Aggregate multiple MCP servers behind a single endpoint with auth, rate limiting, and audit logging
14 tools with clear naming (verb_noun pattern) and basic descriptions. However, critical gaps: parameter descriptions are minimal or absent (most params lack detail on format/constraints), output schemas are undocumented, and error handling is not visible in the provided code. The gateway_* admin tools lack descriptions entirely in the source. Tool composition is reasonable (discovery → schema → execute pattern), but parameter validation rules and recovery guidance are missing. Baseline: 194 chars avg description; most tools here are 50-100 chars, below median.
Execute any tool with parameters
Add a named account for any plugin (admin only)
Query the audit trail (admin only)
Create a new API key (admin only)
Delete an API key (admin only)
List all API keys (admin only)
Manage data-level scoping (e.g. allowed IDs per plugin) (admin only)
Admin tools (gateway_*) lack detailed parameter descriptions. 'credentials' is a dict with no guidance on required keys, format, or validation. LLMs cannot infer what credentials structure each plugin expects.
Output schemas are not documented in the provided code. Tools return results but LLMs have no visibility into response structure (fields, types, pagination). This violates the documented-output-schema requirement.
Parameter 'access_level' in gateway_set_permissions and gateway_set_tool_override lacks enum constraint or valid-value documentation. Description says 'read, write, admin' but does not enforce it as an enum.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 60 | 2026-07-28+ | v2 |
Check upstream service health (admin only)
Set/replace credentials for a key+plugin (admin only)
Set access control permissions for a key (admin only)
Override access level for a specific tool (admin only)
Get exact parameters for a specific tool before calling it
List available plugins, their accounts, and tool counts
Find tools by keyword (e.g. 'send message', 'list items')
Error handling and recovery guidance are not visible in the provided code. Tools do not document what errors can occur, whether they are retryable, or what the LLM should do next (e.g., 'Tool not found, try search_tools() first').
Parameter 'params_json' in call_tool is a string, not a structured object. LLMs must manually construct JSON, increasing error likelihood. Consider accepting a structured params object instead.