Production-ready MCP server over HTTP (Flask) with scoped permissions, API key authentication, and example Portfolio Service tools demonstrating read, write, and destructive operations.
Three tools with basic schemas and descriptions, but significant gaps in parameter documentation and output schema clarity. Tool names follow verb_noun convention (portfolio_get_holdings, portfolio_add_position, portfolio_close_all). Descriptions exist but are brief (18-60 chars, below the 50-200 char baseline for LLM optimization). Input schemas present with types for all parameters, but parameter descriptions are minimal. No documented output schemas. Error handling exists at the server level but tools lack recovery guidance. Risk annotations (READ_ONLY, WRITE, DESTRUCTIVE) are present but not formalized in the schema.
Add a position to the portfolio. Mock Portfolio Service.
Close all portfolio positions. Destructive; requires confirm: true.
Get current portfolio holdings (read-only). Mock Portfolio Service.
Tool descriptions are too brief (18-60 chars vs. 50-200 char baseline). LLMs cannot determine when to select these tools or what they return. Example: 'Get current portfolio holdings (read-only). Mock Portfolio Service.' lacks context on return structure and use cases.
Output schemas are not documented. Tools return content arrays with text fields, but the structure is not formally declared. LLMs cannot plan downstream operations or extract structured data without knowing the response format.
Risk annotations (READ_ONLY, WRITE, DESTRUCTIVE) are metadata but not formalized in tool schema. The MCP spec supports toolAnnotations (readOnlyHint, destructiveHint, idempotentHint) which are absent. This prevents clients from enforcing safety policies.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 53 | <=2025-11-25 | v2 |
Parameter descriptions are minimal or missing context. 'Ticker symbol' for 'symbol' is adequate, but 'Number of shares' and 'Average cost per share' lack constraints (min/max, format). No guidance on valid ranges or formats for LLM input validation.
portfolio_close_all requires confirm=true but lacks recovery guidance in error responses. If an LLM passes confirm=false, the tool should return a clear error explaining the requirement, not a generic failure.