A GitHub Action to deploy a Model Context Protocol (MCP) worker to Cloudflare Workers.
Two tools with basic schemas and descriptions, but significant gaps in parameter documentation, output schema clarity, and error handling. Both tools expose GitHub tokens as parameters (critical security issue). Descriptions are present but generic (avg ~80 chars, below 194-char baseline). Parameter descriptions exist but lack format/constraint details. No output schema documented. No error recovery guidance. Tool names follow verb_noun pattern correctly.
Retrieves the content of a specific file from a GitHub repository
Retrieves the structure of a GitHub repository, optionally including file contents for specified file extensions
GitHub token exposed as tool parameter. Credentials must use server-side secret injection via environment variables or vault. Agent traces log all parameters, tokens in params leak into logs and prompt history.
Output schemas not documented. LLMs cannot plan downstream calls or extract required fields without knowing response structure. Both tools return structured objects but schema is not declared in tool definition.
No error handling or recovery guidance. Code catches errors and logs them but returns empty arrays/null without actionable messages. LLM receives no guidance on what failed or what to try next.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 56 | 2026-07-28+ | v2 |
Parameter descriptions lack format/constraint details. 'owner' and 'repo' accept any 1+ char string; no guidance on valid formats. 'extensions' array has no length limits or examples. Descriptions should state constraints explicitly.
Tool descriptions are generic and lack context for selection. 'Retrieves the structure of a GitHub repository...' does not explain WHEN to use this vs alternatives, what the output contains, or prerequisites. Descriptions should be 50-200 chars and LLM-optimized.