An MCP server for managing and retrieving persona facts for users, with support for getting, updating, and deleting persona information stored in JSON files.
Server has 4 tools with significant definition gaps. Two tools (get_persona, get_persona_tool) have minimal descriptions (<50 chars). Schemas are present but sparse, parameters lack detailed descriptions explaining constraints, formats, or valid ranges. No output schemas documented. Error handling is minimal (generic try-catch blocks returning empty lists or error text). Tool naming has redundancy (get_persona vs get_persona_tool do similar things). No parameter validation, no enum constraints, no pagination support despite potential for large result sets. Security: file paths constructed from user input without sanitization (path traversal risk). No audit logging or permission gates.
Delete a specific fact from a user's persona.
Get persona facts for a user
Get persona facts for a user.
Update persona facts for a user by appending new facts.
Duplicate/redundant tools: get_persona and get_persona_tool both retrieve persona facts but with different interfaces (user_id vs natural language query). LLMs will struggle to choose between them. Consolidate into one canonical tool.
Descriptions are too short (<50 chars) for get_persona and get_persona_tool. Baseline is 194 chars. LLMs cannot determine when to select these tools vs alternatives. Add context: what does it return? When should it be called? What are prerequisites?
No output schemas documented. Tools return lists or dicts but LLMs don't know the field structure. Document: what fields are in each persona fact? What does update_persona return on success? What does delete_persona_fact return?
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 46 | 2026-07-28+ | v2 |
Path traversal vulnerability: user_id is used directly in file path construction (f"{user_id}_persona.json") without sanitization. Attacker could pass '../../../etc/passwd' or similar. Validate user_id against whitelist or reject path separators.
No error guidance for LLMs. When a persona is not found, tools return empty list or generic error text. Per pattern:recovery-guide, errors should tell the agent what to do next: 'No facts found for user X. Try search_users() first' or similar.