Agentic Armor defines 8 tools with clear action verbs (task_create, task_exec, task_upload, task_download, task_list, task_stop, task_delete, task_logs). Tool descriptions are present and substantive (100-150 chars), explaining WHAT each tool does and WHEN to use it. However, critical parameter descriptions are missing or incomplete. The task_create schema shown includes descriptions for taskId, name, owner, image, blockNpmScripts, and network, good coverage. But task_exec, task_upload, task_download, task_stop, task_delete, and task_logs schemas are not visible in the provided source; only their names and brief descriptions appear. Output schemas are not documented. Error handling is present (ArmorError, ArmorResult types) but recovery guidance is not visible in the code excerpt. Audit logging via tombstones is a strong security pattern, but not reflected in tool descriptions.

• Publish complete input and output schemas for all 8 tools. For task_exec, document parameters like command, timeout, user, workdir, and return fields like exit_code, stdout, stderr. For task_list, add limit (default 20, max 100), offset, and return total_count.
• Add parameter descriptions to all tools. E.g., task_exec's 'command' param should state: 'Shell command to execute inside the container (bash syntax). Max 10000 chars. Timeout enforced per tool config.'
• Document output schemas in tool descriptions. E.g., 'Returns {task_id, status, created_at, container_id, exit_code, stdout, stderr}' so LLMs know what fields to expect.
• Add recovery guidance to error responses. E.g., 'Container image not found. Available images: [list]. Try task_create with a valid image name.' Implement per pattern:recovery-guide.
• Implement confirmation pattern for task_delete and task_stop. Add a 'confirm' boolean parameter (default false) or a separate 'confirm_task_delete' tool that requires explicit approval before destruction.

Inferred effective spec: <=2025-11-25.

• Relies on Logging (deprecated) - log to stderr or use OpenTelemetry