Server has 22 tools with consistent naming (verb_noun pattern: sixfab_list_*, sixfab_get_*, sixfab_update_*, sixfab_deploy_*, sixfab_delete_*) and descriptions present for all tools. All tools have input schemas with Zod validation. However, descriptions are brief (avg ~80 chars, below the 194-char baseline for A+ tools) and lack context on WHEN to use each tool or dependencies between them. Parameter descriptions are minimal, many lack format/constraint details. Output schemas are not documented; responses are JSON-stringified without field-level documentation. Error handling returns generic text messages without recovery guidance or error classification. No tool annotations (readOnlyHint/destructiveHint) despite clear risk levels (READ_ONLY, WRITE, DESTRUCTIVE). Passphrase parameter is repeated on all 22 tools, a security anti-pattern (credentials should be server-injected, not per-call parameters).

• Remove passphrase parameter from all tools. Inject WRITE_PASSPHRASE server-side via environment variable. Validate it once at the HTTP handler level, not per-tool. This prevents credential leakage into logs and traces.
• Add tool annotations to all tools: readOnlyHint=true for GET operations (sixfab_list_*, sixfab_get_*), destructiveHint=true for delete_container, idempotentHint=true for operations that can safely retry. Use McpServer.tool() annotation parameter.
• Document output schemas for all tools. Add a 'Returns' section to each tool description listing key fields (e.g., 'Returns: {id, name, status, created_at, ...}'). Include field types and whether they are always present or optional.
• Enhance error handling: categorize errors as retryable (network timeout, rate limit) vs user-fixable (invalid device ID, missing required field) vs fatal (auth failure). Return structured error objects with code, message, and recovery hint (e.g., 'Device not found. Call sixfab_list_assets to see available devices.').
• Add enum constraints to parameters: 'interval' in sixfab_get_sim_usage should be enum ['hourly', 'daily', 'weekly']; 'action' in sixfab_update_container should be enum ['start', 'stop', 'restart']. Use Zod .enum() to enforce at runtime and document in descriptions.

Inferred effective spec: 2026-07-28+.

• Relies on Stateful initialize / Mcp-Session-Id (removed; protocol is stateless) - make each request self-contained