Zerodha MCP has significant structural weaknesses. While all 8 tools have basic descriptions and most have input schemas, the quality is inconsistent. Tool naming follows verb-noun conventions (good), but descriptions are generic and lack depth. Parameter descriptions are minimal or absent, schemas lack enums and constraints, and there is no structured error guidance. The authentication flow tools (initiate_login, get_request_token) expose concerning patterns, they operate on mutable global state (_request_token) and lack idempotency guarantees. Financial tools (place_order) accept critical parameters like price and trigger_price as optional, creating ambiguity about when they're required. Output schemas are entirely undocumented, LLMs cannot predict what fields to expect from responses. Security is problematic: credentials are managed via environment variables (acceptable) but the server exposes an unprotected FastAPI endpoint for auth callbacks. Overall, this reads as a proof-of-concept rather than production-grade tooling.

• Add formal enum constraints to place_order's product, order_type, and transaction_type parameters. Document conditional requirements (e.g., 'price is required if order_type is LIMIT or SL-M').
• Document output schemas for all tools. Example for get_holdings: returns {holdings: [{tradingsymbol: string, quantity: int, price: number, unrealised_value: number}]}. Include field descriptions so LLMs can extract and chain data.
• Refactor initiate_login and get_request_token to be stateless. Store request tokens in a request-scoped context or session store tied to a unique session ID, not global _request_token. This enables concurrent login flows.
• Expand tool descriptions to clarify when to use each. For example, 'get_holdings returns your long-term portfolio (settlement-based); get_positions returns intraday open positions (margin-based).'
• Add error recovery guidance. Return structured errors: {error: 'invalid_order_type', code: 'E4002', message: 'order_type must be one of: MARKET, LIMIT, SL, SL-M', retryable: false}. Guide LLM: 'Choose a valid order_type and retry.'
• Secure the auth callback: validate a state parameter passed in initiate_login, check Referer header, apply rate limits to prevent brute-force token harvesting.
• Add pagination to get_quote: accept a limit parameter (default 20, max 100) and return a cursor for paginated requests. Document the limit in the tool description.
• Add interval descriptions to get_historical_data: 'minute = 1-minute candles, daily = end-of-day candles, etc. Default: daily.'