Holdfast defines 8 tools with complete input schemas and descriptions. Naming follows verb_noun convention (start_session, read_output, send_input, terminate, status, list_sessions, get_command_history, wait_for_pattern). Descriptions are present and substantive (80-200 chars typical). However, output schemas are not documented, LLMs cannot predict response structure for downstream chaining. Parameter descriptions are good but lack explicit constraints (e.g., max_bytes has a default and max but no enum/pattern). Error handling is mentioned in code but not surfaced in tool descriptions. Security considerations (redaction_disabled flag, secret injection via profiles) are present but not explicitly documented in parameter descriptions.

• Document output schemas for all tools. Example: 'Returns {session_id: string, pid: number, state: "running"|"exited", exit_code?: number}'. This enables LLMs to chain tools and extract the right fields.
• Add explicit constraint text to parameter descriptions. Change 'Maximum bytes to return (default 32 KiB, max 256 KiB)' to 'Maximum bytes to return. Range: 1 - 262144 (256 KiB). Default: 32768 (32 KiB).' LLMs parse text, not JSON Schema.
• Add error recovery hints to tool descriptions. E.g., 'If session not found, call list_sessions() to see active sessions.' This guides multi-step planning.
• Enforce mutually exclusive parameters at schema level using oneOf or allOf constraints, not just description text. This prevents LLMs from passing both command and profile.
• Add security warnings to sensitive parameters. E.g., 'redaction_disabled: Set to true only if you trust the session output. Disables automatic redaction of secrets and credentials.' This raises LLM awareness of risk.