Local security gateway for MCP with deny-by-default policy and stateless protocol support.
OpenMoat defines 7 tools with complete input schemas and descriptions. Naming follows verb_noun convention (tool_search, tool_describe, tool_call, tool_result_fetch, moat_health, moat_usage, registry_list). Descriptions are present and substantive (50-150 chars), explaining WHAT each tool does and WHEN to use it. However, parameter descriptions lack depth, many omit format/constraint guidance. Output schemas are not documented. Error handling is minimal; no recovery guidance or actionable error messages visible in source. Tool composition is sound (each does one thing), but descriptions could better explain dependencies and prerequisites.
Return bounded gateway pool, breaker, latency, and failure health.
Return only caller-scoped aggregate counts, coarse errors, timings, and recency.
List all configured downstream servers without secret-bearing fields.
Call one authorized downstream MCP tool. Optional cwd is constrained by the server's declared cwdRoots.
Read current input schemas from one authorized downstream MCP server.
Read caller-owned slices from an opaque oversized-result archive handle.
Search the local, human-refreshed catalog for tools this caller is authorized to use.
Output schemas not documented. LLMs cannot infer what fields tool_search, tool_describe, tool_call, moat_health, moat_usage, and registry_list return, forcing them to guess downstream field names and risk broken tool chains.
Parameter descriptions lack constraint guidance. 'query' in tool_search has minLength/maxLength in schema but description does not explain the format or what constitutes a valid search term. 'hash' in tool_result_fetch requires hex pattern but description omits this.
No error handling guidance visible. Tools return errors but source does not show recovery hints (e.g., 'If server not found, call registry_list() first'). Agents cannot self-correct on failures.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 58 | 2026-07-28+ | v2 |
tool_call accepts 'cwd' parameter with maxLength 4096 but description does not explain the constraint or what 'cwdRoots' means. LLMs cannot determine valid working directory values.
moat_health and moat_usage descriptions are vague ('Return bounded gateway pool, breaker, latency, and failure health'). What is 'bounded'? What fields are in the response? LLMs cannot plan downstream use.