MCP server for generating and reviewing Korean employment contracts with local personal information masking and protection
Korean-contracts has clear intent (PII masking for contract workflows) but suffers from critical definition gaps. Tool names lack action verbs (mask_personal_info is acceptable, but save_contract and load_contract_for_review are vague about what 'save' and 'load' mean in context). Descriptions are present but generic, they explain the Korean workflow rather than guiding LLM tool selection. Critically, input schemas are INFERRED from docstrings, not explicitly visible in the code. The `contract_data` parameter in mask_personal_info accepts a dict with no schema constraints, LLMs cannot validate structure. Output schemas are undocumented. Error handling is minimal (only session_id lookup failure shown). No parameter descriptions for most inputs (e.g., output_dir defaults to ~/Desktop with no guidance on format). Security concern: session_id is a weak identifier stored in-memory; no audit trail or permission checks.
로컬 계약서 파일을 읽어 개인정보를 마스킹한 뒤 Claude에 전달할 안전한 텍스트를 반환한다. 원본 파일은 로컬에만 유지된다.
계약서 입력 데이터에서 개인정보를 마스킹 토큰으로 치환한다. Claude에게 전달할 안전한 사본과 복원용 매핑을 반환한다.
Claude가 생성한 마스킹된 계약서 텍스트에 실제 개인정보를 복원한 뒤 로컬 파일로 저장한다. Anthropic 서버에는 복원된 계약서가 전달되지 않는다.
Claude가 수정·검토한 마스킹 계약서 텍스트에 원본 개인정보를 복원한 뒤 저장한다.
Input schemas are inferred from docstrings, not explicitly registered. The `contract_data` parameter in mask_personal_info is a bare dict with no JSON Schema constraints. LLMs cannot validate structure or know required fields.
Output schemas are completely undocumented. Tools return dicts with fields like 'session_id', 'masked', 'status', 'txt_path', 'docx_path', but LLMs have no schema to parse or plan downstream calls.
Tool names lack clarity. 'save_contract' could mean persist to database, upload to cloud, or write locally. 'load_contract_for_review' is passive, does it fetch, parse, or transform? Action verbs should be explicit: 'create_masked_contract', 'restore_and_save_contract', 'read_and_mask_contract'.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 38 | 2026-07-28+ | v2 |
Parameter descriptions are missing or minimal. 'output_dir' defaults to ~/Desktop with no guidance on format (absolute path? relative? expanduser applied?). 'contract_type' is described as 'prefix' but no examples or constraints given. 'file_path' accepts txt/docx/md but no validation shown.
Error handling is minimal. Only session_id lookup failure is shown. No guidance on what to do if file_path is invalid, docx parsing fails, or session expires. Errors should be actionable: 'Session expired. Call mask_personal_info() again to create a new session.'