Cleo AI has 11 tools with basic schemas and minimal descriptions. Most tool descriptions are under 50 characters (well below the 194-char baseline for A+ tools). Parameter descriptions are sparse or missing entirely. No output schemas documented. Error handling is absent, tools return plain text with no recovery guidance. No tool annotations (readOnlyHint, destructiveHint). The server exposes destructive operations (delete_file, db_execute) without confirmation patterns or permission gates. SQL injection risk in db_query/db_execute is unmitigated. File operations lack path traversal protection. Overall, this is a functional but immature implementation typical of early-stage personal assistants, not production-grade agent tooling.

• Add output schemas to all tools. Document the structure of responses (e.g., list_files returns {files: [{name: string, size_bytes: integer}], total: integer}). This enables LLMs to plan multi-step workflows.
• Parameterize and validate all SQL queries. Use sqlite3 parameter binding (?) for all user input. Reject queries that do not match expected patterns (SELECT for db_query, INSERT/UPDATE/DELETE for db_execute).
• Add confirmation patterns for delete_file and db_execute. Return {status: 'pending_confirmation', action: 'delete_file', filename: '...'} and require a confirm_action(action_id) call before executing.
• Expand parameter descriptions to 50 - 150 characters each. E.g., 'filename: Name of the file to read (relative path, no parent directory traversal)' and 'query: SQL SELECT statement; use ? placeholders for parameters'.
• Add tool annotations: readOnlyHint=true for read_file, list_files, web_search, fetch_url, db_query, db_schema, get_weather, get_datetime; destructiveHint=true for delete_file, db_execute; idempotentHint=true for read operations.