Chronicon exposes 16 tools with basic descriptions and partial schemas. Most tool descriptions are under 50 characters and lack actionable context (e.g., 'Authenticate request using headers' does not explain when to call it or what it returns). Input schemas are present but incomplete: many parameters lack type definitions beyond 'object', and descriptions are minimal. No output schemas are documented. Error handling is absent, no guidance on retryability, user-fixable errors, or recovery paths. Tool naming is reasonable (verb_noun pattern) but compositions like 'authenticate' + 'readPublicProfile' suggest multi-step workflows that could be simplified. No tool annotations (readOnlyHint, destructiveHint, idempotentHint) despite clear risk levels (READ_ONLY, WRITE, DESTRUCTIVE). Parameter descriptions are generic ('Authenticated principal', 'HTTP request headers') without explaining what fields are required or how to construct them.

• Add output schemas to every tool. Document the structure of returned objects, including field names, types, and whether they are required. Example: readPublicProfile should return {id: string, name: string, email: string, bio?: string}.
• Expand tool descriptions to 80 - 150 characters. Include WHAT the tool does, WHEN to use it, and a hint about the return value. Example: 'Read the public profile of an authenticated user. Returns profile metadata (name, email, bio). Call this after authenticate() to fetch user details.'
• Replace generic parameter descriptions with specific field requirements. For 'principal' object, document: 'Authenticated principal object containing {userId: string, token: string, scope: string[]}. Obtained from authenticate() response.'
• Add tool annotations to all tools. Mark readOnlyHint=true for READ_ONLY tools, destructiveHint=true for DESTRUCTIVE tools (revokeKey, revokeCli), and idempotentHint=true for tools safe to retry.
• Document error scenarios and recovery paths. Example for revokeKey: 'Returns 404 if key not found (try listKeys() to verify ID). Returns 403 if user lacks permission (contact admin). Returns 409 if key already revoked (safe to retry).'