Elixir/Phoenix-based authentication server implementing One-Time Password (OTP) authentication flow with JWT tokens via Guardian
Server has 2 tools with reasonable naming and descriptions, but significant gaps in parameter descriptions, output schema documentation, and error handling. Names follow verb_noun convention (request_otp, verify_otp) which is good. Input schemas are present with type declarations, but lack granular descriptions for each parameter. Output schemas are not documented. Error handling guidance is missing. The server is a Phoenix HTTP service for OTP authentication, functionally sound but needs polish for production agent use.
Requests an OTP for the given phone number. Creates a new user if one doesn't exist with the phone number.
Verifies the provided OTP code for the given phone number. Returns the user if the OTP is valid.
Output schemas not documented. Tool descriptions state what the tools do but do not describe the structure of returned data. LLMs cannot plan downstream steps without knowing what fields to expect (e.g., does verify_otp return user_id, email, user object?). This violates the pattern for structured output and breaks tool chaining.
Parameter descriptions are minimal. 'phone_number' parameter in both tools has a description ('Phone number in international format with optional + prefix and 1-15 digits'), but 'code' parameter in verify_otp is described only as '6-digit OTP code to verify', no guidance on format (string only? numeric?), validation behavior on invalid codes, or retry limits. This forces LLMs to guess.
Error handling not documented. No indication of what errors can occur, how to recover, or what the LLM should do if verify_otp fails (invalid code vs. expired code vs. too many attempts). Pattern requires recovery guidance.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | D | 55 | 2026-07-28+ | v2 |
| 2026-03-09 | F | 0 | - | v1 |
No input validation constraints documented. phone_number claims '1-15 digits' but no enum or regex pattern in schema; code is described as '6-digit' but schema type is generic 'string' with no minLength/maxLength/pattern. Ambiguous constraints invite hallucinated values from LLMs.
Missing risk indicators in descriptions. request_otp is marked WRITE (creates users if needed) but the description does not explicitly state this side effect. LLMs need to know which tools are idempotent and which have irreversible consequences.