A remote MCP server with OAuth 2.0 authentication provider running on Cloudflare Workers, demonstrating authorization flows and MCP tool registration
Single tool 'add' has a clear verb-noun name and basic schema with typed parameters. However, the description is extremely minimal (23 chars), barely meeting the 10-char floor. Parameter descriptions are present but terse (12-18 chars each). No output schema is documented, the response structure is inferred from code but not declared in tool metadata. No error handling guidance, no idempotency hints, no security considerations. The tool is trivial (arithmetic), so composition and chaining concerns are moot, but the definition pattern is weak for production use.
Adds two numbers together
Tool description is 23 characters, below the 50-char minimum for LLM clarity. 'Adds two numbers together' lacks context on when to use it, what it returns, or any prerequisites.
Output schema is not documented. The tool returns {content: [{type: 'text', text: string}]} but this structure is not declared in tool metadata. LLMs cannot plan downstream calls or validate responses.
Parameter descriptions are terse (12 - 18 chars). 'First number to add' and 'Second number to add' lack format hints, range constraints, or examples. No guidance on what happens if inputs are null, NaN, or Infinity.
No error handling guidance. What if inputs are non-numeric? What if the sum overflows? The tool provides no recovery hints or error classification.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 45 | 2026-07-28+ | v2 |
Tool is marked READ_ONLY but performs a computation with side effects (returns a result). Risk classification is correct but the tool's purpose (pure function) should be explicit in the description.