mcp-guard is a security analyzer, not a production MCP server. Its 5 tools are deliberately poisoned fixtures designed to test detection rules (MCPG001-MCPG009). Tool descriptions contain injection payloads, hidden text, secret references, exfiltration URLs, ANSI escapes, and cross-tool manipulation phrases, all intentional. The 'search' tool is clean. Schemas are present but minimal (1-2 params each). Descriptions range from 34 - 194 chars; 2 of 5 are malicious by design. This is a test harness, not a usable MCP server. Scoring reflects that: naming is clear (verb_noun), but descriptions are either poisoned or generic, and no output schemas are documented.

• Remove all poisoned descriptions and replace with clean, LLM-optimized text (50 - 200 chars). E.g. 'read_file': 'Reads and returns the contents of a file at the given path. Returns file contents as a string or an error if the file does not exist or is not readable.'
• Document output schemas for all tools. E.g. audit_log returns {entries: [{timestamp: string, action: string, user: string}], total: int}. search returns {paths: [string], count: int}.
• Add parameter descriptions with format/constraint guidance. E.g. 'path': 'Absolute or relative file path. Must be within the allowed directory. Supports Unix and Windows paths.'
• Implement error handling with recovery guidance. E.g. if file not found, return 'File not found at /path/to/file. Check the path and try again.' instead of a bare error.
• Add confirmation/dry-run for delete_file. E.g. add a 'confirm' boolean param (default false) or a separate 'preview_delete' tool that shows what would be deleted.