Skip to main content
Glama

MCP Endpoint Lint - handshake, tool schemas, JSON-RPC errors

Does the handshake work, and is it idempotent?

handshake_report
Read-onlyIdempotent

FIRST CALL, needs nothing: {"name":"whoami","arguments":{}} — POST initialize to an MCP endpoint you name and report what came back: the protocol version it negotiated against the one you asked for, the capabilities it advertises, serverInfo, timing, the transport shape (JSON or SSE frame, session id, content-type), and — sent a second time, byte for byte — whether the server answers an identical initialize the same way. Also asks for a version nobody publishes, to see whether it negotiates down or agrees to anything. Makes 3 requests, 6 s timeout each, user-agent growth-loop/1.0 (+https://www.pathwren.workers.dev/mcp-lint.html). Example: url='https://mcp.example.com/mcp' — or call with {} to run it against the built-in fixture, which makes no outbound request at all.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
urlYesThe MCP endpoint to lint — the URL you POST JSON-RPC to, e.g. https://mcp.example.com/mcp. Not stored anywhere. This server refuses its own publisher, IP literals and private names.
protocol_versionNoThe protocolVersion to ask for. Defaults to 2026-07-28.

TDQS

A3.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnly/idempotent annotations, the description discloses concrete behavior: 3 requests, 6 s timeout each, a deliberately unpublished protocol version to test negotiation, a byte-for-byte second initialize to test idempotence, and the user-agent string. This gives an agent an accurate picture of what the tool will do on the network.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is one dense, run-on paragraph that mixes an unexplained whoami JSON snippet, behavior enumeration, timing, user-agent, example, and fixture instructions. It contains valuable detail, but the opening is confusing and the structure does not cleanly front-load the core purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description thoroughly covers the expected return dimensions and network behavior, which matters because there is no output schema. But it fails to clearly state the required input contract due to the schema/description conflict about whether url can be omitted, and it omits error-handling behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema covers both parameters at 100%, so the baseline is 3, and the description does add useful detail about the fixture and the fact that {} makes no outbound request. However, this directly contradicts the schema's required ['url'] and the url parameter description, which says a URL is needed. That contradiction is actively misleading for an agent deciding how to invoke the tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states exactly what the tool does: POST initialize to a named MCP endpoint and report negotiated protocol version, capabilities, serverInfo, timing, transport shape, and idempotence. This is a specific verb+resource description that clearly separates it from sibling tools like discovery_report or error_conformance.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives a clear example URL and explains that calling with {} uses a built-in fixture with no outbound request, which is useful usage context. However, it never explicitly says when to prefer this tool over its siblings or when not to use it, and the opening 'FIRST CALL, needs nothing: whoami' instruction is ambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Try in Browser

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A3.9/5.0
Disambiguation5/5

Each tool has a clearly distinct role: the four check tools target separate protocol aspects, score_card is explicitly the aggregate runner, example is a fixture demo, and whoami is self-inspection. Even where score_card composes the other checks, descriptions make the relationship unambiguous.

Naming Consistency3/5

Names are all lowercase and underscore-separated, but the pattern is mixed: discovery_report, handshake_report, and tools_list_report share a report suffix, while error_conformance, score_card, example, and whoami do not follow it. The names are readable and descriptive, but not fully predictable.

Tool Count5/5

Seven tools is well-scoped for an endpoint linter: four specialized checks, one aggregate score, one demo helper, and one identity/rate-limit introspection tool. Each tool earns its place and the count supports both granular investigation and high-level monitoring.

Completeness5/5

The tool surface covers the stated domain end to end: pre-handshake discovery, initialize/handshake behavior, tools/list schema validation, and JSON-RPC error conformance, plus an aggregate score_card. No obvious dead ends or missing operations exist within the server's declared purpose.

Resources