Wallet MCP has critical definition gaps across all dimensions. Tool names lack clear action verbs (getTransactions, getBalance are acceptable but inconsistent with listBuffers/closeBuffer). Descriptions are minimal (10-50 chars, well below the 194-char baseline) and lack context on when to use each tool. Parameter descriptions are sparse or missing entirely. Most critically, the server exposes private keys as array-of-numbers parameters (listBuffers, closeBuffer), a severe security violation. Input schemas are present but descriptions are inadequate. No output schemas documented. Error handling is minimal. The closeBuffer tool is destructive but lacks confirmation or dry-run patterns.

• Move private key handling to server-side secret injection. Accept a 'payer_name' or 'payer_id' parameter instead, resolve to keypair internally via environment or vault. Never expose secrets as tool parameters.
• Expand all tool descriptions to 100-200 characters. Include WHAT (action), WHEN (use case), and any prerequisites. E.g., 'Retrieve transaction history for a Solana wallet. Useful for auditing activity or finding a specific transaction. Requires a valid wallet address.'
• Add descriptions to all parameters. For 'limit', specify range (e.g., '1-100, default 10'). For 'payerKey', explain encoding if it must remain a parameter (though it should not).
• Document output schemas for each tool. Define the structure of returned objects (e.g., transactions array with signature, slot, blockTime fields). Use JSON Schema or TypeScript interfaces in comments.
• Add a dry-run or confirmation step to closeBuffer. Return a confirmation token that must be passed in a second call, or add a 'confirm=true' parameter that defaults to false. Prevents accidental buffer closure.