clinic-mcp-server

An MCP server written so that its security properties can be asserted, together with the suite that asserts them. It exposes a clinic booking API to an agent: read the doctor list, read a patient's own appointments, and — only under a profile that says so — book and cancel.

The interesting half is not what the tools do. It is the gap between what a tool does and what an agent is able to reach, which is why every test here drives a real MCP client over an in-memory transport instead of importing the handlers. tools/list and tools/call are what an agent sees. A test that called the functions directly would answer the first question and miss the second.

npm install
npm test          # 21 tests, no services, no API key, nothing leaves the machine

The three properties worth reading the code for

1. A tool outside the session's profile is never registered. Not registered-and-refused: absent from tools/list, absent from the model's context, unreachable by any prompt. A permission check inside a handler leaves the affordance in place — the name and the description still sit in the model's context, still describable, still part of a plan the model can assemble. That check does hold; no prompt talks a server out of an if. It is simply the only thing left between the plan and the call, and it has to stay correct through every later change to the file.

An unregistered name misses the same lookup that a name nobody ever invented misses, and comes back the same way: Tool <name> not found. The tests assert that wording, because "you are not allowed to call this" states that the capability exists and this session is the wrong one, which is an invitation to go looking for a better session. What a model does with that difference is not measured here; the assertion is about what the server says.

2. The server holds no credential of its own. The tempting design is a service account: one privileged token in the server's environment, with the tools deciding who may ask for what. That is the confused deputy, and it builds OWASP ASI03 in on purpose — a hijacked agent would inherit the server's authority over every patient in the database instead of the operator's over their own record. Here the caller's token is forwarded unchanged, so the API's own auth stays the authority and this server can never grant more than the person running it already had.

3. Tool descriptions are screened before the server will start. A description is not documentation. It is text injected into the model's context over a channel the model treats as trustworthy. The published shape of the attack is a description that tells the agent to read a credentials file "for validation" and pass the contents as an argument: nothing in the protocol prevents it, and no test of tool behaviour would notice, because the tool behaves exactly as written. The description is the payload.

descriptionPolicy.js rejects directive phrasing, references to other tools, invisible characters, and anything long enough to hide a payload in — and it reads parameter descriptions too, since they travel to the model inside the same tool definition. A violation stops the process at start-up: a poisoned description must not reach a model even once, and a server that refuses to boot is a failure someone reads, while a warning in a log is not.

One asymmetry in that policy is deliberate and has its own test. A tool description may not name another tool, because that suggests a call chain nobody asked for. A parameter description may, because there it says where the value comes from, which is what a caller needs in order to pass it correctly. The rule is about the field, not about the words.

Related MCP server: Ecuro Light API MCP Server

Tools

Profiles nest: booking includes readonly, full includes both. An unrecognised profile yields an empty catalogue and refuses to build the server, rather than falling through to a default nobody chose — a typo in an environment variable should not hand an agent a catalogue.

Two of the tools aggregate locally instead of proxying. GET /doctors takes no query parameters and there is no /specialties route at all, so passing ?specialty= down would have looked like it worked: the API ignores unknown query strings and returns everyone, and the model would have reported a filtered list that was never filtered. Both tools are built on that one route, and the end-to-end test "list_doctors narrows by specialty, and the narrowing is real" is what keeps the aggregation honest — it asserts the narrowed list is both non-empty and strictly smaller than the full one, which is the pair of assertions a filter that silently does nothing would fail.

What the tests cover

21 tests in test/mcpServer.test.js, grouped by the OWASP Top 10 for Agentic Applications category each one makes real:

The applicability mapping this grouping comes from — which categories a system can have, which it cannot, and what would have to exist for the rest to apply — lives in clinic-booking-api-tests as docs/OWASP_AGENTIC.md.

The stand-in, and what it is honest about

The real system under test is a private Express service. test-double/api.js stands in for it so this repository runs on its own, and the substitution is sound because HTTP is the only thing the server knows about the API: same routes, same status codes, and the same refusal to honour ?specialty= — copied deliberately, because an obliging stand-in would make the tool's own filtering untested and the regression above invisible.

What the stand-in is not: evidence that the tools work against the production service. It is evidence that the whole path is exercised and that a tool calling a route which does not exist turns the suite red. That is what the end-to-end tests are there to do — the check itself was confirmed by deleting the /doctors route and watching exactly the two tests that depend on it fail.

Running it against something

# against the stand-in
npm run start:double                                    # terminal 1, port 3000
MCP_PROFILE=readonly SUT_BASE_URL=http://127.0.0.1:3000 \
  SUT_ACCESS_TOKEN=patient-token node server.js         # terminal 2

# against a real API
MCP_PROFILE=booking SUT_BASE_URL=https://your-api \
  SUT_ACCESS_TOKEN=<the caller's jwt> node server.js

Speaks stdio, so it drops into any MCP client's config the usual way.

Related

• clinic-booking-api-tests — the suite this server was built for: RAG evaluation against a golden set, prompt-injection tests, the OWASP agentic mapping, a scheduled model-drift run

• temporal-failure-lab — Kafka, outbox, DLQ and seven planted temporal defects, shipped with its own system under test