MCP server exposing apex-forge tools via the Model Context Protocol with role-based tool registration (admin, developer, pm)
Critical gaps across all dimensions. Tool definitions are inferred from registration calls rather than explicitly visible in source. No input schemas are visible in the provided code, cannot verify parameter types, constraints, or descriptions. Tool descriptions are generic and lack actionable context (e.g., 'Task execution tools including...' does not explain WHEN to use each tool or what it returns). No output schemas documented. Error handling patterns absent. Security considerations (secret injection, permission gates, audit trails) not evident. The server registers 4 tools but source code for task.ts, memory.ts, browse.ts, status.ts is not provided, only file paths are listed. Per HARD SCORING RULE: if tool definitions are inferred rather than directly visible, cap per-tool scores at 50. Since no actual schemas or detailed descriptions are visible, all tools score 0-20 on schema and description dimensions.
Browse and QA tools for testing and verification
Memory management tools for storing and retrieving project knowledge and learned patterns
Status and telemetry tools available to all roles
Task execution tools including task creation, assignment, status updates, and verification
No input schemas visible in source code. Cannot verify parameter types, constraints, enums, or descriptions.
Tool descriptions are generic category labels ('Task execution tools including...') rather than actionable docstrings. Do not explain WHAT each tool does, WHEN to use it, or what it returns. Descriptions under 20 chars or generic category text score 0-20.
Tool definitions are inferred from registration calls (registerTaskTools, registerMemoryTools, etc.) but actual tool implementations are not provided in source. Cannot verify naming conventions, parameter descriptions, or error handling.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 25 | 2026-07-28+ | v2 |
No evidence of error handling patterns. No recovery guidance, error classification (retryable vs user-fixable vs fatal), or actionable error messages visible in server code.
No security patterns evident: no secret injection, no permission gates, no audit trail logging, no input sanitization visible. Tool descriptions do not declare required permissions (read:*, write:*).