MCP server for gathering project context and recent file information for Gemini discussions
This shell-based MCP server has critical definition gaps. Both tools lack formal input schemas (parameters are documented in descriptions only, not as JSON Schema). Tool descriptions are present but generic (gather-context: 156 chars, recent-files: 189 chars). No output schemas are documented. Parameters lack type constraints and validation guidance. No error handling patterns, no recovery guidance, and no security considerations (shell scripts executing user-provided paths invite injection). The server is not registered as a proper MCP tool provider, tool definitions appear to be shell scripts invoked directly, not MCP-compliant tool registrations with structured schemas.
Collect git and project context for Gemini discussions. Detects project type (Node.js, Python, Rust, Go, Java), extracts project metadata, displays git branch/status/recent commits, and shows top-level directory structure.
Find recently modified files in a project within a specified time window. Excludes common build/cache directories (.git, node_modules, __pycache__, target, .venv, venv, dist, build, .next).
No JSON Schema input definitions. Parameters documented in descriptions only (project_root, minutes).
No output schemas documented. LLMs cannot predict what fields gather-context or recent-files return, forcing them to guess at downstream tool chaining.
Path traversal vulnerability. Both tools accept project_root as a string and cd into it without validation. A malicious agent could pass '../../sensitive' or symlinks to escape intended scope.
No error handling or recovery guidance. Scripts fail silently (exit 1) with no message. LLMs receive no actionable error context to retry or self-correct.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 30 | 2026-07-28+ | v2 |
Parameter descriptions lack constraints. 'minutes' has no min/max bounds (could be negative or 999999). 'project_root' has no validation rules. LLMs will pass invalid values.