Governed MCP server for IP cameras (VAPIX + ONVIF SOAP): fail-closed per-agent policy, hash-chained signed receipts on every call — including denials.
Server has 11 tools with basic naming (verb_noun pattern) and descriptions present. However, parameter descriptions are minimal or absent for most tools. Input schemas are visible but lack detail: most parameters have only type and description fields, with no enums, ranges, or constraints. Output schemas are not documented. Error handling is minimal, no recovery guidance or actionable error messages. The server implements a sophisticated receipt/audit system (hash-chained, ed25519-signed) which is a security strength, but this does not compensate for weak tool definitions. Descriptions average ~50 chars (below the 194-char baseline for A+ tools). No tool has comprehensive parameter documentation matching production standards.
Apply a commissioning plan to a camera
Plan a camera commissioning operation from a spec
Verify a commissioning operation succeeded
Capture baseline configuration for a camera
Compare current camera configuration against baseline
Apply a configuration parameter change to a camera
Retrieve the hash-chained receipt log
Output schemas not documented. LLMs cannot infer what fields each tool returns, forcing them to guess downstream field names and risk broken tool chains.
Parameter descriptions are minimal (avg ~20 chars). 'Camera ID' and 'Spec reference' lack context on format, constraints, or how to obtain valid values. LLMs cannot self-correct invalid inputs.
No enums or constraints on string parameters. 'camera' and 'preset' accept free-form strings with no validation hints. LLMs will hallucinate invalid camera IDs or preset names.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 56 | 2026-07-28+ | v2 |
Capture a snapshot from a camera
List all configured cameras with their metadata
Move camera pan/tilt/zoom by relative amounts
Move camera to a named preset position
No error handling guidance. Tools fail silently or with generic errors. No recovery hints (e.g., 'Camera not found. Call list_cameras() to see available cameras').
Numeric parameters (pan, tilt, zoom in ptz_move; limit in get_receipts) lack range constraints. No min/max documented. LLMs may pass out-of-bounds values.