Lambda-based MCP server that intercepts JSON-RPC tool calls and responses, scanning them through Palo Alto Networks AIRS (AI Runtime Security) for prompt injection, DLP, and policy violations before forwarding to the backend MCP server.
This server has severe definition quality gaps. All 4 tools lack parameter descriptions entirely, the schema objects contain only type and properties but no descriptions for any parameters. Tool descriptions are present but minimal (10-30 chars), below the 50-200 char baseline for LLM-optimized descriptions. No output schemas are documented. The tools appear to be demo/test tools (echo, get_weather) mixed with sensitive operations (get_account_details, view_profile) without proper access controls or error handling guidance. Parameter schemas are present but incomplete, no enums, ranges, or validation constraints. This server would not pass code review for production use.
Echo the provided text back.
Look up a customer's account record.
Get current weather for a city.
View your own saved profile.
All parameters lack descriptions. Schema objects define type and properties but provide zero guidance on what each parameter means, valid ranges, or format constraints. LLMs cannot infer parameter semantics from names alone.
Tool descriptions are too short (10-30 chars). Baseline is 50-200 chars. Descriptions lack context on WHEN to use each tool, WHAT it returns, and any prerequisites. 'Get current weather for a city' and 'Look up a customer's account record' do not explain dependencies or side effects.
No output schemas documented. LLMs cannot plan downstream tool calls or extract required fields without knowing what each tool returns. No structured response definitions provided.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 36 | 2026-07-28+ | v2 |
Sensitive tools (get_account_details, view_profile) lack permission gates and error handling. No indication of what authorization checks are performed, what errors can occur, or how to recover from failures. Destructive/sensitive operations need explicit confirmation patterns.
Parameter 'customer' in get_account_details is ambiguous, unclear if it accepts customer_id, customer_name, customer_email, or all three. No enum constraints or format guidance. Parameter 'city' in get_weather lacks validation (e.g., max length, character restrictions).