Skip to main content
Glama

MCP Endpoint Lint - handshake, tool schemas, JSON-RPC errors

Does it answer JSON-RPC errors, or HTML 500s?

error_conformance
Read-onlyIdempotent

FIRST CALL, needs nothing: {"name":"whoami","arguments":{}} — Send five things a real client eventually sends by accident and check what comes back: an unknown method (expects -32601), tools/call naming a tool that does not exist (expects -32602/-32601 or a result with isError), tools/call with no tool name (expects -32602), a body that is not JSON (expects -32700), and a body missing "jsonrpc":"2.0" (expects -32600). Reports the HTTP status and the error code side by side, and flags an HTML error page or a 5xx where a JSON-RPC error belongs — the failure that makes a client report the wrong cause. Makes 5 requests, 6 s each. Example: url='https://mcp.example.com/mcp' — or {} for the fixture, which fails two of the five.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
urlYesThe MCP endpoint to lint — the URL you POST JSON-RPC to, e.g. https://mcp.example.com/mcp. Not stored anywhere. This server refuses its own publisher, IP literals and private names.

TDQS

B3.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already cover safety (readOnlyHonest, idempotent, non-destructive), so the description only needs to add behavioral context. It does that by disclosing that the tool makes five network requests, each with a 6-second budget, and that it flags HTML error pages or 5xx responses. No contradiction exists between the annotations and the description.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description packs a lot of useful specification into one dense paragraph, including expected error codes and output behavior. It is not concise: the initial whoami instruction is unrelated to the tool's own behavior, and the long run-on structure makes the operational steps harder to parse. A short structured list would serve agents better.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the rich annotations and simple one-parameter schema, the description covers the key contextual gaps: number of requests, timeout, what it reports, and how to interpret failures. It also provides example usage. It is not fully complete because the fixture shortcut contradicts the schema and the response format is only vaguely described as 'side by side'.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already fully describes the single url parameter (100% coverage), so the description did not need to repeat or extend much. However, the description says 'or {} for the fixture' while the schema marks url as required and gives fixture://mcp-endpoint-lint/demo as the example. This is a misleading and contradictory instruction for the agent about a required parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the tool's function: it sends five deliberately malformed JSON-RPC requests and reports whether the endpoint returns proper JSON-RPC errors or HTML/5xx failures. It adds concrete expectations like -32601 and -32700, which make the purpose distinct from the sibling report tools. It loses the fifth point only because the description does not explicitly differentiate itself from siblings, and some sentences focus on a whoami call rather than the tool's core function.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit statement of when to use error_conformance versus sibling tools such as handshake_report, discovery_report, or score_card. The opening 'FIRST CALL' instruction is ambiguous and appears to recommend calling whoami first rather than describing when this tool should be used. The example input provides some operational guidance, but not real usage context or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A3.9/5.0
Disambiguation5/5

Each tool has a clearly distinct role: the four check tools target separate protocol aspects, score_card is explicitly the aggregate runner, example is a fixture demo, and whoami is self-inspection. Even where score_card composes the other checks, descriptions make the relationship unambiguous.

Naming Consistency3/5

Names are all lowercase and underscore-separated, but the pattern is mixed: discovery_report, handshake_report, and tools_list_report share a report suffix, while error_conformance, score_card, example, and whoami do not follow it. The names are readable and descriptive, but not fully predictable.

Tool Count5/5

Seven tools is well-scoped for an endpoint linter: four specialized checks, one aggregate score, one demo helper, and one identity/rate-limit introspection tool. Each tool earns its place and the count supports both granular investigation and high-level monitoring.

Completeness5/5

The tool surface covers the stated domain end to end: pre-handshake discovery, initialize/handshake behavior, tools/list schema validation, and JSON-RPC error conformance, plus an aggregate score_card. No obvious dead ends or missing operations exist within the server's declared purpose.

Resources