MCP 工具服务器:把分散的手写工具能力标准化为 8 个即插即用的 MCP 工具(热点排名 / TC3 签名 / 文本切块 / 日期计算 / SQLite 查询 / 网页抽取 / JWT 解码 / 健康检查)
Toolkit provides 8 well-scoped tools with complete JSON Schema input definitions and descriptions. Naming follows verb_noun convention (travel_hotspot_rank, tc3_sign, text_chunk, date_calc, sqlite_query, webpage_extract, jwt_decode, health_ping). All tools have descriptions (avg ~150 chars, within 10-1024 baseline). Schemas are properly typed with required fields and descriptions. However, output schemas are not documented, LLMs cannot predict response structure. Error handling is minimal; no recovery guidance or categorization. No tool annotations (readOnlyHint, destructiveHint). Parameter descriptions lack format constraints (e.g., 'YYYY-MM-DD' for dates is stated but not formalized). Security: tc3_sign accepts secretId/secretKey as parameters (anti-pattern; should use env-var injection only). webpage_extract lacks timeout validation. Overall solid foundation but missing LLM-critical output documentation and error guidance.
日期计算:加减天数、求日期差、查星期几、判断闰年、查当月天数、取今天日期。日期统一 YYYY-MM-DD 格式,按 UTC 处理规避跨日误差。
健康检查:返回服务名、版本、运行时长、Node 版本与平台信息,用于验证 MCP 服务器连通性。
解码 JWT(不验签),解析 header 与 payload 并判断是否过期;提供 secret 时用 HMAC(HS256/384/512)验签。
对 SQLite 数据库执行只读查询(SELECT / WITH / PRAGMA)。基于 Node 内置 node:sqlite,以只读模式打开,拒绝任何写操作。
生成腾讯云 API 3.0 的 TC3-HMAC-SHA256 签名请求头(含 Authorization)。密钥可入参或从环境变量 TC3_SECRET_ID / TC3_SECRET_KEY 读取,真实密钥不入日志。签名实现与官方公开测试向量逐字节一致。
RAG 文本切块:把长文本按 chunkSize 切成若干片段,支持 overlap 重叠,优先在句末断点切割。适合做检索增强的预处理。
地点口碑榜聚合:输入地点列表与用户帖子,按「发帖数*2 + 投票*3 + 平均评分*5」计算热度并排序,同时聚合每地点的高频优点。算法源自 travel-rank 项目,面试可两边对拍。
Output schemas not documented. LLMs cannot predict response structure (e.g., what fields does travel_hotspot_rank return? Is it an array of objects with 'rank', 'name', 'score'?). Forces agents to guess or fail on downstream tool chaining.
tc3_sign accepts secretId and secretKey as parameters. Credentials must never be tool parameters, they leak into logs and traces. Use environment variables (TC3_SECRET_ID / TC3_SECRET_KEY) exclusively; remove from parameter schema.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint). All 8 tools are read-only but this is not declared. Agents cannot distinguish safe tools from destructive ones without explicit hints.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 68 | 2026-07-28+ | v2 |
抓取网页并抽取纯文本:返回标题、各级标题、链接列表与去标签正文,适合做网页内容的结构化提取。
Error handling is absent or minimal. No recovery guidance (e.g., 'If date format is invalid, use YYYY-MM-DD'). No error categorization (retryable vs user-fixable). Agents cannot self-correct on failures.
Parameter descriptions lack formal constraints. E.g., date_calc 'date' param says 'YYYY-MM-DD' in description but no format/pattern in schema. webpage_extract 'timeoutMs' has no min/max bounds. Agents cannot validate inputs before calling.