MCP server that provides HTTP request tools with full logging support for GET, POST, PUT, DELETE, PATCH, HEAD, and OPTIONS methods
This HTTP request toolkit shows mixed quality. All 8 tools have consistent naming patterns (http_* verbs) and present input schemas with documented parameters. However, descriptions are generic and repetitive ('All requests logged' appended to each), providing minimal LLM guidance on when to select one tool over another. Parameter descriptions lack specificity, e.g., 'Optional headers to include in the request' does not explain format expectations, escaping rules, or common use cases. Output schemas are partially documented in code (HTTPResult struct) but not formally declared in tool registration. The raw_body parameter uses 'any' type without clear conversion rules documented. Error handling exists but lacks recovery guidance. No security consideration for URL validation or request body size limits. Tools do not distinguish between safe (idempotent) and unsafe (destructive) operations in their descriptions, users must infer from the tool name alone.
HTTP DELETE request with full support (headers, cookies, body, timeout) - All requests logged
HTTP GET request with full support (headers, cookies, body, timeout) - All requests logged
HTTP HEAD request with full support (headers, cookies, timeout) - All requests logged
HTTP OPTIONS request with full support (headers, cookies, timeout) - All requests logged
HTTP PATCH request with full support (headers, cookies, body, timeout) - All requests logged
HTTP POST request with full support (headers, cookies, body, timeout) - All requests logged
HTTP PUT request with full support (headers, cookies, body, timeout) - All requests logged
Raw HTTP request with flexible body handling (auto-converts dicts/arrays to JSON, all requests logged)
Generic, repetitive descriptions. All tools append '- All requests logged' which adds no LLM-actionable context. Descriptions do not explain when to use http_get vs http_head, or http_post vs http_raw_request. LLMs cannot distinguish tool intent from these descriptions.
Parameter descriptions lack specificity and constraints. 'Optional headers to include in the request' does not specify: header name/value escaping rules, content-type expectations, authorization header formats, or common header examples. 'Optional request body' does not explain encoding (UTF-8? binary?), size limits, or JSON vs form-data handling.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | F | 43 | <=2025-11-25 | v2 |
| 2026-03-09 | F | 45 | - | v1 |
http_raw_request raw_body parameter uses 'any' type with auto-conversion to JSON. Documentation in description is incomplete (code snippet cuts off mid-implementation). LLMs cannot reliably predict when auto-conversion occurs or how nested structures are serialized without seeing full conversion logic.
No input validation or range constraints documented. timeout parameter accepts any float but defaults to 30 seconds, no min/max documented. URL parameter has no format validation hint (must be valid HTTP/HTTPS URL?). No guidance on maximum request body size, timeout range (1-300s?), or header count limits.
Error responses logged but lack LLM-actionable recovery guidance. Code shows logRequestResponse(..., errorMsg) but does not indicate whether errors are retryable (network timeout) vs fatal (invalid URL). LLM receives generic error text with no 'what to do next' guidance.
Output schema (HTTPResult struct) is defined in code but not formally documented in tool descriptions. No specification of response field types, presence guarantees, or how to extract downstream IDs (if API returns location header, is it included in response_headers?).
No idempotency or destructive operation semantics documented. http_delete is marked DESTRUCTIVE in metadata but tool description does not warn about irreversibility or offer confirmation/dry-run patterns. http_post/put/patch marked WRITE but descriptions are identical to idempotent http_get.
No security guidance on URL validation, request body sanitization, or injection prevention. Code accepts any URL string without scheme/hostname validation. No warning that agent-supplied URLs or headers could be vectors for SSRF, header injection, or other attacks.
Redundant tool proliferation. http_get, http_head, http_options are very similar. http_post, http_put, http_patch, http_delete differ only in HTTP method. http_raw_request duplicates all functionality with a 'method' parameter. LLMs will waste reasoning cycles deciding between them instead of composing a single flexible tool.