OAuth 2.1 MCP resource-server template for Entra ID and generic OIDC
Two tools with minimal definitions. Both lack input parameter descriptions entirely (empty {} schemas). Tool descriptions are present but extremely brief (16-19 chars), falling below the 20-char minimum threshold. No parameter validation, no error handling guidance, no output schema documentation. Naming is acceptable (verb_noun pattern: 'whoami', 'health'), but the complete absence of schema detail and parameter documentation makes these tools unsuitable for LLM-driven agent use. The server appears to be a template/skeleton rather than a production-ready implementation.
Return the health status of the MCP server
Return information about the authenticated principal
Empty input schemas ({}). Both tools declare no parameters, but schemas lack any type definitions, constraints, or descriptions.
Tool descriptions are 16-19 characters, below the 20-char minimum. 'Return information about the authenticated principal' (51 chars) is acceptable, but 'Return the health status of the MCP server' (42 chars) is borderline. These are just above the floor but lack actionable context for LLM selection.
No output schema documentation. Neither tool documents what fields are returned, their types, or structure. LLMs cannot plan downstream calls or extract data without knowing the response shape.
No error handling guidance. Tools provide no recovery hints, error classification, or actionable messages. If a tool fails, the LLM has no direction on retry, user escalation, or alternatives.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 40 | <=2025-11-25 | v2 |
No tool annotations (readOnlyHint, destructiveHint, idempotentHint). Both tools are read-only, but this is not declared in the tool definition. LLMs cannot infer safety properties without explicit annotations.