Static source inference · medium confidence · detected: Logging
Deprecated protocol patterns detected
Summary
The server provides 13 tools with generally clear names and solid descriptions. Most tools have complete input schemas with typed parameters and descriptions. However, there are gaps in output schema documentation, limited error handling guidance, and some parameter descriptions lack specificity around constraints and formats. The tools follow verb_noun conventions well (get_*, list_*, update_*, add_*), and descriptions are in the 50-200 char range typical of good tools. All 13 tools are explicitly registered with schemas. Main weaknesses: (1) output schemas are not documented for any tool, LLMs cannot predict what fields to extract; (2) error handling lacks recovery guidance; (3) some parameter descriptions omit constraints (e.g., 'max_pages must be at least 1' is stated but not formally constrained); (4) no pagination limits are enforced or documented in output; (5) no tool annotations (readOnlyHint, destructiveHint, idempotentHint) despite having clear READ_ONLY and WRITE distinctions.
Tools (13)
add_commentwriteauthsource verified78/100
Post a comment on a runbook, optionally attached to a specific task.
get_action_logsread onlyauthsource verified77/100
Retrieve action logs (audit logs) from Cutover. Paginates through results up to max_pages.
get_activitiesread onlyauthsource verified75/100
Get activities for an incident runbook to track recent actions and events.
No output schemas documented. Tools define inputs clearly but do not document what fields/structure LLMs should expect in responses. This forces LLMs to guess at downstream field names and types, causing extraction errors and wasted discovery calls.
Missing tool annotations. Tools are clearly categorized as READ_ONLY or WRITE in metadata, but do not use MCP readOnlyHint, destructiveHint, or idempotentHint annotations. This prevents agents from understanding side-effect profiles and safety constraints.
Document output schemas for all 13 tools. Specify the structure of the response object, including field names, types, and whether they are arrays, objects, or primitives. Include examples of pagination fields (if present) and timestamps. This enables LLMs to extract correct fields downstream.
Add tool annotations to FastMCP tool definitions. Use @mcp.tool(description='...', hint={'readOnly': True}) for all READ_ONLY tools (12 tools), and @mcp.tool(..., hint={'destructive': True, 'idempotent': False}) for update_runbook to signal write/destructive intent. See FastMCP docs on hint parameter.
Add recovery guidance to error scenarios in tool descriptions. E.g., for get_runbook_by_id: 'If runbook_id is invalid, call list_runbooks() to find the correct ID. Returns error 403 if user lacks read access, request workspace access and retry.' For update_runbook: 'Invalid field values (e.g. status not in {off,red,amber,green}) return 400 with actionable error; fix and retry.'
Enforce and document pagination limits in output schemas. For tools like get_action_logs and list_runbooks, add 'returns an array of up to N items per page; response includes next_cursor for pagination' in description. Document actual response structure with fields like items[], total_count, next_cursor, or page_info{}.
Formalize parameter constraints in JSON Schema. Add 'minimum': 1, 'maximum': <reasonable limit> to max_pages. Use 'enum' for stage, completion_type, and status fields instead of informal 'Allowed: X, Y, Z' strings in descriptions. Use 'pattern' or 'format' for ISO 8601 dates and IANA timezone names.
Spec posture evidence
Inferred effective spec: <=2025-11-25.
Relies on Logging (deprecated) - log to stderr or use OpenTelemetry
Score history
Overall score trend
↑ 68 points across a rubric change (v1 → v2)
68/100
Scored
Grade
Overall
Spec posture
Rubric
2026-09-22
C
68
<=2025-11-25
v2
2026-03-09
F
0
-
v1
auth
source verified
75/100
Fetch details for a specific runbook type by its ID.
Error handling lacks recovery guidance. No tool description specifies what to do on failure, e.g., 'If runbook_id not found, try list_runbooks() first' or 'On permission denied, request access from workspace admin'. Errors are not categorized as retryable vs user-fixable.
Pagination not enforced or documented in output. Tools like get_action_logs accept max_pages but do not document how results are paginated in the response (e.g., does response include 'next_cursor' or 'total_count'?). Without output schema, LLMs cannot predict pagination fields.
Parameter constraints stated informally in descriptions rather than formally. E.g., get_action_logs says 'max_pages...must be at least 1' but does not specify a maximum. Constraints should be enumerated (for enums), use JSON Schema minimum/maximum (for numbers), or pattern/minLength/maxLength (for strings).
Some parameter descriptions lack actionable format guidance. E.g., 'created_after' accepts ISO 8601 date strings, but description does not state the exact format or examples. Similarly, 'timezone' accepts IANA names but does not explain what 'valid' means or how to discover them.
get_action_logsget_activitiesupdate_runbook
Add parameter examples or patterns for date/timezone discovery. E.g., for created_after: 'ISO 8601 format (e.g., 2025-01-01T00:00:00Z)'. For timezone: 'IANA timezone name (e.g., America/New_York, Europe/London), call get_timezones() to discover available zones (if available) or consult IANA database.'
Create a discovery tool or documentation endpoint (outside MCP scope but mentioned in instructions) to reveal custom field names, available task types, and valid status values dynamically. This reduces hard-coded enums in descriptions.
Consider batch operation variants for tools called in loops. E.g., a bulk_add_comments(runbook_id, [comment_objects]) to send multiple comments in one call rather than n sequential add_comment calls. This reduces token waste and latency.
Add dry-run or confirmation support to irreversible operations (update_runbook with destructive changes). Consider a pattern like 'To preview changes without applying, add "dry_run": true. Response will show calculated deltas without persisting.' Or require explicit 'confirm': true for high-impact updates.