A deterministic layer between untrusted content and agent actions: it removes the hidden layer, remembers where data came from, and keeps calls inside the boundaries of the intent.
All three tools have empty input schemas (no properties defined) and minimal descriptions (10-30 chars). No parameter documentation exists. Tools are defined in a test fixture (fake-server.mjs), not production code. Naming is non-standard: 'poisoned_page' and 'mystery_box' do not follow verb_noun convention. No output schemas documented. This is a test harness, not a production MCP server.
Return something odd.
Fetch a product page. Returns the page text.
Set the price of an item.
All tools have empty input schemas: inputSchema: { type: 'object', properties: {} }. No parameters are defined, documented, or constrained.
Tool descriptions are under 20 characters and lack actionable context. 'Fetch a product page. Returns the page text.' (47 chars) does not explain when to use it vs other tools or what data it returns.
Tool names do not follow verb_noun convention. 'poisoned_page' and 'mystery_box' are nouns, not action verbs. Should be 'fetch_page', 'get_page', 'set_price', 'get_mystery_box'.
No output schemas documented. Callers cannot know what fields to expect from tool responses. update_price returns 'done: {...}' as plain text; poisoned_page returns HTML; mystery_box returns base64 image data.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 29 | 2026-07-28+ | v2 |
Tools are defined in test fixture (tests/adapters/mcp/fake-server.mjs), not in production source code. Tool definitions are inferred from JSON-RPC responses, not explicitly registered in src/.