MCP server for interacting with Valenbisi bike-sharing system via Cyclocity API
Server defines 7 tools with basic descriptions and partial schemas. All tools have names starting with action verbs (list_, get_, unlock_) and descriptions present. However, most parameter descriptions are minimal (1-5 words), input schemas lack detail, and output schemas are not documented. No error handling guidance, no parameter constraints (enums, ranges), and no documentation of return structures. Tool descriptions average ~40 chars, well below the 194-char baseline for production tools. Parameters lack type information in descriptions (e.g., 'The station number' doesn't specify integer range or valid values). No evidence of idempotency hints, permission gates, or recovery guidance.
Get information about the authenticated user's account
Get details about a specific bike
Get details about a specific bike station
List all available bikes in the Valenbisi network
List all bike stations in the Valenbisi network
List the user's trip history
Unlock a bike for use
Output schemas not documented. LLMs cannot plan downstream calls or extract required fields without knowing what list_stations, get_station, list_bikes, etc. return. No field names, types, or structure visible.
Parameter descriptions are minimal (1-5 words). 'The station number', 'The bike number', 'The stand number' lack context on valid ranges, format, or when to use. Baseline is 72 chars per param; these average ~20 chars.
No pagination support on list_* tools. list_stations and list_bikes lack limit, offset, or page parameters. If the Valenbisi network has hundreds of stations/bikes, returning all results will blow context windows.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 37 | 2026-07-28+ | v2 |
No error handling guidance. Tools lack descriptions of failure modes (e.g., 'Station not found', 'Bike already unlocked', 'Authentication failed'). LLMs cannot recover from errors without explicit recovery hints.
unlock_bike is a destructive operation (WRITE risk) with no confirmation step or dry-run option. Agents can irreversibly unlock bikes without safeguards. No idempotency hint documented.