MCP server providing health checks, identity profiles, and authentication session management with widget-based UI rendering
All 5 tools have zero-parameter schemas with minimal descriptions (10-30 chars). No input validation, no parameter guidance, no output schema documentation. Tool names lack action verbs (health.check, identity.profile, auth.session use dot notation rather than verb_noun). Descriptions are too brief to guide LLM selection. No error handling guidance. Tool annotations present but insufficient to compensate for missing core definition quality.
Inspect the current OAuth token session
Check service reachability
Display inline health UI card
Inspect the current authenticated profile
Display inline profile UI card
All tool descriptions are under 20 characters (e.g., 'Check service reachability', 'Inspect the current authenticated profile'). Descriptions must be 10-1024 chars and explain WHAT, WHEN, and WHY to use the tool.
Tool names use dot notation (health.check, identity.profile) instead of verb_noun convention (check_health, get_profile). LLMs rely on action verbs to infer intent. Dot notation is ambiguous and does not follow production baseline (90% of A+ tools start with action verb).
All tools have empty input schemas (no properties, no required fields, additionalProperties=false). While technically valid for zero-parameter tools, there is no output schema documentation visible in the source. LLMs cannot plan downstream calls or extract return data without documented output structure.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 26 | 2025-06-18+ | v2 |
No error handling guidance in tool definitions. If auth.session fails due to missing OAuth token, the LLM receives no recovery hint (e.g., 'Call authenticate_user() first'). Error responses must guide the agent's next step.
Tool composition unclear. health.check and health.status_card appear to do similar things (check health, display health UI). No documentation distinguishes when to use each. Similar names (identity.profile vs identity.profile_card) risk LLM conflation.