Evidence-based audit methodology and read-only Laravel context tools for existing AI coding agents.
Laravel Auditor exposes 11 read-only context collection tools via a custom MCP adapter. All tools lack input parameter descriptions and most lack meaningful output schema documentation. Tool names are noun-based ('authorization', 'configuration') rather than verb-based ('get_authorization', 'describe_configuration'), making intent ambiguous. 10 of 11 tools have empty input schemas (no properties), violating the pattern:tool requirement that parameters be described. The 'routes' tool is the only exception with 4 documented filter parameters. Descriptions are present but generic (e.g., 'Authorization context collector', 34 chars, below the 50-char baseline for clarity). No error recovery guidance, no output schema documentation, and no indication of what data structure each tool returns. Tool composition is sound (each does one thing), but the interface lacks the LLM-optimization needed for reliable agent selection and parameter binding.
Authorization context collector
Configuration context collector
Database schema context collector
Dependencies context collector
Jobs, events, and schedules context collector
Migrations context collector
Models context collector
Project info context collector
Routes context collector
10 of 11 tools have empty input schemas (no properties defined). Per HARD SCORING RULE, schema score must be 0 for tools with no input schema. This violates pattern:constrained-input and pattern:tool-description.
Tool names are noun-based ('authorization', 'configuration') rather than verb-based action names ('get_authorization', 'describe_configuration'). This makes intent ambiguous for LLM tool selection.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 33 | 2026-07-28+ | v2 |
Subsystems context collector
Tests context collector
Descriptions are generic and under 50 characters (baseline p10=34, p90=392). E.g., 'Authorization context collector' (34 chars) does not explain WHAT data is returned, WHEN to call it, or WHY it differs from other tools. Per pattern:tool-description, descriptions must be 10 - 1024 chars and answer what, when, and why.
No output schema documentation visible. LLMs cannot plan downstream tool calls or extract data without knowing what fields each tool returns. Per pattern:tool, output schemas must be documented.
Error handling in AuditTool.handle() returns generic 'Error collecting context: <message>' without recovery guidance. Per pattern:recovery-guide, errors must tell the LLM what to do next (retry, ask user, or fatal).