Policy-governed MCP wrapper that evaluates and audits tool calls before forwarding to an upstream MCP server. Implements access control, policy enforcement, and request review workflows.
Two tools with minimal documentation. list_tools_handler has a basic description but no input schema (trivial, no params). call_tool_handler has a description and visible input schema with tool_name and arguments, but both descriptions lack depth on WHEN to use, error recovery, and prerequisites. No parameter descriptions beyond the schema. No output schema documented. No error handling guidance. Descriptions are 80 - 150 chars, below the 194-char baseline for production tools. No tool annotations (readOnlyHint, destructiveHint). Tool names lack verb clarity: 'list_tools_handler' and 'call_tool_handler' are implementation-focused, not user-intent-focused.
Proxies tool calls to the upstream MCP server after policy enforcement and audit logging. Validates input, enforces policies, logs requests, and tracks execution status.
Lists all available tools from the upstream MCP server, sorted by name
No input schema for list_tools_handler; no output schema documented for either tool. LLMs cannot infer what fields to expect in responses, breaking downstream tool chaining.
call_tool_handler accepts generic 'arguments' object with no field-level descriptions. LLMs cannot determine what keys/types are valid without trial-and-error.
Tool names are implementation-focused ('list_tools_handler', 'call_tool_handler') rather than user-intent-focused. Should be 'list_tools' and 'call_tool' or 'proxy_tool_call'. Handler suffix is internal jargon.
No error handling guidance. call_tool_handler can fail with PolicyBlockedError, PolicyDeniedError, PolicyTimeoutError, or upstream execution errors, but descriptions do not explain recovery steps or error categories.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 38 | <=2025-11-25 | v2 |
No tool annotations (readOnlyHint, destructiveHint, idempotentHint). call_tool_handler is destructive (proxies arbitrary tool calls) but lacks annotation to signal this to clients.