Hi there,
I just have played around with the tooling API (32) and PHP (SOAP not REST).
In general it works well and gives us many more information than just a describe call.
Especially in regards of field level security it is worth to check it out.
While querying field definitions, over the tooling API I found, that for picklists no values are included in the response.
I used two different queries:

"Select Id, DeveloperName, NamespacePrefix, Metadata, TableEnumOrId From CustomField Where TableEnumOrId = 'Opportunity'";

and

"SELECT Id, DurableId, DeveloperName,Metadata,Label,MasterLabel,NamespacePrefix,QualifiedApiName FROM FieldDefinition WHERE ( EntityDefinitionId = 'Opportunity' )";

In both cases my respones object for the picklist fields looked as follows:

[10] => stdClass Object
(
    [Id] => 00N40000001OHOIEA4
    [DeveloperName] => Produkt
    [Metadata] => stdClass Object
    (
         [externalId] => 
         [label] => Produkt
         [picklist] => stdClass Object
         (
             [picklistValues] => Array
             (
                 [0] => stdClass Object
                 (
                     [default] => 
                  )
                  [1] => stdClass Object
                  (
                      [default] => 
                  )
                  [2] => stdClass Object
                  (
                      [default] => 
                  )
                  [3] => stdClass Object
                  (
                      [default] => 
                  )
             )
             [sorted] => 
          )
          [trackFeedHistory] => 
          [trackTrending] => 1
          [type] => Picklist
     )
     [TableEnumOrId] => Opportunity
)

I would have expected to get the Palues for the picklistValues Array.
Does anybody has an idea how to get the falues of picklists over the tooling API?