This Express backend exposes 27 tools via HTTP REST endpoints, but lacks MCP protocol integration entirely. Tools have basic descriptions (10-50 chars, well below the 194-char baseline) and input schemas are present but minimal. No output schemas documented. Critical gaps: no error recovery guidance, no tool annotations (readOnlyHint/destructiveHint), no pagination metadata in list responses, no idempotency markers. Tool names are verb-noun (good), but descriptions are generic and do not explain WHEN to use each tool or what happens on failure. Parameters lack format constraints and dependency documentation. Security concerns: passwords exposed as parameters, no audit trail visible, no permission gates in tool definitions.

• Remove password parameters from register, login, and addPartner. Implement server-side authentication via JWT tokens or OAuth. Return tokens in responses, not passwords in requests.
• Document output schemas for all 27 tools. Specify which fields are returned, their types, and which IDs/references downstream tools need. Example: register should return {user_id, token, role} so updateProfile can accept user_id.
• Expand descriptions to 50-200 chars. Include WHEN to use each tool and what happens on failure. Example: 'Get all Pickup Partners assigned to this MCP. Returns partner list with active status and commission rates. Use before assigning orders to check availability.'
• Add tool annotations: mark read-only tools (getProfile, getOrders) with readOnlyHint=true; mark destructive tools (deletePartner, withdrawFunds) with destructiveHint=true; mark idempotent tools with idempotentHint=true.
• Add pagination metadata to list responses: include total_count, page, limit, and has_next_page. Cap results at 20-50 items per page. Document in tool descriptions: 'Returns max 20 partners per page. Use page parameter to iterate.'