Model Context Protocol server exposing Airlock gateway tools (stdio)
8 tools with basic descriptions but significant gaps in schema completeness and parameter documentation. All tools have descriptions (10-80 chars), but most lack detailed parameter descriptions and output schema documentation. No tool annotations (readOnlyHint/destructiveHint). Parameters like 'feedback_json' and 'handshake_json' accept raw JSON strings rather than structured objects, forcing LLMs to construct complex payloads. Error handling and recovery guidance absent. Naming is domain-specific but not action-verb-forward (airlock_* prefix dominates). No pagination, no batch operations, no idempotent hints.
POST signed SignedFeedbackReport JSON (use Python SDK to sign). Same canonical JSON as gateway.
POST a pre-built JSON HandshakeRequest (use Python SDK to sign). Body must be valid JSON.
Get Airlock gateway health (status, protocol_version, airlock_did, subsystems).
Validate a trust JWT with POST /token/introspect (requires gateway secret).
Prometheus text exposition from GET /metrics (request counters).
Fetch stored reputation / trust score for a DID.
Resolve an agent DID (registry lookup). Returns found, profile, registry_source.
JSON string parameters (feedback_json, handshake_json) force LLMs to construct raw JSON payloads. Should accept structured objects with typed fields instead.
No output schemas documented. LLMs cannot infer what fields to expect from responses (e.g., airlock_resolve returns 'found, profile, registry_source' but structure is undocumented).
Parameter descriptions missing or minimal. 'session_view_token' described as 'JWT from handshake ACK (Bearer for /session)', unclear when it's required vs optional, what format it expects, or what happens if omitted.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 50 | 2026-07-28+ | v2 |
Get verification session state. Pass session_view_token from handshake ACK when the gateway uses AIRLOCK_SESSION_VIEW_SECRET.
No error handling guidance. Tools lack recovery hints (e.g., 'If session not found, call airlock_handshake first'). LLMs cannot self-correct on failures.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint). LLMs cannot distinguish safe reads from destructive writes or understand retry safety.