Server has 9 well-named tools with complete input schemas and descriptions. All tools follow verb_noun naming (search_logs, list_streams, get_stream_info). Schemas are properly typed with constraints (enums, min/max). However, output schemas are not documented, LLMs cannot predict response structure. Error handling is minimal; no recovery guidance or actionable error messages. Parameter descriptions are adequate but lack dependency hints and format guidance. No tool annotations (readOnlyHint, etc.) despite all tools being read-only. Missing documentation of what fields are returned and how to chain tools.

• Document output schemas for all tools. E.g., search_logs returns {messages: [{timestamp, source, level, message, ...}], total: int, took_ms: int}. This enables LLMs to extract fields and chain tools.
• Add readOnlyHint: true to all tool definitions via mcp.tool() decorator or schema metadata. Agents need to know these tools are safe to retry.
• Enhance error messages with recovery guidance. E.g., 'Invalid stream_id: "xyz" not found. Call list_streams() to see available streams.' instead of bare 404.
• Add format and constraint guidance to parameter descriptions. E.g., 'timerange: Use RelativeTimeRange {value: 1-365, unit: s|m|h|d|w} for recent logs, AbsoluteTimeRange {from, to} for specific date ranges.'
• Document result limits and pagination. E.g., 'search_logs returns up to 1000 results; use offset for pagination. list_streams returns all streams; consider adding a limit parameter if Graylog instances have >100 streams.'

Inferred effective spec: <=2025-11-25.

• Relies on Logging (deprecated) - log to stderr or use OpenTelemetry