A Gradio-based customer support chatbot that connects to a remote MCP server for product information, customer management, and order processing
8 tools with consistent naming (verb_noun pattern) and descriptions present. All tools have input schemas with typed parameters and descriptions. However, output schemas are completely undocumented, LLMs cannot plan downstream calls or extract structured data. Parameter descriptions lack constraints (enums, ranges, formats). No error handling guidance. Security concern: verify_customer_pin exposes sensitive authentication flow without confirmation pattern. Missing idempotency hints for create_order.
Place a new order
Look up customer details
Get detailed order information
Get detailed info for a specific product (SKU format: "MON-0054", "COM-0001")
View orders (status: draft/submitted/approved/fulfilled/cancelled)
Browse products, optionally filter by category (e.g., "Monitors", "Computers")
Search products by keyword
Verify customer identity with email and 4-digit PIN
Output schemas completely undocumented. LLMs cannot infer what fields each tool returns, breaking downstream tool chaining and forcing wasteful discovery calls.
Parameter descriptions lack formal constraints. 'category' accepts free-form strings instead of enum (Monitors, Computers, Printers, Accessories). 'status' in list_orders lacks enum constraint. LLMs will hallucinate invalid values.
verify_customer_pin lacks confirmation/dry-run pattern. Sensitive authentication flow exposed directly to LLM without explicit user confirmation step. No guidance on failed verification recovery.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 51 | <=2025-11-25 | v2 |
create_order (WRITE operation) lacks idempotency hint and error recovery guidance. No documentation of what happens on retry, whether duplicate orders are created, or how to detect/undo partial failures.
No pagination support documented for list_products and list_orders. Large result sets will blow context window. Missing limit/offset parameters and total_count in responses.