A weather data MCP server that fetches real-time weather information using WeatherAPI.com and streams updates via Server-Sent Events (SSE)
Single tool 'get_weather' has a basic description but lacks critical specification details. Input schema is present with minimal parameter documentation. No output schema is documented. The tool description is only 59 characters, below the 194-char baseline for production tools. Parameter 'city' has a description but lacks constraints, format guidance, or error handling context. No error recovery guidance provided. The code shows no input validation, no enum constraints, no pagination support, and secrets (WEATHER_API_KEY) are hardcoded in source rather than injected. Tool does not follow the pattern:tool-chain or mxe:natural-identifiers patterns, no fallback suggestions if city is not found.
Get current weather for a city using WeatherAPI.com.
Tool description is only 59 characters, far below production baseline of 194 chars. Lacks WHEN to use, expected output format, and prerequisites. LLMs cannot determine when to select this tool vs other weather sources.
No output schema documented. Code returns a JSON object with 16 fields (city, region, country, etc.) but LLMs have no visibility into structure, field names, or data types. Downstream tool chaining is impossible without guessing.
Parameter 'city' has minimal description and no constraints or format guidance. No indication of required format (e.g., 'Use full city name or ISO code'), expected range, or fallback if city not found. Invites hallucinated city names.
API credentials (WEATHER_API_KEY) hardcoded in source code. Should be injected via environment variables or secrets vault. Credentials in code will leak into logs and agent traces.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | F | 40 | <=2025-11-25 | v2 |
| 2026-03-09 | F | 46 | - | v1 |
No error handling or recovery guidance. Function returns 'Failed to fetch weather data.' for all errors (network timeout, invalid city, API rate limit, malformed response). LLM cannot distinguish between retryable and user-fixable errors.
No input validation. Tool accepts any string for 'city' parameter with no length limits, character restrictions, or format validation. Malicious or malformed input (SQL injection, path traversal, extremely long strings) could cause failures or security issues.
SSE stream endpoint hardcoded to default city 'Jakarta' with no documented pagination or result limits. Streaming weather updates indefinitely every 60 seconds is unnecessary and wastes tokens. No guidance on when to use stream vs single call.