Secure-by-default FastAPI→MCP bridge. Deny-by-default exposure, scope→tool auth that fails closed (even on STDIO), built-in rate limiting, PII redaction at the source, and a structured audit log — in-process, no gateway.
Three tools with explicit schemas and descriptions, but significant gaps in parameter documentation and output schema clarity. get_invoice and refund have clear names and basic descriptions (READ_ONLY/DESTRUCTIVE hints present), but lack output schema documentation. echo has a well-structured input schema with three typed parameters, each with descriptions. However, no tool documents what it returns, forcing LLMs to infer output structure. Parameter descriptions are minimal (10-20 chars) and lack format/constraint guidance. Tool descriptions are adequate (20-50 chars) but fall short of the 50-200 char LLM-optimized baseline. No error handling guidance or recovery paths documented.
Echo back the provided arguments
Retrieve invoice details by ID
Process a refund for an invoice
No output schemas documented for any tool. LLMs cannot infer what fields to expect in responses, forcing them to guess at downstream field names and risk broken tool chains.
Parameter descriptions are too brief (10-20 chars). 'The invoice identifier' and 'Query string' lack format constraints, valid ranges, or usage context. LLMs cannot determine if 'INV-123' or '123' is the correct format.
Tool descriptions are generic and under 50 chars. 'Retrieve invoice details by ID' and 'Echo back the provided arguments' lack context for when to use each tool or what makes them distinct from similar operations.
refund tool lacks confirmation/dry-run pattern for destructive operation. Agents can accidentally process refunds without verification, risking financial errors.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 56 | 2026-07-28+ | v2 |
No error handling guidance. Tools do not document what errors are possible, whether they are retryable, or what the LLM should do if a call fails (e.g., 'invoice not found' recovery path).