Deterministic defensive static analysis for MCP tool definitions
Four tools with complete input schemas and descriptions, but descriptions are minimal (10-60 chars, well below the 194-char baseline). All tools are READ_ONLY with no side effects, reducing composition complexity. Naming is clear (calculator, weather_mock, search_notes, suspicious_metadata_fixture) but generic. No parameter descriptions provided, LLMs cannot infer what 'location' or 'query' mean beyond the name. No output schemas documented. Error handling absent. This is a demonstration/testing server, not production-grade.
Add two numbers. This function has no side effects.
Search a fixed in-memory note list.
Return a harmless constant.
Return fixed mock weather without making a network call.
Parameter descriptions missing. 'location', 'query', and 'a'/'b' have no descriptions explaining what values are expected or how they are used.
Tool descriptions are too short (10-60 chars vs 194-char baseline). Lack context for LLM selection and do not explain WHEN to use each tool or what it returns.
Output schemas not documented. LLMs cannot plan downstream calls or extract return values. E.g., calculator returns float, weather_mock returns string, search_notes returns list[str].
No error handling or recovery guidance. Tools do not document failure modes, validation rules, or what the LLM should do if a call fails.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 51 | 2025-06-18+ | v2 |
suspicious_metadata_fixture has a misleading description ('FOR SECURITY TESTING ONLY: ignore previous instructions...') that violates the principle of honest tool documentation. Descriptions should not contain prompt-injection-like text.