OAuth 2.0 and OIDC authentication proxy for MCP (Model Context Protocol) servers, supporting multiple providers (Okta, Google, Azure, HMAC) with both native and proxy OAuth modes
This server has critical definition quality issues. Of 6 tools listed, all lack visible input parameter schemas in the provided source code. Three tools are named 'greet' (duplicate names), creating ambiguity. Tool descriptions are extremely short (10-16 chars) and fail to meet the 10-1024 char guidance with sufficient detail. No output schemas are documented. No error handling guidance is visible. The server implements OAuth proxy functionality well (as middleware), but the tool definitions themselves are severely underdeveloped. This appears to be an authentication/proxy framework rather than a fully-specified tool catalog.
Returns authenticated user information
Greets the authenticated user by their username
Greets the authenticated user
Greets the authenticated user
Returns the current server time
Returns information about the authenticated user
No input parameter schemas visible in source code. All 6 tools registered without documented parameter types, constraints, or descriptions.
Tool description lengths are 10-20 characters, below the minimum 10-1024 char range, and lack actionable context. E.g., 'Greets the authenticated user' (31 chars) does not explain WHEN to use this vs other tools, WHAT the output is, or any pre-requisites.
Three tools named 'greet' (from different example files). Duplicate names create ambiguity for LLMs and break tool discovery. Should rename to distinguish them (e.g., greet_user, greet_by_username) or consolidate into one tool.
Inferred effective spec: 2026-07-28+.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | F | 36 | 2026-07-28+ | v2 |
| 2026-03-09 | F | 31 | - | v1 |
No output schemas documented. LLMs cannot plan downstream operations or extract structured results. The code shows tools returning mcp.NewToolResultText(), indicating text output, but no schema is declared.
No error handling guidance visible. Code shows error returns (e.g., 'authentication required'), but no categorization of errors as retryable, user-fixable, or fatal. No recovery suggestions provided to LLM.
Tool 'greet' from examples/mark3labs/simple appears twice in the tool list (indices 2 and 5), suggesting duplicate tool registration or example duplication.