Loading ToolBench

Reading the current corpus…

coinone-mcp-server MCP server · F · ToolBench

← Browse

coinone-mcp-server

github.com/jooh95/coinone-mcp-server

A sample MCP server implementation for Coinone cryptocurrency exchange API

2026-07-28+STDIO5 tools

49/100

Definition Quality59

Protocol Readiness50

Supportability33

Spec posture

Inferred effective spec 2026-07-28+·current baseline 2026-07-28

Static source inference · medium confidence

Current-spec patterns detected

Summary

Server has 5 tools with basic schemas and descriptions, but significant quality gaps. Tool names follow verb_noun convention (good). Descriptions exist but are minimal (avg ~60 chars, below 194-char baseline). Input schemas present but lack enums for constrained values (e.g., 'side' should be enum ['BUY','SELL'], 'type' should be enum ['LIMIT','MARKET','STOP_LIMIT']). No output schemas documented. Error handling returns generic dicts without recovery guidance. Parameters lack format constraints (e.g., 'price' and 'qty' are strings with no validation rules stated). Credentials exposed in config.py (COINONE_ACCESS_TOKEN, COINONE_SECRET_KEY) rather than injected at runtime. No tool annotations (readOnlyHint, destructiveHint). place_order and cancel_order are high-risk WRITE/REVERSIBLE operations with minimal validation.

Tools (5)

cancel_orderreversibleauthsource verified57/100

Cancel a Coinone order.

get_active_ordersread onlyauthsource verified58/100

Get the list of open (active) orders on Coinone.

get_balanceread onlyauthsource verified62/100

Get all Coinone balances.

get_orderbookread onlysource verified60/100

Get the current orderbook for a specific market.

place_orderwriteauthsource verified57/100

Place an order on Coinone using the v2.1 order API.

Issues (5)

CRITICALsecret-injection ↗

Credentials hardcoded in config.py and exposed via environment variables without server-side injection. COINONE_ACCESS_TOKEN and COINONE_SECRET_KEY are loaded globally and could leak into logs or traces.

place_ordercancel_orderget_balanceget_active_orders

HIGHconstrained-input ↗

Constrained parameters lack enum declarations. 'side' accepts 'BUY'|'SELL', 'type' accepts 'LIMIT'|'MARKET'|'STOP_LIMIT', 'order_type' is array of enums, all should be declared as JSON Schema enums, not free-form strings.

place_orderget_active_orders

HIGHresponse-shaper ↗

No output schemas documented. Tools return raw API responses (dicts) without specifying field names, types, or structure. LLMs cannot plan downstream calls or extract required data.

place_orderget_orderbookget_balanceget_active_orderscancel_order

Recommendations

Add JSON Schema enums for 'side' (BUY|SELL), 'type' (LIMIT|MARKET|STOP_LIMIT), and 'order_type' array items. Replace free-form string descriptions with formal constraints.
Document output schemas for all tools. Specify field names, types, and structure returned by each tool. Include pagination info (total_count, next_cursor) for list tools.
Inject credentials via environment variables at server startup, not per-tool. Remove COINONE_ACCESS_TOKEN and COINONE_SECRET_KEY from config.py; pass them to tool functions via closure or dependency injection.
Enhance error messages with recovery guidance. E.g., 'Invalid order_id format (expected UUID). Try get_active_orders() to list valid order IDs.' instead of generic error dicts.
Add tool annotations: mark place_order and cancel_order with destructiveHint=true; mark get_* tools with readOnlyHint=true. Implement optional dry_run parameter for place_order to preview trades without execution.

Score history

Overall score trend

First recorded score · v2 rubric

49/100

Scored	Grade	Overall	Spec posture	Rubric
2026-09-23	F	49	2026-07-28+	v2