Loading ToolBench
MCP server for creating activities in meupontoonline
This MCP server has significant structural and definition quality issues. Both tools expose credentials (email, password) as parameters, which violates critical security patterns. Schemas are partially defined using Zod but lack formal JSON Schema validation with proper type constraints. Parameter descriptions are minimal or missing entirely. Tool descriptions are present but generic, lacking LLM-optimized guidance on when to use each tool or what happens after invocation. The second tool has a complex nested object schema that is poorly documented. No output schemas are documented, making it impossible for downstream agents to understand the structure of responses. Error handling is present in the code but not reflected in documented recovery patterns.
A tool that creates activities in meupontoonline
A tool that creates missing activities in meupontoonline
CRITICAL: Credentials (email, password) exposed as tool parameters. These are secrets that must never appear in tool parameters, as they will be logged and traced. Use server-side secret injection via environment variables or a secure vault instead.
Missing or inadequate parameter descriptions. Most parameters (startDate, endDate, project, email, password) have minimal descriptions that do not explain format requirements, valid ranges, or dependencies. Parameter descriptions should be 30-100 characters and spell out constraints explicitly.
No output schemas documented. Tool responses are text strings; LLMs cannot determine what fields are available for downstream tool composition. All tools must document their return structure so agents can extract relevant data and chain calls.
Inferred effective spec: 2026-07-28+.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | D | 54 | 2026-07-28+ | v2 |
| 2026-03-09 | F | 40 | - | v1 |
Tool naming is acceptable but second tool name 'create-missing-activities' uses a hyphenated format inconsistent with common MCP tool naming conventions (verb_noun with underscores). The name also lacks clarity about what 'missing' means in context.
Schemas defined with Zod but not properly structured for JSON Schema validation. The code shows 'z.string()' and 'z.object()' but these are not translated to formal JSON Schema with explicit type declarations, oneOf discriminators, or proper additionalProperties constraints.
create-activity tool requires all 6 parameters including credentials every time. No optional parameters or defaults reduce cognitive load. Consider making description and project optional with sensible defaults, or splitting credential handling into a separate authentication step.
Tool descriptions lack LLM-optimized structure. Descriptions should include: (1) What the tool does, (2) When to use it vs alternatives, (3) What it returns, (4) Any prerequisites. Current descriptions are single sentences that omit context for selection.
No error classification provided. Handler returns success/error with text responses, but no guidance to LLM on what is retryable, user-fixable, or fatal. Error messages in code ('Failed to create activity') do not tell the agent what to do next.