BelVG Extensions for PrestaShop MCP Server - Adds advanced store management tools (Morning Briefing, Low Stock) to the MCP Server.
Two tools with basic verb-noun naming and present schemas, but significant gaps in parameter descriptions and output documentation. Both tools lack descriptions for their parameters (threshold, limit, startDate, endDate), violating the critical rule that every parameter needs a description. Output schemas are not documented, LLMs cannot plan downstream calls or extract required fields. Error handling is absent; no guidance on what to do if queries fail or return empty. Tool descriptions are adequate (150 - 180 chars) but lack WHEN to use hints or prerequisites. No input validation rules stated (e.g., date format enforcement, threshold bounds). Schemas use proper JSON types but lack required/optional declarations and constraints.
Scan inventory for products that are below the critical threshold. Use this to generate reorder lists for suppliers.
Get a daily summary of store performance. Returns total revenue, order count, and top selling product for a specific date range (default: yesterday).
All parameters lack descriptions. 'startDate', 'endDate', 'threshold', 'limit' have no explanation of what they control, valid ranges, or format constraints. LLMs cannot infer parameter meaning from names alone.
Output schemas are not documented. Tool descriptions do not specify what fields are returned (e.g., 'period', 'revenue', 'orders', 'average_cart', 'top_product' for get_morning_briefing). LLMs cannot plan downstream tool calls or extract required data without knowing the response structure.
No error handling or recovery guidance. If a date range is invalid, if no products are found, or if the database query fails, the tools return raw results or empty objects with no actionable error message. LLMs cannot self-correct or retry intelligently.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 56 | 2026-07-28+ | v2 |
No input validation rules documented. Date parameters lack format specification (YYYY-MM-DD is mentioned but not enforced in description). Numeric parameters (threshold, limit) have no stated min/max bounds. LLMs may pass invalid values (negative threshold, limit=0, malformed dates).
SQL injection risk in get_morning_briefing. While pSQL() is used for date parameters, the code constructs SQL strings dynamically. No evidence of parameterized queries or prepared statements. Untrusted input from LLM calls could be exploited.