Minimal MCP stdio server for the Cyfrin Solodit Findings API
Single tool 'search_findings' has a well-structured input schema with proper Zod validation and comprehensive filter options. Description is adequate (118 chars) but generic. Parameter descriptions are present and mostly clear, though some lack actionable constraints. Output schema is not explicitly documented, the code trims findings but LLMs cannot see the return structure. Error handling is minimal; network failures and PDF parsing errors are caught but responses lack recovery guidance. No tool annotations (readOnlyHint, etc.) despite READ_ONLY risk classification.
Search for security findings from the Solodit database with optional filters and content extraction
Output schema not documented. Code trims findings and extracts nested fields (tags, finders, protocol_categories) but LLMs cannot see the return structure. This forces agents to guess field names and types.
Error responses lack recovery guidance. PDF fetch failures, HTML parsing errors, and API errors return raw messages without suggesting next steps (e.g., 'Try without includeReportText' or 'Check the source_link field').
Tool marked READ_ONLY but lacks tool annotations. MCP spec supports readOnlyHint to signal safety; absence forces LLMs to infer intent from description alone.
Parameter 'reportTextMaxChars' lacks minimum/maximum constraints in description. Code enforces min(1) but description does not state upper bound or typical values (e.g., '1-50000').
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 58 | 2026-07-28+ | v2 |
Nested filter object lacks per-field descriptions. 'minFinders' and 'maxFinders' are strings (not numbers) due to preprocess logic, but description does not explain this type mismatch or why string conversion is needed.