MCP server for accessing CMS drug pricing data and APIs through Code Mode execution with catalog search, API proxy, and data staging capabilities
This server exposes 4 tools with significant definition gaps. All tools have descriptions (good), but schemas are incomplete or missing critical details. The `search` tool has a well-structured schema with proper types and descriptions. However, `execute`, `graphql_execute`, and `sparql_execute` have minimal schemas, each accepts only a `code` string parameter with no validation, constraints, or output schema documentation. Parameter descriptions exist but lack actionable guidance on expected formats, error cases, or recovery paths. No tool declares error handling, permissions, or idempotency guarantees. Tool names are verb-based (search, execute) but generic, `execute` appears three times with different contexts, risking LLM confusion. Output schemas are entirely undocumented; agents cannot plan downstream calls or extract structured data. Security concerns: tools accept arbitrary JavaScript code execution, yet no description warns of sandbox limitations, timeout behavior, or what happens on malicious input.
Execute JavaScript code against the API with sandboxed V8 isolate. Code runs with api.get/api.post wrappers, catalog search helpers, console.log capture, and optional filesystem access. Large responses (>30KB) auto-stage into SQLite for querying.
Execute JavaScript code against a GraphQL endpoint with sandboxed V8 isolate. Code runs with gql.query() for GraphQL execution, schema.* introspection helpers, optional REST api.get/api.post, console.log capture, and optional filesystem access. Large responses auto-stage into SQLite.
Search the API catalog (legacy catalog mode) or OpenAPI spec. Returns matching endpoints with full parameter docs. Use this to discover API capabilities before calling execute.
Execute JavaScript code against a SPARQL endpoint with sandboxed V8 isolate. Code runs with sparql.query(), sparql.ask(), sparql.raw() for SPARQL execution, common ontology prefixes, console.log capture, and optional filesystem access. Large responses auto-stage into SQLite.
Three tools named *_execute with identical minimal schemas (code string only). LLMs cannot distinguish contexts or understand output structure. Ambiguous names violate verb_noun clarity principle.
No output schemas documented for any tool. Agents cannot plan downstream calls, extract IDs for chaining, or validate response structure. Violates response-shaper and tool-chain patterns.
execute/graphql_execute/sparql_execute accept arbitrary code with no validation, timeout, or sandbox escape documentation. Descriptions lack error guidance, recovery paths, or security constraints.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 36 | 2026-07-28+ | v2 |
Parameter 'code' in execute tools has no format constraints, length limits, or examples. Description mentions 'api.get/api.post wrappers' but does not explain what happens on invalid syntax, infinite loops, or memory exhaustion.
search tool description mentions 'auto-staging' and 'SQLite' but does not document the __staged response field structure, when staging triggers, or how to query staged data. Incomplete output documentation.