An MCP server that provides OAuth 2.0 authentication via Clerk, with role-based access control for tools like image generation
Three tools with mixed quality. 'add' and 'userInfo' have basic but adequate definitions; 'generateImage' has good parameter constraints but inconsistent description style. All tools have explicit schema registration via Zod. Parameter descriptions are present but some lack detail. No tool describes error cases or recovery guidance. Output schemas are implicit in the code (text or image returns) but not documented in descriptions.
Add two numbers the way only MCP can
Generate an image using the `flux-1-schnell` model. Works best with 8 steps.
Get authenticated user information from Clerk
Parameter descriptions lack constraint detail. 'a' and 'b' in 'add' tool have null descriptions; 'generateImage' prompt description omits format/length guidance.
No output schema documentation. Tool descriptions do not state what fields/structure the response contains. LLMs cannot plan downstream tool chains without knowing response structure.
Error handling lacks recovery guidance. 'generateImage' throws 'Failed to generate image' with no suggestion for retry, fallback, or root cause (e.g., quota, invalid prompt). Agents cannot self-correct.
'add' tool description is vague ('Add two numbers the way only MCP can'). The phrase 'the way only MCP can' is not action-descriptive. Does not explain when to call this vs alternatives.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | D | 54 | 2026-07-28+ | v2 |
| 2026-03-09 | F | 0 | - | v1 |
Role-gated tool registration. 'generateImage' is only registered if user role matches ALLOWED_ROLES. This dynamic registration is not discoverable upfront, clients cannot know which tools are available without calling init(), violating stateless tool listing.
'userInfo' returns raw JSON dump of user props without documenting output structure. Callers cannot predict field names (userId, sessionId, email, firstName, etc.) without reading code.