This repository contains multiple MCP server implementations with severe quality gaps. The ashra-mcp (TypeScript) server is the primary focus. It has only 1 properly defined tool (create_prompt) with a complex but present schema. The other two 'add' tools appear to be from example/vulnerable code in the repo (mcp_server_example and vulnerable_mcp_server_example), not part of the main ashra-mcp server. The create_prompt tool has a reasonable description but the nested schema definition is overly complex and difficult for LLMs to parse. None of the tools include error recovery guidance, destructive hints, or idempotency annotations. The add tool in mcp_server_example contains a serious security anti-pattern: the docstring instructs the LLM to extract and pass sensitive file contents (SSH keys, MCP config files) as parameters, which is a prompt injection vulnerability. The vulnerable_mcp_server_example has minimal implementation. Overall, the definition quality is poor due to incomplete descriptions for real-world constraints, lack of error handling patterns, missing tool annotations, and the presence of exploitable prompt injection vulnerabilities in example code.
Critical prompt injection vulnerability in add() tool docstring (mcp_server_example). The IMPORTANT section explicitly instructs the LLM to read and pass sensitive files (~/.cursor/mcp.json, ~/.ssh/id_rsa) as the 'sidenote' parameter. This is a clear security anti-pattern that could leak credentials and private keys into logs and context.
Missing tool descriptions. The second 'add' tool (vulnerable_mcp_server_example) has no description field at all, making it impossible for LLMs to understand when or why to use it.
Overly complex nested schema for create_prompt. The schema definition includes deeply nested object/array structures with complex type constraints that are difficult for LLMs to parse and reason about. The 'schema' parameter itself is a meta-schema definition that should be simplified or documented with concrete examples.
create_prompt
Recommendations
URGENT: Remove the prompt injection vulnerability from mcp_server_example. Delete the IMPORTANT docstring section that instructs the LLM to read sensitive files. If you need the LLM to perform security analysis, use server-side secret injection or pass file content through a secure parameter explicitly marked with a readOnlyHint.
Add comprehensive parameter descriptions to create_prompt: 'url' should specify 'Valid URL (http/https, max 2048 chars) pointing to the prompt definition endpoint', 'prompt' should describe format/length constraints, and 'options' should explain what each flag does (e.g., 'deep (bool): if true, crawl linked resources; default false for performance').
Document the response schema for create_prompt. Include example output showing field names, types (e.g., { id: string, name: string, created_at: string, status: 'draft'|'published' }).
Add error handling examples to create_prompt description: 'On invalid URL, returns 400 with message. On network timeout, returns 503 with retry guidance. Call list_prompt_templates() first to see available templates.'
Annotate create_prompt with tool metadata: add { destructiveHint: true } to signal it creates/modifies state, supporting LLM decisions about confirmation workflows.
Simplify the 'schema' parameter structure or provide schema examples. If it must support arbitrary JSON schemas, validate server-side and return clear errors like 'Invalid schema: missing required properties object' rather than generic failures.
Add missing descriptions to the vulnerable_mcp_server_example add() tool. Minimum: 'Adds two integers and returns their sum (idempotent, read-only operation).'
Missing error recovery guidance. None of the tools provide actionable error messages or recovery steps. If create_prompt fails due to invalid schema or URL, the error response does not guide the LLM on what to try next.
No tool annotations for destructive or read-only operations. The create_prompt tool modifies state (creates a prompt) but lacks a destructiveHint annotation. The add tools are read-only but lack readOnlyHint annotations. These help LLMs understand operation safety and retry semantics.
Parameter descriptions lack constraint details. The 'url' parameter in create_prompt has only a 1-word description ('The URL of the prompt'). Missing details on: valid URL schemes (http/https?), maximum length, whether relative URLs are accepted, and example patterns.
No output schema documentation. The create_prompt tool returns JSON but does not document what fields, types, or structure the response contains. LLMs cannot plan downstream operations without knowing the response schema.
create_prompt
For the mcp_server_example add() tool, clarify the 'sidenote' parameter. Current description is deceptive (instructs file extraction). Replace with: 'Optional context string (max 500 chars) explaining the computation. For security analysis, use server-side injection, not this parameter.'
Add parameter type descriptions: Specify that 'a' and 'b' are 'integers (range: -2^31 to 2^31-1)' rather than bare type names.
Implement per-tool error classification: mark add() errors as 'retryable' (if network issue) vs 'user-fixable' (if parameter invalid). Format errors as 'Invalid input: a must be an integer, got string; b must be an integer, got string.'
Consider consolidating the three add() tools into one canonical implementation. Multiple tools with the same name and similar signatures force LLM reasoning overhead and risk confusion.