Historical audit findings for Web3 security review, served over MCP
Two well-defined read-only tools with complete input schemas, clear descriptions, and proper output schema documentation. Tool names follow verb_noun convention (search_, get_). Descriptions are concise (60 - 90 chars) and explain purpose clearly. Input parameters have types, descriptions, and constraints (min/max, enums, defaults). Output schemas are formally defined with Zod. Annotations correctly mark both tools as read-only and idempotent. Minor gaps: parameter descriptions could be more prescriptive about format/range; no error recovery guidance in descriptions.
Read one page of a historical description or recommendation by finding ID. Follow nextOffset for remaining text. The dedicated PoC field is excluded; narrative text may still contain code.
Search historical finding descriptions and recommendations. Returns bounded excerpts, source IDs, and citations for human-reviewed assessment. Does not scan or validate a contract.
Parameter descriptions lack prescriptive format guidance. 'query' and 'section' descriptions do not explain expected format, character constraints, or valid enum values in natural language.
Tool descriptions do not include recovery guidance for common failure modes (e.g., 'If no results found, try a broader query' or 'If offset exceeds totalCharacters, use nextOffset').
Output schema fields like 'omittedForBudget' and 'nextOffset' are not explained in tool descriptions. LLMs may not understand when/why these fields appear or how to use them.
STDIO transport only. Server is not remotely accessible and cannot be used by hosted MCP clients. Limits deployment flexibility.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 67 | 2025-06-18+ | v2 |