FastAPI-based AI school assistant backend with role-based access control, attendance management, and escalation tools. Integrates with Cohere LLM for natural language processing and Firebase for authentication.
Server has 6 tools with basic structure and authorization checks. Tool names follow verb_noun convention (get_*, create_*). Descriptions are present but brief (avg 95 chars, below 194-char baseline). Input schemas use Pydantic models with type hints, but parameter descriptions are minimal or missing. Error handling exists (ToolAuthorizationError, InvalidArgumentsError) but lacks recovery guidance. Output schemas are not documented. No tool annotations (readOnlyHint/destructiveHint). Authorization logic is sound but not exposed in tool metadata.
Request human contact with school management (teacher or principal only). Requires a reason and explicit confirmation.
Request human contact with a student's teacher (parent or teacher only). Requires student_id, a reason, and explicit confirmation.
View a parent's child attendance records. Provide student_id or name.
View school-wide attendance analytics (principal only).
View the calling student's own attendance records.
Mark a student's attendance (PRESENT/ABSENT/LATE) for a date. Teacher only; provide student_id or name.
Parameter descriptions are minimal or absent. 'start_date' and 'end_date' in attendance tools lack format guidance (ISO 8601?). 'status' in mark_attendance lacks enum constraint in schema. LLMs cannot infer valid values.
Output schemas are not documented. Tools return service layer objects without specifying what fields the LLM should expect. This forces the LLM to guess at response structure and breaks downstream tool chaining.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint). Attendance read tools should be marked readOnly=true; write tools should be marked destructive=true. This metadata is required for current MCP spec (2026-07-28).
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 57 | <=2025-11-25 | v2 |
Error messages lack recovery guidance. InvalidArgumentsError for ambiguous student names returns 'Multiple students match' but does not suggest calling a search/list tool. ToolAuthorizationError returns 'Forbidden' without explaining why or what permission is needed.
Confirmation pattern in escalation tools requires 'confirmed: bool' parameter, but no guidance on how the LLM should obtain explicit user confirmation before calling. Multi-round-trip request (MRTR) pattern not used.