Reference MCP server for lease analysis. Published route structure; bring your own auth store and analyzer.
RenterShield defines 2 tools with clear action verbs and reasonable descriptions (194 - 250 chars, within baseline 34 - 392). Both tools have input schemas with Zod validation. However, parameter descriptions are missing entirely, the schema shows type but no explanation of what each parameter controls or its constraints. Output schemas are documented in TypeScript types but not exposed to MCP clients. Error handling is present but generic ('Unauthorized', 'Rate limit: {reason}'). No tool annotations (readOnlyHint, destructiveHint, idempotentHint) despite both being read-only operations.
Analyze a residential lease for clauses that may conflict with applicable tenancy law. Returns red flags with legal citations. Neutral, factual — not legal advice.
List jurisdictions supported by analyze_lease, with their governing legislation and applicable unit types. Free (no model call, but counts against rate limit to prevent enumeration abuse).
Parameter descriptions missing. 'text', 'jurisdiction', 'unitType' have no descriptions in the schema, LLMs cannot infer what values are valid or why each parameter exists.
No enum constraint on 'jurisdiction' parameter. Free-form string invites hallucinated values. Should declare valid jurisdictions (ontario, bc, nyc, texas, general) as an enum.
Output schema not exposed to MCP clients. RedFlag, AnalyzeLeaseOutput types exist in TypeScript but are not declared in the tool definition. LLMs cannot plan downstream operations without knowing the response structure.
No tool annotations. Both tools are read-only (no side effects), but readOnlyHint is not set. Agents cannot distinguish safe tools from destructive ones without explicit hints.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 59 | 2026-07-28+ | v2 |
Error messages lack recovery guidance. 'Unauthorized' and generic 'Rate limit: {reason}' do not tell the LLM what to do next (retry, ask user, abort). Should include actionable next steps.