12 tools with consistent verb-noun naming (get_*, watch_*) and complete input schemas. All parameters have type definitions and descriptions. However, tool descriptions are terse (avg ~40 chars, well below the 194-char baseline), lacking WHEN/WHY context and recovery guidance. Output schemas are not documented, LLMs cannot predict response structure for chaining. No error handling guidance. Missing idempotency hints for watch_process. No pagination support despite max_events=200000 parameter suggesting large result sets.

• Expand tool descriptions to 50 - 200 chars. Add WHEN/WHY context: 'Call get_status first to verify Sysmon is running and Event Log is accessible. Returns operational status and event count. Prerequisite for all other tools.'
• Document output schemas in tool definitions. E.g., get_recent_events returns {events: [{time_created, record_id, event_id, event_type, process_id, image, command_line, fields, ...}], total_count, next_offset}. Include field types and meanings.
• Add error handling guidance to descriptions. E.g., 'If watch_process times out, retry with a shorter duration. If PID not found, use get_recent_events to discover active processes.'
• Implement pagination: add offset/limit params, return total_count and next_offset. Cap default results at 100 (not 200,000). Document in description: 'Returns up to 100 events by default; use offset to paginate.'
• Add idempotency hints to watch_process: 'Each call creates a new watch session. To retrieve results without re-watching, use get_watch_result(watch_id). Idempotent: safe to retry.'