HiveAttest exposes 16 cryptographic attestation tools with complete input schemas and detailed descriptions. All tools have proper JSON Schema definitions with required fields, enums, and type constraints. Descriptions are substantive (150-250 chars) and reference C-codes (C15-C20). However, output schemas are entirely undocumented, no tool declares what fields it returns, forcing LLMs to guess response structure. Error handling is absent: no guidance on retryability, user-fixable vs fatal errors, or recovery paths. Tool naming follows verb_noun pattern (attest_*) consistently but lacks action clarity, 'attest_gate_evaluate' is domain-specific jargon; 'check_access' would be clearer. Parameter descriptions are strong (e.g., 'Declared taint status' with enum), but no guidance on parameter relationships (e.g., when is 'observed_inputs' required vs optional in verify tools?). Security posture is unclear: no mention of credential injection, permission gates, or audit logging.

• Document output schemas for all 16 tools. Example for attest_passport_issue: 'Returns {manifest: {action_id, agent_did, intended_op, target_resource, inputs_hash, signature, issued_at, expires_at}, status: "issued"}'. This enables LLMs to extract warranty_id, chain_id, etc. for downstream calls.
• Add error handling guidance to verify tools. Example: 'Returns {valid: true} on success. On signature failure: {valid: false, reason: "signature_mismatch", retryable: false}, ask user to reissue attestation.' Categorize errors as retryable vs fatal.
• Clarify parameter relationships in descriptions. For attest_passport_verify, add: 'observed_inputs: Optional. If provided, verifies that the declared inputs hash matches the observed payload. Omit to skip input validation.' This removes ambiguity.
• Rename tools for clarity: attest_gate_evaluate → check_attestation_access, attest_custody_append → add_custody_node, attest_cargo_register → register_cargo_type. Reduce domain jargon; prioritize verb_noun clarity.
• Add security declarations to tool descriptions. Example: 'Requires: sign_attestation permission. Logs: caller_did, action_id, timestamp. Audit: all issuances are recorded in the HiveAttest audit log.' This enables least-privilege agent configuration.