Two authentication tools with clear, detailed descriptions (194 - 250 chars each) and proper Zod schemas. Both tools have input parameters with type definitions and descriptions. Tool annotations present (readOnlyHint, openWorldHint). However, output schemas are not formally documented in the code, responses are constructed ad-hoc via toToolResult() helper without a declared return type schema. Error handling is present but generic (errorResult wrapper). No pagination, no batch operations, and no guidance on error recovery paths. The login tool's 120-second timeout is hardcoded without user visibility. Overall solid for a narrow auth domain but lacks production-grade schema documentation and error recovery patterns.

• Document output schemas explicitly. Define return types for both login (success: {signed_in: boolean, message?: string, authorize_url?: string, next?: string}, error: {error: string, code: string}) and submit_code (success: {signed_in: true, message: string}, error: {error: string, code: string}).
• Enhance error messages with recovery guidance. E.g., submit_code error: 'No pending login found. Call login() first to start the sign-in flow.' instead of bare error.
• Document timeout behavior in login description: 'Waits up to 120 seconds for browser approval. If timeout occurs, call login(oob=true) to use copy-paste flow instead.'
• Add idempotency note to both tools: 'Safe to retry. Calling login() multiple times overwrites any previous pending session. Calling submit_code() with the same code is idempotent.'
• Replace module-level pending state with request-scoped storage (e.g., Map keyed by session ID or user context) to support concurrent agent invocations and multi-user deployments.