OpenCTI MCP server has 16 tools with complete input schemas and basic descriptions, but critical gaps undermine quality. All descriptions are in Chinese (non-English), which violates LLM optimization baselines. Descriptions average ~25 chars, well below the 194-char baseline for A+ tools. No output schemas documented. Parameter descriptions are minimal (e.g., 'search keyword' for query param). No error handling guidance, no recovery paths, no actionable error messages. Tools lack composition guidance, no chaining IDs returned, no pagination metadata. Security: OPENCTI_TOKEN exposed in Dockerfile ENV example (hardcoded placeholder). No tool annotations (readOnlyHint present in metadata but not in schema). Naming is verb-noun compliant (get_, search_, list_) but descriptions do not explain WHEN to use each tool or what distinguishes similar tools (e.g., search_indicators vs search_malware vs search_threat_actors).

• Translate all tool descriptions to English and expand to 50-200 characters. Example: 'get_latest_reports' → 'Retrieve the most recent OpenCTI threat intelligence reports. Use this to stay updated on latest threat activity and indicators. Returns report metadata including creation date, description, and associated indicators.'
• Document output schemas for all tools. Add a 'outputSchema' field to each tool definition showing the structure of returned data (e.g., array of objects with id, name, description, created_at fields).
• Add pagination support to all list_* tools: accept 'limit' (default 20, max 100) and 'offset' (default 0) parameters. Return total_count and next_offset in responses to enable multi-page iteration.
• Wrap all tool implementations in try-catch blocks. Return structured error responses: {error: 'InvalidInput', message: 'Query must be 1-100 chars', suggestion: 'Try a shorter search term'}. Include recovery guidance for each error type.
• Remove hardcoded credentials from Dockerfile. Use only environment variable references (ENV OPENCTI_TOKEN=${OPENCTI_TOKEN}) and document in README that users must set these at runtime.