Policy-aware OAuth 2.1 MCP gateway for Microsoft 365 operated by 21Vianet
Critical gaps across all dimensions. Tool definitions are inferred from benchmark scripts rather than explicit schema registration in source code. No visible input schemas, parameter descriptions, or output documentation. Descriptions are minimal (10-50 chars) and lack LLM-optimized guidance on WHEN to use each tool or WHAT it returns. No error handling patterns, no pagination support visible, no parameter validation rules. The server exposes 12 tools but provides almost no structured metadata to guide agent selection or composition.
Check current authentication status
List events from user calendar
Confirm execution of a sensitive operation
Search items in user OneDrive
Execute a tool through the gateway
Get detailed schema for a specific tool
Search available tools in discovery mode
No input schemas visible in source code. All 12 tools scored 0 for schema, cannot verify parameter types, constraints, or descriptions. Tool definitions appear inferred from benchmark scripts only, not explicitly registered with MCP SDK.
Descriptions are minimal (10 - 50 chars) and lack LLM-optimized guidance. No explanation of WHEN to use each tool, WHAT it returns, or HOW it differs from similar tools. E.g., 'List messages from user mailbox' does not explain pagination, filtering, or output structure.
Inferred effective spec: 2026-07-28+.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 41 | 2026-07-28+ | v2 |
Get current user profile information from Microsoft Graph
List messages from user mailbox
Search messages in user mailbox
Detect calendar scheduling conflicts
Generate intelligent mail digest summary
No visible error handling patterns. No recovery guidance, error classification (retryable vs fatal), or actionable error messages. Agents cannot determine whether to retry, ask user, or abort.
No pagination support visible. List tools (mail_list_messages, calendar_list_events, drive_search_items) lack limit, offset, page_size, or cursor parameters. Large result sets will blow context windows.
Tool composition risk: gateway_execute_tool accepts arbitrary tool names and parameters, but no visible validation, rate limiting, or permission checks. Agents could invoke unintended tools or exhaust quotas.