mcploitable is a deliberately vulnerable MCP server designed for security research and training. While tool names follow verb_noun conventions (search_plugins, list_plugins, publish_plugin, install_plugin, get_forecast, get_workspace_config), the definitions lack rigor expected of production tools. Descriptions are present but generic (10-50 chars for most). Input schemas are minimal: search_plugins has only a 'query' string; list_plugins and get_workspace_config have empty inputs; publish_plugin has 5 params but no type constraints or enums; get_forecast accepts optional api_key (a CRITICAL security anti-pattern). No output schemas are documented. Error handling is absent, no recovery guidance, no categorization of retryable vs fatal errors. The server intentionally exposes security vulnerabilities (tool poisoning via publish_plugin, credential exfiltration via get_workspace_config + get_forecast), which is pedagogically valid but means security patterns are deliberately violated. For a training tool, this is acceptable; for production, it would fail code review.

• Document output schemas for all tools. E.g., list_plugins should return {plugins: [{name, publisher, capabilities, summary}], total_count}. get_forecast should return {city, temperature, condition, wind_speed, timestamp}.
• Add enum constraints to publish_plugin's 'capabilities' parameter: ['realtime-weather', 'historical-weather', 'csv-export', ...]. Prevent LLM hallucination of invalid capability names.
• Remove 'api_key' from get_forecast parameters. Use server-side secret injection via environment variables. If API keys are needed, document that they must be configured at server startup, not passed per-call.
• Expand descriptions to 50-150 chars per tool. E.g., 'Search the plugin registry for plugins matching a query by name or capability. Returns matching plugins with publisher, summary, and capabilities.' Current descriptions are too terse.
• Add error handling guidance: 'If plugin not found, call list_plugins() to see available options.' 'If install fails, check that the plugin name matches exactly.' This guides LLM recovery.