Skip to main content
Glama

MCP Endpoint Lint - handshake, tool schemas, JSON-RPC errors

What a client looks for before it dials

discovery_report
Read-onlyIdempotent

FIRST CALL, needs nothing: {"jsonrpc":"2.0","id":1,"method":"tools/call","params":{"name":"whoami","arguments":{}}} — GET the documents an MCP client reads BEFORE the handshake and report what each one answered: /.well-known/oauth-protected-resource in BOTH forms — the root form everyone publishes and the RFC 9728 §3.1 insertion form a spec-following client actually requests for a resource served under a path — /.well-known/oauth-authorization-server, /.well-known/mcp, /.well-known/mcp.json, /mcp.json and /llms.txt. Each result carries the status, the verdict (served, missing, gated, soft-404 — a 200 carrying an HTML error page — or invalid JSON) and what a client does with that document. Makes one GET per document, 6 s each. Example: host='mcp.example.com' or host='https://mcp.example.com/mcp' (a path turns on the RFC 9728 insertion-form check) — or {} for the built-in fixture.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
hostYesA hostname, or the full endpoint URL. Give the full URL when your endpoint is served under a path: that is what the RFC 9728 §3.1 insertion form is derived from.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observed

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark readOnly, idempotent, non-destructive, and openWorld; the description adds that it makes one GET per document with a 6-second timeout, reports per-document status and verdict, and checks both root and RFC 9728 §3.1 insertion forms when a path is supplied. This clearly extends beyond the annotations without contradicting them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense and informative, but it front-loads a confusing JSON-RPC snippet for whoami that is not this tool's invocation, wasting space before the actual action is stated. The rest is well organized with documents, verdicts, timing, and examples, but the extraneous prelude and inline JSON block reduce clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description compensates by stating that each result carries status, verdict, and what a client does with the document, plus timing, path behavior, and fixture support. It covers the main invocation and interpretation needs for a one-parameter read-only diagnostic, though it does not specify the exact report aggregation format.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already covers host with 100% description coverage, but the tool description adds further meaning: it accepts a hostname, a full endpoint URL where a path enables the insertion-form check, or {} for the built-in fixture. This goes beyond the schema, although the '{}' option slightly conflicts with the schema's required field.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action: GET the discovery documents an MCP client reads before the handshake and report what each answered, listing exact endpoints and verdict categories. It distinguishes from siblings like handshake_report by emphasizing 'BEFORE the handshake' and from tools_list_report/whoami by targeting well-known documents rather than listings or identity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description positions the tool as 'FIRST CALL' and gives concrete host examples, but it never explicitly names alternatives or says when not to use it. The 'FIRST CALL, needs nothing' prelude is ambiguous because the embedded JSON-RPC payload is for whoami, not for this tool, weakening the guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

Resources