A Kotlin/Ktor-based authentication and domain management service for agent registration, API key management, and domain verification
Critical gaps across all dimensions. Tool definitions lack input schemas (only 3 of 25 tools show any schema), descriptions are minimal (most under 50 chars), and parameter documentation is absent. No evidence of error handling guidance, output schema documentation, or security patterns. The server exposes 25 tools with almost no structured metadata for LLM consumption. This is far below production baseline.
Admin endpoint to re-verify all domains and manage lifecycle (warning/removal)
Delete an agent
Issue a new agent registration
Revoke an agent's key
Rotate an agent's cryptographic key
List keys for an agent
Get agent status
Update agent configuration
Missing input schemas for 22 of 25 tools. Only domain_claim, domain_delete, and domain_verify show any parameter schema. LLMs cannot infer valid inputs without explicit JSON Schema definitions.
Descriptions are minimal (10-30 chars) and lack actionable context. No explanation of WHEN to use each tool, WHAT it returns, or dependencies. E.g., 'Verify a challenge response' does not explain what a challenge is or what success looks like.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 31 | 2026-07-28+ | v2 |
List agents for authenticated user
Create a new API key
List API keys for authenticated user
Revoke an API key
Exchange authentication code for tokens
Logout current user
Get current authenticated user information
Refresh authentication tokens
Send authentication code to user
Verify authentication code
Verify a challenge response
Claim a domain for verification
Delete a claimed domain
Verify domain ownership via DNS TXT record
List domains for authenticated user
Register a public key for an agent
List user sessions
No output schema documentation visible. LLMs cannot plan downstream tool calls or extract required fields (e.g., agent_id, domain_id) without knowing response structure.
No error handling guidance. Tools like auth_send_code, api_key_revoke, and agent_delete are destructive or have failure modes, but no documentation explains what errors are retryable, user-fixable, or fatal.
No security documentation. Tools handle authentication tokens, API keys, and domain verification but lack descriptions of permission requirements, scope declarations, or audit trail guidance.