MCP server that provides company information lookup from a SQLite database
This server has severe quality gaps. Only 1 tool is present (get_company_info), registered via @mcp.tool() decorator with fastmcp. The tool has a basic description and a simple schema, but lacks critical elements: parameter descriptions, output schema documentation, error handling guidance, and security considerations. The parameter 'name' has a type (string) but no description to guide the LLM on expected format, examples of valid inputs, or behavior when no match is found. The response is unstructured JSON with ad-hoc error handling. There is no pagination, no input validation, no recovery guidance, and SQL injection risk from direct LIKE query. The server is STDIO-only, which hard-caps protocol readiness at 50, but definition quality independently scores low due to missing descriptions, undocumented output schemas, and unsafe database patterns.
Retrieve company information from the companies database by name
Parameter lacks description. The 'name' parameter has a type but no description explaining what format is expected (partial match? exact? case-sensitive?), when to use it, or what the LLM should pass.
No output schema documented. The response is returned as an ad-hoc dict with conditional structure (either company fields or an error dict). LLMs cannot plan downstream tool calls or validate responses without a declared schema.
SQL injection vulnerability. The query uses parameterized LIKE with user input, which is correct, but there is no input validation, length limits, or sanitization. An LLM could pass extremely long or malformed strings.
Error handling lacks recovery guidance. When no company is found, the response is {"error": "No information found for {name}."}, this tells the LLM nothing about what to do next (retry with a partial name? Call a search tool? Give up?).
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | F | 37 | 2026-07-28+ | v2 |
| 2026-03-09 | F | 26 | - | v1 |
No pagination or result limits. If a partial name matches many companies, the tool returns only the first result without indication of total matches or pagination. LLMs cannot disambiguate or explore alternatives.
Tool description is vague about behavior. 'Retrieve company information from the companies database by name' does not specify: partial vs exact match? Case-sensitive? What fields are returned? What happens if no match?
STDIO transport only. The server uses STDIO, which is not remotely accessible and cannot be integrated with hosted MCP clients. This hard-caps protocol readiness at 50.