Single tool with minimal definition quality. Tool name 'run_snowflake_query' is generic and does not follow verb_noun pattern clearly (should be 'execute_query' or 'query_snowflake'). Description is adequate (58 chars) but lacks critical context: does not state that this tool modifies state (WRITE risk), has no error recovery guidance, and no output schema documentation. Input schema present but minimal, only 'query' string with basic description. No parameter validation, no pagination, no structured output format specified. Tool accepts raw SQL without sanitization, creating SQL injection risk. No mention of permissions, rate limits, or audit logging.

• Add SQL validation: parse query to reject DDL/DML on protected tables, or require explicit confirmation for destructive operations (pattern:confirmation-request).
• Document output schema: return structured JSON with {success: bool, rows: [], column_names: [], row_count: int, execution_time_ms: int} instead of str(result).
• Classify errors: return {error_type: 'retryable'|'user_fixable'|'fatal', message: '...', suggestion: '...'} so LLM knows whether to retry, ask user, or abort.
• Add rate limiting and per-user audit logging: track who executed what query, when, and with what result for compliance and incident response.
• Rename tool to 'execute_snowflake_query' and enhance description to state: 'Executes a SQL query (SELECT, INSERT, UPDATE, DELETE). Modifies state. Requires read/write permissions. Returns structured result with row count and column names.'