docs: clarify Xquik tool runtime surface

Author: kriptoburak

mcp-registry/servers/xquik.json

@@ -49,13 +49,13 @@
   "tools": [
     {
       "name": "explore",
-      "description": "Search the Xquik API catalog before making live API calls. Runs against an in-memory catalog only, does not make network calls, and is limited by a 60 second execution timeout.",
+      "description": "Search the Xquik API catalog before making live API calls. Runs against an in-memory catalog only, does not make network calls, and is limited by a 60 second execution timeout. Runtime surface: standard JavaScript built-ins plus read-only spec.endpoints.",
       "inputSchema": {
         "type": "object",
         "properties": {
           "code": {
             "type": "string",
-            "description": "JavaScript async arrow function for inputSchema.properties.code that filters the Xquik endpoint catalog. No filesystem, process, credential, or outbound network access is available."
+            "description": "JavaScript async arrow function for inputSchema.properties.code that filters the Xquik endpoint catalog. Available globals are standard JavaScript built-ins and spec.endpoints. No filesystem, process, import, credential, fetch, or outbound network access is available."
           }
         },
         "required": [
@@ -65,13 +65,13 @@
     },
     {
       "name": "xquik",
-      "description": "Execute authenticated Xquik API calls for X/Twitter data, publishing, monitors, events, webhooks, and account workflows. Runs in a restricted server-side sandbox with a 60 second execution timeout.",
+      "description": "Execute authenticated Xquik API calls for X/Twitter data, publishing, monitors, events, webhooks, and account workflows. Runs in a restricted server-side JavaScript runtime with a 60 second execution timeout. Runtime surface: standard JavaScript built-ins, spec.endpoints, and xquik.request.",
       "inputSchema": {
         "type": "object",
         "properties": {
           "code": {
             "type": "string",
-            "description": "JavaScript async arrow function for inputSchema.properties.code that calls xquik.request(path, options). Authentication is injected by the server; code cannot read credentials, access the filesystem or process, or call arbitrary network hosts."
+            "description": "JavaScript async arrow function for inputSchema.properties.code that calls xquik.request(path, options). Authentication is injected by the server. Available globals are standard JavaScript built-ins, spec.endpoints, and xquik.request. Code cannot read credentials, access the filesystem or process, import modules, call fetch, or call arbitrary network hosts."
           }
         },
         "required": [