Single tool 'generate_chart' has critical definition gaps. Tool name lacks action verb clarity (should be 'create_chart' or 'render_chart'). Description is present but minimal (18 chars, below 20-char threshold). Input schema exists with 'code' parameter but lacks type validation, format constraints, or error guidance. No output schema documented. No parameter description for 'code' input. Tool executes arbitrary Python code (WRITE risk) with no validation, sanitization, or permission checks. No error handling guidance for LLM recovery.

• Rename tool to 'create_chart' and update description to 50-150 chars: 'Generate a chart image by executing provided Python code. Returns image URL and metadata. Supports matplotlib, seaborn, plotly.'
• Add parameter description for 'code': 'Python code snippet (max 5000 chars) using matplotlib/seaborn. Must define a figure and call plt.show() or equivalent. No imports of os, sys, subprocess, or file I/O allowed.'
• Document output schema: {image_url: string (URL), chart_id: string, created_at: ISO8601, error?: string}
• Implement input validation: reject code containing 'import os', 'import sys', 'open(', 'exec(', '__import__'. Return actionable error: 'Code contains forbidden imports. Allowed: matplotlib, seaborn, plotly, numpy, pandas.'
• Add timeout (e.g., 10s) and resource limits (memory, CPU). Return timeout error with retry guidance: 'Code execution exceeded 10s limit. Simplify visualization or reduce data size.'

Inferred effective spec: <=2025-11-25.

• Relies on Logging (deprecated) - log to stderr or use OpenTelemetry