MCP server that audits Excel workbooks — formula dependency tracing, circular-reference detection, and risk smells (INDIRECT, hardcoded constants, external links). Reviews the model, not the data.
Four well-defined tools with clear, domain-specific descriptions (avg 156 chars). All tools have explicit input schemas with typed parameters and descriptions. Naming follows verb_noun pattern (workbook_overview, list_formulas, trace_cell, audit_workbook). Error handling via guarded() wrapper catches exceptions and returns isError flag. However, output schemas are not formally documented, responses are JSON-stringified but structure is implicit. Parameters lack enums and some constraints (e.g., cell address format). No tool annotations (readOnlyHint). Missing pagination guidance for list_formulas despite accepting limit parameter.
Risk report across the whole model: circular references (with example chains), volatile functions (INDIRECT/OFFSET/NOW/RAND...), hardcoded constants inside formulas, external workbook links, merged cells, very long formulas.
Formulas with addresses and cached values. Filter with `contains` (e.g. 'INDIRECT', 'VLOOKUP') and/or `sheet`.
Audit one cell: its formula and cached value, precedents (cells and ranges it reads), and dependents (formulas that read it, directly or via a range). Address like 'Summary!B14'; unqualified addresses use the first sheet.
Structure of an .xlsx workbook: sheets with dimensions and formula counts, defined names, external workbook links, merged cells. The map you need before tracing or auditing.
Output schemas not formally documented. Responses are JSON-stringified but structure (sheets, formulas, precedents, etc.) is implicit. LLMs cannot plan downstream operations without knowing return field names and types.
No tool annotations (readOnlyHint). All four tools are read-only and should declare this via inputSchema.readOnlyHint=true to signal safety to agents.
Cell address parameter (trace_cell) lacks format constraint. Description says 'e.g. B14 or Summary!B14' but no regex pattern or enum. LLMs may pass invalid formats like 'B-14' or 'Sheet1.B14'.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 60 | 2026-07-28+ | v2 |
list_formulas accepts limit (1 - 200) but no pagination cursor or offset. If totalMatches > limit, agent cannot fetch remaining results. Should return next_cursor or offset for continuation.
Error messages from guarded() wrapper are raw exception text. Should categorize errors (retryable vs user-fixable) and provide recovery guidance, e.g., 'File not found. Check the path and try again.'