Three tools with complete input schemas and basic descriptions, but significant gaps in parameter documentation and output schema specification. All tools expose credentials as parameters (critical security flaw), violating pattern:secret-injection. Descriptions are minimal (10-30 chars) and lack context for LLM selection. No output schemas documented. Error handling present but generic. Tool naming follows verb_noun convention correctly.

• Move siteUrl, username, password to server-side environment variables only. Remove from tool parameters. Use pattern:secret-injection: read credentials from process.env at startup, validate presence in constructor, throw clear error if missing.
• Expand tool descriptions to 100-200 chars. Example: 'create_post: Create a new WordPress post with title and content. Returns post ID and URL. Status defaults to draft; use publish to make live immediately. Requires WordPress admin credentials.'
• Document output schemas for each tool. Example for create_post: '{type: object, properties: {id: {type: number}, title: {type: string}, content: {type: string}, status: {type: string}, link: {type: string}}, required: [id, title, status]}'
• Add enum constraints and bounds to parameters. Example: status enum: ['draft', 'publish', 'pending', 'private']; perPage: {type: number, minimum: 1, maximum: 100, default: 10}; page: {type: number, minimum: 1}.
• Add dry-run or confirmation step for create_post and update_post. Implement pattern:confirmation-request: return {type: 'confirmation_required', preview: {...}} before executing, require explicit confirm parameter.