Two tools with complete input schemas and clear descriptions. Both follow verb_noun naming (generate_access_token, generate_id_token). Descriptions are concise (80-120 chars) and explain the action and GCP mechanism. All parameters have types and descriptions. However, output schemas are not documented in the source, and error handling guidance is absent. No tool annotations (readOnlyHint/destructiveHint) despite WRITE risk classification. Identity mapping logic is sophisticated but not surfaced in tool descriptions.

• Document output schemas for both tools. Specify: access_token (string), expires_in (integer, seconds), token_type (string, 'Bearer'), and any other fields returned by the IAM Credentials API.
• Add error handling guidance to descriptions. E.g., 'Returns error if service_account is invalid, caller lacks iam.serviceAccountKeys.create permission, or lifetime_seconds exceeds allowed range. Verify service account email format and caller IAM role.'
• Add tool annotations: mark both tools with destructiveHint=false (tokens are read-only credentials, not destructive) and idempotentHint=true (repeated calls with same params return same token, safe to retry).
• Clarify identity_mapping behavior in parameter descriptions. E.g., 'service_account parameter is used only if identity_mapping is Static; otherwise, the target is derived from caller identity (subject_id, roles, or template substitution).'
• Document lifetime_seconds range explicitly: 'Integer, 1 - 3600 seconds (1 hour default). Up to 43200 (12 hours) if allow_extended_lifetime is enabled in server config. Invalid values return a validation error.'

Inferred effective spec: <=2025-11-25.

• Relies on Logging (deprecated) - log to stderr or use OpenTelemetry