A runtime and semantic trust registry for MCP servers that catches tool poisoning and scope creep through static analysis (rule-based and AI engines) and behavioral sandboxing
Single tool 'calculate' has a complete input schema with proper types and enum constraints for the 'op' parameter. Description is present (94 chars) and explains the core function. However, the description lacks critical context: it does not state WHEN to use this tool vs alternatives, does not mention that division by zero returns null, and omits any guidance on error handling or recovery. Parameter descriptions are entirely absent, 'a', 'b', and 'op' have no individual documentation explaining their roles or constraints. Output schema is not documented in the tool definition. The tool is READ_ONLY but lacks explicit idempotentHint annotation. No error handling guidance is provided for edge cases (e.g., division by zero). Overall, the tool meets minimum viability but falls short of production-grade clarity expected for agent-facing tools.
Performs basic arithmetic (add, subtract, multiply, divide) on two numbers.
Missing parameter descriptions. Parameters 'a', 'b', and 'op' have no individual documentation explaining their meaning, constraints, or expected format.
Tool description lacks context for LLM selection. Does not explain WHEN to use this tool, what happens on division by zero, or how to handle errors.
Output schema not documented. Tool definition does not specify the structure of the response (e.g., that it returns a text field with the numeric result).
No error handling guidance. Division by zero returns null with no explanation to the LLM about recovery steps or alternative approaches.
Missing tool annotations. Tool lacks idempotentHint annotation despite being read-only and safe to retry.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 54 | 2026-07-28+ | v2 |