Single tool 'azure_cli' has a basic description but critical gaps in schema documentation, parameter descriptions, and error handling. The tool accepts arbitrary shell commands, creating injection risks. Input schema visible in code shows 'command' (string) and 'timeout' (integer, default 60), but parameter descriptions are minimal. No output schema documented. Error responses are JSON-wrapped but lack actionable recovery guidance. Tool does one thing (run CLI) but exposes dangerous surface area without input validation or security guardrails.

• Add an allowlist of permitted Azure CLI command prefixes (e.g., 'az vm', 'az storage', 'az account') and reject commands outside the list. Validate command structure before subprocess execution.
• Document output schema explicitly: define the structure of success responses (e.g., {status: 'success', output: string, duration_ms: number}) and error responses (e.g., {status: 'error', error_code: string, message: string, recovery_hint: string}).
• Expand parameter descriptions: 'command' should specify 'Azure CLI command (e.g., vm list, storage account show). Supported categories: compute, storage, networking, security. Do not include shell metacharacters or pipes.' Add enum or pattern constraint.
• Enhance error messages with recovery hints: 'Timeout after 60s. Try: (1) increase timeout parameter, (2) use --query to filter results, (3) check if resource exists with a list command first.'
• Refactor token management to be stateless: pass token/session info in request _meta or accept an optional 'auth_token' parameter. Remove global TOKEN_EXPIRES_AT and ensure each call is independent.