Both tools have minimal descriptions (under 100 chars) and lack parameter descriptions entirely. Input schemas are present with basic types (string, number) but no constraints, enums, or validation guidance. No output schema documented. Tools perform write operations (BUY/SELL) with no error handling, confirmation patterns, or recovery guidance. No security considerations visible (credentials hardcoded in trade.ts). Naming is acceptable but descriptions fail to explain WHEN to use each tool or what happens on failure.
Buys the stock for the user on the Zerodha exchange
Sells the stock for the user on the Zerodha exchange
Parameter descriptions missing entirely. 'stock' and 'qty' parameters have no descriptions explaining format, constraints, or valid ranges. LLMs cannot infer whether 'stock' expects 'AAPL' or 'Apple Inc.' or a numeric code.
No output schema documented. Tools return generic text responses ('Stock has been bought') with no structured fields. LLMs cannot extract order IDs, execution prices, or confirmation details for downstream operations.
Credentials hardcoded in trade.ts (apiKey, apiSecret, access_token as empty strings). Secrets must never appear in source or as tool parameters. Use server-side secret injection via environment variables.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 38 | 2026-07-28+ | v2 |
No error handling or recovery guidance. If placeOrder() fails, the tool returns a generic error. LLMs receive no actionable guidance on whether to retry, ask the user, or abort. Destructive operations (BUY/SELL) need explicit confirmation patterns.
No input validation. 'qty' accepts any number (negative, zero, fractional). 'stock' accepts any string. No enums, min/max bounds, or format constraints. LLMs will pass invalid values without guidance.