This is a proxy server that forwards MCP protocol to a remote dochost.io HTTP API. The actual tool definitions are not defined in this server's source code, they are discovered from the remote API at runtime. All 6 tools (publish, update_page, list_my_pages, get_page, get_account, delete_page) are passed through unchanged from dochost.io/api/mcp. Per the HARD SCORING RULES, tool definitions that are inferred rather than directly visible in the source code must have their overall score capped at 50. Additionally, since the server's source does not contain explicit tool registration with full schemas and descriptions, only a proxy forwarding mechanism, we cannot verify the actual parameter schemas, input validation rules, or output structures. The publish.sh example shows ONE tool being called manually (publish) with a documented 2-parameter schema (body, format), but the other 5 tools are ONLY mentioned in the smoke test as assertions that they exist, no schemas are shown. Score is reduced further because this is a STDIO-only proxy with no direct integration of tool quality assurance; it merely relays whatever the remote server returns.
Publish a Markdown or HTML document to dochost and receive a shareable URL
Tool definitions inferred, not explicitly visible in source. Five of six tools (update_page, list_my_pages, get_page, get_account, delete_page) have no visible schema definitions in the server code, only assertions in smoke-test.js that they exist. Per HARD SCORING RULES, inferred tools cap at 50 overall; combined with missing descriptions and schemas, actual scores are much lower.
No input schemas visible for 5 of 6 tools.
No descriptions visible for 5 of 6 tools. The other five tools have no descriptions in the provided code.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | F | 31 | 2026-07-28+ | v2 |
publish tool description is marginally short (90 chars). Baseline for A+ tools is 50-200 chars, this is at the lower end but acceptable. However, it does not explain WHEN to use this tool vs alternatives, prerequisites (API key), or return value structure. Tool descriptions should answer: What? When? Return?
publish tool parameters lack descriptions. The schema shows body (string) and format (enum: markdown|html), but neither parameter has a description explaining what 'body' means (the file content?), when 'format' should be markdown vs html, or constraints on body size/content.
delete_page tool risk is marked DESTRUCTIVE but no error handling or confirmation pattern documented. The rubric pattern:confirmation-request states: 'Irreversible operations (delete, send, publish) should support a dry-run or confirmation step.' No evidence this is implemented in the forwarded dochost API.
No output schemas documented for any tool. The rubric critical check states: 'Document the output schema. LLMs need to know what fields to expect so they can plan downstream tool calls and extract the right data.' None of the 6 tools include a documented return type or response structure in the available source.
list_my_pages tool does not document pagination. Baseline pattern:paginated-result requires tools returning lists to 'accept page/offset and limit parameters and return a total count or next_cursor.' No evidence of pagination support in the source.
Credentials (DOCHOST_API_KEY) are passed via environment variable and injected into Authorization header by mcp-remote. This is correct per pattern:secret-injection. However, the publish.sh example requires users to manually export the API key, which is a user-facing security risk. Score: handled correctly on the server side, but the UX encourages mishandling.