An MCP server using the SSE (Server-Sent Events) transport protocol with FastMCP framework to expose tools that clients can call over an SSE connection
Server has 3 tools with basic schemas and descriptions, but significant quality gaps. Tool naming lacks consistency (run_command vs add_numbers vs convert_image_to_greyscale, mixed verb_noun patterns). Descriptions are present but generic (10-50 chars for most params). No output schemas documented. run_command is destructive but lacks confirmation/dry-run pattern. Parameter descriptions are minimal or absent. No error handling guidance. Schemas are present but incomplete, missing type info for some fields, no validation constraints, no pagination support.
Adds two numbers and returns the sum.
Convert an image to greyscale and return image uri.
Executes a shell command in the default workspace and returns the result.
run_command is destructive but lacks confirmation/dry-run pattern. No error guidance for failed commands. LLM cannot distinguish retryable vs fatal errors.
No output schemas documented for any tool. LLMs cannot plan downstream calls or extract structured data. add_numbers returns float but no schema; run_command returns string but no field structure; convert_image_to_greyscale returns URI string but no validation.
Parameter descriptions are minimal or missing. 'command' param has only 'A shell command like ls, pwd, etc.', no format constraints, no safety guidance, no examples of what NOT to do. 'image_url' has only 'url for the image', no format, no timeout, no size limits.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 41 | 2026-07-28+ | v2 |
run_command accepts arbitrary shell input with no sanitization. Vulnerable to command injection if LLM is prompted to construct commands from user input. No input validation, no allowlist, no escaping guidance.
convert_image_to_greyscale makes external HTTP request without timeout, retry logic, or error handling. If image_url is unreachable or slow, tool hangs. No guidance on supported formats, max size, or expected response time.