An MCP server to interact with cPanel via API functions to manage email accounts
This server has 9 tools with basic schemas and descriptions, but falls significantly short of production quality. Tool names follow verb_noun convention (add_email_account, delete_email_account, etc.), which is good. However, descriptions are thin (most are 20-50 chars), lacking critical details about when to use each tool, prerequisites, and output structure. Parameter descriptions exist but are generic and repetitive (e.g., 'The full email address for which to send client settings' appears 5 times verbatim, which is copied-paste evidence). No output schemas are documented, making it impossible for LLMs to plan downstream calls. Error handling is absent, no recovery guidance, no categorization of retryable vs fatal errors. Security concerns: password parameters are accepted as plain tool inputs rather than via secret injection. The server's tool interface does not match the chat data model, it requires explicit domain parameters for list operations rather than deriving context from prior calls. Schemas have types and basic structure, preventing the score from falling below 50, but lack depth needed for safe agent use.
Add a new email account.
Changes the password for a given email account.
Create an email forwarder.
Delete an email account from domain.
Delete an email forwarder.
Retrieves the settings for a given email account.
Lists all email accounts for a specific domain.
No output schemas documented for any tool. LLMs cannot plan multi-step flows, extract IDs for chaining, or validate responses. Per pattern:tool, all tool outputs must be documented.
Passwords exposed as plain tool parameters. Per pattern:secret-injection, all credentials must be server-side injected via environment variables or vault, never as parameter inputs. Current design risks credential leakage in agent traces and prompt logs.
List tools (list_email_accounts, list_email_forwarders) lack pagination support (limit, offset, cursor) and no result-count documentation. Per pattern:paginated-result, all list tools must support pagination to prevent context window exhaustion.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | F | 49 | 2026-07-28+ | v2 |
| 2026-03-09 | F | 48 | - | v1 |
List email forwarders.
Changes the quota for a given email account.
Descriptions are generic and too brief (most 20-50 chars, baseline 194 chars). Copy-paste descriptions across tools ('The full email address for which to send client settings' appears 5 times verbatim, including in get_email_settings where it says 'send' not 'get'). Per pattern:tool-description, every description must be specific, 10-1024 chars, and guide LLM selection.
No error handling guidance. Per pattern:recovery-guide, errors must tell the LLM what to do next (retryable? user-fixable? fatal?). Current implementation provides no categorization, recovery hints, or actionable error messages.
Destructive operations (delete_email_account, delete_email_forwarder) lack confirmation or dry-run pattern. Per pattern:confirmation-request, irreversible operations must offer a confirmation step to prevent accidental data loss by agents.
Ambiguous and overly generic parameter descriptions. E.g., get_email_settings param description says 'for which to send client settings' (wrong verb). add_email_account quota description lacks units confirmation, range, or default behavior. Per pattern:tool-description, every parameter needs a clear, actionable description.
Typo in update_quota parameter description: 'acount' instead of 'account'. Typos undermine credibility and may confuse LLMs.