Thin shim MCP server for the Rockie research action space. Loads 9 tool schemas from contract manifest and dispatches them via MCP tools/list and tools/call. Provides filesystem sandbox, shell execution, web tools, and Rockie backend integration.
Server has 9 tools with complete input schemas and descriptions. Naming follows verb_noun convention (read_file, list_files, write_file, run_command, web_search, fetch_url, submit_job, get_job, finish). Descriptions are present and substantive (avg ~120 chars), exceeding the 10-char minimum. However, parameter descriptions are sparse or missing in several tools (web_search lacks query format guidance; submit_job's job_spec is underdocumented; fetch_url lacks SSRF detail in schema). Output schemas are not formally documented in the tool definitions. Error handling is present in code (ToolError class, timeout handling, SSRF guards) but not surfaced in tool descriptions. No tool annotations (readOnlyHint, destructiveHint, idempotentHint) despite clear risk profiles (write_file, run_command, submit_job are destructive). Parameter constraints (e.g., timeout_sec range, query format) are implemented in code but not declared in schemas.
Fetch a URL and return readable text. SSRF-guarded (blocks private/loopback/link-local/metadata ranges on every hop).
Terminal tool that echoes the result and completes the task.
Retrieve job status and results from the Rockie backend.
List files in a directory within the workspace.
Read the contents of a file from the workspace.
Execute a shell command in the workspace with timeout and output capture.
Submit a job to the Rockie backend via device-flow authentication.
Search the web using DuckDuckGo HTML by default, or a BYO SEARCH_API_KEY provider (tavily/brave/serper) for higher quality.
submit_job has underdocumented job_spec parameter. Schema shows only type:object with description 'Job specification', no nested field definitions, constraints, or examples. LLMs cannot infer valid job structure.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint) despite clear risk profiles. write_file, run_command, and submit_job are destructive; read_file, list_files, web_search, fetch_url, get_job are read-only. Agents cannot distinguish safe from unsafe operations.
Output schemas not documented in tool definitions. Agents do not know what fields to expect from each tool's response, forcing them to guess or parse unstructured text.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 55 | 2026-07-28+ | v2 |
Write content to a file in the workspace.
Parameter constraints implemented in code but not declared in schemas. timeout_sec has a default (120) and implicit range (0 - ∞) but no minValue/maxValue. query format for web_search is undocumented. Agents cannot validate inputs before calling.
Error handling guidance not surfaced in tool descriptions. Code includes SSRF guards, timeout handling, and path-escape validation, but descriptions do not explain what errors to expect or how to recover.