Four well-named, read-only diagnostic tools with clear descriptions (avg 156 chars) and complete input schemas. All parameters are typed and described. Tool annotations correctly declare readOnlyHint=true. Output schemas are not explicitly documented in the source, which is the primary gap. Error handling returns structured dicts with 'error' fields but lacks recovery guidance. No security issues detected (no credentials exposed, SSRF guards present). Naming follows verb_noun pattern (dns_lookup, tls_certificate, http_probe, ip_rdap). Parameter constraints are well-specified (enums for record_type, port range 1-65535, domain/IP validation). Composition is sound, each tool does one thing and returns relevant data for chaining.

• Document output schemas for all four tools. Use Pydantic models or explicit JSON Schema definitions in docstrings. Example: 'Returns {"records": [{"type": str, "value": str, "ttl": int}], "error": str | null}'.
• Enhance error messages with recovery hints. When TargetRefused is caught, return {'error': 'not a valid domain name: example', 'hint': 'Domain must be 1-253 chars, ASCII only, no trailing dot. Try example.com'}.
• Add format='uri' or a regex pattern constraint to http_probe's url parameter to guide LLM input validation.
• Add optional limit and offset parameters to dns_lookup and ip_rdap to support pagination and cap result sizes.
• Document timeout behavior (8.0s) in tls_certificate and http_probe descriptions so LLMs know when to retry vs. escalate.