Skip to main content
Glama
Shylendra

oauth-mcp-server

by Shylendra

oauth-mcp-server

A production-grade Model Context Protocol (MCP) resource server with OAuth 2.1 authorization. Written in TypeScript with the official @modelcontextprotocol/sdk.

It is provider-agnostic — swap between Auth0, Keycloak, Google, Entra ID, Okta, or any OAuth 2.1-compliant authorization server by changing one configuration file.

Compatible with both MCP specification versions:

  • 2026-07-28 (primary: per-request _meta, server/discover, stateless auth)

  • 2025-11-25 (backward compat: initialize handshake)


Quick Start

Requires Node.js >= 18. All commands below are PowerShell (Windows). For macOS/Linux, replace $env:VAR = "value" with VAR=value.

# 1. Install dependencies
npm install

# 2. Build the TypeScript
npm run build

# 3. Start the server on port 6000 (dev mode — no OAuth required)
$env:PORT = "6000"; $env:MCP_NO_AUTH = "true"; npm run start:http

Verify it's running:

# Health check
curl http://localhost:6000/health

# Protected Resource Metadata (RFC 9728)
curl http://localhost:6000/.well-known/oauth-protected-resource

Expected output:

{"status":"ok","server":"oauth-mcp-server v1.0.0","auth":"disabled (dev mode)","sessions":0}

Running on a Custom Port

The server reads the PORT environment variable. The config file uses port 6000 by default. To use a different port, set both:

# Pick any free port
$env:PORT = "8080"; npm run start:http

If you change the port, also update these fields in your config file to match (config/default.json):

{
  "baseUrl": "http://localhost:8080",
  "authorization": {
    "validation": {
      "jwks": {
        "uri": "http://localhost:8080/.well-known/jwks.json",
        "issuer": "http://localhost:8080"
      }
    },
    "resourceMetadata": {
      "authorizationServers": ["http://localhost:8080"],
      "resource": "http://localhost:8080"
    }
  }
}

The port appears in 5 places in the config — they must all match the port you actually run on.


Related MCP server: MCP REST API Server

Setup Guide: Local Development

For local development, start with OAuth disabled. This unlocks all capabilities without needing any tokens — perfect for testing the server itself.

# Build and start in dev mode
npm run build
$env:PORT = "6000"; $env:MCP_NO_AUTH = "true"; npm run start:http

Variable

What it does

PORT

Port to listen on (defaults to 6000)

MCP_NO_AUTH

Set to "true" to skip ALL OAuth checks — every request gets full access

MCP_CONFIG_PATH

Path to a config JSON file (defaults to config/default.json)

HOST

Bind address (defaults to 127.0.0.1; Cloud Run auto-sets to 0.0.0.0)

Testing with curl (no auth)

# Discover server capabilities
$body = '{"jsonrpc":"2.0","id":1,"method":"server/discover","params":{"_meta":{"io.modelcontextprotocol/protocolVersion":"2026-07-28","io.modelcontextprotocol/clientCapabilities":{}}}}'
curl -X POST http://localhost:6000/mcp -H "Content-Type: application/json" -H "MCP-Protocol-Version: 2026-07-28" -d $body

# List tools (all 18 available since auth is off)
$body = '{"jsonrpc":"2.0","id":2,"method":"tools/list","params":{}}'
curl -X POST http://localhost:6000/mcp -H "Content-Type: application/json" -H "MCP-Protocol-Version: 2026-07-28" -d $body

# Call the echo tool
$body = '{"jsonrpc":"2.0","id":3,"method":"tools/call","params":{"name":"echo","arguments":{"text":"hello world"}}}'
curl -X POST http://localhost:6000/mcp -H "Content-Type: application/json" -H "MCP-Protocol-Version: 2026-07-28" -d $body

Local dev with live reload

# stdio transport (no build step, auto-reloads on code changes)
npm run dev:stdio

# HTTP transport, no OAuth, auto-reloads
$env:MCP_NO_AUTH = "true"; npm run dev:http

Setup Guide: Enabling OAuth (Local Testing with a Real Provider)

When you're ready to test the full OAuth flow, point the server at a real authorization server. Here's the step-by-step for Auth0 (the same pattern works for Keycloak, Okta, etc.).

Step 1: Create an API in Auth0

  1. Go to Auth0 Dashboard → Applications → APIs → Create API

  2. Set Name: MCP Server

  3. Set Identifier: http://localhost:6000 (this becomes your audience)

  4. Set Signing Algorithm: RS256

  5. Click Create

Step 2: Add scopes to the API

In your Auth0 API settings, add these scopes:

mcp:read
mcp:write
mcp:admin

Step 3: Create a Machine-to-Machine client

  1. Go to Applications → Create Application

  2. Name it MCP Client

  3. Choose Machine to Machine

  4. Select the MCP Server API

  5. Grant it mcp:read and mcp:write scopes

  6. Note the Client ID and Client Secret

Step 4: Update the server config

Copy the Auth0 example and fill in your details:

Copy-Item config\auth0.example.json config\production.json

Edit config/production.json — the three fields you must change:

{
  "baseUrl": "http://localhost:6000",
  "authorization": {
    "validation": {
      "jwks": {
        "uri": "https://YOUR_DOMAIN.us.auth0.com/.well-known/jwks.json",
        "issuer": "https://YOUR_DOMAIN.us.auth0.com/",
        "audience": "http://localhost:6000"
      }
    },
    "resourceMetadata": {
      "authorizationServers": ["https://YOUR_DOMAIN.us.auth0.com"],
      "resource": "http://localhost:6000"
    }
  }
}

Field

Where to find it

YOUR_DOMAIN

Auth0 Dashboard → your tenant domain (e.g. acme-corp.us.auth0.com)

uri

https://YOUR_DOMAIN/.well-known/jwks.json

issuer

https://YOUR_DOMAIN/ (trailing slash matters — use exactly what Auth0 shows)

audience

The API Identifier you set in Step 1

Step 5: Start the server with OAuth enabled

# Omit MCP_NO_AUTH — OAuth is now active
$env:PORT = "6000"; $env:MCP_CONFIG_PATH = "config/production.json"; npm run start:http

Step 6: Get a token and test

# Get a token from Auth0 (Client Credentials flow)
$tokenResponse = curl -X POST https://YOUR_DOMAIN.us.auth0.com/oauth/token `
  -H "Content-Type: application/json" `
  -d '{"client_id":"YOUR_CLIENT_ID","client_secret":"YOUR_CLIENT_SECRET","audience":"http://localhost:6000","grant_type":"client_credentials","scope":"mcp:read"}'

$token = ($tokenResponse | ConvertFrom-Json).access_token

# Now call the server with the token
$body = '{"jsonrpc":"2.0","id":1,"method":"tools/list","params":{}}'
curl -X POST http://localhost:6000/mcp `
  -H "Content-Type: application/json" `
  -H "MCP-Protocol-Version: 2026-07-28" `
  -H "Authorization: Bearer $token" `
  -d $body

What happens with no token (OAuth enabled)

# Without a token, the server returns 401
curl -X POST http://localhost:6000/mcp `
  -H "Content-Type: application/json" `
  -H "MCP-Protocol-Version: 2026-07-28" `
  -d '{"jsonrpc":"2.0","id":1,"method":"server/discover","params":{}}'

# Response:
# HTTP 401 Unauthorized
# WWW-Authenticate: Bearer resource_metadata="http://localhost:6000/.well-known/oauth-protected-resource", scope="mcp:read"

Provider-specific notes

Provider

JWKS URI pattern

Issuer pattern

Notes

Auth0

https://<domain>/.well-known/jwks.json

https://<domain>/

Trailing slash on issuer

Keycloak

https://<host>/realms/<realm>/protocol/openid-connect/certs

https://<host>/realms/<realm>

No trailing slash

Okta

https://<domain>/oauth2/<server-id>/v1/keys

https://<domain>

Use the authorization server ID

Entra ID

https://login.microsoftonline.com/<tenant-id>/discovery/v2.0/keys

https://login.microsoftonline.com/<tenant-id>/v2.0

Use tenant ID, not domain


Setup Guide: Production Deployment

Configuration changes for production

The only differences between local and production config are the URLs — everything else stays the same:

{
  "baseUrl": "https://mcp.your-company.com",
  "authorization": {
    "validation": {
      "jwks": {
        "uri": "https://YOUR_DOMAIN.us.auth0.com/.well-known/jwks.json",
        "issuer": "https://YOUR_DOMAIN.us.auth0.com/",
        "audience": "https://mcp.your-company.com"
      }
    },
    "resourceMetadata": {
      "authorizationServers": ["https://YOUR_DOMAIN.us.auth0.com"],
      "resource": "https://mcp.your-company.com"
    }
  }
}

Config field

Local value

Production value

baseUrl

http://localhost:6000

https://mcp.your-company.com

jwks.uri

Your provider's JWKS URL

Same provider URL (unchanged)

jwks.issuer

Your provider's issuer

Same (unchanged)

jwks.audience

http://localhost:6000

https://mcp.your-company.com

resourceMetadata.resource

http://localhost:6000

https://mcp.your-company.com

resourceMetadata.authorizationServers

Your provider

Same (unchanged)

Key insight: The authorizationServers and JWKS/issuer fields point to your OAuth provider (which doesn't change between local and prod). Only the baseUrl, audience, and resource fields reflect where this server is running.

Deploying to Google Cloud Run

npm run build

Cloud Run sets PORT (usually 8080) and K_SERVICE automatically. The server detects K_SERVICE and binds to 0.0.0.0. Set your config path as an env var in Cloud Run:

MCP_CONFIG_PATH=config/production.json

A Dockerfile is included for container-based deployments. After deployment:

  • MCP endpoint: https://<your-cloud-run-url>/mcp

  • Health: https://<your-cloud-run-url>/health

  • Metadata: https://<your-cloud-run-url>/.well-known/oauth-protected-resource

Deploying to Vercel

api/
├── health.ts     # Health check (no auth)
└── mcp.ts        # Stateless Streamable HTTP handler with OAuth

Deploy via Vercel Git integration — no build step or framework preset needed. Set these env vars in Vercel:

MCP_CONFIG_PATH=config/production.json
MCP_CORS_ORIGIN=https://your-client.example.com

After deployment:

  • MCP endpoint: https://<project>.vercel.app/api/mcp

  • Health: https://<project>.vercel.app/api/health

  • Metadata: https://<project>.vercel.app/.well-known/oauth-protected-resource


How OAuth Works on This Server

This server acts as an OAuth 2.1 Resource Server. It never issues tokens — it only validates tokens issued by an authorization server.

The Flow

MCP Client                         This Server                   Auth Server
    │                                    │                            │
    │  POST /mcp  (no token)             │                            │
    │ ──────────────────────────────────►│                            │
    │                                    │                            │
    │  HTTP 401                          │                            │
    │  WWW-Authenticate: Bearer          │                            │
    │    resource_metadata="...",        │                            │
    │    scope="mcp:read"                │                            │
    │ ◄──────────────────────────────────│                            │
    │                                    │                            │
    │  [Client discovers auth server,    │                            │
    │   gets a Bearer token via OAuth]   │                            │
    │ ───────────────────────────────────────────────────────────────►│
    │ ◄───────────────────────────────────────────────────────────────│
    │                                    │                            │
    │  POST /mcp                         │                            │
    │  Authorization: Bearer <token>     │                            │
    │  MCP-Protocol-Version: 2026-07-28  │                            │
    │ ──────────────────────────────────►│                            │
    │                                    │  Validate JWT signature    │
    │                                    │  Check exp, iss, aud       │
    │                                    │  Resolve scopes→permissions│
    │                                    │  Filter capabilities       │
    │  HTTP 200 + MCP response           │                            │
    │ ◄──────────────────────────────────│                            │

Token Validation Modes

Mode

How it works

When to use

jwt

Fetches JWKS from your provider, verifies signature locally. Fast, no network call per request after JWKS is cached.

Auth0, Okta, Keycloak — most providers

introspection

Sends the token to the provider's introspection endpoint on every request. Works with opaque tokens.

When tokens are not JWTs, or you need real-time revocation

hybrid

Tries JWT validation first; falls back to introspection if JWT fails.

When your provider issues both JWT and opaque tokens

Scope Model

Different OAuth scopes unlock different subsets of capabilities. The default config defines:

Scope

What it unlocks

(no token)

echo, current_time, calculate, random_number — public tools only

mcp:read

Public tools + search documents, query analytics, list projects/files, read resources

mcp:write

Everything in read + create/update documents, create/update projects, upload files

mcp:admin

Everything — including get_server_stats, reload_config, list_server_capabilities

mcp:documents:read

Just search_documents + docs://* resources

mcp:analytics:read

Just query_analytics + analytics://* resources

mcp:files:read / mcp:files:write

File system tools

mcp:projects:read / mcp:projects:write

Project management tools

Scopes are additive and resolved in the order listed — if a single token has both mcp:read and mcp:files:write, the user gets the union of both permission sets.


Configuration Reference

Environment Variables

Variable

Default

Description

PORT

6000

HTTP port to listen on

HOST

127.0.0.1

Bind address (0.0.0.0 when K_SERVICE is set, i.e. Cloud Run)

MCP_CONFIG_PATH

config/default.json

Path to the OAuth config JSON file

MCP_NO_AUTH

(not set)

Set to "true" to disable all OAuth checks

MCP_DEV_TOKEN

(not set)

A static JWT to use for local testing (bypasses real OAuth flow)

MCP_LOG_BODY_LIMIT

4000

Max characters logged per request/response body

MCP_CORS_ORIGIN

*

CORS origin for Vercel/public deployments

Config File Structure

The config file (config/default.json or your own) controls everything about the OAuth integration:

{
  "name": "oauth-mcp-server",
  "version": "1.0.0",
  "baseUrl": "http://localhost:6000",

  "authorization": {
    "validation": {
      "mode": "jwt",
      "jwks": {
        "uri": "https://YOUR_DOMAIN/.well-known/jwks.json",
        "cacheTtlSeconds": 3600,
        "allowedAlgorithms": ["RS256"],
        "issuer": "https://YOUR_DOMAIN/",
        "audience": "http://localhost:6000"
      }
    },
    "resourceMetadata": {
      "authorizationServers": ["https://YOUR_DOMAIN"],
      "scopesSupported": ["mcp:read", "mcp:write", "mcp:admin"],
      "bearerMethodsSupported": ["header"],
      "resourceSupported": true,
      "resource": "http://localhost:6000"
    },
    "scopeMapping": {
      "scopes": {
        "mcp:read": {
          "tools": ["echo", "calculate", "current_time", "..."],
          "resources": ["config://app", "docs://*", "..."],
          "prompts": ["summarize", "code_review", "..."]
        }
      },
      "defaultPermissions": {
        "tools": ["echo", "current_time"],
        "resources": ["config://app", "docs://about"],
        "prompts": []
      }
    }
  },
  "capabilities": {
    "tools": { "listChanged": true },
    "resources": { "subscribe": true, "listChanged": true },
    "prompts": { "listChanged": true }
  },
  "instructions": "OAuth-protected MCP resource server. ..."
}

Tool/resource/prompt names in scopeMapping support glob patterns — "*" matches everything, "docs://*" matches all document resources.

Provider Presets

File

Provider

Validation

config/default.json

Local dev

JWKS (dev keys)

config/auth0.example.json

Auth0

JWKS RS256

config/keycloak.example.json

Keycloak

JWKS RS256, ES256


HTTP API Reference

Method

Path

Auth Required

Purpose

POST

/mcp

Yes (Bearer token)

JSON-RPC requests

GET

/mcp

Session ID

Server-Sent Events stream

DELETE

/mcp

Session ID

Terminate a session

GET

/health

No

Health check

GET

/.well-known/oauth-protected-resource

No

RFC 9728 metadata

GET

/.well-known/oauth-protected-resource/mcp

No

Path-specific metadata


Capabilities Inventory

Tools (18)

Category

Tool

Description

Scope

Utility

echo

Text echo — connectivity check

Public

calculate

add, subtract, multiply, divide, power, sqrt

Public

current_time

Server time in any IANA timezone (structured output)

Public

random_number

Random integer in [min, max] range

Public

summarize_list

count, sum, min, max, mean, median, stddev

Public

Data Ops

search_documents

Full-text search across 15+ articles

mcp:read

query_analytics

DAU, revenue, churn, regional data, feature usage

mcp:read

create_document

Create a new KB article

mcp:write

update_document

Update an existing KB article

mcp:write

list_projects

List/filter 12+ mock projects

mcp:read

create_project

Create a new project

mcp:write

update_project

Update project status/progress

mcp:write

File System

list_files

Browse mock directory tree

mcp:files:read

read_file

Read mock file contents

mcp:files:read

upload_file

Create/overwrite a mock file

mcp:files:write

Admin

get_server_stats

Uptime, requests, memory, auth info

mcp:admin

reload_config

Hot-reload OAuth config from disk

mcp:admin

list_server_capabilities

List all tools, resources, prompts

mcp:admin

Resources (10)

URI

Description

Scope

config://app

Server config and feature flags (JSON)

Public

docs://about

About this server (Markdown)

Public

docs://articles/{id}

KB article by ID

mcp:read

docs://articles/recent

10 most recent articles

mcp:read

analytics://dashboard

Current analytics snapshot

mcp:read

analytics://users/{region}

Regional user/revenue data

mcp:read

projects://{id}

Project details by ID (listed)

mcp:read

files://{path}

Mock file content by path

mcp:files:read

user://me

Current user profile from token

mcp:read

system://health

Server health and auth info

mcp:admin

Prompts (5)

Prompt

Arguments

Description

Scope

summarize

text, style

Summarize text (bullet/paragraph/tweet/executive)

mcp:read

code_review

language, code, focus

Structured code review with senior engineer persona

mcp:read

brainstorm

topic, count, perspective

Guided brainstorming session

mcp:read

data_explore

dataset, question

Data exploration with tool guidance

mcp:read

refactor

language, code, goal

Structured refactoring with architect persona

mcp:write


Using with Claude Desktop (stdio)

Add to claude_desktop_config.json:

{
  "mcpServers": {
    "oauth-mcp-server": {
      "command": "node",
      "args": ["C:\\Users\\Shylendra\\git\\oauth-mcp-server\\dist\\stdio.js"]
    }
  }
}

The stdio transport does not use OAuth per the MCP spec — it runs in full-access mode. For OAuth, use the HTTP transport.


Testing

npm run test:smoke         # stdio transport — validates all 18 tools, 10 resources, 5 prompts
npm run test:vercel        # Vercel serverless handler

MCP Inspector

npm run inspect            # stdio transport

Or for HTTP: start the server, then open the Inspector and connect with Transport type: Streamable HTTP, URL: http://localhost:6000/mcp.


Project Layout

src/
├── server.ts                    # McpServer factory (auth-aware)
├── stdio.ts                     # stdio transport entry point
├── http.ts                      # Streamable HTTP entry point (OAuth)
├── banner.ts                    # Startup banner
├── logging.ts                   # Structured JSON logging
├── auth/
│   ├── index.ts                 # Public API surface
│   ├── types.ts                 # ValidatedToken, AuthContext, etc.
│   ├── token-validator.ts       # JWT/JWKS + introspection
│   ├── scope-resolver.ts        # OAuth scopes → MCP permissions
│   ├── discovery.ts             # RFC 9728 metadata + WWW-Authenticate
│   └── errors.ts                # 401/403/400 error responses
├── config/
│   ├── types.ts                 # Config type definitions
│   └── loader.ts                # Config loading + Zod validation
├── capabilities/
│   ├── tools/                   # 18 tools in 4 categories
│   ├── resources/index.ts       # 10 resources
│   └── prompts/index.ts         # 5 prompts
└── data/
    ├── users.ts                 # 8 mock users
    ├── documents.ts             # 15+ knowledge base articles
    ├── projects.ts              # 12+ mock projects
    ├── analytics.ts             # 30-day metrics, regional data
    └── files.ts                 # Mock directory tree

config/
├── default.json                 # Dev config (port 6000)
├── auth0.example.json           # Auth0 preset
└── keycloak.example.json        # Keycloak preset

api/
├── health.ts                    # Vercel health endpoint
└── mcp.ts                       # Vercel serverless OAuth handler

scripts/
├── smoke.mjs                    # stdio smoke test
├── smoke-http.mjs               # HTTP smoke test
├── smoke-vercel.ts              # Vercel smoke test
└── gen-jwks.mjs                 # Dev JWKS generator

Standards Compliance

  • MCP 2026-07-28 — Full spec: server/discover, per-request _meta, stateless auth

  • MCP 2025-11-25 — Backward compatible initialize handshake

  • OAuth 2.1 (draft-ietf-oauth-v2-1-13) — Resource server role

  • RFC 6750 — Bearer Token Usage

  • RFC 8414 — OAuth 2.0 Authorization Server Metadata

  • RFC 8707 — Resource Indicators for OAuth 2.0

  • RFC 9207 — Authorization Server Issuer Identification

  • RFC 9728 — OAuth 2.0 Protected Resource Metadata

License

MIT

Available Tools

18 tools
calculateCalculatorA

Performs a basic arithmetic operation on two numbers. Supports add, subtract, multiply, divide, power, and sqrt.

ParametersJSON Schema
NameRequiredDescriptionDefault
aYesThe first operand (or sole operand for sqrt)
bNoThe second operand (not needed for sqrt)
operationYesThe arithmetic operation to perform

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It only lists operations and says 'basic arithmetic', which repeats the schema's enum. It does not disclose edge-case behaviors like division by zero, square root of negative numbers, or return format, which are important for a calculator tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no filler. It concisely conveys the tool's scope and supported operations.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has potential failure modes (e.g., divide by zero, sqrt of negative) and no output schema, leaving the agent unaware of return values or error handling. The schema captures parameter types but the description adds no behavioral context beyond a listing of operations, making it incomplete for safe invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, providing descriptions for all parameters. However, the description says 'on two numbers' which is misleading for sqrt, which uses only one operand. This internal inconsistency detracts from the schema's clarity.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool performs basic arithmetic operations, listing specific supported operations (add, subtract, multiply, divide, power, sqrt). This distinguishes it from sibling tools, which are unrelated (e.g., echo, read_file, create_project).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies this is for basic arithmetic, which is clear context. Since no sibling tool performs similar arithmetic, explicit exclusions are unnecessary. However, it lacks guidance on when to prefer this over, say, a more specialized calculator tool (none exist here).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

create_documentCreate DocumentB

Creates a new knowledge base article in the mock document store.

ParametersJSON Schema
NameRequiredDescriptionDefault
tagsNoTags for categorization
titleYesDocument title
contentYesDocument content (markdown)
categoryYesDocument category

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses mutation ('creates a new') but does not mention return values, validation behavior, potential errors, or side effects. For a create operation, it could state whether the created document is returned or whether duplicates are allowed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence front-loaded with the action, wasting no words. It is appropriately sized for a simple create tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is a simple create operation with rich schema coverage, but the description lacks return-value information and usage context. Given no annotations and no output schema, additional details about expected response or edge cases would improve completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All four parameters are fully described in the schema (100% coverage), so the description need not explain them. The description adds no additional parameter meaning, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific verb ('creates') and resource ('knowledge base article') in a specific store, making the purpose evident. It implicitly distinguishes from sibling create_project, but does not explicitly contrast with update_document or other create tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives like create_project or update_document. There is no mention of context, prerequisites, or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

create_projectCreate ProjectB

Creates a new project in the mock project management system.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesProject name
tagsNoProject tags
deadlineNoDeadline in YYYY-MM-DD format
descriptionYesProject description

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the full burden of behavioral disclosure. It only states the action and target, without mentioning side effects, return behavior, permissions, or any other behavioral traits. This is a significant gap for a mutation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no redundant words, effectively communicating the core purpose. It is concise and well-structured, earning its place without unnecessary elaboration.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having a clear purpose and complete parameter schema, the description lacks context about return values, successful behavior, or any operational details. Since there is no output schema, the description should at least indicate what the tool returns, but it does not.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage for all four parameters, providing meaningful semantics without relying on the tool description. The description adds no extra parameter details, but the schema already handles this adequately.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly identifies the action ('creates'), the resource ('a new project'), and the context ('mock project management system'), making it unambiguous. It clearly distinguishes from sibling tools like create_document or update_project by specifying 'project' as the target.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for creating projects, but it does not explicitly state when to prefer this over similar tools (e.g., create_document) or provide exclusions or prerequisites. It lacks guidance on alternative scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

current_timeCurrent TimeA

Returns the current server time in the requested IANA timezone (e.g., 'America/New_York', 'Asia/Tokyo'). Defaults to UTC.

ParametersJSON Schema
NameRequiredDescriptionDefault
timezoneNoAn IANA timezone name, e.g. 'America/New_York'. Defaults to UTC.UTC

Output Schema

ParametersJSON Schema
NameRequiredDescription
isoYesISO 8601 timestamp
unixYesUnix timestamp in seconds
timezoneYes
dayOfWeekYes
formattedYes

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It transparently states that the tool returns server time (not local/client time), accepts an IANA timezone, and defaults to UTC. It also implies a read-only operation with no side effects. While it doesn't detail error handling or output format, the core behavior is clearly disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-structured sentence that front-loads the action ('Returns the current server time') and includes necessary context (IANA timezone, default UTC). Every word is informative, and there is no redundant or filler content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a low-complexity tool with one optional parameter and an output schema present. The description adequately covers the tool's purpose and input behavior. Since an output schema exists, the description does not need to explain return values. The description is complete enough for an agent to correctly select and invoke the tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema provides 100% coverage of the 'timezone' parameter, including its IANA format and default value. The description adds example timezone names, but this information is already in the schema description. Therefore, the description adds minimal semantic value beyond the structured schema, warranting the baseline score of 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states what the tool does: 'Returns the current server time in the requested IANA timezone.' It uses a specific verb and resource, and provides concrete examples of timezone values. This distinguishes it from sibling tools like echo, calculate, or random_number, which have entirely different purposes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage: use this when you need the current server time, optionally in a specific timezone. However, it does not explicitly mention alternatives or when not to use it compared to other tools. There is no direct guidance on tool selection relative to siblings, so it falls to 'implied usage' rather than clear contextual differentiation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

echoEchoA

Echoes back the text you send. Useful as a connectivity check to verify the server is reachable.

ParametersJSON Schema
NameRequiredDescriptionDefault
textYesThe text to echo back

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It states the exact behavior (echoing back text) and frames it as a connectivity check, implying no side effects or state changes. While it doesn't explicitly say 'read-only' or 'no side effects,' the nature of an echo tool makes this strongly implicit.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two short sentences, front-loaded with the core action and followed by a practical use case. Every word earns its place with zero redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a trivially simple tool with one parameter and no output schema. The description fully covers its purpose, behavior, and recommended use context. Nothing important is missing for an agent to correctly select and invoke this tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema describes the single parameter 'text' as 'The text to echo back,' achieving 100% schema coverage. The tool description adds no additional meaning about parameter constraints, format, or limits. With full schema coverage, the baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Echoes back the text you send,' which is a specific verb+resource action. It is unambiguous and distinct from all sibling tools such as calculate, read_file, or create_document. No other tool suggests echoing input, so it stands alone.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly provides a use case: 'Useful as a connectivity check to verify the server is reachable.' This gives clear context for when to invoke the tool. It does not mention alternatives or when-not-to-use, but for such a simple utility this is sufficient.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_server_statsServer StatisticsB

Returns server health metrics including uptime, request count, memory usage, and the OAuth provider configuration summary.

ParametersJSON Schema
NameRequiredDescriptionDefault
includeMemoryNoInclude detailed memory usage information

Output Schema

ParametersJSON Schema
NameRequiredDescription
uptimeYes
platformYes
nodeVersionYes
authProviderYes
requestCountYes
uptimeSecondsYes

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description must carry the full burden of behavioral transparency. It states what the tool returns but does not disclose whether the operation is read-only, whether it requires specific permissions, or any potential side effects. The name suggests a read operation, but the description does not explicitly confirm safety or limitations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-structured sentence that front-loads the main purpose ('Returns server health metrics') and then lists specific metrics. Every word contributes meaning, with no repetition or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simplicity of the tool (one optional parameter) and the presence of an output schema, the description is reasonably complete. It explains what the tool returns, and the schema covers the parameter. However, it lacks usage guidance and explicit safety information, which would improve completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema fully documents the only parameter (includeMemory) with a description and default value, so baseline is 3. The tool description adds no additional information about the parameter or its effect, but since schema coverage is 100%, no compensation is needed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool returns server health metrics including uptime, request count, memory usage, and OAuth provider configuration summary. It uses a specific verb ('Returns') and names the resource ('server health metrics'), but does not explicitly distinguish it from sibling tools like query_analytics or list_server_capabilities.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage when server health metrics are needed, but provides no explicit guidance on when to prefer this tool over alternatives or when not to use it. There is no mention of exclusions or prerequisites, so the guidance is only implicit through the stated purpose.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_filesList FilesA

Lists files and directories in a mock file system. Use '/' to see the root, or a directory path like '/project/src' for subdirectories.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathNoDirectory path to list. Use '/' for root./

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It discloses that the tool operates on a 'mock file system,' which is a key behavioral context. It also implies a read-only operation via 'lists,' though it does not detail error handling or hidden-file behavior. Still, the disclosure is adequate for this simple tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the purpose and immediately followed by a concrete usage example. Every word earns its place with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter list tool with no output schema, this description covers the essential context: what it lists, the mock nature, and how to specify paths. No further information is needed for an agent to select and invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description reiterates the schema's 'Use '/' for root' and adds a multi-level path example, but this is marginal extra meaning beyond what the schema already provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource: 'Lists files and directories in a mock file system.' This clearly distinguishes it from sibling tools like read_file, upload_file, and list_projects, which target different resources or actions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit usage guidance with examples: 'Use '/' to see the root, or a directory path like '/project/src' for subdirectories.' It gives concrete context on how to invoke the tool, though it does not explicitly discuss alternatives or when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_projectsList ProjectsC

Lists mock projects with optional filters for status, owner, and tag.

ParametersJSON Schema
NameRequiredDescriptionDefault
tagNoFilter by tag
statusNoFilter by project status

TDQS

C2.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must communicate behavioral traits, but it only states the tool lists mock projects, implying a read operation without detailing permissions, side effects, or return format. The mention of an 'owner' filter that isn't in the schema is misleading, further reducing transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence that front-loads the primary action. The unnecessary 'owner' mention is an inaccuracy, but structurally it is clean and easy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list tool with two optional filters, the description covers the basic purpose and filter capability. However, it lacks details about response format, pagination, or any usage context, and the inaccurate owner filter creates a gap. Overall, it is minimally sufficient but not thorough.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already provides clear descriptions for the two parameters (status and tag), so the baseline is 3. However, the description introduces an 'owner' filter that is not a real parameter, which adds confusing and inaccurate semantics beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists projects, with a specific resource ('projects') and action ('lists'). It also mentions optional filters, distinguishing it as a listing operation. However, it inaccurately claims an 'owner' filter that does not exist in the schema, which slightly detracts from clarity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives like search_documents or query_analytics. The phrase 'mock projects' implies a testing context, but there are no explicit exclusions or alternative suggestions, leaving the decision to the agent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_server_capabilitiesList Server CapabilitiesA

Lists all available tools, resources, and prompts that this server exposes, grouped by scope requirement.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must carry behavioral disclosure. It adds a useful detail: results are 'grouped by scope requirement.' However, the meaning of 'scope requirement' is not explained, leaving some ambiguity about the output structure. The tool is inherently read-only, but this is not explicitly stated, though it is fairly obvious.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, clear sentence that delivers all essential information without redundancy. It is front-loaded with the verb and resource, making it easy to scan. No word is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, no-output-schema tool, this description is mostly complete. It tells the agent what the tool lists and hints at the grouping structure. However, it could briefly mention that this is the canonical way to discover capabilities, and it might clarify what 'scope requirement' refers to, but overall it is sufficient for the tool's simplicity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the schema is fully covered (100%). The description correctly avoids inventing parameter details. With no parameters, a baseline of 4 is appropriate because there is nothing to explain; the description's mention of grouping refers to output structure, not input semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Lists all available tools, resources, and prompts that this server exposes.' It uses a specific verb ('lists') and resource ('available tools, resources, and prompts'). It also distinguishes itself from all sibling tools, which are domain-specific, by being a server introspection tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage as a discovery mechanism but does not explicitly state when to use it versus alternatives. Since no sibling tool performs a similar discovery function, the lack of explicit 'when not to use' is acceptable, but the guidance is still only implied rather than clearly articulated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

query_analyticsQuery AnalyticsA

Query mock analytics data including daily active users, revenue, churn rate, and feature usage across a 30-day window.

ParametersJSON Schema
NameRequiredDescriptionDefault
metricYesWhich analytics view to query
endDateNoEnd date (YYYY-MM-DD) for daily metrics
startDateNoStart date (YYYY-MM-DD) for daily metrics

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full responsibility for behavior disclosure. It does add the 30-day window and the type of data returned, which gives some transparency about the query scope. However, it does not disclose the response format, pagination, or behavior when date parameters are omitted or exceed the 30-day window, leaving ambiguity.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-front-loaded sentence that states the action, resource, and key details without any superfluous information. Every word earns its place, making it highly concise and easy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is relatively simple with only three parameters and no output schema, so the description covers the core purpose. However, the interplay between the '30-day window' and arbitrary startDate/endDate parameters is unclear—does it represent a default, a maximum, or a fixed range? Also, without an output schema, the description would benefit from explaining what the query returns for each metric value, but it does not.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already provides 100% coverage for all three parameters, so the baseline is 3. The description adds extra meaning by indicating the 30-day window, which likely relates to how startDate and endDate are interpreted, and by naming the metrics that correspond to the 'metric' enum options (e.g., daily, features). This goes beyond simply restating the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool queries mock analytics data and specifies the exact metrics (daily active users, revenue, churn rate, feature usage) and a 30-day window. This uses a specific verb ('Query') and resource ('analytics data'), and it fully distinguishes itself from the sibling tools, none of which deal with analytics.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage context is implied: use this tool to query analytics data. However, there is no explicit guidance on when to use it versus alternatives, nor any exclusions or prerequisites. The mention of 'mock' data hints that it is not for real data, but this is not stated as a direct usage guideline.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

random_numberRandom NumberA

Generates a random integer in an inclusive range [min, max].

ParametersJSON Schema
NameRequiredDescriptionDefault
maxNoInclusive upper bound
minNoInclusive lower bound

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden. It discloses the core behavior: random integer, inclusive bounds. However, it doesn't mention edge-case handling (e.g., min > max) or the distribution, leaving some ambiguity for error-prone inputs.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence that is direct and information-dense, with no unnecessary words or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with no output schema and no complex parameters, the description fully captures the behavior: it returns a random integer within the specified inclusive range. It is sufficient for an agent to use it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, with both 'min' and 'max' described as inclusive bounds. The description reinforces this with the [min, max] notation but adds little beyond what the schema already provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's action ('Generates a random integer') and its key scope (inclusive range [min, max]). This distinguishes it from siblings like 'calculate' and 'current_time' which serve different functions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies its use case: when a random integer within a specified inclusive range is needed. It doesn't explicitly discuss exclusions or alternatives, but for a simple generator, the context is clear enough.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

read_fileRead FileA

Reads the contents of a mock file from the file system. Specify the full path like '/project/src/server.ts'.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYesFull file path to read, e.g. '/project/package.json'

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses that this reads a 'mock' file and specifies the path format, implying a read-only operation. However, it does not mention error handling, return format, or explicitly confirm non-destructiveness beyond the verb 'reads'.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, directly stating the action and providing an example. It is front-loaded, efficient, and contains no unnecessary words or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter read tool with no output schema, the description covers the essential action and parameter guidance. It does not explicitly state the return value format or error behavior, but the low complexity and clear verb 'reads' make this adequate for selection and invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, with the path parameter already described in the schema. The description adds a concrete example path and emphasizes 'full path', providing slight value beyond the schema, but does not add significant semantic detail beyond what is already documented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool reads the contents of a mock file from the file system, using a specific verb ('Reads') and resource. It distinguishes from sibling tools like list_files or upload_file by focusing on reading existing file contents, and the example path clarifies the expected input format.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the use case (read a file's contents) but does not explicitly compare to alternatives or state when not to use it. It provides no exclusions or references to sibling tools, so usage guidance is only implicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

reload_configReload ConfigurationA

Hot-reloads the OAuth provider configuration from disk. Useful after updating scopes or provider settings.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It mentions that the reload is 'hot' and reads 'from disk,' but it does not disclose side effects, prerequisites (e.g., admin permissions), error behavior, or whether the reload affects other components. This leaves significant behavioral ambiguity.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two short sentences that get straight to the point: 'Hot-reloads the OAuth provider configuration from disk. Useful after updating scopes or provider settings.' No wasted words, and the most essential information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (zero parameters, no output schema), the description covers the core purpose and a common use case. It is missing details like error handling or preconditions (e.g., config file must exist), but for a straightforward reload action, it is reasonably complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the input schema is empty and there is nothing to document. The baseline for no params is 4, and the description correctly does not invent parameter details. It adds no parameter-specific meaning, but none is needed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function with a specific verb and resource: 'Hot-reloads the OAuth provider configuration from disk.' This unambiguously identifies what the tool does and distinguishes it from any sibling tools, none of which handle configuration.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides a clear usage context: 'Useful after updating scopes or provider settings.' This tells the agent when the tool is appropriate. However, it does not explicitly mention when not to use it or alternative tools, so it loses a point for lacking exclusions or alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_documentsSearch DocumentsA

Full-text search across the mock knowledge base of 15+ articles covering Technology, Science, and Business topics.

ParametersJSON Schema
NameRequiredDescriptionDefault
queryYesSearch query (matches title, content, tags, and category)
categoryNoOptional: filter by category
maxResultsNoMaximum number of results to return (default: 5)

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultsYes
totalMatchesYes

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden. It discloses the tool performs full-text search over a mock knowledge base and covers specific topics, adding context beyond the schema. However, it does not mention result sorting, pagination, or read-only nature, leaving some behavioral gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with no wasted words, immediately stating the verb and resource. It is well-structured and easy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the output schema exists and the input schema fully documents parameters, the description provides sufficient context about the mock knowledge base and topics. It lacks an explicit note about read-only behavior or result count limits, but these are inferable from the schema. For a simple search tool, this is adequate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% description coverage for all parameters, so the baseline is 3. The description adds context about the search scope but does not elaborate on individual parameters beyond what the schema already provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific action (full-text search) on a defined resource (mock knowledge base of 15+ articles), with scope (categories). This distinguishes it from sibling tools like read_file or list_files, which do not offer search functionality.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The context implies the tool is for searching the knowledge base, but there is no explicit when-to-use guidance or exclusions. Since no sibling tools perform search, usage is inferable but not explicitly stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

summarize_listSummarize ListA

Computes basic statistics (count, sum, min, max, mean, median, standard deviation) over a list of numbers.

ParametersJSON Schema
NameRequiredDescriptionDefault
numbersYesA non-empty list of numbers

Output Schema

ParametersJSON Schema
NameRequiredDescription
maxYes
minYes
sumYes
meanYes
countYes
medianYes
stddevYes

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations are absent, so the description carries the full burden. It explicitly states it computes statistics, implying a pure, non-mutating operation. However, it does not disclose edge-case behavior (e.g., NaN, Infinity) or side effects, but for a simple computation tool, this is adequate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-organized sentence that front-loads the purpose and lists all statistics, with no wasted words or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple (one parameter) and has an output schema, so return values don't need to be in the description. The description covers purpose and parameters sufficiently, but lacks explicit usage context; still, it is complete enough for a tool of this complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already has 100% coverage, describing 'numbers' as 'A non-empty list of numbers'. The description repeats 'list of numbers' without adding any additional parameter semantics, so it meets the baseline of 3 but adds no extra value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb 'computes' and clearly specifies the resource 'a list of numbers' along with the exact statistics (count, sum, min, max, mean, median, standard deviation). This fully distinguishes it from sibling tools like 'calculate' or 'random_number'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for summarizing numeric lists but does not explicitly state when to use it over alternatives like 'calculate' or exclude non-list cases. No direct comparison or when-not-to-use guidance is provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

update_documentUpdate DocumentB

Updates an existing knowledge base article.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesDocument ID to update
tagsNoNew tags
titleNoNew title
contentNoNew content

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. It does not explain whether this is a partial or full update, what happens if the document does not exist, or whether changes are reversible. The single sentence provides no behavioral context beyond the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence that immediately states the core purpose. It wastes no words and is appropriately sized for the simplicity of the tool, though it lacks detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite low complexity and full schema coverage, the description is too sparse for a mutation tool. It does not cover key behavioral aspects like partial update semantics, error handling, or return value, especially since annotations are absent and there is no output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all four parameters. The description adds no extra semantics about how parameters interact (e.g., whether tags replace or merge), so it stays at the baseline of 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Updates') and the resource ('existing knowledge base article'). The word 'existing' distinguishes this from create operations, and the resource type is specific enough to differentiate from other update tools like update_project.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for updating existing articles, but does not explicitly state when to use this tool versus alternatives like create_document. No exclusions or prerequisites are mentioned, so guidance is only implied by the word 'existing'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

update_projectUpdate ProjectB

Updates a project's status, progress, or details.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesProject ID to update
statusNoNew status
deadlineNoNew deadline in YYYY-MM-DD format
progressPercentNoNew progress percentage (0-100)

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description must fully convey behavioral traits. It indicates mutation ('Updates') but does not disclose whether fields are partially updated or replaced, whether the operation requires special permissions, or what the response looks like. This leaves significant behavioral ambiguity for a mutation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence that front-loads the core purpose. However, the word 'details' is vague and could be interpreted as a catch-all, slightly reducing precision while maintaining brevity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has four parameters, no output schema, and no annotations, so the description must carry more weight. It fails to mention required parameters, update semantics, return behavior, or any side effects. This is insufficient for an agent to confidently invoke the tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema provides full documentation for all four parameters (id, status, deadline, progressPercent), so the description adds little beyond that. It lists 'status' and 'progress' which map to schema properties, but does not explain id or deadline semantics beyond what the schema already provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool updates a project's status, progress, or details. It uses a specific verb ('Updates') and resource ('project'), and distinguishes itself from sibling tools like update_document by focusing on projects rather than documents.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives. There is no mention of exclusions or prerequisite conditions, leaving the agent to infer usage solely from the tool's name and description.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

upload_fileUpload FileA

Creates or overwrites a file in the mock file system. Specify the full path and content.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYesFull file path, e.g. '/project/docs/NOTES.md'
contentYesFile content to write

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It explicitly states 'overwrites,' which is a key destructive behavior, and 'mock file system' sets expectations about the environment. It doesn't mention other side effects (e.g., permission checks, parent directory creation), but for a simple tool, the overwrite disclosure is valuable.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences. The first states the purpose and behavior, the second tells the user what to provide. No redundant words or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple two-parameter tool with no output schema, the description covers the core purpose, the overwrite behavior, and the required inputs. It lacks details on return values or error behavior, but the tool's simplicity and the mock-file-system context make it reasonably complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema covers both parameters fully (100% coverage) with descriptions for path and content. The description's instruction to 'Specify the full path and content' adds minimal value beyond the schema, so the baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'Creates or overwrites a file in the mock file system.' It uses a specific verb and resource, and distinguishes itself from siblings like read_file and list_files by focusing on file creation/overwrite.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use the tool (when creating or overwriting a file), but it does not explicitly mention when not to use it or provide alternatives. It's clear enough for the simple use case, but lacks the explicit context and exclusions seen in high-scoring examples.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

TDQS

B3.2/5.0
Disambiguation5/5

Each tool performs a distinct action on a distinct resource (e.g., echo vs calculate vs read_file vs create_project). Descriptions are explicit and leave no ambiguity about what each tool does.

Naming Consistency4/5

The vast majority of tools follow a verb_noun pattern (read_file, create_document, list_projects, upload_file). A few outliers (echo, calculate, current_time, random_number) use bare verbs or noun phrases, causing minor inconsistency.

Tool Count2/5

With 18 tools, the set feels bloated for an OAuth-oriented server. Many tools (echo, calculate, current_time, random_number, summarize_list) are generic utilities unrelated to OAuth, making the count disproportionate to the server's stated purpose.

Completeness1/5

The server lacks any OAuth-specific tools such as authorize, token, or client management. Even within the mock domains (files, documents, projects), operations like delete or single-item retrieval are missing, leaving significant gaps in the tool surface.

Maintenance

ActivityMaintained
ResponsivenessSyncing

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • F
    license
    D
    quality
    D
    maintenance
    A ready-to-use starter implementation of the Model Context Protocol (MCP) server that enables applications to provide standardized context for LLMs with sample resources, tools, and prompts.
    2
    0
    1
  • F
    license
    Not graded
    quality
    D
    maintenance
    A server implementation of the Model Context Protocol (MCP) that provides REST API endpoints for managing and interacting with MCP resources.
  • A
    license
    Not graded
    quality
    D
    maintenance
    A self-hostable OAuth 2.0 server designed for the Model-Context-Protocol (MCP) that enables you to secure your MCP applications with a robust implementation you control.
    3,607
    112
    ISC
  • A
    license
    Not graded
    quality
    D
    maintenance
    A comprehensive reference implementation demonstrating all features of the Model Context Protocol (MCP) specification, serving as documentation, learning resource, and testing tool for MCP implementations.
    1
    MIT

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/Shylendra/oauth-mcp-server'

If you have feedback or need assistance with the MCP directory API, please join our Discord server