Drop-in MCP security middleware: audit · policy · human-approval · injection defense
Warden's test echo server has minimal tool definitions. Tool descriptions are present but generic (10-50 chars, below the 50-200 char LLM-optimized baseline). Input schemas exist but are bare JSON Schema with no parameter-level documentation. No output schemas documented. No error handling guidance. The 'danger' tool is marked DESTRUCTIVE but has no confirmation/dry-run pattern. This is a test fixture, not production-grade tooling.
Echo a command argument.
Echo back the provided text.
Return content that contains a secret + an injection (for testing).
All parameters lack descriptions. 'text' in echo, 'cmd' in danger have no guidance on format, constraints, or purpose.
Tool descriptions are under 50 characters and generic. 'Echo back the provided text' and 'Echo a command argument' do not explain WHEN to use each tool or what distinguishes them.
No output schemas documented. LLMs cannot plan downstream calls or extract structured data from responses.
'danger' tool is marked DESTRUCTIVE but has no confirmation, dry-run, or permission gate. No error handling guidance for injection defense.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 39 | 2026-07-28+ | v2 |
Input schemas use bare JSON Schema with no type constraints, enums, or validation rules. 'text' and 'cmd' accept any string with no bounds or format guidance.