Server has 10 tools with clear action verbs and basic descriptions. All tools have input schemas with type definitions. However, descriptions are inconsistent in depth, some lack context on when to use them or what they return. Parameter descriptions are minimal (often just restating the parameter name). No output schemas documented. Error handling is absent from tool definitions. Security-sensitive tools (port_scan, http_probe) lack explicit permission/scope documentation in their schemas. Passive tools are well-named but active tools need clearer risk labeling in descriptions.

• Document output schemas for all tools. Use JSON Schema format in tool descriptions or a separate schema registry. Example: 'Returns {"subdomains": [string], "count": int, "source": string}'.
• Enhance parameter descriptions with format constraints and examples. E.g., 'domain (string, e.g. example.com): The target domain. Must be a valid FQDN without protocol prefix.'
• Add explicit scope/permission documentation to active tools. E.g., 'Requires OFFSEC_SCOPE to include the target host. Call scope_status() first to verify authorization.'
• Document error scenarios and recovery paths. E.g., 'May fail if NVD API is unreachable (retryable) or if cve_id format is invalid (user-fixable). Returns error_code and error_message.'
• Add min/max constraints to numeric parameters. E.g., 'ports (array of integers, 1 - 65535): List of ports to scan. Defaults to [22, 80, 443, 8080, 8443] if omitted.'