MCP gateway server that routes tool calls to downstream MCP servers, with session management, OAuth authentication, tool discovery, and customization capabilities
Gateway server exposes 6 tools with basic descriptions and schemas, but significant quality gaps limit production readiness. Tool names follow verb_noun convention (gateway_search, gateway_call), but descriptions are generic and lack actionable context. Input schemas are present but minimal, most parameters lack detailed type constraints, ranges, or validation guidance. Critical security tool (gateway_run_code) has no safeguards documented. Error handling is absent from visible code. Output schemas are not documented. Composition is reasonable (each tool has one responsibility), but parameter descriptions do not guide LLM selection or explain when to use each tool vs. alternatives.
Call a specific tool on a downstream server
Get help information about available tools and gateway capabilities
List all available downstream servers in the current namespace
Execute JavaScript code in an isolated VM context
Search for tools across downstream servers by name and description
Search for a tool and immediately call it with provided arguments
gateway_run_code lacks security documentation and safeguards. No mention of sandbox limits, timeout, memory constraints, or what code can/cannot access. Executing arbitrary JavaScript is high-risk; description must detail isolation guarantees and restrictions.
gateway_search_and_call combines two responsibilities (search + call). Naming convention 'and' signals multiple concerns. Should split into separate tools so agent can compose them independently.
Parameter descriptions are generic and lack actionable guidance. 'Arguments to pass to the tool' does not explain format, constraints, or how to construct valid arguments. LLMs cannot infer parameter structure from vague descriptions.
Inferred effective spec: 2025-06-18+.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 47 | 2025-06-18+ | v2 |
No output schemas documented for any tool. LLMs cannot plan downstream calls or extract required fields without knowing response structure. gateway_list_servers, gateway_search, and gateway_call must document what fields they return.
No error handling guidance visible. Tools do not document what errors can occur, whether they are retryable, or what the LLM should do next. Error responses must include recovery hints.