MCP server for the League of Legends client: LCU REST API, live WAMP events & recording, CDP console/DOM access, and OpenAPI schema introspection
Critical gaps across all dimensions. Tool definitions lack visible input schemas in source code, cannot verify parameter types, constraints, or descriptions. Tool names follow a prefix pattern (lol_*) but lack clear verb-noun structure (e.g., 'lol_passthrough_get' vs 'get_lol_endpoint'). No evidence of structured output documentation. Passthrough tools (GET/POST/PUT/PATCH/DELETE) expose raw API complexity to LLM without abstraction. Error handling and recovery guidance absent. Security concerns: passthrough tools accept arbitrary endpoints and parameters, risking injection attacks and unintended API calls.
No visible input schemas in source code. Cannot verify parameter types, constraints, enums, or descriptions. All 34 tools lack documented input/output structure.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 28 | 2026-07-28+ | v2 |
Passthrough tools (lol_passthrough_*) expose raw HTTP verbs without semantic abstraction. LLM must reason about endpoints, parameters, and payloads directly. Violates single-responsibility principle and invites injection attacks.
No tool descriptions visible in source. LLMs cannot determine when to select a tool or what it does. Descriptions are mandatory for tool selection.
Tool names lack clear verb-noun structure. 'lol_passthrough_get' and 'lol_events_start' do not clearly signal action. Baseline: 90% of A+ tools start with action verbs (get_, create_, list_, search_, update_, delete_).
No error handling or recovery guidance visible. Tools do not indicate what to do on failure, whether errors are retryable, or how to self-correct.