TypeScript MCP server for the ChatGPT Apps SDK that integrates with the Univex media API. Exposes tools to search media files and albums from the Univex media library.
Two well-structured tools with complete JSON schemas, clear naming conventions following verb_noun pattern, and excellent parameter documentation. Tool definitions are explicit and verifiable in src/server.ts. However, output schemas are not documented, the response structure is never specified in code or documentation, which violates the pattern:tool requirement. Both tools have good descriptions (180-220 chars), parameter types are properly declared with constraints, and tool annotations (readOnlyHint) are correctly applied. The main gap is the absence of documented return types and output field definitions, which LLMs need to plan downstream tool calls.
Search through your Univex albums and collections. Returns a list of matching albums with metadata such as album name, cover image, file count, and creation date. Provide your authToken and serviceDict to authenticate.
Search through your Univex media library. Returns a list of matching media files with metadata such as filename, type, size, creation date, and thumbnail URLs. Provide your authToken and serviceDict to authenticate.
Output schemas are undocumented. The tools describe what they return ('Returns a list of matching media files with metadata such as filename, type, size, creation date, and thumbnail URLs') but do not provide a structured schema for the response objects. LLMs cannot infer the exact field names, types, or presence/absence of optional fields. This violates pattern:tool (Document the output schema) and pattern:response-shaper (Return structured objects with typed fields).
Credentials passed as tool parameters. Both tools require 'authToken' and 'serviceDict' as explicit input parameters. This is a security anti-pattern (pattern:secret-injection), credentials should never appear in tool parameters because agent traces log every parameter, exposing secrets in logs. Move authToken and serviceDict to server-side environment variables or a vault, and have the server inject them automatically.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | C | 64 | 2026-07-28+ | v2 |
| 2026-03-09 | F | 0 | - | v1 |
No error guidance for failed API calls. The univexGet() helper function throws a generic error ('Univex API error {status} {statusText}: {body}') but provides no recovery guidance. Per pattern:recovery-guide, errors should tell the LLM what to do next: 'User not found. Try search_users() with a partial name.' A 401 authentication error should suggest checking credentials; a 404 should suggest trying a different query; a 429 should suggest retrying. Currently, the LLM has no actionable next step.
Missing error handling in CallToolRequest handler. The server.setRequestHandler() call for CallToolRequest does not wrap the tool implementations in try-catch or distinguish between retryable errors (network timeouts, 5xx) and user-fixable errors (invalid parameter, not found). A malformed request or an API timeout will surface an unhandled error with no recovery path.