Muster is an OAuth aggregator MCP server with 2 tools. While tool names follow verb_noun conventions (auth_login, auth_logout), the definitions are severely lacking. Tool descriptions are present but minimal (16-17 characters each, below the 20-character hard floor). Input schemas are visible in the source code but lack depth: parameter descriptions are present but formulaic, and there is no documented output schema. The tools handle OAuth flow state (an inherently stateful operation) without clear documentation of what data is returned or how to handle OAuth errors. No error handling guidance, no parameter validation rules, and no composition patterns evident. The risk labels (WRITE) are noted but not explained to the agent. This server appears to be a custom OAuth orchestration layer for aggregating multiple MCP server connections, a niche but legitimate use case, yet the tool definitions do not guide an LLM through the authentication lifecycle or explain when to use login vs. logout.

• Expand auth_login description to 100-150 characters, explaining: (a) what OAuth flow is initiated, (b) whether it is async or blocking, (c) what the LLM should expect in the response, (d) when to call this tool (e.g., 'Call this once per server you want to use'), (e) prerequisites (e.g., does the user need to open a browser?). Example: 'Initiates OAuth login flow for a specified MCP server. Returns OAuth code and session ID for polling. User must approve consent in browser. Use this before making authenticated calls to the server.'
• Expand auth_logout description to explain: (a) what happens to existing tokens, (b) whether this immediately revokes access or just clears local state, (c) what the agent should do after logging out (nothing? cleanup?). Example: 'Logs out from a server and revokes all active OAuth tokens. Revocation is immediate. Any subsequent calls to that server will fail until re-authenticated.'
• Add output schema documentation for both tools. For auth_login, document: { 'session_id': string, 'oauth_code': string, 'expires_at': ISO8601_string, 'server_name': string }. For auth_logout, document: { 'server_name': string, 'status': 'logged_out', 'revoked_count': integer }.
• Replace free-form 'server' parameter with enum or validation guidance. Either (a) define an enum of valid server names, or (b) document how to discover valid servers (e.g., 'Call list_servers() first to see available options'), or (c) add a tool like list_authenticated_servers() to enable discovery.
• Add error handling documentation. For auth_login, explain: 'If user denies consent, returns error code USER_DENIED_CONSENT with recovery hint: ask user to approve, or try a different server. If OAuth provider is unreachable, returns error code OAUTH_PROVIDER_ERROR; retry after 30s.' For auth_logout, explain: 'If server is not found, returns error code SERVER_NOT_FOUND; valid servers can be listed with list_servers().'

Inferred effective spec: 2025-06-18+.

• Relies on Logging (deprecated) - log to stderr or use OpenTelemetry