A multi-agent security system that evaluates input for threats, masks PII, and analyzes SQL data using Google ADK agents and MCP tools
Server has 4 tools with basic descriptions but critical gaps in schema completeness, parameter documentation, and error handling. Two tools (execute_sql_query, query_data) appear to be duplicates with identical descriptions. Input schemas are minimal, only 'sql' and 'tables' parameters visible with type strings but no constraints, ranges, or validation guidance. No output schemas documented. Descriptions are generic (10-50 chars) and lack context on when to use each tool or what they return. No error handling guidance, no security validation details, and no idempotency guarantees despite WRITE risk on execute_sql_query.
Execute SQL queries safely on the salaries database.
Get schema and sample data for specified tables (comma-separated).
List all tables in the database.
Execute SQL queries safely on the salaries database.
Duplicate tools: execute_sql_query and query_data have identical descriptions ('Execute SQL queries safely on the salaries database') and identical input schemas. This forces LLMs to guess which to call, violating single-responsibility principle.
No output schemas documented for any tool. LLMs cannot plan downstream calls or extract required fields (e.g., table names from list_database_tables, column info from get_table_info). Violates response-shaper pattern.
SQL parameter lacks validation constraints. No description of allowed query types, forbidden keywords (DROP, DELETE), or injection prevention. execute_sql_query marked WRITE but no dry-run or confirmation pattern. Violates tool-gateway and confirmation-request patterns.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 40 | <=2025-11-25 | v2 |
Descriptions are 10-50 characters, below the 34-char baseline minimum for A+ tools. 'Get schema and sample data for specified tables' lacks context on when to call it vs list_database_tables, what 'sample data' means, or result structure.
No error handling guidance. No recovery hints (e.g., 'If query fails, check table names with list_database_tables'). No categorization of errors as retryable vs user-fixable. Violates recovery-guide pattern.