A custom MCP server integrating Brave search, filesystem, GitHub, and sequential thinking
Critical gaps across all dimensions. Of 33 tools, only 2 (download_file, download_multiple_files) have visible schemas and descriptions in source. The remaining 31 tools are inferred from switch statements with no explicit schema definitions visible. No tool descriptions are present in the code. Parameter types are not declared. Error handling is generic (500 errors with error.message). No tool annotations (readOnlyHint, destructiveHint, idempotentHint). Naming is inconsistent: 'sequentialthinking' lacks verb prefix; 'brave_local_search' vs 'brave_web_search' are unclear in purpose. No output schemas documented. No pagination support visible. This server exposes 14 WRITE operations (filesystem, GitHub, downloads) with no permission gates, audit trails, or confirmation patterns.
31 of 33 tools have NO visible input schemas in source code. Only download_file and download_multiple_files show schema definitions. Per HARD SCORING RULE, tools without visible schemas must score 0 on schema dimension.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 23 | <=2025-11-25 | v2 |
Download a file from a URL and save it locally
Download multiple files from URLs and save them locally
NO tool descriptions present in source code. All 33 tools lack descriptions explaining WHAT they do, WHEN to use them, or WHAT they return. LLMs cannot determine tool selection without descriptions.
14 WRITE operations (write_file, edit_file, create_directory, move_file, create_repository, create_or_update_file, push_files, create_issue, create_pull_request, fork_repository, create_branch, update_issue, add_issue_comment, download_file, download_multiple_files) have NO permission gates, NO audit logging, NO confirmation patterns, and NO dry-run support. Agents can destructively modify filesystems and GitHub repos without safeguards.
Tool naming inconsistencies: 'sequentialthinking' lacks action verb (should be 'run_sequential_thinking' or 'think_sequentially'). 'brave_local_search' vs 'brave_web_search' distinction is unclear, what does 'local' mean? No parameter descriptions to disambiguate.
Error handling is generic: all errors return HTTP 500 with error.message. No error categorization (retryable vs user-fixable vs fatal), no recovery guidance, no invalid value echoing. LLMs cannot self-correct or plan recovery.