A real MCP server protected by AgentsID with per-tool permission enforcement
Demo server has 5 tools with basic schemas and descriptions. All tools have names starting with action verbs (search_, save_, list_, delete_, admin_). Descriptions are present but minimal (10-30 chars), below the 50-200 char baseline for LLM-optimized docs. Input schemas exist but are sparse: most parameters lack detailed constraints, enums, or format guidance. No output schemas documented. Error handling is absent, no recovery guidance, no categorization of retryable vs fatal errors. The destructive tools (delete_note, admin_reset) lack confirmation patterns or dry-run support. Tool composition is reasonable (each does one thing), but parameter descriptions are generic.
Reset all notes — DANGEROUS
Delete a note by ID
List all notes
Save a new note
Search through notes by keyword
Descriptions are too short (10-30 chars), below 50-char minimum for LLM clarity. 'Search through notes by keyword' and 'Save a new note' lack context on when to use each tool vs alternatives, expected return format, or prerequisites.
No output schemas documented. LLMs cannot plan downstream calls or extract data without knowing what fields search_notes, list_notes, or save_note return. Missing return type definitions violate baseline 100% of A+ tools have documented return types.
Destructive tools (delete_note, admin_reset) lack confirmation or dry-run patterns. Agents can irreversibly delete all notes without a safety gate. No error recovery guidance provided.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 51 | 2026-07-28+ | v2 |
Parameter descriptions are minimal or absent. 'query' in search_notes has a 1-word description. 'id' in delete_note lacks format guidance (is it numeric, UUID, string?). No constraints on title/content length, query format, or id range.
No error handling or recovery guidance. If delete_note fails (note not found, permission denied), the LLM receives no actionable error message or next steps. No categorization of retryable vs fatal errors.