Single tool with partial schema definition. Tool name 'MS_GRAPH_TOOL' lacks action verb (should be 'call_graph_api' or 'query_graph'). Description is adequate (97 chars, within 10-1024 range) but generic. Input schema present with Zod types but lacks critical parameter descriptions for 'path' and 'method', descriptions are minimal (10-15 chars). Output schema is documented in GraphResponse type but not exposed to LLM. No error handling guidance, no pagination support, no output field documentation. Tool performs write operations (POST/PUT/PATCH) but description does not warn of side effects. Parameters lack constraints (e.g., path format, method enum values are present but not described). No validation of GRAPH_API_TOKEN presence until runtime.
A tool to call Microsoft Graph API. It supports working with a Microsoft 365 tenant using the Graph API.
Tool name lacks action verb. 'MS_GRAPH_TOOL' is a noun; should start with verb like 'call_', 'query_', or 'execute_' to signal intent to LLM.
Parameter descriptions are too short (<20 chars). 'path' described as 'The Graph API URL path to call (e.g. '/me', '/users')' includes example values that LLMs may reuse literally. 'method' description is similarly minimal. Descriptions should explain constraints and format without examples.
No error recovery guidance. Error responses return raw JSON error objects without actionable next steps. LLM cannot determine if error is retryable, user-fixable, or fatal.
Destructive operations (POST/PUT/PATCH/DELETE) lack confirmation or dry-run support. Tool can modify Microsoft 365 tenant data without agent confirmation, risking accidental data loss.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 35 | 2026-07-28+ | v2 |
Output schema not documented for LLM. GraphResponse type exists in code but is not exposed to the MCP protocol. LLM cannot plan downstream operations or extract fields reliably.