Loading ToolBench

Reading the current corpus…

firmauy-mcp-inspect MCP server · D · ToolBench

firmauy-mcp-inspect

github.com/carlosplanchon/firmauy-mcp-inspect

Read-only MCP server that brings FirmaUY signature inspection to your AI assistant. Offline, no smart card, no signing, redacted by default.

2026-07-28+STDIO2 tools

56/100

Definition Quality58

Protocol Readiness50

SupportabilityNot measured-

Spec posture

Inferred effective spec 2026-07-28+·current baseline 2026-07-28

Static source inference · medium confidence

Current-spec patterns detected

Summary

Two tools with clear, domain-specific purposes and reasonable descriptions (inspect: 156 chars, validate_cedula: 95 chars). Both have documented input schemas with type and description fields. However, output schemas are not visible in the source code provided, only input schemas are shown. Parameter descriptions are present but minimal (e.g., 'Path to the signed file' lacks format/constraint details). No error handling guidance, no parameter validation rules, and no recovery hints documented. Tool names follow verb_noun pattern (inspect, validate_cedula) appropriately for read-only operations. Missing: output schema documentation, error classification, and actionable error messages.

Tools (2)

inspectread only50/100

Verify a signature on a file and report what was signed, by whom, when, and whether the signature is valid.

validate_cedularead only50/100

Validate a Uruguayan cédula (national ID) check digit.

Issues (5)

HIGHtool ↗

Output schemas not documented. LLMs cannot plan downstream tool calls or extract structured data without knowing what fields to expect from inspect() and validate_cedula().

inspectvalidate_cedula

HIGHconstrained-input ↗

Parameter descriptions lack format/constraint details. 'Path to the signed file' does not specify accepted file types (PDF, XML, ASiC), character limits, or path format. 'A Uruguayan cédula number' does not clarify format (digits only? with/without hyphens?) or length.

inspectvalidate_cedula

HIGHrecovery-guide ↗

No error handling guidance. Tools do not document what errors can occur (invalid file, corrupted signature, malformed cédula), how to classify them (retryable vs user-fixable), or what the LLM should do next.

inspectvalidate_cedula

MEDIUMconstrained-input ↗

Missing parameter constraints. 'original' parameter in inspect is optional but no enum or pattern validates file paths. LLMs may pass invalid paths without guidance on format.

Recommendations

Document output schemas for both tools. For inspect(), specify fields like: is_valid (boolean), signer_name (string, redacted by default), signature_timestamp (ISO 8601), signature_type (string: PAdES|XAdES|CAdES), and any error details. For validate_cedula(), specify: is_valid (boolean), cedula_with_check_digit (string).
Enhance parameter descriptions with format constraints. For 'file': 'Path to a signed file (PDF, XML, ASiC, or detached signature container). Must be an absolute or relative path; max 4096 chars.' For 'cedula': 'A Uruguayan cédula number (8 digits, optionally with check digit; e.g., 12345678 or 12345678-9).'
Add error classification and recovery guidance. Document: 'If the file is corrupted or signature is invalid, inspect() returns is_valid=false with error_reason. If the file path does not exist, returns a file_not_found error, verify the path and retry.'
Clarify PII redaction behavior. The code mentions FIRMAUY_MCP_ALLOW_PII environment variable but tool descriptions do not explain that signer names are redacted by default. Add: 'Signer name and document number are redacted unless FIRMAUY_MCP_ALLOW_PII is set at server startup.'
Add dependency hints for multi-step workflows. E.g., 'Call inspect() first to verify a signature; if valid, you can trust the signer identity and timestamp for downstream compliance checks.'

Score history

Overall score trend

First recorded score · v2 rubric

56/100

Scored	Grade	Overall	Spec posture	Rubric
2026-09-23	D	56	2026-07-28+	v2