Server has 6 tools with basic schemas and descriptions, but significant quality gaps. All tools have input schemas (Zod-validated) and descriptions present, but descriptions are generic (10-50 chars, well below the 194-char baseline). No output schemas documented. Critical security issue: credentials (passwords, connection strings, tokens) exposed as required parameters (queryMySQL password param, queryPostgres connectionString, getFileContent token). No error handling guidance, no parameter validation hints, no idempotency markers. Tool names are verb-noun but descriptions lack WHEN/WHY context. No pagination support for list-returning tools. Schemas use z.any() for outputs, providing zero guidance to LLMs about return structure.

• Move credentials to server-side injection: read DB_PASSWORD, POSTGRES_URI, SHAREPOINT_TOKEN from environment variables. Remove password, connectionString, and token from tool parameters. Document in tool description: 'Credentials configured server-side via environment variables.'
• Document output schemas explicitly. Replace z.any() with z.object({...}) or add outputSchema descriptions. E.g., queryMongo: 'Returns array of MongoDB documents, each with _id and query-matched fields.' fetchAPI: 'Returns parsed JSON object or plain text string depending on response content-type.'
• Expand all descriptions to 100-200 chars. Include WHEN to use, WHAT it returns, and any prerequisites. Example: 'Query a PostgreSQL database using SQL. Returns array of result rows. Use this to fetch data from PostgreSQL; requires valid connection string and SQL syntax.'
• Add parameter format hints in descriptions. E.g., filter param: 'MongoDB query filter as JSON object (e.g., {status: "active", age: {$gte: 18}}). Omit for no filter.' query param: 'SQL query string (e.g., SELECT * FROM users WHERE id = $1). Use parameterized queries to prevent SQL injection.'
• Implement error handling with recovery guidance. Catch connection errors, auth failures, and syntax errors. Return structured errors: {error: 'Connection failed', reason: 'Invalid URI format', suggestion: 'Verify URI matches mongodb+srv://user:pass@host/db'}. Add try-catch blocks in each utils/*.ts file.