MCP server with SpiceDB authorization on every tool call. Exposes four tools (list_documents, read_document, edit_document, approve_refund), each gated by an AuthZed Cloud permission check.
Four tools with basic descriptions and minimal parameter documentation. All tools have descriptions (10-50 chars baseline), but lack depth on WHEN to use them and what they return. Input schemas present but sparse: list_documents has empty input {}, others have 1-2 string params with minimal constraint info. No output schemas documented. Error handling returns permission-denied strings but lacks recovery guidance or actionable next steps. No tool annotations (readOnlyHint, destructiveHint, idempotentHint). Naming is clear (verb_noun pattern) but descriptions are too terse to guide LLM selection effectively.
Approve a billing refund. Requires approve permission. This is a high-risk operation: only explicitly authorized approvers can execute it. Team membership alone is not sufficient.
Update a document's content. Requires write permission.
List all documents the current user can read. Uses SpiceDB LookupResources to find accessible documents.
Read a document's content. Requires read permission.
No output schemas documented. LLMs cannot plan downstream calls or extract structured data from responses.
Descriptions lack WHEN/WHY context. 'Read a document's content' does not explain when to call this vs list_documents, or what the LLM should do with the returned content.
Error responses are strings, not structured errors. 'Permission denied (insufficient_scope)' lacks recovery guidance. Should suggest: 'Try list_documents() to see accessible resources' or 'Contact admin for approval access.'
No tool annotations. approve_refund is destructive/irreversible but lacks destructiveHint=true. read_document is read-only but lacks readOnlyHint=true. Agents cannot distinguish safe from risky tools.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 58 | 2026-07-28+ | v2 |
Parameter descriptions are minimal. 'The document to read (e.g. "q1-report")' includes an example value; LLMs may reuse 'q1-report' literally in real calls. Use enum or pattern constraint instead.