Hosted, OAuth-gated multi-tenant gateway for the quantakrypto MCP server. Better Auth (Google + GitHub + email) issues 30-day access tokens; the MCP endpoint runs behind withMcpAuth in the same process.
Critical gaps across all four tools. No input schemas are visible in the source code, only tool names and generic descriptions are provided. The descriptions are extremely brief (under 100 chars each) and lack actionable detail about parameters, expected inputs, outputs, or error handling. Tools are registered via `quantakryptoTools` from an external package (@quantakrypto/mcp), but their actual schemas, parameter definitions, and output structures are not visible in this codebase. Per the hard rules, tools without visible schemas score 0 on schema, and tools with descriptions under 20 chars score 0-20 on description. The gateway filters tools but does not define or document them.
Content-based analysis tool for checking dependencies (HTTP-safe, does not require filesystem access)
Content-based analysis tool for remediating findings (HTTP-safe, does not require filesystem access)
Content-based analysis tool for triaging findings (HTTP-safe, does not require filesystem access)
Content-based analysis tool for verifying fixes (HTTP-safe, does not require filesystem access)
No input schemas visible for any tool. Tools are imported from @quantakrypto/mcp package; their parameter definitions, types, and constraints are not present in this codebase and cannot be evaluated.
Tool descriptions are extremely brief and generic ('Content-based analysis tool for X'). They do not explain WHEN to use each tool, what parameters are required, what the output contains, or how tools differ from each other.
No output schemas documented. LLMs cannot plan downstream tool calls or extract required fields without knowing what each tool returns.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 39 | 2026-07-28+ | v2 |
No error handling guidance. Tools do not document what errors can occur, whether they are retryable, or what the LLM should do on failure.
Tool definitions are inferred from external package imports, not explicitly registered in this codebase.