VirusTotal MCP has 11 tools with consistent naming (verb_noun pattern) and complete input schemas. All tools have descriptions and parameters are typed. However, descriptions are terse (avg ~40 chars, well below the 194-char baseline), lack context on WHEN to use each tool, and omit recovery guidance in error cases. Output schemas are not documented. Tool composition is sound (each does one thing), but parameter descriptions lack format/constraint details. No tool annotations (readOnlyHint/destructiveHint) despite clear risk stratification (5 WRITE, 6 READ_ONLY). Error handling returns structured JSON but lacks actionable recovery steps.

• Expand tool descriptions to 100-200 chars. Include WHEN to use (e.g., 'Use submit_local_file when you have a file on disk; use submit_file for remote/streamed content'), WHAT happens (e.g., 'Queues file for analysis; returns submission ID'), and NEXT STEPS (e.g., 'Poll get_submission() to check status').
• Add format constraints to parameter descriptions. E.g., 'path: Local file path (1-4096 chars, no null bytes)', 'hash: File hash as MD5 (32 hex), SHA1 (40 hex), or SHA256 (64 hex)', 'content_base64: Base64-encoded file content (max 50MB when decoded)'.
• Document output schemas for each tool. Specify which fields are always present, which are conditional, and which IDs/references are returned for chaining. E.g., 'get_submission returns {status, analysis_id, submission_id, timestamp}'.
• Add tool annotations: set destructiveHint=true on submit_* and reanalyze_* tools; set readOnlyHint=true on get_* and report tools. This signals to LLMs which operations have side effects.
• Enhance error messages with recovery hints. Instead of 'invalid_input', return 'Invalid SHA256: expected 64 hex characters, got 32. Did you mean to use MD5 hash instead?' or 'File too large (150MB). VirusTotal accepts files up to 100MB. Try compressing or splitting the file.'