Spoor-sift provides 12 forensic tools with consistent naming (verb_noun pattern: vol_*, tsk_*, regripper_run, hash_file, yara_scan, log2timeline_run, psort_query) and descriptions (avg ~120 chars). All tools have input schemas with type definitions and parameter descriptions. However, output schemas are not documented, LLMs cannot predict return structure. Error handling returns structured dicts with hints but lacks categorization (retryable vs fatal). No tool annotations (readOnlyHint/destructiveHint) despite clear risk profiles. Parameter descriptions are adequate but lack format constraints (e.g., vol_netscan state param has no enum). Missing pagination guidance for tools that cap results server-side.

• Document output schemas for all tools. Specify return fields, types, and structure. Example: vol_pslist returns {processes: [{pid, name, ppid, ...}], total_count: int}.
• Add tool annotations to MCP tool definitions. Use readOnlyHint=true for evidence-only tools (vol_*, tsk_fls, hash_file, yara_scan, psort_query) and destructiveHint=true for workspace-writing tools (tsk_icat, log2timeline_run).
• Constrain free-form parameters with enums or patterns. vol_netscan state should be enum [ESTABLISHED, LISTEN, TIME_WAIT, ...]. regripper_run plugin should list valid plugin names or link to documentation.
• Classify errors in responses. Add error_type field: 'retryable' (transient), 'user_fixable' (bad args), or 'fatal' (permission denied). Include actionable recovery hints.
• Document pagination behavior. For tools that cap results, state: 'Results capped at 300. If truncated, use offset parameter to fetch next batch.' Provide total_count in response.