Which criteria indicate a high-quality MCP server tool definition?

Attempt it

Quick reference

TL;DR

Quality lives in each tool: precise descriptions free of hidden instructions, proper isError handling, labeled destructive actions, idempotency notes. Tool count and loose schemas signal nothing good.

Memory aid

Sign in for the mnemonic that makes this stick. See Pro pricing.

Easy to grasp

Picture hiring a contractor by reading their job listings. A good listing tells you exactly what the job does, what inputs it needs, and warns you if it touches something dangerous like tearing down a wall. A bad listing says 'I do anything, give me whatever' with no specifics, or hides a sneaky note telling you to also hand over your house keys. You judge each listing on clarity, honesty, and whether it warns you about risky work. You do not judge the contractor by how many listings they posted. Evaluating an MCP server is the same: you read each tool's description and schema, check it handles errors cleanly, and confirm it flags the destructive jobs.

Key concepts

Tool poisoning Tool schema design Least privilege

Quick scan · 2–4 min

Everything important, quickly.

5 min: four evaluation planes (description integrity, schema rigor, error contract, security posture) plus the tool poisoning and rug pull risks an evaluation must screen for.

Side-by-side

Signal	Quality indicator?	Why
Precise description, no model instructions	Yes	Improves routing, avoids tool poisoning
Empty-properties inputSchema	No (negative)	Gives the model no argument guidance
isError: true on failures	Yes	Spec-compliant, host can react
Destructive tools labeled	Yes	Enables informed user consent
More than 20 tools	No	Count says nothing about per-tool quality
Idempotency documented	Yes	Enables safe retry logic

Real-world examples

Real products, models, and research that use this idea.

Anthropic's MCP inspector lets you list a server's tools and read each description and schema before wiring it into Claude Code.
The OWASP MCP Top 10 published in 2025 codifies tool poisoning, rug pulls, and confused deputy as the risks an evaluation must screen for.
Cursor and Zed expose per-tool consent prompts in 2026, which only work when destructive tools are honestly labeled in their descriptions.

Interviewer follow-ups

What an interviewer would ask next. Try answering before peeking at the approach.

QHow would you detect a rug pull where a server silently swaps its tool definitions after you approved them?

Sign in or go Pro to see the approach for this follow-up.

QWhat does evaluating the security posture of a remote MCP server involve beyond reading descriptions?

Sign in or go Pro to see the approach for this follow-up.

QWhy is the tool description such a sensitive field compared to ordinary API docs?

Sign in or go Pro to see the approach for this follow-up.

60-second cheat sheet

The night-before-the-interview bullets. Scan these on the way to the call.

Sign in for 5 unlocks/day or go Pro for unlimited revision sheets. See Pro pricing.

References

Primary sources. Skim if you want the original framing.