Server has 4 tools with significant definition gaps. Tool names lack clear action verbs (get_system_info is acceptable, but op_command and commit_config are vague). Descriptions exist but are sparse (10-50 chars for most) and lack WHEN/WHY context. Input schemas are present but incomplete: get_system_info has empty schema ({}), op_command lacks description for xml_cmd parameter, commit_config and commit_all_shared_policy have minimal param descriptions. No output schemas documented. Error handling is absent, no guidance on retryability, user-fixable errors, or recovery paths. No tool annotations (readOnlyHint, destructiveHint). Security concern: PA_API_KEY and PA_HOST are hardcoded globals, not injected. Overall, definitions are below production baseline.

• Expand tool descriptions to 100-200 chars. Include WHAT (retrieves system info), WHEN (before making config changes), and WHAT IT RETURNS (dict with hostname, version, serial). Example: 'Retrieve system information from the PAN-OS device (hostname, version, serial number, uptime). Call this first to verify device connectivity and firmware version before making changes.'
• Add parameter descriptions to all tools. For op_command, document xml_cmd: 'Raw XML command string (e.g., <show><system><info></info></system></show> for read, <request><restart><system></system></request> for write). See PAN-OS XML API docs for valid commands.'
• Document output schemas for each tool. Example for get_system_info: 'Returns dict with keys: hostname (str), version (str), serial (str), uptime_days (int). Use hostname in subsequent tool calls.'
• Add tool annotations: mark get_system_info with readOnlyHint=true; mark op_command, commit_config, commit_all_shared_policy with destructiveHint=true to signal to LLMs that these modify state.
• Move PA_API_KEY and PA_HOST to environment variables (os.getenv('PAN_OS_HOST'), os.getenv('PAN_OS_API_KEY')). Never hardcode or expose credentials in tool parameters. Add validation: raise ValueError if env vars are missing at server startup.