Loading ToolBench

Reading the current corpus…

nano-MCP MCP server · D · ToolBench

nano-MCP

A lightweight MCP server implementation with file management and version control tools, featuring FastAPI-based HTTP transport and LLM integration

<=2025-11-25STREAMABLE_HTTP7 tools

51/100

Definition Quality66

Protocol Readiness62

Supportability18

Spec posture

Inferred effective spec <=2025-11-25·current baseline 2026-07-28

Static source inference · medium confidence · detected: Logging

Deprecated protocol patterns detected

Summary

nano-MCP has basic tool definitions with schemas and descriptions, but significant gaps limit production readiness. All 7 tools have descriptions (10-100 chars) and input schemas via Pydantic models. However, descriptions are generic and lack LLM-optimization guidance. Parameter descriptions are minimal or absent. Output schemas are not documented, tools return unstructured text wrapped in {'type':'text','text':...} without field definitions. Error handling returns raw error messages as text rather than structured recovery guidance. No tool annotations (readOnlyHint, destructiveHint, idempotentHint) despite clear risk levels (READ_ONLY, WRITE, IRREVERSIBLE). The run_command tool is particularly dangerous, accepts arbitrary shell commands with no validation, sanitization, or confirmation step, violating the confirmation-request pattern for irreversible operations.

Tools (7)

create_filewritesource verified70/100

Create a new file with the specified content.

git_commitwritesource verified67/100

Stages all changes in the repository directory (/repo) and commits them with the provided message.

git_initwritesource verified62/100

Initializes the repository directory (/repo) as a Git repository if it is not already.

read_fileread onlysource verified72/100

Read the content of a specific file.

run_commandirreversiblesource verified55/100

Runs an arbitrary shell command within the repository directory (/repo). Use 'async_run=True' for long-running processes or servers.

show_folder_treeread onlysource verified67/100

List the contents (files and directories) of a specified directory.

update_filewritesource verified70/100

Update the content of an existing file. Overwrites the file.

Issues (5)

CRITICALconfirmation-request ↗

run_command accepts arbitrary shell commands with no validation, sanitization, or confirmation. Violates confirmation-request pattern for irreversible operations. LLM can execute destructive commands (rm -rf /, kill processes) without safeguards.

run_command

HIGHresponse-shaper ↗

No output schemas documented. All tools return unstructured text in {'type':'text','text':...} format. LLMs cannot parse structured results or chain tool calls. Violates response-shaper pattern.

read_fileshow_folder_treeupdate_filecreate_filegit_initgit_commitrun_command

HIGHtool-annotation ↗

No tool annotations (readOnlyHint, destructiveHint, idempotentHint) despite clear risk levels. Clients cannot determine which tools are safe to retry or which modify state.

read_fileshow_folder_treeupdate_filecreate_filegit_initgit_commitrun_command

Recommendations

Add tool annotations to all tools: mark read_file and show_folder_tree with readOnlyHint=true; mark update_file, create_file, git_init, git_commit with destructiveHint=true; mark git_commit with idempotentHint=false (commits are not idempotent).
Document output schemas for each tool. E.g., read_file should return {type:'object', properties:{content:{type:'string'}, path:{type:'string'}, size:{type:'integer'}}}. show_folder_tree should return {type:'object', properties:{items:{type:'array', items:{type:'object', properties:{name:{type:'string'}, type:{enum:['file','directory']}}}}}}.
Add structured error responses with recovery guidance. Instead of returning {'type':'text','text':'File not found'}, return {'type':'error', 'code':'FILE_NOT_FOUND', 'message':'File not found at /data/path/to/file', 'recovery':'Check the path and try again, or call show_folder_tree to list available files'}.
Add confirmation step for run_command. Require a separate confirm_command(command_id) tool or add a 'dry_run' parameter that returns the command without executing it, letting the LLM review before confirming.
Expand parameter descriptions. E.g., 'path' in show_folder_tree should be 'Relative path from /data root (e.g., "subdir/nested"). Defaults to root. Must not contain ".." for security.' Add constraints for file_path (max length, allowed characters) and command (list of allowed commands or patterns if restricting).

Spec posture evidence

Inferred effective spec: <=2025-11-25.

Relies on Logging (deprecated) - log to stderr or use OpenTelemetry

Score history

Overall score trend

First recorded score · v2 rubric

51/100

Scored	Grade	Overall	Spec posture	Rubric
2026-09-23	D	51	<=2025-11-25	v2