Each tool has a clearly distinct role: scan_domain initiates a scan, list_reports lists report metadata, get_report_summary provides a detailed summary, list_assets retrieves asset data, get_evidence pulls evidence, and list_vulnerabilities returns vulnerability data. There is no meaningful overlap between these operations.

All tool names follow a consistent snake_case verb_noun pattern: scan_domain, list_reports, get_report_summary, list_assets, get_evidence, list_vulnerabilities. The verb choice consistently indicates whether the tool creates or retrieves information.

Six tools is a well-scoped size for an attack surface management/recon server. Each tool maps to a distinct step in the workflow: scan, report listing, summary, asset enumeration, evidence retrieval, and vulnerability listing.

The core reconnaissance workflow is well covered: scan a domain, view reports, inspect summaries, list assets, retrieve evidence, and see vulnerabilities. Minor gaps exist around report lifecycle management, such as deleting or updating reports, but users can complete the primary investigation workflow without dead ends.