MCP server implementing Server-Sent Events (SSE) transport with tool execution capabilities
DataPulseSSE has 2 tools with minimal definition quality. Tool names are acceptable (get_time, fetch_url) and start with verbs, but descriptions are extremely sparse (13-26 characters, well below the 10-1024 character recommendation). Most critically, the fetch_url tool's schema is severely incomplete: it declares a 'url' parameter with a type and basic description, but get_time declares an empty input schema {}. Parameter descriptions are present but superficial. No output schemas are documented anywhere in the code, LLMs cannot determine what fields to expect from responses. Error handling is minimal: catch-all exception blocks return generic error strings without guidance on recovery or error classification. No input validation is shown, and the fetch_url tool accepts arbitrary URLs with a 5-second timeout, creating potential security and reliability issues. The tools lack any indication of idempotency, read-only status, or destructive intent in their descriptions.
Get data from provided url
Returns actual time
Missing output schema documentation. LLMs cannot determine what fields (time, status, content, etc.) or types (string, object, array) the tools return. This forces LLMs to guess downstream data structure and breaks tool composition.
get_time has empty input schema ({}). Per hard scoring rules, input schema score must be 0. LLMs cannot understand if parameters are required or optional.
Tool descriptions are extremely short (13-26 characters, far below 34-character p10 baseline). 'Returns actual time' and 'Get data from provided url' lack context on WHEN to use these tools, WHAT happens, or any prerequisites.
fetch_url accepts arbitrary URLs without validation, sanitization, or allowlist. No URL format constraints (e.g., must start with http/https, no localhost). Agents could be tricked into SSRF attacks or fetching malicious content.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | F | 38 | 2026-07-28+ | v2 |
| 2026-03-09 | F | 25 | - | v1 |
Error handling is minimal: bare except block with str(e). No error classification (retryable vs fatal), no actionable recovery guidance, no invalid value reporting. LLMs receive unstructured error text and cannot self-correct.
No parameter description for fetch_url's 'url' parameter beyond 'URL to fetch data from'. Missing constraints: format (http/https required?), length limits, allowed domains, timeout behavior.
fetch_url returns first 200 characters of content without documenting this limit in the tool description or response schema. Agents cannot predict truncation and may misinterpret partial responses.
No tool annotation hints. Neither tool declares readOnlyHint (both appear read-only) or idempotentHint (both should be idempotent). LLMs cannot determine if tools are safe to retry or have side effects.