MCP server providing weather alerts and forecasts via National Weather Service API, with additional MySQL database access and financial transaction management capabilities
This server exhibits severe definition quality issues across multiple dimensions. Only 2 of 6 tools have weather-related functionality; the other 4 (access-mysql, get_last_transaction, top_expense_by_category, create_expense) are unrelated financial/database tools mixed into a weather server, indicating architectural confusion. Tool descriptions are present but minimal (10-80 chars, below the 194-char baseline). Schemas are partially defined via Zod but lack comprehensive parameter descriptions. The access-mysql tool exposes dangerous SQL query execution with no input validation, sanitization, or permission gating. Tool naming is inconsistent (kebab-case vs snake_case). Error handling is minimal, most tools return generic failure messages without recovery guidance.
Access MySQL database
Create an expense with fields for receipt date, amount, category, and description
Get weather alerts for a state
Get weather forecast for a location
Mendapatkan transaksi terakhir expense atau income
Menentukan kategori pengeluaran paling banyak dalam range tanggal tertentu
Dangerous SQL injection vulnerability: access-mysql tool accepts raw SQL queries as a string parameter with no sanitization, validation, or permission checks. Any agent can execute arbitrary SQL including DROP TABLE or data exfiltration.
Architectural incoherence: server named 'weather' exports 6 tools, only 2 of which are weather-related. The other 4 (MySQL access, expense tracking, transaction history) belong to separate domains. This violates single-responsibility and confuses tool discovery.
Inconsistent tool naming: weather tools use kebab-case (get-alerts, get-forecast) while financial tools use snake_case (get_last_transaction, top_expense_by_category, create_expense). LLMs struggle with mixed conventions.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 55 | 2026-07-28+ | v2 |
Minimal error recovery guidance: tools return generic failure messages ('Failed to retrieve alerts data', 'Failed to retrieve forecast data') without actionable next steps. LLMs cannot determine if the error is retryable, user-fixable, or fatal.
Missing parameter descriptions for financial tools: get_last_transaction and top_expense_by_category have minimal descriptions (40 chars vs 194-char baseline). Parameters like 'transaction_type' and 'limit' lack context on valid values, ranges, or defaults.