Snuffles has 10 tools with basic descriptions and input schemas, but significant gaps limit production readiness. Tool names lack consistent verb-noun structure (e.g., 'snuffles.discover' vs 'snuffles.observe' vs 'snowball.contain'). Descriptions are present but brief (avg ~80 chars), lacking WHEN/WHY context and recovery guidance. Input schemas exist but are minimal, most parameters lack type constraints, enums, or validation rules. Output schemas are not documented in the source. Error handling is not visible. No tool annotations (readOnlyHint, destructiveHint, idempotentHint) despite clear risk levels. Parameter descriptions are sparse; e.g., 'severity' in snuffles.observe has no enum or valid values listed.

• Add explicit output schemas for all tools. Document return types, field names, and structure. Example: snuffles.discover should return {resources: [{id, name, type}], snapshot: {timestamp, status}}.
• Convert parameter descriptions to formal constraints. Replace 'severity (max 16 chars)' with enum: ['critical', 'high', 'medium', 'low']. Replace 'provider: cloudflare, telegram, or slack' with enum constraint in schema.
• Add tool annotations. Mark snuffles.test_integration and snowball.contain with destructiveHint: true. Mark snuffles.observe and snuffles.explain with readOnlyHint: true.
• Expand descriptions to 50-150 chars with WHEN/WHY context. Example: 'snuffles.observe' → 'Retrieve active signals and integrations. Call this first to understand the current monitoring state before planning containment actions.'
• Document error responses and recovery paths. Example: 'If provider is invalid, returns 400 with valid options. If integration is unreachable, returns 503 with retry guidance.'