Security and conformance testing for MCP servers
This is a test harness, not a production MCP server. It deliberately includes malformed and vulnerable tools for testing purposes. Of 11 tools, 5 are intentionally broken (null_schema_tool, bad name with spaces, echo_unsafe, run_command, no_validation, run_command_shell, hang). The 3 good tools (echo, add, greet) have minimal descriptions (10-50 chars, below the 50-200 char baseline for LLM optimization) and lack parameter descriptions entirely. No output schemas documented. No error handling guidance. Tool names lack action verbs (echo, add, greet are weak; run_command_shell is destructive without confirmation pattern). This server is designed to fail conformance tests, not to serve production agents.
Add two numbers and return the result as a string.
Tool name violates naming rules.
Echo the input message back.
Echo tool that skips input sanitisation.
Greet someone. The greeting parameter is optional.
Sleeps indefinitely to test harness timeout handling.
Tool that skips all input validation.
null_schema_tool has null inputSchema, violating MCP spec requirement that inputSchema must be a dict
Tool name 'bad name with spaces' violates naming rules (must match ^[A-Za-z0-9_\-.]{1,128}$)
All tool descriptions are under 50 characters (baseline 50-200 for LLM optimization). Descriptions lack context for agent selection and do not explain WHEN to use each tool vs alternatives
No parameter descriptions provided for any tool. LLMs cannot infer what 'message', 'command', 'path', 'value', 'count', 'duration' mean without explicit descriptions
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 39 | 2025-06-18+ | v2 |
Tool with null inputSchema — violates spec.
Simulates a file-reading tool vulnerable to path traversal.
Simulates a command-running tool vulnerable to shell injection.
Intentionally shell-injection-vulnerable tool for harness self-testing.
Destructive/dangerous tools (run_command, run_command_shell, read_file with path traversal risk) lack confirmation patterns, dry-run modes, or permission gates. No error handling guidance for recovery