将传统WebAPI转换为MCP工具的服务器 (Convert traditional Web APIs to MCP tools)
This MCP server exposes 7 tools for registering and managing Web APIs dynamically. However, there are critical issues across naming clarity, parameter descriptions, and output schema documentation. The tool names are somewhat descriptive but several lack the verb-first pattern recommended for LLM clarity. Many parameters have type definitions but lack adequate descriptions explaining their purpose in the context of API registration. Output schemas are not explicitly documented, responses are inferred from code execution patterns rather than declared. The server does have a multi-tool composition pattern (register API, then invoke it) but this is not well-integrated into the tool definitions themselves. Descriptions vary in quality: some are translated from Chinese and are moderately detailed (register_web_api, set_default_headers), while others are sparse (load_api_from_file, load_apis_from_directory). Error handling is present in the code but not reflected in tool descriptions, so LLMs cannot anticipate failure modes or recovery steps.
列出当前已注册的所有Web API,包括它们的名称、URL、方法、参数定义和请求头配置等详细信息。
从JSON或Markdown文件加载API定义并注册为MCP工具
从目录加载所有API定义文件并注册为MCP工具
从配置文件加载API定义
将Web API注册为MCP工具,使其可以通过MCP协议直接调用。您可以指定API名称、URL、HTTP方法、参数定义、请求头和结果处理路径。注册后将创建与API名称相同的新工具。
设置适用于所有API请求的全局默认请求头。这些请求头将自动应用于通过register_web_api注册的所有API调用,但可以被单个API的特定请求头覆盖。
移除已注册的Web API工具。成功移除后,相应的MCP工具将不再可用。
Output schemas not documented. Tools return responses but the structure (fields, types, nested objects) is not declared in tool definitions. LLMs cannot plan downstream calls or extract required data reliably.
Insufficient parameter descriptions. The 'parameters' field in register_web_api and 'pattern' field in load_apis_from_directory are defined as records/strings but lack guidance on structure, format, and examples. LLMs cannot infer what JSON structure or regex pattern is expected.
load_api_from_file and load_apis_from_directory descriptions are minimal (~40-45 chars). They do not explain expected file format, structure, or how parsed APIs are registered. 'Load API definition file' is too terse to guide LLM selection.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | F | 44 | <=2025-11-25 | v2 |
| 2026-03-09 | F | 29 | - | v1 |
No error handling guidance in tool descriptions. When register_web_api receives invalid parameters, unregister_api fails on non-existent APIs, or file loading encounters parse errors, descriptions do not explain what to do next or which tools to call for recovery.
Composition flow not documented. Tools form a workflow (register API → then call it via dynamically created tools), but this is not explained in tool descriptions. LLMs do not know that register_web_api creates new tools that appear later in the tool list.
Path traversal and command injection risks not addressed. load_api_from_file and load_apis_from_directory accept file paths from the agent without documented validation. The code does call fs-extra but no sanitization against '../' or symlink attacks is visible in the provided snippet.