A Model Context Protocol server for code contract verification and policy enforcement using static analysis
Guard MCP has well-structured schemas with Zod validation and clear parameter constraints (enums, min/max bounds). Tool names follow verb_noun convention (verify_code, verify_changed_files, generate_contract_rules). However, descriptions are terse (10-50 chars), lacking context on WHEN to use each tool and what distinguishes them. Parameter descriptions exist but are minimal. Output schema is documented via TypeScript types but not exposed in tool registration. Error handling returns structured responses but lacks recovery guidance (e.g., 'spec not found' doesn't suggest how to generate one). No tool annotations (readOnlyHint/destructiveHint) despite clear risk profiles.
Generate contract rules from source code analysis
Verify all changed files in the workspace against contract rules
Verify a single code file against contract rules and return violations
Tool descriptions are under 50 characters and lack context on when to use each tool. 'Verify a single code file against contract rules and return violations' (verify_code) does not explain when to call it vs verify_changed_files, or what prerequisites exist.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint) despite clear risk profiles. generate_contract_rules is marked WRITE but tool registration does not declare this. Agents cannot infer safety/idempotency.
Error responses lack recovery guidance. When spec is not found, the tool returns 'spec not found at <path>' but does not suggest calling generate_contract_rules or explain the auto_generate_spec flag behavior.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 48 | 2026-07-28+ | v2 |
Output schema is defined in TypeScript types (PolicyResultView, VerifyCodeResultSchema) but not exposed in tool registration. LLMs cannot see what fields to expect without reading implementation code.
Parameter descriptions are minimal (e.g., 'Profile for spec generation' for profile param). No guidance on which profile to use when, or what each profile enables.