Loading ToolBench

Reading the current corpus…

linavelt MCP server · F · ToolBench

linavelt

MCP server to keep repository updated and resolve issues. Provides endpoints for repository updates, security audits, and periodic maintenance tasks.

2026-07-28+STREAMABLE_HTTP3 tools

30/100

Definition Quality20

Protocol Readiness45

Supportability38

Spec posture

Inferred effective spec 2026-07-28+·current baseline 2026-07-28

Static source inference · medium confidence · evidence: Streamable HTTP

Current-spec patterns detected

Summary

Critical gaps across all dimensions. Three tools with empty input schemas ({}), no parameter descriptions, and minimal tool descriptions (10-30 chars). No output schemas documented. No error handling guidance. Tools lack verb-noun naming clarity. update-repo and run-audit expose security-sensitive operations without documented permission gates or dry-run patterns. No evidence of input validation, rate limiting, or audit logging in visible code.

Tools (3)

healthread only30/100

Health check endpoint (public).

run-auditwriteauth23/100

Run npm and Composer security audits (requires API key).

update-repowriteauth23/100

Trigger a git pull from the main branch (requires API key).

Issues (5)

CRITICALpattern:tool ↗

All three tools have empty input schemas ({}). No parameters are defined, typed, or described. Violates pattern:constrained-input and pattern:tool-description. LLMs cannot understand what inputs each tool accepts.

update-reporun-audithealth

CRITICALpattern:tool-description ↗

Tool descriptions are 10 - 30 characters, below the 34-char p10 baseline. 'Trigger a git pull from the main branch (requires API key)' and 'Run npm and Composer security audits (requires API key)' lack WHEN to use, WHAT is returned, and side-effect clarity required by pattern:tool-description.

update-reporun-audit

CRITICALpattern:confirmation-request ↗

Destructive operations (update-repo, run-audit) lack confirmation/dry-run patterns and no documented permission gates. No evidence of audit logging or access control in server.js. Violates pattern:confirmation-request and pattern:permission-gate.

update-reporun-audit

Recommendations

Add explicit input schemas to all tools. Even if a tool accepts no parameters, declare 'input: { type: "object", properties: {}, required: [] }' and document why no inputs are needed.
Expand tool descriptions to 100 - 200 characters. For update-repo: 'Pulls latest changes from the main branch. Requires valid API key. Returns commit hash and file count. Use before running audits to ensure fresh dependencies.' For run-audit: 'Runs npm and Composer security audits on current dependencies. Requires API key. Returns vulnerability count and severity breakdown. Use after updating repo.'
Add a dry-run parameter to update-repo and run-audit (e.g., 'dry_run: boolean, default false'). Document: 'If true, shows what would change without executing. Recommended for first-time calls.'
Document output schemas for each tool. E.g., update-repo returns { commit_hash: string, files_changed: number, timestamp: string }. health returns { status: 'ok'|'degraded'|'down', uptime_seconds: number }.
Add error handling guidance. E.g., 'If API key is invalid, returns 401 Unauthorized. Verify MCP_API_KEY environment variable. If git pull fails, check network connectivity and branch permissions.'

Score history

Overall score trend

First recorded score · v2 rubric

30/100

Scored	Grade	Overall	Spec posture	Rubric
2026-09-23	F	30	2026-07-28+	v2