A local-first security proxy for AI agents. Audit, policy, and secret detection for MCP tool calls.
This is a test/mock server, not a production MCP tool. All three tools are defined in test-support/mock-server.ts with minimal descriptions and incomplete schemas. 'echo' and 'leak_secret' have trivial descriptions (<20 chars). 'run_bash' description is 60 chars but marked FAKE. Input schemas are present but sparse: 'echo' has a single string param with description; 'leak_secret' has empty input {}; 'run_bash' has a command param. No output schemas documented. No error handling guidance. Tool names are acceptable (verb-noun style) but descriptions fail the 20-char minimum for two tools. This server appears designed to test the firewall's policy/audit layer, not to provide production-grade tools.
Echo back the provided text.
Return a string that (deliberately) contains a fake secret.
Run a shell command. (FAKE — this fixture never executes anything.)
Two tools have descriptions under 20 characters, violating minimum documentation standard. 'leak_secret' description is missing entirely.
'leak_secret' has empty input schema ({}), providing no parameter guidance to LLMs. Even a no-parameter tool should document what it returns.
No output schemas documented for any tool. LLMs cannot plan downstream calls or extract structured data without knowing return types.
'run_bash' is marked FAKE and never executes, yet is exposed as a callable tool. This is appropriate for testing but misleading in production context.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 44 | 2026-07-28+ | v2 |
No error handling guidance. Tools do not document failure modes, retryability, or recovery steps for LLMs.