MCP-compliant server with World ID authentication that exposes tools gated by World ID proof verification, providing human-in-the-loop authorization for AI agents
Server has 3 tools with complete input schemas and descriptions. Naming follows verb_noun pattern (world-id.verify, echo, advanced-operation). Schemas use Zod validation with proper types. However, descriptions are minimal (34-72 chars, below the 50-200 char baseline for LLM optimization). Parameter descriptions exist but lack actionable guidance on constraints, dependencies, and error recovery. Output schemas are not documented. Error handling returns generic messages without recovery guidance. Security model relies on JWT tokens passed as parameters, which is acceptable but not ideal for sensitive operations.
Performs a privileged action requiring document/orb World ID verification
Returns the input message. Requires World ID session verification.
Verify a World ID proof to establish an authenticated session
Tool descriptions are too brief (34-72 chars vs. 50-200 char baseline). 'Returns the input message. Requires World ID session verification.' lacks context on when to use echo vs. advanced-operation, what it returns, and why an LLM would select it.
Output schemas are not documented. Callers cannot infer what fields to expect from world-id.verify (does it return token, expiresAt, scopes?), echo (does it return the message or metadata?), or advanced-operation (what is the result structure?).
Parameter descriptions lack actionable constraints. 'JWT from world-id.verify' is vague, does it expire? What scopes does it grant? What happens if it's invalid or expired? LLMs cannot infer these details.
Inferred effective spec: 2025-06-18+.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 56 | 2025-06-18+ | v2 |
Error handling does not guide recovery. verifyAndCreateSession catches errors and returns {ok: false, error: message}, but error messages like 'actionId mismatch' or 'verificationLevel too low' do not suggest next steps (e.g., 'Check your World ID app configuration' or 'Use a higher verification level').
Tool naming 'advanced-operation' is vague and generic. It does not convey what action is performed. Rename to a specific verb_noun pattern (e.g., 'execute_privileged_action' or 'perform_orb_verified_operation') so LLMs understand intent without reading the description.