Three tools with clear names and reasonable descriptions, but significant gaps in schema completeness and parameter documentation. gdpr_audit and gdpr_export_report have input schemas visible, but gdpr_get_capabilities lacks parameter descriptions. Output schemas are not documented. Error handling is minimal, gdpr_export_report returns a dict with an 'error' key but provides no recovery guidance. No tool annotations (readOnlyHint/destructiveHint) despite clear risk profiles. Descriptions are adequate (100-200 chars) but lack dependency hints and prerequisites.

• Document output schemas for all three tools. For gdpr_audit, specify the structure of the returned dict (url, score, findings array with check_id/title/severity/evidence/confidence fields, passed_checks array). For gdpr_export_report, document the success response structure (written, format keys).
• Add enum constraint to gdpr_export_report 'format' parameter instead of free-form string. Change schema from {"type": "string", "description": "..."} to {"type": "string", "enum": ["json", "markdown", "html"], "description": "Output format"}.
• Enhance error responses with actionable recovery hints. When gdpr_export_report finds no audit, return {"error": "No audit found for {url}. Call gdpr_audit(url) first to generate a report."} instead of a bare error message.
• Add tool annotations to the MCP server registration. Mark gdpr_audit and gdpr_get_capabilities with readOnlyHint=true; mark gdpr_export_report with destructiveHint=true (writes to filesystem).
• Add parameter descriptions to gdpr_get_capabilities input schema (currently empty). Clarify that it takes no parameters and returns capability metadata including version, supported checks, and limitations.