Official MCP client for Buildable - AI-powered development platform that makes any project buildable
The Buildable MCP server has 7 tools with explicit Zod schemas visible in src/cli.ts. Naming is action-verb-based and generally clear (get_project_context, start_task, update_progress, complete_task, create_discussion, health_check). Descriptions are present for all tools and most parameters. However, several issues prevent a higher score: (1) Return schemas are not documented, tools return raw JSON.stringify() of API responses without specifying output structure; (2) Error handling is minimal, tools throw generic 'Not connected' errors but don't include recovery guidance or error classification; (3) Some parameter descriptions are generic or lack constraint detail (e.g., 'Optional notes about the task' lacks format/length guidance); (4) No parameter-level input validation or sanitization visible; (5) Complete_task and other write tools lack any confirmation/dry-run pattern despite being destructive. Tools average ~70-80 chars in description length (within baseline range of 194 chars avg but on the brief side). Schema completeness varies: update_progress has rich input schema with constraints (min/max on progress), but output schemas are entirely undocumented.
Complete a task
Create a discussion/question for human input
Get the next recommended task to work on
Get complete project context including plan, tasks, and recent activity
Check health/connectivity with Buildable API
Start working on a specific task
Update progress on the current task
Output schemas are not documented. Tools return JSON.stringify() of API responses, but no schema is visible in the code for what fields consumers should expect. This forces LLMs to parse unstructured text and prevents planning of downstream tool calls.
Error handling provides no recovery guidance. Tools throw 'Not connected to Buildable API' errors but do not explain how to reconnect, whether to retry, or what alternatives exist. Errors must be categorized (retryable/user-fixable/fatal) and include actionable next steps.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | D | 58 | <=2025-11-25 | v2 |
| 2026-03-09 | F | 0 | - | v1 |
Destructive tools (start_task, update_progress, complete_task, create_discussion) lack confirmation or dry-run patterns. No guard prevents an agent from accidentally completing a critical task or creating a spam discussion without verification.
Parameter descriptions are brief and lack constraint detail. E.g., 'Optional notes about the task' does not specify max length, format, or examples. Per the rubric baseline, descriptions should be 50-200 chars with actionable detail. Current descriptions average ~50-80 chars and omit constraints.
No input validation or sanitization visible in tool implementations. Parameters are passed directly to client methods without checks for SQL injection, command injection, or path traversal. LLMs can be tricked via prompt injection.
No pagination support visible. If get_project_context or get_next_task returns lists (tasks, activity), there are no limit/offset/page parameters and no total count in the response. Large result sets could exhaust context windows.
No tool chaining IDs documented. If start_task returns a task object, it should include the task_id so downstream calls to update_progress or complete_task can immediately use it. Current responses are opaque JSON blobs without field documentation.