OAuth 2.1 Authorization Server for AI agents with support for identity-chaining, transaction-tokens, RFC 8693 delegation, DPoP, and MCP
Three tools with minimal documentation. All have descriptions (10-20 chars baseline), but lack depth and context. Input schemas present but sparse: 'search' and 'summarize' have basic parameter definitions; 'search_with_auth' has only a query string. No output schemas documented. No error handling guidance, no parameter constraints (enums, ranges), no idempotency hints. Tool names are action-verb based (search, summarize) which is good, but descriptions are too terse to guide LLM selection. The 'search_with_auth' description is domain-specific (authgent token chaining) but lacks actionable guidance on when to use it vs 'search'. No evidence of pagination, result limits, or composition patterns.
Search the corpus.
Search a downstream resource that itself requires an authgent token. The token's `act` chain shows: Claude Desktop → this MCP server → downstream search service. Audit logs at every hop see the full chain because authgent's RFC 8693 nested-act exchange ran for free.
Summarize text. Required scope: ``summarize:execute``.
Descriptions are too terse (10-20 chars). 'Search the corpus' and 'Summarize text' lack context on when to use each tool, what corpus/text means, and what output to expect.
No output schemas documented. LLMs cannot plan downstream calls or extract results without knowing what fields are returned (e.g., does search return 'results' or 'items'? Does summarize return 'summary' or 'text'?).
Parameter 'max_results' has no constraint documentation. Unbounded integers let LLMs pass absurd values (e.g., 999999) that break APIs or cause timeouts.
No error handling guidance. If search returns zero results or summarize fails on malformed text, LLMs have no recovery path.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 50 | <=2025-11-25 | v2 |
'search_with_auth' description mentions RFC 8693 and audit logs but does not explain when to use it instead of 'search'. LLMs will struggle to disambiguate.