MCP server for file management operations including listing, creating, reading, and deleting notes
Server has 4 tools with basic schemas and descriptions, but significant quality gaps. All tools have descriptions (10-50 chars, below the 50-200 char baseline for LLM optimization). Input schemas use Zod validation but lack proper JSON Schema type declarations visible in the registration. No parameter descriptions provided in any tool. list_files has an empty input schema {}. No output schemas documented. Error handling is absent, tools will fail silently or throw unhandled exceptions. No security validation (path traversal risk in filename parameters). Naming is adequate (verb_noun pattern) but descriptions are too terse to guide LLM selection effectively.
Create or update a note file with the specified filename and content
Delete a note file
List all files in the notes directory
Read the contents of a note file
list_files has empty input schema {}, no parameters defined or validated. Violates pattern:constrained-input and pattern:tool-description.
All tool descriptions are under 50 characters (baseline 50-200 chars). Descriptions like 'List all files in the notes directory' lack context for LLM selection. Missing WHEN to use, prerequisites, and return structure guidance.
No parameter descriptions provided. 'filename' parameter appears in 3 tools but has no description explaining format, constraints, or allowed values. LLMs cannot infer whether to pass 'notes.txt', './notes/file.txt', or 'U12345'.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 39 | 2026-07-28+ | v2 |
No error handling or recovery guidance. delete_note and create_update_note perform destructive/write operations but provide no confirmation, dry-run, or error classification. Violates pattern:confirmation-request and pattern:error-classification.
Path traversal vulnerability: filename parameter is not validated. An LLM could pass '../../../etc/passwd' and read/write outside NOTES_DIR. Violates pattern:tool-gateway (sanitize untrusted input).