Skip to main content
Glama
Asmit Dev Tools

Asmit Dev Tools

by asmitsr

Asmit Dev Tools — MCP Server

Python MCP License: MIT

A small, safe MCP server that other people can install from GitHub and connect to Claude Desktop, VS Code, Cursor or any MCP client. It is a program, not a website — it runs over stdio and is not deployed to Vercel.

Tools

Tool

What it does

check_password_breach

Counts how many times a password appeared in known breaches. Only the first 5 characters of the SHA-1 hash are sent to Have I Been Pwned (k-anonymity); the password and full hash are never sent or stored.

password_strength

Local 0-5 strength score for a password, with improvement suggestions. Nothing is sent anywhere.

generate_password

Random password generated locally with the secrets module. Never stored or sent elsewhere.

split_expense

Splits an expense equally or by custom shares and simplifies who owes whom. Money is handled in integer poisha, never floats, so shares always add up exactly.

settle_balances

Simplifies any set of balances (who is owed / owes) into the fewest payments.

convert_currency

Converts between currencies with a free no-key exchange-rate API. Indicative rates only.

repo_health

Health summary of a public GitHub repository: stars, forks, open issues, language, license, days since last push, top languages by bytes, and open pull requests counted from the first 100. No token is used; private repos return "not found" by GitHub's design.

repo_compare

Side-by-side health of two public repositories.

github_user_summary

Public user summary: repo count, followers, total stars on fetched repos, top languages. Public data only.

audit_tool_list

Static security checklist for an MCP server's tool list (score + findings + fixes). Nothing is run and nothing connects to a live server.

check_url_status

Checks whether a URL is reachable and what status it returns (HEAD). Guarded against SSRF: only globally routable addresses may be fetched, and every redirect target is re-validated (max 5 redirects).

world_time

Current time in any IANA timezone, plus UTC and Asia/Dhaka.

Deliberately not included: shell execution, file writes, database writes, money movement, or anything that handles secrets. Those are exactly the capabilities the MCP security discussion warns about.

Related MCP server: @mate-tools/mcp-server

Architecture (Phase 1)

asmit_mcp/server.py is only the registrar (FastMCP + logging wrapper). Tool logic lives in tools/ — security.py, finance.py, github.py, utility.py — and shared helpers live in core/ — errors.py (response format), validation.py (input rules), http.py (timeouts, response cap, rate limit), cache.py (currency-rate cache), ratelimit.py (per-host call limit), ssrf.py (URL guard).

Error format: success is {"ok": true, ...data}; errors are {"ok": false, "error": "message", "error_code": "CODE"} where CODE is VALIDATION_ERROR, NOT_FOUND, RATE_LIMITED, EXTERNAL_API_ERROR, SSRF_BLOCKED or UNKNOWN_ERROR. Input problems raise a validation error that the server wrapper converts; external API problems return their code directly. Logs go to stderr only (stdout is the MCP channel) and record tool name, success/failure, duration and error code — never inputs, passwords, tokens or arguments.

Validation is FastMCP/Pydantic at the protocol level plus explicit domain rules in core/validation.py (types, ranges, length caps, GitHub name shapes, finite numbers, 3-letter currency codes). No separate Pydantic model layer was added: it would duplicate what FastMCP already does without adding safety.

Install and use

Requires Python 3.10+.

git clone https://github.com/asmitsr/asmit-mcp-server.git
cd asmit-mcp-server
python -m venv .venv
.venv/bin/pip install .

Claude Desktop config (claude_desktop_config.json), using uvx:

{
  "mcpServers": {
    "asmit-mcp-server": {
      "command": "uvx",
      "args": ["--from", "git+https://github.com/asmitsr/asmit-mcp-server.git", "asmit-mcp-server"]
    }
  }
}

Or run the server directly for testing:

.venv/bin/python -m asmit_mcp.server

Example prompts (once connected)

  • "Check whether the password password has appeared in a breach."

  • "Split 900 taka between A, B and C, paid by A, and tell me who owes whom."

  • "How healthy is the public repo asmitsr/DoremanAI?"

  • "Audit this tool list for security risks: ..."

Test

Protocol test (stdio, lists tools and calls each one):

.venv/bin/python test_client.py

Offline unit tests for the pure-computation tools, including SSRF, rate-limit, timeout, currency-failure and expense edge cases:

.venv/bin/python -m unittest discover -s tests -v

Lint:

.venv/bin/pip install ruff
.venv/bin/ruff check asmit_mcp tests test_client.py

The test client connects over stdio, lists the tools, and calls each one: a known breached password, a random password, a 900/3 split, a public repo, and safe vs risky tool lists for the audit.

Honest limits

  • This server never runs shell commands, never writes files, and never moves money. That is a safety choice, not a missing feature.

  • repo_health uses GitHub's unauthenticated public API, so it is subject to GitHub's 60 requests/hour limit for shared IPs. The server also applies its own generous per-host limit (50 calls/minute) so a runaway client cannot burn that budget, and currency rates are cached in memory for 5 minutes. An optional GITHUB_TOKEN is not supported yet — the server is designed to need no token at all.

  • check_url_status's SSRF guard resolves the hostname locally and requires a globally routable address. On networks where local DNS is intercepted (a VM whose resolver maps every hostname to a synthetic reserved address), the guard blocks instead of fetching — it never fails open. On a normal machine with direct DNS, public URLs pass. The guard was verified with mocked DNS and with private addresses; the public-URL path was not verified end-to-end in the proxied test environment, for exactly this reason.

  • MCP clients pass only a small environment whitelist to a stdio server by default. If your network needs a proxy, add its variables in your client's env config for this server; the included test_client.py forwards the machine's proxy variables for the same reason (values are read at runtime, never stored in the repo).

  • audit_tool_list is a static checklist, not a safety certification. A high score does not prove a server is safe.

  • Never give this server (or any MCP server) your API keys, passwords or tokens. It does not need them.

Known limitations

  • DNS rebinding (TOCTOU): check_url_status validates the addresses a hostname resolves to, but the connection then resolves the hostname again. An attacker-controlled DNS record could change between the check and the connection, so the guard alone does not close this gap. A fix is planned for a later Phase 2 step: connect to the validated IP while keeping the original Host header and TLS SNI.

  • Client testing: the server has only been tested with a Python MCP client over stdio. Claude Desktop, VS Code, and Cursor have NOT been tested yet.

Available Tools

12 tools
audit_tool_listA

Static security checklist for an MCP server's tool list.

tools_json is a JSON list of {"name": ..., "description": ...}. Nothing is run and nothing connects to a live server. The result is a checklist score, not a safety certification.

NameRequiredDescriptionDefault
tools_jsonYes

Output Schema

NameRequiredDescription
resultYes

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations supplied, the description carries the full burden and does reasonably well: it discloses that nothing executes, no network connection occurs, and the output is a graded checklist rather than a certification. This preempts the main misuse risk (treating the score as a safety guarantee). It does not mention input size limits or failure behavior on malformed JSON, which are the remaining behavioral gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, front-loaded with the purpose before the caveats. The phrasing is fragmentary but every sentence adds information; nothing is redundant. Slightly more polish in wording would help readability without lengthening it.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return-value details are correctly omitted, and the negative scoping (no execution, no live connection, not a certification) covers the key behavioral question for a single-parameter tool. Only minor details, such as handling of malformed input or expected size, are absent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, and it does by defining the expected shape: a JSON list of objects with 'name' and 'description'. The one weakness is that the schema types tools_json as a string while the description calls it a 'JSON list', leaving ambiguity about whether the agent should pass a serialized string or an array.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names the resource (an MCP server's tool list) and the operation (a static security checklist audit), so an agent knows exactly what it produces. It is distinguishable from all siblings, which are unrelated utility tools (password, currency, repo, URL checks), so no sibling disambiguation is needed.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It sets clear boundaries on use: 'Nothing is run and nothing connects to a live server' and the result is 'a checklist score, not a safety certification.' That tells an agent when this is appropriate (static review of tool metadata) and what not to expect from it. What's missing is an explicit statement of when to prefer this over any alternative, but no comparable sibling exists.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

check_password_breachA

Count how many times a password appeared in known data breaches.

Privacy: only the first 5 characters of the SHA-1 hash are sent to Have I Been Pwned (k-anonymity). The password and the full hash are never sent, stored or logged.

NameRequiredDescriptionDefault
passwordYes

Output Schema

NameRequiredDescription
resultYes

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden, and it delivers meaningfully: it discloses the k-anonymity mechanism, exactly what data leaves the system (first 5 SHA-1 characters), and that the password and full hash are never sent, stored, or logged. It does not cover rate limits, offline/failure behavior, or result semantics beyond the count, which keeps it below 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short blocks: the purpose sentence first, then the privacy note. Every sentence earns its place, and the privacy disclosure is exactly the kind of information an agent needs before passing a secret into a tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter read tool with an output schema present, the description covers purpose and the critical privacy behavior. The main remaining gap is a lack of explicit guidance on when to prefer it over the sibling password tools, but nothing essential for correct invocation is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It does convey that the parameter is a plaintext password and that hashing is handled internally, but it does not state format constraints such as length, encoding, or whether an already-hashed value is accepted. Baseline-adjacent with a useful hint but incomplete.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: count how many times a password appeared in known data breaches. This is clearly distinguishable from sibling tools like password_strength and generate_password, and an agent can tell what it returns without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage (check whether a password has been exposed) but never explicitly says when to use this versus password_strength or generate_password, nor does it state any preconditions such as requiring a plaintext password. Usage is inferable but not guided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

check_url_statusA

Check whether a URL is reachable and what status it returns.

SSRF guard (core.ssrf) runs before the request and again for every redirect target: only globally routable addresses may be fetched, at most 5 redirects. Only a HEAD request is made; nothing is downloaded fully and no form is submitted. "reachable: false" is a result, not an error: it means the check itself ran and the URL did not answer.

NameRequiredDescriptionDefault
urlYes

Output Schema

NameRequiredDescription
resultYes

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does substantial work: it discloses the SSRF guard, the globally-routable-only restriction, the five-redirect cap, HEAD-only requests, and that nothing is downloaded or submitted. It does not cover timeouts, rate limits, or authentication requirements, which leaves room above a 4.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the purpose, then grouped into guard behavior, request behavior, and error semantics. Every sentence contributes a distinct operational fact with no repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter tool with an output schema, this covers nearly everything an agent needs, including the crucial clarification that `reachable: false` is a successful check result rather than a failure. The remaining gap is URL format and timeout behavior.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% for the single `url` parameter, so the description must compensate. It adds the important constraint that only globally routable addresses may be fetched, but never states whether a scheme is required or which schemes are accepted, leaving the most basic input-format question unanswered.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: check whether a URL is reachable and what status it returns. No sibling overlaps this capability (the siblings are password, expense, currency, repo, and time tools), so there is no ambiguity to resolve.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: an agent can infer this is for verifying URL reachability, but there is no explicit statement of when to prefer it over another approach and no exclusions. There are no close alternatives among the siblings, which softens the gap but does not eliminate it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

convert_currencyB

Convert an amount between currencies using a free no-key rate API.

Rates are indicative, from exchangerate-api.com, and are not financial advice. Rates are cached in memory for 5 minutes.

NameRequiredDescriptionDefault
amountYes
to_currencyYes
from_currencyYes

Output Schema

NameRequiredDescription
resultYes

TDQS

B3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With zero annotation coverage the description carries the full behavioral burden, and it does disclose several useful traits beyond the schema: no API key required, upstream source exchangerate-api.com, indicative (non-authoritative) rates, a 'not financial advice' caveat, and a 5-minute in-memory cache. However, it omits what happens on an invalid or unsupported currency code, whether unsupported pairs are rejected or approximated, and whether any rate limiting applies to callers.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences with no filler, and the core action is front-loaded ahead of the provenance and caveat details. The mid-sentence line breaks are cosmetic noise but do not impair readability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values needn't be explained, and the caching and disclaimer context is genuinely helpful for a rate lookup. What is missing for a three-required-parameter conversion tool with no schema descriptions is any specification of currency code format or amount constraints, which an agent needs to invoke it correctly on the first try.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and all three parameters are required with no titles beyond bare names, so the description is the only source of meaning. It says nothing about expected currency code format (ISO 4217 like 'USD' vs a name), casing, or whether amount may be negative or zero. It only indirectly implies the parameters by describing the operation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb ('Convert') and resource ('an amount between currencies') plus the mechanism ('a free no-key rate API'), so the operation is unambiguous. No sibling tool deals with currency, so no explicit differentiation is needed or provided, which caps it just below the top mark.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the purpose rather than stated: there is no explicit 'use this when...' guidance, no mention of when a different tool would be preferable, and no prerequisites called out. Given the sibling set contains nothing adjacent to currency conversion, the omission is low-risk but still a gap.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

generate_passwordA

Generate a random password locally with the secrets module.

The password is generated on the server machine and returned to the caller; it is never stored or sent anywhere else. Length is clamped to 8-64.

NameRequiredDescriptionDefault
lengthNo
include_symbolsNo

Output Schema

NameRequiredDescription
resultYes

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations supplied, the description carries the full burden and does disclose meaningful behavior: the password is generated on the server, returned to the caller, and never stored or transmitted elsewhere. It also discloses input clamping ('Length is clamped to 8-64'), which tells the agent how out-of-range values are handled. It stops short of describing the character-set/entropy guarantees or what happens if include_symbols makes generation impossible, so not a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The core action is front-loaded in the first sentence, and the following sentences add non-redundant behavioral context. Slightly padded by line breaks, but no wasted wording.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, and for a simple two-parameter generator the description covers what is generated, where it is generated, whether it is persisted, and the input bounds. The only residual gap is include_symbols semantics, which is minor at this complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It does add real meaning for 'length' by declaring the 8-64 clamp that the schema does not state, but it says nothing about 'include_symbols' — the parameter that most affects the output's character set. Partial compensation for a two-parameter tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Generate a random password') plus the mechanism ('secrets module'), which unambiguously separates it from siblings like check_password_breach and password_strength. An agent can pick this tool without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the description (produce a fresh random password, generated server-side rather than stored), but there is no explicit when-to-use/when-not guidance and no routing to siblings such as password_strength for validating an existing password. Adequate but leaves the agent to infer the workflow.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

github_user_summaryA

Public summary of a GitHub user: profile, repo count, total stars across their public repos, and most-used languages. Public data only, no token; private repos are invisible to the public API by design.

NameRequiredDescriptionDefault
usernameYes

Output Schema

NameRequiredDescription
resultYes

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations supplied, the description carries the full burden and does well on the important traits: it discloses the auth model (no token required) and a real behavioral limit (private repos are invisible to the public API by design). It does not cover error behavior for a nonexistent username or rate limiting, which is why it falls short of a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the resource and its contents, followed immediately by the data-visibility constraint. Nothing is repeated and every clause adds information an agent would otherwise have to guess.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter, read-oriented lookup with an output schema already documenting returns, this covers purpose, scope, and visibility limits adequately. The remaining gap is edge-case behavior (nonexistent user, rate limits) and parameter format, which is minor given the tool's simplicity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% for the single 'username' parameter, so the description would need to compensate. It does not add format detail such as whether this is the login handle versus display name, case sensitivity, or whether a URL is accepted, though the parameter name itself is largely self-documenting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific resource (a GitHub user) and enumerates exactly what the summary contains: profile, repo count, total stars across public repos, and most-used languages. That is concrete enough that an agent can distinguish it from repo-scoped siblings like repo_health and repo_compare without opening a schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Scope is stated ('public data only, no token'), which implies when the tool is applicable, but there is no explicit when-to-use guidance or named alternative (e.g., 'use repo_health for a single repository'). The agent must infer that this is the user-level overview tool rather than a repo-level one.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

password_strengthA

Score a password 0-5 and explain how to improve it.

The password is scored locally and never sent anywhere. Score: one point each for length 8+, length 12+, mixed case, a digit, and a symbol. This is a strength hint, not a guarantee.

NameRequiredDescriptionDefault
passwordYes

Output Schema

NameRequiredDescription
resultYes

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden and does meaningful work: it reveals the scoring rubric (five named criteria), discloses that the password is scored locally and never transmitted, and sets expectations that the result is advisory rather than a security guarantee. What is missing is only what the improvement explanation contains, which the output schema already covers.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, front-loaded with the outcome, followed by the rubric and then the caveat. Every sentence adds information not present in the structured fields, and nothing is redundant.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter tool with an output schema, the description covers scoring logic, privacy handling, and the interpretation caveat. The only gap is the absence of explicit sibling routing, which is minor given how distinct this tool's function is.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% and the single parameter 'password' is a bare string with no constraints in the schema. The description compensates for the most important semantic point by stating the value is processed locally and never sent anywhere, but adds nothing about length limits, encoding, or whether the plaintext is echoed back.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Score a password 0-5 and explain how to improve it.' It is immediately distinguishable from the siblings check_password_breach (breach lookup) and generate_password (creation), so an agent can route correctly without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: the tool is presumably for evaluating a password the user already has, and the caveat 'strength hint, not a guarantee' hints at when its result is insufficient. It never explicitly says when to prefer check_password_breach or generate_password instead, nor any prerequisites, so the agent must infer the routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

repo_compareC

Side-by-side health comparison of two public GitHub repositories.

NameRequiredDescriptionDefault
repo1Yes
repo2Yes
owner1Yes
owner2Yes

Output Schema

NameRequiredDescription
resultYes

TDQS

C2.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are supplied, so the description carries the full behavioral burden. It hints that only public repositories are accepted but says nothing about which health signals are compared, what happens with nonexistent or private repos, rate limits, or whether the two repos must be related.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single tight sentence with no filler and the key constraint ('two public repositories') front-loaded. Its brevity is efficient in form, though it borders on under-specification rather than padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be described. But for a four-parameter comparison tool with zero annotation and zero schema-description coverage, the description omits comparison dimensions, error behavior, and parameter pairing semantics, leaving real gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, with four required parameters documented only by bare titles like 'Owner1' and 'Repo1'. The description does not explain that the parameters form two owner/repo pairs, nor any format expectations (URL vs slug, case sensitivity), so it fails to compensate for the coverage gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Names a specific verb ('health comparison') and resource ('two public GitHub repositories') in a single clear phrase. The word 'two' and 'side-by-side' implicitly separates it from the sibling repo_health, which handles a single repo, though that sibling is never named.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No statement of when to pick this over repo_health, no prerequisites, no exclusions. An agent must infer that repo_health is the single-repo alternative and that private repositories are out of scope from the word 'public' alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

repo_healthB

Health summary of a PUBLIC GitHub repository, plus upgrades: top languages by bytes and open pull requests counted from the first 100 open PRs. If those extra calls fail, they are reported as null instead of failing the whole health check.

NameRequiredDescriptionDefault
repoYes
ownerYes

Output Schema

NameRequiredDescription
resultYes

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the behavioral burden, and it does disclose one important trait: extra calls (languages, PRs) may fail and return null rather than failing the whole check. It does not mention authentication needs, rate limits, or that PR counting is capped at the first 100 open PRs in a way that could undercount — actually the cap is stated, but the consequence (truncated counts) is not spelled out.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Roughly three sentences with the core purpose front-loaded and the failure-mode caveat last. 'Plus upgrades' is slightly awkward phrasing but no sentence is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, and the failure semantics are covered. Missing pieces for a tool that makes multiple GitHub API sub-calls are auth expectations and rate-limit behavior, which an agent would want before calling.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% — 'owner' and 'repo' are bare strings with no descriptions. The description compensates only partially by restricting the repo to public GitHub repositories; it says nothing about owner login format (user vs org) or case sensitivity. Adequate but not fully compensating for the coverage gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (health summary) and resource (a public GitHub repository), plus the included data (top languages by bytes, open PR count). It is clearly not repo_compare or github_user_summary, though it never names a sibling explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The 'PUBLIC' qualifier implicitly tells the agent this tool is unsuitable for private repos, which is useful scoping. However, there is no explicit when-to-use guidance or routing to repo_compare for comparison tasks; usage must be inferred from the name.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

settle_balancesA

Simplify any set of balances into the fewest payments.

balances maps each person to what they are owed (+) or owe (-); the values must sum to zero. Money is handled in integer poisha.

NameRequiredDescriptionDefault
balancesYes

Output Schema

NameRequiredDescription
resultYes

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full disclosure burden and does meaningful work: it defines the sign convention, states the invariant that values must sum to zero, and specifies integer poisha as the money unit. It stops short of saying what happens if the invariant is violated (error vs. silent normalization) or how ties in the minimal-payment set are resolved.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short clauses with the core action front-loaded, then the input contract and the unit convention in dependency order. Nothing is repeated and nothing is padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Output schema exists, so return values need not be described, and the description covers the input semantics and the key invariant for a one-parameter computational tool. The remaining gap is failure behavior when the sum is non-zero, which matters for a tool that hard-constrains its input.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% and the single parameter is a nested free-form object, so the description must compensate — and it does, explaining that keys are people and values are signed net positions in integer poisha. It leaves a minor ambiguity: the schema types values as 'number' while the text says integer poisha, so the agent is not told whether floats are rejected or rounded.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource plus the optimization goal: 'Simplify any set of balances into the fewest payments.' An agent can tell this is a netting/settlement computation rather than the arithmetic in split_expense, though the description never names that sibling explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the input contract ('balances maps each person to what they are owed (+) or owe (-); the values must sum to zero'), which effectively tells the agent the precondition for calling it. There is no explicit when-to-use, when-not-to-use, or pointer to an alternative, so the routing signal is indirect.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

split_expenseB

Split an expense and simplify who owes whom.

Equal split: the remainder poisha go to the first members, so the shares always add up exactly. Custom split: shares must sum exactly to the total, otherwise a validation error is returned.

NameRequiredDescriptionDefault
membersYes
paid_byYes
total_amountYes
custom_sharesNo

Output Schema

NameRequiredDescription
resultYes

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations supplied, the description carries the full burden, and it does disclose two real behaviors: remainder poisha are allocated to the first members so shares sum exactly, and custom shares that do not sum to the total produce a validation error. It does not state whether the expense is persisted/mutated, whether it requires prior setup, or anything about side effects, so a mutation-vs-pure-computation question is left open.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short paragraphs, each front-loading its mode, with no filler sentences. The only minor friction is the unexplained "poisha" term and the line break that splits the equal-split sentence mid-thought.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, and the splitting arithmetic is well covered. Still, for a four-parameter tool with 0% schema coverage and no annotations, the undefined paid_by and the unspecified currency/units of total_amount are meaningful gaps an agent would have to guess at.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate for all four parameters, and it only partly does: it explains the interaction between members and custom_shares and the exact-sum constraint, but never defines paid_by (payer identity semantics) or the unit of total_amount beyond the unexplained word "poisha".

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

"Split an expense and simplify who owes whom" gives a specific verb and resource, and the two named modes (equal vs custom) clarify scope. It does not differentiate itself from the sibling settle_balances, which plausibly also deals with who-owes-whom, so an agent must infer the boundary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description effectively distinguishes two invocation modes (equal split vs custom_shares) and states the failure condition for the custom path, which is useful routing guidance at the parameter level. However, it never says when to choose this tool over settle_balances or whether the expense is persisted, leaving the sibling relationship to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

world_timeA

Current time in a given IANA timezone, plus UTC and Asia/Dhaka for comparison. timezone_name examples: Asia/Dhaka, Asia/Kolkata, Europe/London, America/New_York.

NameRequiredDescriptionDefault
timezone_nameYes

Output Schema

NameRequiredDescription
resultYes

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full disclosure burden. It does add genuinely non-obvious behavior by revealing that the response also contains UTC and Asia/Dhaka values alongside the requested zone, but it says nothing about how invalid or misspelled timezone names are handled or what the failure mode looks like.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two compact sentences, front-loaded with what the tool returns before the format examples. Every element earns its place; the example list is the most valuable part for callers and nothing is redundant.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter read-only utility with an output schema already defining return values, this is nearly sufficient: purpose, format and examples are all present. The only meaningful gap is error behavior for invalid timezone identifiers, which the annotation-free description could have covered.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the schema says only 'timezone_name: string'. The description compensates well for a single parameter by naming the format ('IANA timezone') and giving four concrete valid examples spanning Asia/Dhaka, Asia/Kolkata, Europe/London and America/New_York, which is enough for an agent to construct a correct value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific resource and scope: 'Current time in a given IANA timezone', and even enumerates the extra values returned (UTC and Asia/Dhaka). No sibling tool covers time lookup, so there is nothing to confuse it with, and an agent can select it from the name plus this sentence alone.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: the agent can infer it is the tool for 'what time is it in X'. There is no explicit when-to-use framing, no statement of when not to use it, and no prerequisite such as requiring a valid IANA identifier rather than a city name or offset.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 12 tool updatesv0.1.0
    • First observedaudit_tool_list
    • First observedcheck_password_breach
    • First observedcheck_url_status
    • First observedconvert_currency
    • First observedgenerate_password
    • First observedgithub_user_summary
    • First observedpassword_strength
    • First observedrepo_compare
    • First observedrepo_health
    • First observedsettle_balances
    • First observedsplit_expense
    • First observedworld_time

TDQS

B3.4/5.0

Scored across 12 tools

Disambiguation4/5

Most tools target clearly different resources: password checks vs. expense math vs. GitHub repo analysis vs. URL probing vs. time lookup. The only real overlap is split_expense, which also 'simplifies who owes whom', versus settle_balances which does the same simplification on a balance set; descriptions distinguish them but the boundary is soft.

Naming Consistency3/5

Everything is snake_case, which is good, but the verb_noun convention is only partly followed: check_password_breach, generate_password, split_expense, convert_currency, check_url_status are verb-led, while password_strength, repo_health, repo_compare, github_user_summary, world_time are bare noun phrases. Readable, but not a predictable pattern an agent can extrapolate.

Tool Count4/5

Twelve tools is a reasonable, well-scoped count with no obvious filler; each tool has a concrete job. The count is fine, though it is spread across many unrelated mini-domains rather than one coherent surface.

Completeness3/5

Each sub-domain is thin: expenses can be split and settled but there is no notion of groups, members, or persistence; currency offers only conversion with no rate lookup or supported-currency listing; GitHub covers health/compare/user but no repo search or issue/PR detail; time offers only current time with no conversion. Agents can work around these gaps, but they will hit dead ends for anything beyond a single call per domain.

Maintenance

ActivityMaintained
ResponsivenessNo recent community issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    D
    maintenance
    Provides essential utility tools for text processing, file operations, hashing, temperature conversion, password generation, and date/time operations through a comprehensive MCP interface.
    MIT
  • A
    license
    A
    quality
    D
    maintenance
    MCP server providing 35 utility tools for AI agents including text analysis, encoding, hashing, password generation, JSON/CSV/XML parsing, regex, color, date, finance, URL metadata, SEO tags, DNS lookup, SSL inspection, and JWT decoding. Free, zero-dependency, and works with any MCP client.
    35
    66 npm
    MIT
  • A
    license
    A
    quality
    C
    maintenance
    Enables everyday utilities like calculation, text analysis, encoding, hashing, UUID generation, datetime lookup, and note management through MCP tools, resources, and prompts.
    11
    MIT
  • A
    license
    A
    quality
    C
    maintenance
    Provides deterministic developer utilities as MCP tools, including UUID/password generation, hashing, encoding, JWT decoding, cron scheduling, regex execution, and text analysis. Runs entirely locally with no network calls, telemetry, or API keys.
    20
    336 npm
    MIT