Skip to main content
Glama
havvari

trigger_refund

by havvari
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Local

FDE Assessment — MCP servers, gateways, and LLM routing

Four independent deliverables in one Python project: an MCP server with strict validation over stdio, an MCP security gateway proxy, a streaming PII-redaction guardrail, and a rate-limiting model-fallback router.

Task

Where

The interesting part

1

MCP server, trigger_refund

task1_mcp_server/

Malformed input becomes a real -32602, which the SDK does not do by default

2

MCP security gateway

task2_mcp_gateway/

A denied admin_ call never reaches the downstream server

3

Streaming PII guardrail

task3_stream_guardrail/

PII split across chunk boundaries, redacted at +0.16 ms TTFT

4

Rate limiter + fallback router

task4_router/

Sliding window, BEGIN IMMEDIATE, reserve-then-reconcile

Each task directory has its own README covering how to run it, how to test it, the design decisions behind it, and what I would do differently in production. NOTES.md records the ambiguities in the brief and how each was resolved.

Setup

uv sync            # Python 3.12, pinned in .python-version and uv.lock

uv is the only prerequisite (pip install uv). If it is not on your PATH, the Makefile falls back to python3 -m uv.

Related MCP server: mcp-server-skeleton

Everything, in two commands

uv run pytest -q                                          # 175 tests
uv run ruff check . && uv run ruff format --check . && uv run mypy .

Both must be clean, with no skipped tests.

Running the pieces

uv run uvicorn mock_provider.llm:app --port 8100            # fake LLM: 429s, hangs, split PII
uv run uvicorn mock_provider.mcp_downstream:app --port 8200 # fake downstream MCP server
uv run python -m task1_mcp_server                           # MCP server over stdio
uv run uvicorn task2_mcp_gateway.app:app --port 8300        # MCP security gateway
uv run uvicorn task3_stream_guardrail.app:app --port 8400   # streaming PII guardrail
uv run uvicorn task4_router.app:app --port 8500             # rate-limiting router
uv run python -m task3_stream_guardrail.benchmark           # the TTFT numbers in Task 3

Task 1 waits silently for a client — that is correct, it is speaking JSON-RPC on stdin/stdout.

A Makefile wraps all of the above (make test, make lint, make run-task2, make bench, …). It is a convenience only; every target is a one-line uv run of the command above it. It is unverified — make is broken on the machine this was built on (the Xcode Command Line Tools are an x86_64 install on an arm64 Mac, so /usr/bin/make cannot start), so the uv run forms above are the ones that were actually executed.

Each task README has verified curl invocations — every command printed there was run against a live server, and two of them found real bugs while being checked.

Repo map

common/            jsonrpc.py · errors.py · logging.py   — shared across tasks
mock_provider/     llm.py · mcp_downstream.py            — controllable failure modes
task1_mcp_server/  validation.py · ledger.py · server.py · __main__.py
task2_mcp_gateway/ config.py · auth.py · policy.py · app.py
task3_stream_guardrail/ redactor.py · sse.py · app.py · benchmark.py
task4_router/      limiter.py · providers.py · router.py · app.py
tests/             one module per task, plus stdio_harness.py and fixtures/

MCP SDK version — read this before writing MCP code

Pinned to mcp==2.2.0. v2 is a breaking change from v1, and almost every example online is still v1. What changed:

  • FastMCP → MCPServer (from mcp.server.mcpserver import MCPServer).

  • Wire types moved to the standalone mcp-types package, imported as mcp_types.

  • Fields normalised to snake_case.

mcp.server.fastmcp still exists solely to raise ModuleNotFoundError with a pointer to the migration guide, which is a kindness — the bare "No module named" would have given no hint that the installed SDK is simply a different major version.

Two v2 behaviours shaped the design and are worth knowing before you read Task 1:

  1. stdio_server() claims fd 1 — it dup2s the real JSON-RPC wire onto a private descriptor and points fd 1 at stderr for the session. A print() inside a handler cannot corrupt the stream. The window before that claim is still exposed.

  2. Argument-validation failures raise ToolError, not -32602 — the call succeeds carrying isError: true, on the reasoning that the model chose the arguments and can correct them. Task 1 overrides this because the brief asks for JSON-RPC error codes; the argument for and against is in its README.

Notes on the environment

  • Python 3.12. 3.11.0 was the system interpreter and segfaults in traceback formatting (a known CPython bug fixed in 3.11.1), which turns a failing test into a crashed runner.

  • HTTP client is httpx2 (module httpx2, distinct from httpx). mcp 2.x and starlette 1.6's TestClient both use it, so the project has one HTTP client rather than two.

  • ruff bans print() repo-wide via the T20 rule. Task 1's whole premise is that nothing in the import graph may write to stdout, and a linter enforces that better than a habit does.

Available Tools

1 tool
trigger_refundTrigger a refundB

Issue a refund against a customer's account. The reason is written to the audit log verbatim, so it should say why the refund is warranted.

ParametersJSON Schema
NameRequiredDescriptionDefault
amountYesRefund amount in account currency. Strictly positive, finite.
reasonYesWhy the refund is being issued. At least 10 characters after leading and trailing whitespace is removed.
customer_idYesCustomer identifier in the form CUST-00000 (literally five digits).

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It does disclose one non-obvious trait — the reason string is written to the audit log verbatim — but says nothing about irreversibility, required permissions, idempotency, or the speed/finality of the refund, which are exactly the traits an agent needs before moving money.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tightly written sentences, front-loaded with the action and followed immediately by the one behavioral nuance that changes how the agent fills a parameter. No filler, no repetition of the title.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained. However, for a financial mutation with zero annotation coverage, the description omits the safety-critical context (irreversibility, authorization, whether a repeat call double-refunds), leaving an agent under-informed on the risky parts.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds genuine meaning: the reason parameter is persisted verbatim to the audit log, which tells the agent to write an explanatory, human-readable justification rather than a terse code. The other two parameters (amount, customer_id) are fully specified in the schema and need no extra narrative.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Issue') and resource ('a refund against a customer's account'), so an agent can tell exactly what the tool does. There are no sibling tools to distinguish it from, so the ceiling of 5 (sibling differentiation) isn't reachable here.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no when-to-use guidance, no prerequisites, and no alternatives or exclusions. The only usage-adjacent signal is implicit ('the reason ... should say why the refund is warranted'), which is content guidance for a parameter, not selection guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 1 tool updatev0.1.0
    • First observedtrigger_refund
Deploy Server
RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

TDQS

A3.5/5.0

Scored across 1 tool

Disambiguation5/5

With only a single tool, there is no possibility of confusion or overlap. The tool's purpose is clearly stated.

Naming Consistency5/5

The single tool name follows a clear verb_noun snake_case convention. No inconsistency exists because there is only one tool.

Tool Count3/5

A single tool is borderline thin for a refund-related server. While the narrow focus may be intentional, it limits the server to one action.

Completeness2/5

The surface only covers issuing a refund. There is no way to query refund status, list past refunds, or cancel a refund, which are significant gaps for a refund domain.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Resources

Related MCP Connectors

Related MCP Servers

  • veriloop

    arvindcr4
    A
    license
    A
    quality
    C
    maintenance
    Exposes a verified tool registry (calculator, sandboxed file read, web fetch) over MCP stdio, enabling any MCP-capable client to reuse the same tools from the inspectable ReAct loop.
    3
    MIT