Six tools with basic schemas and descriptions, but significant gaps in parameter documentation and error handling. All tools have names and descriptions, but most parameter descriptions are minimal or missing. The call_api tool lacks critical security guidance. No output schemas documented. Error handling is minimal, most tools return plain text rather than structured recovery guidance. Naming is generally clear (verb_noun pattern), but descriptions are brief (avg ~60 chars, below the 194-char baseline for A+ tools). No tool annotations (readOnlyHint/destructiveHint) despite clear risk profiles.

• Add parameter descriptions to all tools. For query_database, document 'sql' as 'SQL SELECT query (read-only; no INSERT/UPDATE/DELETE allowed)'. For search_files, describe 'pattern' as 'Glob pattern (e.g. *.txt, **/*.py) to match files under dir'.
• Document output schemas for each tool. E.g. query_database returns 'Array of objects with column names as keys and values as strings/numbers/nulls'. list_directory returns 'Array of {name, type, size_bytes, modified_iso8601}'.
• Add tool annotations: mark query_database, list_tables, list_directory, read_file, search_files with readOnlyHint=true. Mark call_api with destructiveHint=true if method is POST/PUT/DELETE.
• Enhance error messages with recovery guidance. Instead of 'Only SELECT queries are allowed', return 'Invalid query: only SELECT is allowed. To modify data, use a separate write tool.' For 'Database error: ...', suggest 'Database error: {error}. Check syntax or try a simpler query.'
• For call_api, add explicit security guidance in description: 'Calls HTTP APIs. Do NOT pass credentials, API keys, or secrets in headers or body, use server-side secret injection. Validate URLs to prevent SSRF attacks.' Add 'timeout_seconds' parameter (default 30, max 300) to prevent hung requests.