Bun + TypeScript MCP gateway that bridges MCP clients to REST/OpenAPI backends and other MCP servers through one SSRF-safe, governed guard pipeline.
This server exposes 15 system management tools with significant definition gaps. Most tools lack visible input schemas in the provided source code, only search_tools and sys_list_tools show partial schema details. Descriptions are present but generic (10-50 chars for most system tools), failing to explain WHEN to use each tool or what distinguishes similar operations (e.g., sys_list_clients vs sys_get_client). No parameter descriptions visible for system tools. Tool names follow verb_noun convention (good), but lack clarity on prerequisites and error recovery. The server acts as a gateway/bridge, not a domain-specific tool suite, which limits the relevance of traditional tool patterns. Security-critical tools (sys_revoke_mcp_key, sys_register_client) lack permission documentation and confirmation patterns.
Search the tools available on this endpoint by keyword. Returns the best-matching tool names and descriptions ranked by relevance — call this first to find the exact tool to use, then call that tool.
Create a new tool bundle.
Create a new MCP API key.
Get detailed information about a specific bundle.
Get detailed information about a specific client.
Get details about a specific MCP API key.
Get system metrics and statistics.
Input schemas not visible for 14 of 15 tools. Only search_tools shows a partial schema. sys_list_* and sys_get_* tools have no documented input parameters, making it impossible for LLMs to know what arguments they accept.
Descriptions are generic and under 50 characters for most system tools (e.g., 'List all tools available in the system'). They lack context on WHEN to use each tool, what distinguishes similar operations, or what the output contains. LLMs cannot reliably select between sys_list_clients and sys_get_client without richer descriptions.
Inferred effective spec: 2025-06-18+.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 42 | 2025-06-18+ | v2 |
List audit log entries.
List all tool bundles.
List all registered MCP clients and REST backends.
List all MCP API keys.
List all tools available in the system, optionally filtered by client or bundle scope.
List recent traffic and request logs.
Register a new MCP client or REST backend.
Revoke an MCP API key.
Destructive tools (sys_revoke_mcp_key, sys_create_bundle, sys_register_client) lack confirmation patterns and permission documentation. No evidence of dry-run support or user confirmation steps before irreversible operations.
No parameter descriptions visible for any system tool. LLMs cannot infer what arguments sys_get_client, sys_list_traffic, or sys_list_audit_log expect (e.g., does sys_get_client take a client_id, client_name, or both?).
No error handling guidance visible. Tools do not document what errors are retryable, user-fixable, or fatal. No recovery hints (e.g., 'If client not found, call sys_list_clients first').