AgentPerms is a security policy framework, not a production MCP server. The bundled vulnerable-mcp-demo is intentionally over-privileged for testing. Tool definitions are minimal: 8 tools with bare descriptions (10-50 chars, well below the 194-char baseline) and schemas lacking parameter descriptions entirely. No error handling, no output schema documentation, no security annotations. The demo server echoes tool calls rather than executing them. This is a teaching tool, not a production-grade MCP implementation.

• Add 50 - 200 character descriptions to each tool explaining WHAT it does, WHEN to use it, and what it returns. E.g., 'read: Read a file from disk. Returns file contents as text. Use to inspect configuration, logs, or source code. Fails if path does not exist or is not readable.'
• Add descriptions to all parameters. E.g., for 'read', add 'path: Absolute or relative file path. Must be readable by the server process. Supports ~ for home directory.'
• Document output schemas. E.g., 'read returns {"content": string, "size_bytes": number, "encoding": string}'. This enables LLMs to chain tools and extract data.
• Add error handling guidance. E.g., 'If path not found, returns error code 404 with message "File not found: {path}". Retry with a different path or call list_repos() to discover available files.'
• For destructive tools (delete_repo, force_push, exec, send_email), add a dry_run parameter or require explicit confirmation. E.g., 'delete_repo: Requires confirmation=true to prevent accidental deletion. Call with confirmation=false first to preview what would be deleted.'