An MCP server for executing SELECT queries on ClickHouse databases and exploring database structure
Single tool with acceptable naming but severe deficiencies in parameter description, output schema documentation, and error handling. The tool 'execute_select_query' starts with a verb (positive), but the input schema lacks parameter-level descriptions beyond the query field itself. No output schema is documented, callers must infer the tab-separated format from implementation. Error handling returns a generic TextContent with a string message rather than structured error guidance. The server lacks meaningful composition (only one tool) and provides no pagination, limit controls, or result-shape documentation. Baseline: average tool description length is 194 chars; this one is 56 chars. Parameter descriptions average 72 chars; 'query' has none in the schema (only 'The SELECT query to execute' in the tool description, not in the parameter itself).
Execute a SELECT query on the ClickHouse server
Parameter 'query' has no description in the JSON Schema itself, only a generic sentence in the tool description. LLMs cannot parse the constraint 'Only SELECT queries are allowed' from the tool-level description; it must appear in the parameter description.
No output schema documented. Tool returns tab-separated TextContent, but callers have no schema to parse the response. LLMs need to know what fields to expect.'
Tool lacks pagination, result limits, and control parameters. Query results can grow unbounded, risking context window exhaustion. No 'limit' or 'offset' parameters, no documentation of result caps.
Error handling returns generic TextContent strings rather than actionable recovery guidance. 'Error executing query: <str(e)>' gives LLM no path forward.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | F | 47 | <=2025-11-25 | v2 |
| 2026-03-09 | F | 39 | - | v1 |
SQL injection vulnerability: Tool accepts raw query strings from LLM and validates only that they start with 'SELECT'. An LLM could pass 'SELECT * FROM users; DROP TABLE users;' (multiple statements separated by semicolon). Whitelist allowed tables and use parameterized queries.
Tool description is only 56 characters; rubric baseline is 194 chars. Insufficient detail on what the tool does, when to use it, and dependencies. E.g., does it support CTEs? Subqueries? What happens with large result sets?
No idempotency guarantee documented. SELECT queries are read-only (low risk), but the tool description does not state this explicitly. Agents need to know what's safe to retry.