MCP server for retrieving user pull request activity from GitHub within specified date ranges for performance review data collection
The server implements one tool for retrieving GitHub pull request activity. The tool has a descriptive name (list_user_pull_request_activity) that starts with a verb and clarifies intent. However, the implementation has several notable gaps: (1) the tool description is adequate but could better explain when to use it vs alternatives; (2) parameters have type definitions and descriptions, but descriptions are minimal (18-25 chars each); (3) output schema is partially documented via XML generation but no structured schema is returned to the LLM, the tool generates XML strings rather than returning structured JSON objects; (4) error handling is minimal, environment variable validation only logs warnings, and the GitHub API call has no try-catch or recovery guidance; (5) no input validation of date formats despite accepting 'YYYY-MM-DD' strings. The tool is READ_ONLY (safe) but lacks defensiveness in parsing and error reporting.
Retrieve the user's opened pull requests from GitHub within a specified date range. Use this to get an overview of the user's development activity within a specific time frame.
Output schema not documented or structured. Tool returns XML strings to the LLM rather than parsed JSON objects. LLMs cannot reliably extract data from unstructured XML without additional parsing logic.
Parameter descriptions are too brief (18-25 chars). 'The start date for the activity (format: YYYY-MM-DD)' and 'The end date for the activity (format: YYYY-MM-DD)' lack context on valid ranges, how dates are interpreted, or timezone handling.
No input validation or error handling for malformed dates. If an LLM passes '2024-13-45' or invalid format, Time.parse() will raise an exception with no recovery guidance for the agent.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | F | 48 | 2026-07-28+ | v2 |
| 2026-03-09 | F | 19 | - | v1 |
GitHub API credentials and configuration (GITHUB_USERNAME, GITHUB_ORGANIZATION, GITHUB_PERSONAL_ACCESS_TOKEN) are injected at server startup via environment variables. No mechanism for per-request credential injection or validation. If credentials are invalid, warnings are logged but the tool will still fail at runtime.
Tool description does not explain when to call this tool vs other GitHub activity tools (if available), what the response contains, or what the agent should do next with the results.