MCP server with JWT authentication via SSE transport
This server defines 4 tools with basic schemas and minimal descriptions. All tools are explicitly registered in index.ts with Zod schemas, so tool definitions are clearly visible. However, descriptions are critically sparse (13-32 chars, well below the 10-1024 baseline recommended minimum of 50-200 for LLM clarity). The 'test' tool lacks any input schema entirely. Parameter descriptions exist for 'echo' and 'random-number' but are generic. Output schemas are not documented. Error handling is minimal, tools return only happy-path responses with no guidance for failure modes. No input validation beyond Zod type coercion. This is a proof-of-concept or demo server, not production-grade.
Echo back a message
Get current server time
Generate a random number
Test description
Tool 'test' has no input schema (empty {}). Also, 'Test description' (19 chars) is too short and generic to guide LLM tool selection.
All tool descriptions are under 30 characters ('Test description', 'Echo back a message', 'Get current server time', 'Generate a random number'). These are too terse; LLMs cannot infer intent without richer context.
No output schemas documented. Tools return hardcoded text responses like 'Security check successful' or 'Current server time is: <ISO>' without declaring the structure. Agents cannot plan downstream tool chains when response formats are undocumented.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | F | 41 | 2026-07-28+ | v2 |
| 2026-03-09 | F | 0 | - | v1 |
No error handling or recovery guidance. Tools do not validate inputs (e.g., random-number accepts any number for min/max with no bounds checking). No error responses, all paths return 200 with text content even if logic fails silently.
Tool names are generic action verbs without clear domain context. 'test' and 'echo' are demo utilities, not domain tools. 'get-time' and 'random-number' lack distinguishing context (time of what? Random in what units?). A tool named 'test' signals a placeholder, not a production capability.
'random-number' parameters min/max have descriptions but no bounds constraints in the parameter definition itself. Description says 'Minimum value' and 'Maximum value' but does not specify valid ranges (e.g., integers? floats? -999 to +999?).