MCP server with OAuth2 authentication and a simple arithmetic tool, deployed on Cloudflare Workers
Single tool 'add' is well-defined with proper naming, clear description, complete schema with typed parameters, and descriptions for all inputs. However, the server is extremely minimal (1 arithmetic tool) and lacks the breadth, error handling patterns, and security considerations expected of production systems. The tool itself scores well individually (78), but the lack of composition, pagination, output documentation, and error recovery patterns limits the overall assessment.
Adds two numbers together
Tool description lacks context on WHEN to use it and what it returns. Currently: 'Adds two numbers together'. Should state: 'Adds two numbers and returns their sum as a text response. Use when you need to compute basic arithmetic.'
Output schema is not documented. The response returns {content: [{type: 'text', text: string}]} but this structure is implicit in the code, not exposed to clients. Agents cannot infer the response format without reading source.
No error handling or validation. What happens if non-numbers are passed? No error guidance, no input validation in tool, no error classification (retryable vs fatal).
Server is essentially non-functional for real-world use. One arithmetic tool does not constitute a useful MCP server. Missing: resources, prompts, pagination, composition, error handling, security patterns, and audit trails.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | C | 62 | 2026-07-28+ | v2 |
| 2026-03-09 | F | 30 | - | v1 |
OAuth and HTTP infrastructure present but MCP tool definition completely disconnected from OAuth flow. OAuth provider wraps the MCP server but there is no integration or security scoping. Tokens/credentials are not shown in code path to the tool.