Server defines 7 tools with explicit schemas and descriptions visible in src/index.ts. All tools have non-empty descriptions (range 60-180 chars) and input schemas with typed properties. However, critical gaps limit production readiness: (1) Tool names lack action verbs, 'subfinder', 'dnsx', 'naabu', 'httpx', 'katana', 'nuclei' are tool names, not verb_noun patterns like 'discover_subdomains', 'resolve_dns'. LLMs struggle to infer intent from bare tool names. (2) Parameter descriptions are minimal (10-40 chars) and lack constraints, ranges, or format guidance. E.g., 'ports' param has no example format or validation rules. (3) No output schemas documented, LLMs cannot predict response structure or plan downstream calls. (4) No error handling guidance, tools return raw command output without recovery hints. (5) 'bug_bounty_workflow' combines 6 distinct operations (subdomain discovery, DNS, port scan, HTTP probe, crawl, vulnerability scan) into one tool, violating single-responsibility principle. Average tool description length ~110 chars (below 194-char baseline); parameter descriptions average ~25 chars (well below 72-char baseline).

• Rename tools to verb_noun pattern: 'subfinder' → 'discover_subdomains', 'dnsx' → 'resolve_dns', 'naabu' → 'scan_ports', 'httpx' → 'probe_http', 'katana' → 'crawl_web', 'nuclei' → 'scan_vulnerabilities'. This enables LLMs to infer intent from names alone.
• Add output schema documentation for each tool. Document the response structure (e.g., subfinder returns {subdomains: string[], count: number}, dnsx returns {results: {domain: string, records: {type: string, value: string}[]}[]}). This enables downstream tool chaining.
• Expand parameter descriptions with format constraints and enums. E.g., recordType should be enum: ['A', 'AAAA', 'CNAME', 'MX', 'NS', 'TXT', 'SOA']. Ports param should clarify format: 'Comma-separated ports (e.g., 80,443) or range (e.g., 1-1000)'.
• Split bug_bounty_workflow into composable steps or add per-step error handling and result filtering. If keeping as single tool, document which sub-operations can fail independently and how partial results are returned.
• Add error handling guidance to all tools. Document common failure modes (e.g., 'Domain not found', 'Network timeout', 'Invalid port range') and recovery hints (e.g., 'Verify domain is valid and reachable', 'Retry with smaller port range'). Categorize errors as retryable or user-fixable.