Code execution sandbox with MCP server adapters for wrapping MCP tools and executing JavaScript against them
Four tools with significant definition gaps. mcp_search_tools and mcp_get_tool_details have reasonable descriptions (60-80 chars) and basic schemas, but mcp_execute_code and mcp_code lack meaningful differentiation and have minimal descriptions (under 100 chars). All tools accept only string/number inputs with no enums, ranges, or validation constraints. No output schemas documented. Error handling guidance absent. Tool naming uses underscores but lacks clarity on why two nearly identical code execution tools exist (mcp_execute_code vs mcp_code). No parameter descriptions beyond bare type info.
Execute JavaScript against the wrapped mcp MCP tool namespace. Namespace with full TypeScript type declarations for all wrapped tools.
Execute JavaScript against the wrapped mcp MCP tool namespace. Use the search and details tools before writing code.
Return the full schema and generated TypeScript declaration for one wrapped mcp MCP tool.
Search wrapped MCP tools exposed under the mcp namespace. Returns concise catalog entries only; call the details tool for schemas.
Two nearly identical code execution tools (mcp_execute_code and mcp_code) with no clear distinction. LLMs cannot determine which to call. Violates single-responsibility principle.
No output schemas documented for any tool. LLMs cannot plan downstream calls or extract structured data. mcp_search_tools and mcp_get_tool_details should return typed objects with fields like 'tools[]', 'name', 'schema', 'description'.
Parameter descriptions missing or trivial. 'code' parameter in mcp_execute_code lacks guidance on what JavaScript is allowed, what namespace is available, error handling, or return value expectations.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 47 | 2025-06-18+ | v2 |
No input validation constraints. 'limit' parameter in mcp_search_tools has no min/max bounds (baseline: 1 - 100). 'query' and 'code' parameters accept unbounded strings with no length limits or format guidance.
No error recovery guidance. Tools marked DESTRUCTIVE (mcp_execute_code, mcp_code) provide no guidance on what errors are retryable, how to handle failures, or what to do if code execution fails.