A TypeScript framework for building stateless MCP servers — deploy to serverless and edge.
ViteMCP provides a framework for building MCP servers with HTTP transport and OAuth support. However, tool definitions are sparse and lack critical metadata. Only 1 of 5 tools has a visible input schema (greet with {name: string}). The remaining 4 tools (get-time, get-user-info x2, get-server-info) show empty input schemas {} with no parameter descriptions. Descriptions are present but minimal (10-50 chars), below the 50-200 char baseline for LLM optimization. No output schemas are documented. Tool naming follows verb_noun convention (get_*, greet) but lacks clarity on when to use similar tools (two get-user-info tools with identical names). Error handling, recovery guidance, and parameter constraints are not visible in the provided code samples.
Get information about this OAuth-enabled MCP server
Get current timestamp
Get user information (requires OAuth)
Get user information from OAuth token
Greet someone over HTTPS
Duplicate tool names: two 'get-user-info' tools with identical names but different implementations (oauth-integrated-server.ts vs oauth-server.ts). LLMs cannot distinguish between them and will select arbitrarily.
Four of five tools have empty input schemas ({}). No parameter descriptions, types, or constraints visible.
Tool descriptions are 10-50 characters, well below the 50-200 char baseline for LLM optimization. 'Get current timestamp' and 'Get user information (requires OAuth)' lack context on WHEN to use the tool, WHAT it returns, and any prerequisites beyond a bare statement.
Inferred effective spec: 2026-07-28+.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 52 | 2026-07-28+ | v2 |
No output schemas documented for any tool. LLMs cannot plan downstream tool calls or extract required fields (e.g., user_id for follow-up calls) without knowing the response structure.
No error handling guidance visible. Tools do not indicate what errors are retryable, user-fixable, or fatal. No recovery suggestions (e.g., 'If OAuth fails, check token expiration').