Single tool 'mcp_query' has critical definition gaps. Tool name lacks action verb (should be 'execute_query' or 'query_database'). Description is present but generic (97 chars, below 194-char baseline). Input schema exists but lacks parameter descriptions, 'query' param has no guidance on format, length, or constraints. No output schema documented. No error handling guidance. Tool performs LLM-based SQL generation + execution, a high-risk operation combining two concerns (NL→SQL translation + query execution) without safety guardrails, confirmation steps, or destructive operation warnings.

• Rename tool to 'execute_query' or 'query_database' (verb_noun pattern). Update description to 50-200 chars explaining: WHAT (executes SQL against PostgreSQL), WHEN (after user approves generated SQL), WHAT IT RETURNS (result rows as JSON array).
• Add parameter description for 'query': 'Natural language question about the database (e.g., "How many users signed up last week?"). Server will convert to SQL and execute. Max 500 chars.'
• Document output schema: {"sql": string, "results": [{column_name: value, ...}], "row_count": number}. Include pagination guidance if result sets exceed 50 rows.
• Implement confirmation step: return generated SQL to user for approval before execution. Add a separate 'confirm_and_execute_query' tool or use MRTR (Multi Round-Trip Request) pattern with result.input_required.
• Use parameterized queries (psycopg2 with %s placeholders) to prevent SQL injection. Validate SQL syntax before execution. Inject DB credentials via vault/environment, never expose in responses. Add audit logging (who, what, when, result).