An authorization server and admin BFF (Backend for Frontend) implementing OAuth 2.0 and OpenID Connect with MCP (Model Context Protocol) tool integration and per-tool access control policies
Boltway's three tools have minimal definitions. All three lack proper descriptions (under 20 chars or trivial), no input schemas are visible in the test files provided, and naming does not follow verb_noun conventions. The 'closed' and 'open' tools appear to be policy-gating demonstrations rather than production tools. 'ping' is a deprecated MCP pattern. No evidence of structured output schemas, error handling guidance, or parameter validation. Tool definitions appear inferred from test code rather than explicitly registered.
A tool that is gated by policy - only accessible to the 'ada' actor
A tool that is open to all callers but with argument-level gating on the 'owner' parameter
Answers, so the filter above has a call to observe.
No input schemas visible for any tool. All three tools show empty or missing schema definitions in source code.
Tool descriptions are trivial or missing context. 'Answers, so the filter above has a call to observe' (ping) is not actionable for LLM tool selection.
Tool names do not follow verb_noun convention. 'closed', 'open', and 'ping' are not action-oriented names that convey intent.
'ping' is a deprecated MCP pattern (removed in current spec). Should be replaced with application-level health checks or removed entirely.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 29 | 2026-07-28+ | v2 |
No error handling guidance, output schemas, or parameter constraints documented. LLMs cannot determine when to call these tools or how to handle failures.