MCP Server for creating and visualizing mermaid diagrams, analyzing CSV files, and managing documentation
This server has significant definition quality issues. Tool names lack strong action verbs (flow-chart, create-mermaid-file use hyphens inconsistently; analyze_csv mixes naming conventions). Parameter descriptions are minimal or missing entirely, only the input tool schema shows property descriptions in JSON, but descriptions in tool registration (ListToolsRequestSchema handler) lack detail explaining what each parameter controls or expects. No descriptions for operations array values in analyze_csv. Output schemas are completely undocumented, LLMs have no way to know what fields or structure will be returned. Error handling is implicit (no guided recovery messages visible in the code snippet). The server appears to have partial implementations, CallToolRequestSchema handler cuts off mid-implementation for flow-chart tool, making it impossible to verify error handling or output structure. Security concerns: the code uses fs.writeFile without path validation, creating potential directory traversal vulnerabilities.
Analyze CSV file
Creates mermaid flow chart file if it does not exists
Display flow chart with mermaid
No output schemas documented for any tool. LLMs cannot plan downstream calls or extract data from responses.
Parameter descriptions are minimal or absent. analyze_csv 'operations' array has no description of what sum/average/count do or produce. Input tool descriptions in ListToolsRequestSchema lack explanatory text for parameters beyond JSON type.
Inconsistent tool naming convention: 'flow-chart' and 'create-mermaid-file' use hyphens; 'analyze_csv' uses underscore. No consistent verb-noun pattern (e.g., 'analyze_csv' lacks clear action, 'flow-chart' not verb-first).
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | F | 38 | 2026-07-28+ | v2 |
| 2026-03-09 | F | 25 | - | v1 |
create-mermaid-file implementation exposes path traversal vulnerability: fileName parameter is concatenated directly into './src/docs/{fileName}' with no validation. Attacker could pass '../../../etc/passwd' or similar.
CallToolRequestSchema handler for flow-chart is incomplete in source (cuts off mid-function). Error handling, output structure, and success/failure paths are unverifiable.
No error handling guidance visible. When analyze_csv fails (bad filepath, unsupported operation), LLM receives no recovery hints ('Try check_file_exists() first', 'Valid operations are sum, average, count').
Tool annotations are present but trivial ('Flow chart views', 'Analyze CSV file'). Annotations lack destructiveHint, idempotentHint, or readOnlyHint flags that would help LLMs reason about side effects.