cliguard defines 6 tools with partial schema coverage and inconsistent descriptions. All tools have input schemas with typed parameters and descriptions, meeting baseline requirements. However, descriptions are terse (10-80 chars, well below the 194-char production average), output schemas are undocumented, and error handling lacks recovery guidance. Tool naming follows verb_noun convention (propose_, check_, explain_, audit_, run_, undo_) but lacks clarity on distinctions between similar tools (propose_command vs check_command vs explain_command). No tool annotations (readOnlyHint/destructiveHint) despite clear risk classifications in metadata. Parameter descriptions are minimal; e.g., 'Command as argv array' lacks format/constraint details. Error responses return structured ToolError objects but do not guide LLM recovery (e.g., 'command_blocked' lacks 'try check_command first' guidance).

• Expand tool descriptions to 100 - 200 chars. For propose_command: 'Analyze a command proposed by an AI agent without executing it. Use this to preview agent actions before approval. Returns risk analysis and guidance for the agent.' For check_command: 'Analyze a command from a human user without executing it. Use this to understand what a command does before running it manually.' This disambiguates the three analysis tools.
• Document output schemas for all tools. E.g., propose_command returns {ok: bool, tool: string, analysis: {risk: {level, reasons}, decision: {execution_allowed, requires_human_confirmation}}, agent_guidance: string}. Include field types and what each field means.
• Add recovery guidance to error responses. Change 'command_blocked' to include 'This command violates your cliguard policy. Call check_command to see the risk analysis and policy rules that apply.' Change 'human_confirmation_required' to 'This command requires human approval. Ask the user to review the analysis and confirm before retrying.'
• Add tool annotations to input schemas. Mark propose_command, check_command, explain_command, audit_recent as readOnly. Mark run_command as destructive. Mark undo_last as reversible. This enables LLM safety reasoning.
• Enhance parameter descriptions with constraints. For 'command' param: 'Command as argv array (e.g., ["rm", "-rf", "/tmp/cache"]). Max 100 elements. No shell metacharacters; each element is a separate argument.' For 'cwd': 'Absolute or relative path to working directory. Must be readable by the cliguard process. Defaults to current directory if omitted.'