Four tools with complete input schemas and descriptions, but significant gaps in output documentation and error guidance. Tool names follow verb_noun pattern (nmap_scan, gobuster_scan, nuclei_scan, nikto_scan) which is good. Descriptions are present (60-90 chars) but lack context on when to use each tool vs. alternatives, prerequisites, or what the structured JSON output contains. Parameters have types and descriptions, but no guidance on output schema structure. Error handling is minimal, no recovery guidance or actionable error messages visible in code. Scope enforcement is well-implemented (audit logging, CIDR matching) but not exposed to LLM as tool annotations or error context.

• Document the output schema for each tool. Example: 'nmap_scan returns {"host": string, "status": string, "ports": [{"port": int, "state": string, "service": string}]}'. This enables LLMs to extract and chain results.
• Add tool-specific context to descriptions. Distinguish nmap (port discovery) from gobuster (web enumeration) from nuclei (vulnerability detection) from nikto (web server audit). Help LLMs select the right tool for the task.
• Implement structured error responses with recovery guidance. Instead of raising ValueError, return {"error": "Target out of scope", "hint": "Update config.yaml scope.targets or verify the target is correct", "retryable": false}.
• Add readOnlyHint: true to all four tool definitions to signal that these are safe, non-destructive reconnaissance operations. This enables clients to optimize execution and logging.
• Document parameter defaults explicitly. For nuclei severity, state 'If omitted, runs all severity levels.' For nikto port, state 'If omitted, scans default HTTP/HTTPS ports (80, 443, 8080, 8443).'