MCP server providing Code Mode execution for API discovery and querying, with support for REST APIs, GraphQL, and SPARQL endpoints
Five tools with reasonable naming (verb_noun pattern) and detailed descriptions (150-250 chars each). However, critical gaps: schemas are visible but parameter descriptions are inconsistent, some params lack type clarity or constraints. Output schemas are not documented. Error handling is absent from descriptions. The execute tools accept arbitrary JavaScript code, creating security and validation concerns not addressed in the tool definitions. No tool annotations (readOnlyHint, destructiveHint, idempotentHint) despite clear risk profiles.
Search the API catalog (legacy mode). Returns matching endpoints with full parameter docs. Use this to discover API capabilities before calling execute.
Execute JavaScript code against an API catalog or OpenAPI spec in a sandboxed V8 isolate. Code runs with api.get/api.post wrappers, catalog search helpers, and console.log capture.
Execute JavaScript code against a GraphQL endpoint in a sandboxed V8 isolate. Code runs with gql.query() for GraphQL execution, schema introspection helpers, and optional REST API support.
Search an OpenAPI spec using JavaScript code. Write code to search paths, list tags, get operations, or access the full frozen spec object directly.
Execute JavaScript code against a SPARQL endpoint in a sandboxed V8 isolate. Code runs with sparql.query(), sparql.ask(), sparql.raw() for SPARQL execution, and common ontology prefix helpers.
Execute tools (createExecuteTool, createGraphqlExecuteTool, createSparqlExecuteTool) accept arbitrary code strings with no input validation, constraints, or error recovery guidance. Descriptions do not warn of risks or document sandboxing limits.
No output schemas documented for any tool. LLMs cannot predict response structure, forcing them to guess field names and types for downstream tool chaining.
Tool descriptions lack error recovery guidance. No mention of what to do if a query returns no results, if code execution times out, or if an API is unreachable.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 44 | 2026-07-28+ | v2 |
Missing tool annotations. All tools should declare readOnlyHint (true for search/execute tools) and idempotentHint (false for execute tools that may have side effects).
Parameter 'workspace' in execute tools is optional but its purpose and format are vague. No description of what a workspace ID looks like, how to obtain one, or what happens if it is invalid.