Single tool 'vaultwarden_maintenance' has a lengthy description (280+ chars) but critical structural defects. Input schema uses generic 'action' string enum and 'params_json' free-form string instead of typed, documented parameters. No output schema documented. Parameters lack individual descriptions explaining what each action does or what params_json should contain. Tool combines 5 distinct operations (plan_deduplication, apply_deduplication, rotate_password, generate_password, ingest_metadata) into one, violating single-responsibility principle. Destructive operations (apply_deduplication, rotate_password) require confirmation but no confirmation mechanism is visible in the schema. No error handling guidance for LLMs.

• Split vaultwarden_maintenance into 5 separate tools: plan_deduplication (returns plan with item_ids), apply_deduplication (requires confirm: true, returns applied_count), rotate_password (requires confirm: true, returns rotated_count), generate_password (returns password string), ingest_metadata (returns ingestion_status). Each tool should have a single, clear responsibility.
• Replace 'params_json' string with typed parameters specific to each action. E.g., apply_deduplication should have: plan_id (string), confirm (boolean, required). rotate_password should have: item_id (string), confirm (boolean, required). Document each parameter with description, type, and constraints.
• Document output schema for each tool. E.g., apply_deduplication returns {applied_count: integer, failed_count: integer, error_details: []}. rotate_password returns {rotated_count: integer, failed_items: []}. Include field descriptions.
• Add error handling guidance. E.g., 'If confirm is false, returns error: "Confirmation required. Set confirm=true to proceed." If plan is loose, returns error: "Loose deduplication plan rejected. Call plan_deduplication first to validate."'
• Implement confirmation_request pattern: add a dry_run parameter (default false) to destructive operations. When dry_run=true, return what would happen without executing. When dry_run=false and confirm=true, execute and return results.