14 tools with mixed quality. All have descriptions (10-200 chars, mostly adequate), but input schemas lack critical details: no enums for constrained fields (e.g., 'direction' in assemble_context accepts 'outbound'/'inbound'/'bidirectional' but no enum), no min/max bounds on numeric params (depth, max_chars unbounded), no format specs for connection strings. Parameter descriptions are present but generic ('Path to...', 'Database connection string'). Output schemas are not documented anywhere in the code. Error handling is absent, no recovery guidance, no categorization. Tools like harvest_* expose api_key as a parameter (security violation). No tool annotations (readOnlyHint/destructiveHint). Naming is verb-first and clear (parse_, validate_, harvest_, merge_, etc.), which is a strength. Composition is reasonable, tools are single-purpose. However, lack of schema rigor, missing output documentation, and credential exposure in parameters are major gaps.

• Move all api_key, Gemini API key, and OKF Hub API Key parameters to server-side environment variables or vault injection. Remove from tool signatures entirely.
• Document output schema for every tool. Specify return type (object/array), field names, types, and descriptions. Example: 'parse_bundle returns {bundle_id: string, concepts: [{id: string, title: string, description: string}], links: [{source: string, target: string}]}'.
• Add enum constraints to direction, strategy, driver, format, and ai_model parameters. Use JSON Schema enum field, not free-form strings.
• Add min/max bounds to numeric parameters: depth (1-10), max_chars (100-1000000), port (1-65535), crawl depth (1-5).
• Add tool annotations: mark harvest_* and merge_bundles as destructiveHint=true (they write files); mark parse_, validate_, assemble_, diff_, lint_ as readOnlyHint=true.