Server defines 5 tools with complete input schemas and descriptions. Naming follows verb_noun convention (http_request, api_health, jwt_decode, url_parse, header_analyzer). Descriptions are present and substantive (100-200 chars), meeting baseline expectations. However, output schemas are not documented, LLMs cannot predict response structure for downstream chaining. Parameter descriptions are adequate but lack constraint details (ranges, formats, validation rules). No error handling guidance visible in tool definitions. All tools are READ_ONLY, reducing risk, but composition could be tighter (url_parse does both parsing and building, violating single-responsibility).
Check the health of multiple API endpoints. Returns status, response time, SSL certificate validity, and optional response body validation for each endpoint.
Analyze HTTP response headers for security (HSTS, CSP, X-Frame-Options, etc.), caching directives, CORS configuration, cookies, and server information. Provides a security grade.
Make an HTTP request with full control over method, headers, body, authentication, and timeouts. Returns status, headers, body, and timing information.
Decode a JWT token without verification. Returns header, payload, expiry, issued-at time, and whether the token is expired.
Parse a URL into its component parts: protocol, host, port, path, query parameters, hash, and more. Can also build a URL from parts.
Output schemas not documented. LLMs cannot predict response structure, breaking tool chaining and forcing agents to guess field names for downstream calls.
url_parse violates single-responsibility principle: both parses URLs and builds them from parts. Should split into parse_url and build_url tools.
Parameter constraints lack specificity. 'timeout' has no min/max bounds; 'endpoints' array has 'max 20' in description but no maxItems in schema; 'expected_status' lacks enum or range.
No error handling guidance in tool definitions. LLMs cannot determine if failures are retryable, user-fixable, or fatal.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 57 | 2026-07-28+ | v2 |
http_request auth parameter requires 'type' but username/password/token are optional without clear dependency rules. LLM may pass incomplete auth configs.