FHI MCP Server Security Audit

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden and does disclose meaningful traits: statefulness, that output is a delta relative to a baseline, that certificate-expiry signals are included, and that each call costs $0.01 USDC on Base. It omits rate limits, baseline retention/expiry, and failure behavior when no baseline exists.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Three dense sentences with zero filler: capability first, then the stateful lifecycle, then cost. Every sentence carries new information and nothing is repeated from the name or title.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter tool with no annotations and no output schema, the description covers what it watches, the baseline/delta model, the kind of signals returned, and the price. The remaining gap is operational detail such as baseline lifetime and behavior on the very first versus subsequent invocations under failure.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single 'domain' parameter has 0% schema description coverage, so the description must compensate. It adds one qualifier — the domain must be public — but gives no format, TLD scope, or normalization rules, leaving the schema gap only partially filled.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb-and-resource: stateful DNS, CAA, and certificate-transparency monitoring for a public domain. An agent knows exactly what the tool observes. It does not, however, contrast itself with siblings like sec_material_event_delta or mcp_vendor_due_diligence, so differentiation is left to inference.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explains the invocation lifecycle ('first call establishes a baseline; later calls return evidence changes'), which tells the agent this is a repeated-call tool rather than a one-shot lookup. There is still no explicit when-to-use versus an alternative, no prerequisite (e.g. domain must already resolve), and no when-not guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does well: it discloses the probe mechanism (initialize and tools/list), the no-side-effect boundary ('Does not execute tools'), the output taxonomy (ALLOW/CAUTION/BLOCK), and a concrete cost ($0.01 USDC on Base). It stops short of covering timeouts, reachability requirements, or rate limits for an operation that makes outbound calls to an arbitrary URL.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose and trigger are front-loaded in the first clause, the capability list is packed into a single semicolon-delimited enumeration, and the cost caveat is a short trailing parenthetical. No sentence is filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter tool with no output schema and no annotations, the description supplies the decision-relevant facts: what it probes, what it returns, that it does not execute tools, and what it costs. Only the target-URL expectations are underspecified.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and there is one parameter, serverUrl, whose meaning is only inferable from the surrounding context ('MCP server'). The description adds no format, reachability, or endpoint-shape requirements beyond the schema's bare uri format.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('MCP server security audit') plus the exact trigger point ('before an agent connects or pays'), and enumerates what the audit covers (command/filesystem/wallet capabilities, injection/exfil signals, schema inputs, HSTS, tool surface). This clearly separates it from siblings like mcp_vendor_due_diligence and package_install_preflight, which target different subjects.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'before an agent connects or pays' gives explicit timing guidance for when to call it, which is the key decision point for a preflight tool. However, it never names an alternative or states when-not to use it (e.g., how it differs from mcp_vendor_due_diligence), leaving the sibling choice to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does reasonably well: it discloses non-execution of vendor tools, no safety certification, that metadata is 'live,' and the exact cost ($0.10 USDC on Base). It omits return format, auth requirements, and caching behavior, which a no-annotation tool ideally would cover.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

The deliverable and its components are front-loaded, followed by scope limits and cost. It is dense but each clause carries information; no filler or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a composite tool with no annotations and no output schema, the description covers purpose and boundaries but leaves parameter meaning and return structure undocumented. An agent can decide to call it, but cannot confidently construct arguments for cik/ticker/since from the description alone.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% for four parameters, and the description compensates poorly. It implies mcpUrl (metadata) and cik/ticker (SEC evidence) but never defines 'since' or explains formats, defaults, or optionality of cik/ticker/since. The heavy lifting is left to a bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific deliverable ('decision-ready due-diligence dossier') and enumerates its contents: live MCP metadata, tool-risk preflight, DNS/CAA/certificate evidence, and optional SEC filing evidence. This clearly distinguishes it as a composite vetting tool, though it never explicitly names or contrasts with its sibling preflight/evidence tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives a clear trigger condition – 'before an agent adopts or pays an MCP vendor' – and a when-not in 'Does not execute vendor tools or certify safety.' It stops short of naming alternative tools for narrower needs (e.g., payment or domain preflight), so the routing guidance is contextual rather than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden, and it does disclose meaningfully: what it blocks, that typosquat detection depends on supplying an expected name, that OSV advisories are consulted, and that it costs $0.01 USDC on Base. It remains silent on auth/permission needs, rate limits, and whether the call is strictly read-only.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single dense sentence with the core purpose front-loaded, followed by the cost. Zero filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema and no annotations, so the description should say more about what a caller gets back (verdict shape, advisory details) and any prerequisites. It conveys the check's intent and cost but leaves result format and version handling unaddressed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It clarifies expectedName's role ('when an expected name is supplied') and the ecosystem values (npm or PyPI), but leaves 'version' entirely undocumented in both schema and description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('install preflight' for npm/PyPI) and enumerates the three things it does: block missing packages, detect typosquats, check OSV advisories. This clearly separates it from siblings like mcp_payment_preflight, whose domain is payments rather than package registries.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The word 'preflight' and 'install' imply usage before installing a package, but there is no explicit when-to-use, no exclusions, and no comparison to alternatives. Usage is implied rather than stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It usefully discloses that the guide is free (relevant given the paid x402 siblings), but says nothing about what the call returns, its format, or any limits on usage.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler; the most decision-relevant word ('Free') leads and the covered topics follow. Every phrase earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter informational lookup with no output schema, the listed topics are a reasonable summary of what the agent gets back. It stops short of saying how the guide is delivered or how it relates to the paid siblings in the workflow.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so the baseline is 4 and there is no parameter semantics to explain. Nothing in the description misrepresents the empty input schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

Names a concrete resource (a guide to the FHI MCP tools, the Base-USDC x402 payment flow, and per-tool prices) rather than restating the title. The retrieve/get verb is only implied and the siblings are not named, but an agent can still tell this is a free documentation lookup rather than an analysis tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit when-to-use or when-not-to-use statement. Usage is only implied: the phrase 'per-tool prices' and 'payment flow' suggest consulting it before invoking paid siblings, but the agent has to infer that itself.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden, and it does add one genuinely useful behavioral fact: the cost ($0.01 USDC on Base). It says nothing about rate limits, whether payment must be pre-authorized, or what happens when both ticker and cik are supplied, so coverage is partial at best.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Is the description appropriately sized, front-loaded, and free of redundancy?

A single tight sentence with the core capability front-loaded and the cost deferred to a trailing parenthetical. Nothing is wasted, though the terseness is part of why the semantic gaps above remain.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema and no annotations, yet the description omits the single most important detail for a delta endpoint: whether the response returns a next cursor and how to advance polling. Return shape, pagination and error behavior are all unspecified for a 3-parameter tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate; it does name all three parameters (ticker, cik, since) and gives 'since' a cursor-date meaning. However it omits date/cursor formats and does not resolve whether ticker and cik are alternatives or can be combined, leaving real ambiguity.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: retrieves new SEC 8-K, 6-K and late-filing evidence, scoped to an incremental window. The filing-type list makes it clearly distinct from siblings like domain_change_evidence or package_install_preflight, though it never names a sibling directly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'since a cursor date' implies incremental polling usage without saying so explicitly, and there is no when-to-use/when-not guidance or named alternative. An agent can infer the delta pattern but must guess at the surrounding workflow.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.