Model Context Protocol server with Shopify and Stripe integrations, deployed on Vercel with HTTP transport
Server has 5 tools with explicit schemas and descriptions. All tools are properly registered via mcp-handler with Zod validation. Naming follows verb_noun convention (ping, search, create, get). Descriptions are present but brief (10-80 chars, below the 194-char baseline). Parameters have types and some constraints (e.g., z.number().positive(), z.string().url()), but descriptions for individual parameters are minimal or absent in the schema definitions. Output is JSON-stringified text, not structured. No error handling guidance, no pagination support, no idempotency markers. Security: Stripe/Shopify keys injected server-side (good), but no audit logging visible.
A simple ping tool
Search for products in a Shopify store by query string
Create a Stripe checkout session with a product name and price
Create a Stripe checkout session using price IDs (legacy API)
Get the payment status for a Stripe payment intent
Tool descriptions are too brief (10-80 chars vs. 194-char baseline). Missing context on WHEN to use each tool and what it returns. E.g., 'Search for products in a Shopify store by query string' lacks guidance on result structure, pagination, or when to call it.
Parameter descriptions are missing or implicit in Zod schema. LLMs cannot read JSON Schema constraints, they rely on text descriptions. E.g., 'limit' parameter has no description explaining the 1-10 range or default behavior.
Output is JSON-stringified text, not structured. LLMs must parse unstructured strings to extract fields, wasting tokens and increasing hallucination risk. No documented output schema.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 60 | 2026-07-28+ | v2 |
No error handling guidance. Errors are caught and logged but LLM receives no actionable recovery hints. E.g., if Shopify API fails, agent has no guidance on retry strategy or fallback.
No pagination support. shopify_search_products accepts 'limit' but no offset/cursor. Large result sets will blow context window. No documented result cap.