MCP Server for Student Grade Management System with role-based access control (student, professor, admin)
Scoring was not performed
No output schemas documented. Code returns TextContent but the actual response structure is completely invisible to the LLM. Per pattern:tool, LLMs need to know what fields to expect so they can plan downstream tool calls and extract the right data.
Parameter descriptions are dominated by boilerplate ('Session ID for authentication' appears 35 times identically). This violates DRY and wastes the opportunity to document domain-specific constraints, dependencies, and valid ranges. Descriptions should explain WHAT the parameter controls in the business domain, not just repeat the field name.
No constraints on numeric parameters. 'year_of_study' and 'semester' accept integers with no min/max. 'grade' in exam_record_create accepts 'integer' but spec says 5-10, this constraint is ONLY in the description, not in the schema. LLMs cannot read descriptions to enforce constraints; they need JSON Schema minumum/maximum.
No enums for status and role fields. 'status' in student_search accepts 'active, graduated, inactive', stated in description only, not as enum in schema. 'day_of_week' in consultation_create_availability accepts 0-6 but no enum constraint. Enums are self-documenting and prevent LLM hallucination.
exam_list_by_subject_and_date has undocumented parameter relationships. It accepts exam_date (exact) OR start_date/end_date (range), but the mutual exclusivity is not stated. This forces the LLM to guess which combination is valid.
Error responses return bare strings ('NOT_AUTHENTICATED', 'FORBIDDEN') without recovery guidance. Per pattern:recovery-guide, errors should tell the LLM what to do next: 'NOT_AUTHENTICATED: call auth_start() first' or 'FORBIDDEN: you lack write:exam permission, contact admin.'
No pagination or limit enforcement documented. Tools like student_search, enrollment_list, and subject_enrolled_students accept a 'limit' parameter but do not specify min/max or default. Per pattern:paginated-result, large results risk blowing context window. Responses should declare default and max limits explicitly.
No documentation of which tools require which fields from prior calls. E.g., exam_record_create requires 'exam_session_id' but no tool is shown that lists exam sessions. Missing dependency hints force discovery detours.
Tool names like 'enrollment_students_in_subject_with_status' are overly long and unclear. 'enrollment_students_in_subject_with_status' (41 chars) vs. simpler 'get_enrolled_students_status' (29 chars). Long names reduce clarity; concise verb_noun is preferred.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | F | 0 | 2026-07-28+ | v2 |
| 2026-03-09 | F | 39 | - | v1 |