), add a confirmation step or dry-run parameter to prevent accidental execution by agents.