Two tools with clear naming (get_identity, authenticate) and reasonable descriptions (120-180 chars). Both have input schemas with Zod validation. However, output schemas are undocumented, responses are wrapped in a generic text() helper with no declared structure. Parameter descriptions are present but minimal. Error handling exists but lacks recovery guidance. No tool annotations (readOnlyHint/destructiveHint). Missing idempotency guidance for authenticate tool, which performs external HTTP POST (side effect).

• Document output schemas explicitly. Define the structure of text() responses: e.g. for get_identity, return {identity: string, network: string, scheme: string, note: string}. For authenticate, return {authenticated: boolean, identity: string, callbackUrl: string, httpStatus: number, serviceReply: object}.
• Add tool annotations: mark get_identity with readOnlyHint=true; mark authenticate with destructiveHint=true (external side effect) and idempotentHint=false (POST is not idempotent).
• Enhance error messages with recovery guidance. E.g. 'Not a Digi-ID challenge, expected digiid://... URI. Check the service issued a valid challenge.' For callback failures: 'Callback POST to {url} failed: {error}. Verify the service is reachable and accepts JSON.'
• Clarify the 'post' parameter: 'If true (default), POST the signed response to the service callback and return the service reply. If false, return only the signature without posting, useful for testing or manual callback.'
• Add idempotency guidance: 'Calling authenticate twice with the same URI will POST twice. Services should deduplicate by nonce or timestamp to prevent double-authentication.'