Critical failures across all dimensions. Tool names lack action verbs (buy-stock, sell-stock use hyphens instead of verb_noun convention). Descriptions are present but generic and lack context on irreversibility, prerequisites, or recovery guidance. Input schemas exist but parameters lack descriptions entirely, 'stock' and 'qty' have no guidance on format, range, or constraints. No output schema documentation. Error handling is absent; placeOrder() silently catches exceptions without returning actionable feedback. The server exposes real financial operations (BUY/SELL orders) without confirmation, dry-run, or permission gates. Credentials hardcoded in trade.ts (apiKey, accessToken) violate secret-injection pattern. No pagination, no structured output beyond plain text, no error classification.

• Move apiKey and accessToken to environment variables (process.env.ZERODHA_API_KEY, process.env.ZERODHA_ACCESS_TOKEN). Never hardcode secrets in source.
• Add parameter descriptions: stock → 'Stock symbol (e.g., AAPL, INFY). Must be a valid NSE/BSE ticker.'; qty → 'Number of shares to buy/sell (positive integer, 1 - 10000).'
• Implement confirmation pattern for buy-stock and sell-stock: return a confirmation_required error with order details, requiring the agent to call a confirm_order(order_id) tool before execution.
• Wrap placeOrder() errors in structured responses: return {success: false, error: 'Invalid symbol INVALID_STOCK', recovery: 'Call show-portfolio to see valid holdings'} instead of silent console.error().
• Rename tools to verb_noun convention: buy-stock → buy_stock, sell-stock → sell_stock, show-portfolio → get_portfolio. Add descriptions explaining when to use each (e.g., 'Call get_portfolio first to see current holdings before placing orders').