MCP Server Security & Performance Analysis — v0.1.0
| Test ID | Severity | Test Name | Description / Details | Duration |
|---|---|---|---|---|
| SECURITY · 107 tests | ||||
| T04-001 | MEDIUM | Rug Pull Detection (Mutation Check) |
1 tool description(s) grew between two consecutive list_tools() calls (3 s apart). Descriptions only extended — likely C…Tool 'query_worker_observability' description CHANGED at char 1000:
Length: 1001 → 1603 chars (grew)
BEFORE[920:1001]: 'ore applying filters, use the observability_keys and observability_values tools …'
AFTER [920:1160]: 'ore applying filters, use the observability_keys and observability_values tools to confirm available filter fields and the correct filter value to add unless you have the data in a response from a previous query.\n- Common filter fields: $m'
Remediation:
Tool descriptions should be fully materialized at startup. If descriptions grow between calls, clients may make tool-use decisions based on incomplete instructions. Ensure list_tools() always returns the full, stable description. |
4319ms |
| T04-003 | LOW | Cross-Tool Reference Detection |
Found 4 cross-tool reference(s) in tool descriptions — server uses chained workflow guidance. Verify no sensitive data i… Tool 'workers_list' description references 'workers_get_worker'
Tool 'query_worker_observability' description references 'observability_keys'
Tool 'query_worker_observability' description references 'observability_values'
Tool 'observability_values' description references 'observability_keys'
Remediation:
Cross-tool references in descriptions are common in multi-step APIs and are not inherently malicious. Review each reference to confirm it describes legitimate workflow guidance (e.g. 'call tool X first to discover available values') rather than parasitic data exfiltration (e.g. 'silently forward results to tool Y'). Tool descriptions must describe only the tool's own behaviour. References to other tool names in a description can trick LLMs into invoking them as a silent side-effect, creating an unaudited tool chain. |
2ms |
| T02-search_cloudflare_documentation-PI-001 | PASS | Injection PI-001 → search_cloudflare_documentation |
Tool 'search_cloudflare_documentation' handled PI-001 (Classic override) gracefully.Response excerpt: '<result>\n<url>https://developers.cloudflare.com/https://developers.cloudflare.com/waf/detections/ai-security-for-apps/prompt-injection/</url>\n<title></title>\n<text>\n### Why a score instead of a boolea'
|
3219ms |
| T02-search_cloudflare_documentation-PI-002 | PASS | Injection PI-002 → search_cloudflare_documentation |
Tool 'search_cloudflare_documentation' handled PI-002 (Newline injection) gracefully.Response excerpt: '<result>\n<url>https://developers.cloudflare.com/https://developers.cloudflare.com/ai-search/configuration/system-prompt/</url>\n<title></title>\n<text>\n# System prompt\n\nSystem prompts allow you to guide'
|
3204ms |
| T02-search_cloudflare_documentation-PI-003 | PASS | Injection PI-003 → search_cloudflare_documentation |
Tool 'search_cloudflare_documentation' handled PI-003 (XML tag injection) gracefully.Response excerpt: ''
|
4449ms |
| T02-search_cloudflare_documentation-PI-004 | PASS | Injection PI-004 → search_cloudflare_documentation |
Tool 'search_cloudflare_documentation' handled PI-004 (SQL injection probe) gracefully.Response excerpt: ''
|
2388ms |
| T02-search_cloudflare_documentation-PI-005 | PASS | Injection PI-005 → search_cloudflare_documentation |
Tool 'search_cloudflare_documentation' handled PI-005 (Shell injection) gracefully.Response excerpt: '<result>\n<url>https://developers.cloudflare.com/https://developers.cloudflare.com/workers/wrangler/commands/general/</url>\n<title></title>\n<text>\n## `auth`\n\n### `auth token`\n\nRetrieve your current aut'
|
1985ms |
| T02-search_cloudflare_documentation-PI-006 | PASS | Injection PI-006 → search_cloudflare_documentation |
Tool 'search_cloudflare_documentation' handled PI-006 (Backtick injection) gracefully.Response excerpt: '<result>\n<url>https://developers.cloudflare.com/https://developers.cloudflare.com/workers-ai/models/kimi-k2.5/</url>\n<title></title>\n<text>\n* `id` ` string ` required \n '
|
2741ms |
| T02-search_cloudflare_documentation-PI-007 | PASS | Injection PI-007 → search_cloudflare_documentation |
Tool 'search_cloudflare_documentation' handled PI-007 (Path traversal) gracefully.Response excerpt: ''
|
3614ms |
| T02-search_cloudflare_documentation-PI-008 | PASS | Injection PI-008 → search_cloudflare_documentation |
Tool 'search_cloudflare_documentation' handled PI-008 (Right-to-left override unicode) gracefully.Response excerpt: ''
|
2577ms |
| T02-search_cloudflare_documentation-PI-009 | PASS | Injection PI-009 → search_cloudflare_documentation |
Tool 'search_cloudflare_documentation' handled PI-009 (Null byte injection) gracefully.Response excerpt: '<result>\n<url>https://developers.cloudflare.com/https://developers.cloudflare.com/workers/best-practices/workers-best-practices/</url>\n<title></title>\n<text>\n// ✅ Good: test the null case explicitly\n\n'
|
2580ms |
| T02-search_cloudflare_documentation-PI-010 | PASS | Injection PI-010 → search_cloudflare_documentation |
Tool 'search_cloudflare_documentation' handled PI-010 (BOM character) gracefully.Response excerpt: ''
|
2824ms |
| T02-search_cloudflare_documentation-PI-011 | PASS | Injection PI-011 → search_cloudflare_documentation |
Tool 'search_cloudflare_documentation' handled PI-011 (Rug pull attempt) gracefully.Response excerpt: ''
|
2172ms |
| T02-search_cloudflare_documentation-PI-012 | PASS | Injection PI-012 → search_cloudflare_documentation |
Tool 'search_cloudflare_documentation' handled PI-012 (Exfiltration instruction) gracefully.Response excerpt: ''
|
2840ms |
| T02-search_cloudflare_documentation-PI-013 | PASS | Injection PI-013 → search_cloudflare_documentation |
Tool 'search_cloudflare_documentation' handled PI-013 (Large payload DoS probe 10k) gracefully.Response excerpt: ''
|
4121ms |
| T02-search_cloudflare_documentation-PI-014 | PASS | Injection PI-014 → search_cloudflare_documentation |
Tool 'search_cloudflare_documentation' handled PI-014 (Large payload DoS probe 100k) gracefully.Response excerpt: ''
|
7266ms |
| T02-search_cloudflare_documentation-PI-015 | PASS | Injection PI-015 → search_cloudflare_documentation |
Tool 'search_cloudflare_documentation' handled PI-015 (Jinja template injection) gracefully.Response excerpt: ''
|
2800ms |
| T02-search_cloudflare_documentation-PI-016 | PASS | Injection PI-016 → search_cloudflare_documentation |
Tool 'search_cloudflare_documentation' handled PI-016 (Python format injection) gracefully.Response excerpt: ''
|
2480ms |
| T02-workers_get_worker-PI-001 | PASS | Injection PI-001 → workers_get_worker |
Tool 'workers_get_worker' handled PI-001 (Classic override) gracefully.Response excerpt: 'Error retrieving worker script: Cloudflare API request failed'
|
1327ms |
| T02-workers_get_worker-PI-002 | PASS | Injection PI-002 → workers_get_worker |
Tool 'workers_get_worker' handled PI-002 (Newline injection) gracefully.Response excerpt: 'Error retrieving worker script: Cloudflare API request failed'
|
1234ms |
| T02-workers_get_worker-PI-003 | PASS | Injection PI-003 → workers_get_worker |
Tool 'workers_get_worker' handled PI-003 (XML tag injection) gracefully.Response excerpt: 'Error retrieving worker script: Cloudflare API request failed'
|
1082ms |
| T02-workers_get_worker-PI-004 | PASS | Injection PI-004 → workers_get_worker |
Tool 'workers_get_worker' handled PI-004 (SQL injection probe) gracefully.Response excerpt: 'Error retrieving worker script: Cloudflare API request failed'
|
1292ms |
| T02-workers_get_worker-PI-005 | PASS | Injection PI-005 → workers_get_worker |
Tool 'workers_get_worker' handled PI-005 (Shell injection) gracefully.Response excerpt: 'Error retrieving worker script: Cloudflare API request failed'
|
1427ms |
| T02-workers_get_worker-PI-006 | PASS | Injection PI-006 → workers_get_worker |
Tool 'workers_get_worker' handled PI-006 (Backtick injection) gracefully.Response excerpt: 'Error retrieving worker script: Cloudflare API request failed'
|
1099ms |
| T02-workers_get_worker-PI-007 | PASS | Injection PI-007 → workers_get_worker |
Tool 'workers_get_worker' handled PI-007 (Path traversal) gracefully.Response excerpt: 'Error retrieving worker script: Cloudflare API request failed'
|
822ms |
| T02-workers_get_worker-PI-008 | PASS | Injection PI-008 → workers_get_worker |
Tool 'workers_get_worker' handled PI-008 (Right-to-left override unicode) gracefully.Response excerpt: 'Error retrieving worker script: Cloudflare API request failed'
|
1029ms |
| T02-workers_get_worker-PI-009 | PASS | Injection PI-009 → workers_get_worker |
Tool 'workers_get_worker' handled PI-009 (Null byte injection) gracefully.Response excerpt: 'Error retrieving worker script: Cloudflare API request failed'
|
1088ms |
| T02-workers_get_worker-PI-010 | PASS | Injection PI-010 → workers_get_worker |
Tool 'workers_get_worker' handled PI-010 (BOM character) gracefully.Response excerpt: 'Error retrieving worker script: Cloudflare API request failed'
|
1101ms |
| T02-workers_get_worker-PI-011 | PASS | Injection PI-011 → workers_get_worker |
Tool 'workers_get_worker' handled PI-011 (Rug pull attempt) gracefully.Response excerpt: 'Error retrieving worker script: Cloudflare API request failed'
|
1195ms |
| T02-workers_get_worker-PI-012 | PASS | Injection PI-012 → workers_get_worker |
Tool 'workers_get_worker' handled PI-012 (Exfiltration instruction) gracefully.Response excerpt: 'Error retrieving worker script: Cloudflare API request failed'
|
1025ms |
| T02-workers_get_worker-PI-013 | PASS | Injection PI-013 → workers_get_worker |
Tool 'workers_get_worker' handled PI-013 (Large payload DoS probe 10k) gracefully.Response excerpt: 'Error retrieving worker script: Cloudflare API request failed'
|
1603ms |
| T02-workers_get_worker-PI-014 | PASS | Injection PI-014 → workers_get_worker |
Tool 'workers_get_worker' handled PI-014 (Large payload DoS probe 100k) gracefully.Response excerpt: 'Error retrieving worker script: Cloudflare API request failed'
|
1163ms |
| T02-workers_get_worker-PI-015 | PASS | Injection PI-015 → workers_get_worker |
Tool 'workers_get_worker' handled PI-015 (Jinja template injection) gracefully.Response excerpt: 'Error retrieving worker script: Cloudflare API request failed'
|
1189ms |
| T02-workers_get_worker-PI-016 | PASS | Injection PI-016 → workers_get_worker |
Tool 'workers_get_worker' handled PI-016 (Python format injection) gracefully.Response excerpt: 'Error retrieving worker script: Cloudflare API request failed'
|
1324ms |
| T02-workers_get_worker_code-PI-001 | PASS | Injection PI-001 → workers_get_worker_code |
Tool 'workers_get_worker_code' handled PI-001 (Classic override) gracefully.Response excerpt: 'Error retrieving worker script: 403 {"success":false,"errors":[{"code":10000,"message":"Authentication error"}],"messages":[],"result":null}'
|
1140ms |
| T02-workers_get_worker_code-PI-002 | PASS | Injection PI-002 → workers_get_worker_code |
Tool 'workers_get_worker_code' handled PI-002 (Newline injection) gracefully.Response excerpt: 'Error retrieving worker script: 403 {"success":false,"errors":[{"code":10000,"message":"Authentication error"}],"messages":[],"result":null}'
|
1379ms |
| T02-workers_get_worker_code-PI-003 | PASS | Injection PI-003 → workers_get_worker_code |
Tool 'workers_get_worker_code' handled PI-003 (XML tag injection) gracefully.Response excerpt: 'Error retrieving worker script: 403 {"success":false,"errors":[{"code":10000,"message":"Authentication error"}],"messages":[],"result":null}'
|
956ms |
| T02-workers_get_worker_code-PI-004 | PASS | Injection PI-004 → workers_get_worker_code |
Tool 'workers_get_worker_code' handled PI-004 (SQL injection probe) gracefully.Response excerpt: 'Error retrieving worker script: 403 {"success":false,"errors":[{"code":10000,"message":"Authentication error"}],"messages":[],"result":null}'
|
2524ms |
| T02-workers_get_worker_code-PI-005 | PASS | Injection PI-005 → workers_get_worker_code |
Tool 'workers_get_worker_code' handled PI-005 (Shell injection) gracefully.Response excerpt: 'Error retrieving worker script: 403 <!DOCTYPE html>\n<!--[if lt IE 7]> <html class="no-js ie6 oldie" lang="en-US"> <![endif]-->\n<!--[if IE 7]> <html class="no-js ie7 oldie" lang="en-US"> <![endif]--'
|
799ms |
| T02-workers_get_worker_code-PI-006 | PASS | Injection PI-006 → workers_get_worker_code |
Tool 'workers_get_worker_code' handled PI-006 (Backtick injection) gracefully.Response excerpt: 'Error retrieving worker script: 403 {"success":false,"errors":[{"code":10000,"message":"Authentication error"}],"messages":[],"result":null}'
|
964ms |
| T02-workers_get_worker_code-PI-007 | PASS | Injection PI-007 → workers_get_worker_code |
Tool 'workers_get_worker_code' handled PI-007 (Path traversal) gracefully.Response excerpt: 'Error retrieving worker script: 404 {"result":null,"success":false,"errors":[{"code":7003,"message":"Could not route to /client/v4/accounts/etc/passwd, perhaps your object identifier is invalid?"}],"m'
|
854ms |
| T02-workers_get_worker_code-PI-008 | PASS | Injection PI-008 → workers_get_worker_code |
Tool 'workers_get_worker_code' handled PI-008 (Right-to-left override unicode) gracefully.Response excerpt: 'Error retrieving worker script: 403 {"success":false,"errors":[{"code":10000,"message":"Authentication error"}],"messages":[],"result":null}'
|
1028ms |
| T02-workers_get_worker_code-PI-009 | PASS | Injection PI-009 → workers_get_worker_code |
Tool 'workers_get_worker_code' handled PI-009 (Null byte injection) gracefully.Response excerpt: 'Error retrieving worker script: 400 <html>\r\n<head><title>400 Bad Request</title></head>\r\n<body>\r\n<center><h1>400 Bad Request</h1></center>\r\n<hr><center>cloudflare</center>\r\n</body>\r\n</html>\r\n'
|
820ms |
| T02-workers_get_worker_code-PI-010 | PASS | Injection PI-010 → workers_get_worker_code |
Tool 'workers_get_worker_code' handled PI-010 (BOM character) gracefully.Response excerpt: 'Error retrieving worker script: 403 {"success":false,"errors":[{"code":10000,"message":"Authentication error"}],"messages":[],"result":null}'
|
1172ms |
| T02-workers_get_worker_code-PI-011 | PASS | Injection PI-011 → workers_get_worker_code |
Tool 'workers_get_worker_code' handled PI-011 (Rug pull attempt) gracefully.Response excerpt: 'Error retrieving worker script: 403 {"success":false,"errors":[{"code":10000,"message":"Authentication error"}],"messages":[],"result":null}'
|
1168ms |
| T02-workers_get_worker_code-PI-012 | PASS | Injection PI-012 → workers_get_worker_code |
Tool 'workers_get_worker_code' handled PI-012 (Exfiltration instruction) gracefully.Response excerpt: 'Error retrieving worker script: 403 {"success":false,"errors":[{"code":10000,"message":"Authentication error"}],"messages":[],"result":null}'
|
1252ms |
| T02-workers_get_worker_code-PI-013 | PASS | Injection PI-013 → workers_get_worker_code |
Tool 'workers_get_worker_code' handled PI-013 (Large payload DoS probe 10k) gracefully.Response excerpt: 'Error retrieving worker script: 403 {"success":false,"errors":[{"code":10000,"message":"Authentication error"}],"messages":[],"result":null}'
|
1141ms |
| T02-workers_get_worker_code-PI-014 | PASS | Injection PI-014 → workers_get_worker_code |
Tool 'workers_get_worker_code' handled PI-014 (Large payload DoS probe 100k) gracefully.Response excerpt: 'Error retrieving worker script: 400 error code: 1036'
|
1229ms |
| T02-workers_get_worker_code-PI-015 | PASS | Injection PI-015 → workers_get_worker_code |
Tool 'workers_get_worker_code' handled PI-015 (Jinja template injection) gracefully.Response excerpt: 'Error retrieving worker script: 403 {"success":false,"errors":[{"code":10000,"message":"Authentication error"}],"messages":[],"result":null}'
|
1129ms |
| T02-workers_get_worker_code-PI-016 | PASS | Injection PI-016 → workers_get_worker_code |
Tool 'workers_get_worker_code' handled PI-016 (Python format injection) gracefully.Response excerpt: 'Error retrieving worker script: 403 {"success":false,"errors":[{"code":10000,"message":"Authentication error"}],"messages":[],"result":null}'
|
1301ms |
| T03-03-scriptname-FUZZ-STR-001 | PASS | Fuzz FUZZ-STR-001 → workers_get_worker.scriptName |
Tool 'workers_get_worker' handled FUZZ-STR-001 (empty string) on param 'scriptName' correctly.Response excerpt: "meta=None content=[TextContent(type='text', text='Error retrieving worker script: Cloudflare API request failed', annotations=None, meta=None)] structuredContent=None isError=False"
|
1137ms |
| T03-03-scriptname-FUZZ-STR-002 | PASS | Fuzz FUZZ-STR-002 → workers_get_worker.scriptName |
Tool 'workers_get_worker' handled FUZZ-STR-002 (single space) on param 'scriptName' correctly.Response excerpt: "meta=None content=[TextContent(type='text', text='Error retrieving worker script: Cloudflare API request failed', annotations=None, meta=None)] structuredContent=None isError=False"
|
1185ms |
| T03-03-scriptname-FUZZ-STR-003 | PASS | Fuzz FUZZ-STR-003 → workers_get_worker.scriptName |
Tool 'workers_get_worker' handled FUZZ-STR-003 (whitespace only) on param 'scriptName' correctly.Response excerpt: "meta=None content=[TextContent(type='text', text='Error retrieving worker script: Cloudflare API request failed', annotations=None, meta=None)] structuredContent=None isError=False"
|
1453ms |
| T03-03-scriptname-FUZZ-STR-004 | PASS | Fuzz FUZZ-STR-004 → workers_get_worker.scriptName |
Tool 'workers_get_worker' returned a structured error for FUZZ-STR-004 (null value) on param 'scriptName' — handled grac…McpError: MCP error -32602: Invalid arguments for tool workers_get_worker: [
{
"code": "invalid_type",
"expected": "string",
"received": "null",
"path": [
"scriptName"
],
"message": "Expected string, received null"
}
]
|
698ms |
| T03-03-scriptname-FUZZ-STR-005 | PASS | Fuzz FUZZ-STR-005 → workers_get_worker.scriptName |
Tool 'workers_get_worker' returned a structured error for FUZZ-STR-005 (integer as string field) on param 'scriptName' —…McpError: MCP error -32602: Invalid arguments for tool workers_get_worker: [
{
"code": "invalid_type",
"expected": "string",
"received": "number",
"path": [
"scriptName"
],
"message": "Expected string, received number"
}
]
|
920ms |
| T03-03-scriptname-FUZZ-STR-006 | PASS | Fuzz FUZZ-STR-006 → workers_get_worker.scriptName |
Tool 'workers_get_worker' returned a structured error for FUZZ-STR-006 (boolean as string field) on param 'scriptName' —…McpError: MCP error -32602: Invalid arguments for tool workers_get_worker: [
{
"code": "invalid_type",
"expected": "string",
"received": "boolean",
"path": [
"scriptName"
],
"message": "Expected string, received boolean"
}
]
|
1046ms |
| T03-03-scriptname-FUZZ-STR-007 | PASS | Fuzz FUZZ-STR-007 → workers_get_worker.scriptName |
Tool 'workers_get_worker' returned a structured error for FUZZ-STR-007 (list as string field) on param 'scriptName' — ha…McpError: MCP error -32602: Invalid arguments for tool workers_get_worker: [
{
"code": "invalid_type",
"expected": "string",
"received": "array",
"path": [
"scriptName"
],
"message": "Expected string, received array"
}
]
|
748ms |
| T03-03-scriptname-FUZZ-STR-008 | PASS | Fuzz FUZZ-STR-008 → workers_get_worker.scriptName |
Tool 'workers_get_worker' returned a structured error for FUZZ-STR-008 (dict as string field) on param 'scriptName' — ha…McpError: MCP error -32602: Invalid arguments for tool workers_get_worker: [
{
"code": "invalid_type",
"expected": "string",
"received": "object",
"path": [
"scriptName"
],
"message": "Expected string, received object"
}
]
|
922ms |
| T03-03-scriptname-FUZZ-STR-009 | PASS | Fuzz FUZZ-STR-009 → workers_get_worker.scriptName |
Tool 'workers_get_worker' handled FUZZ-STR-009 (very long string 10k) on param 'scriptName' correctly.Response excerpt: "meta=None content=[TextContent(type='text', text='Error retrieving worker script: Cloudflare API request failed', annotations=None, meta=None)] structuredContent=None isError=False"
|
2135ms |
| T03-03-scriptname-FUZZ-STR-010 | PASS | Fuzz FUZZ-STR-010 → workers_get_worker.scriptName |
Tool 'workers_get_worker' handled FUZZ-STR-010 (newlines and tabs) on param 'scriptName' correctly.Response excerpt: "meta=None content=[TextContent(type='text', text='Error retrieving worker script: Cloudflare API request failed', annotations=None, meta=None)] structuredContent=None isError=False"
|
978ms |
| T03-03-scriptname-FUZZ-STR-011 | PASS | Fuzz FUZZ-STR-011 → workers_get_worker.scriptName |
Tool 'workers_get_worker' handled FUZZ-STR-011 (null byte in string) on param 'scriptName' correctly.Response excerpt: "meta=None content=[TextContent(type='text', text='Error retrieving worker script: Cloudflare API request failed', annotations=None, meta=None)] structuredContent=None isError=False"
|
804ms |
| T03-03-scriptname-FUZZ-STR-012 | PASS | Fuzz FUZZ-STR-012 → workers_get_worker.scriptName |
Tool 'workers_get_worker' handled FUZZ-STR-012 (all unicode planes) on param 'scriptName' correctly.Response excerpt: "meta=None content=[TextContent(type='text', text='Error retrieving worker script: Cloudflare API request failed', annotations=None, meta=None)] structuredContent=None isError=False"
|
1262ms |
| T03-04-scriptname-FUZZ-STR-001 | PASS | Fuzz FUZZ-STR-001 → workers_get_worker_code.scriptName |
Tool 'workers_get_worker_code' handled FUZZ-STR-001 (empty string) on param 'scriptName' correctly.Response excerpt: 'meta=None content=[TextContent(type=\'text\', text=\'Error retrieving worker script: 403 {"success":false,"errors":[{"code":10000,"message":"Authentication error"}],"messages":[],"result":null}\', annotat'
|
2028ms |
| T03-04-scriptname-FUZZ-STR-002 | PASS | Fuzz FUZZ-STR-002 → workers_get_worker_code.scriptName |
Tool 'workers_get_worker_code' handled FUZZ-STR-002 (single space) on param 'scriptName' correctly.Response excerpt: 'meta=None content=[TextContent(type=\'text\', text=\'Error retrieving worker script: 403 {"success":false,"errors":[{"code":10000,"message":"Authentication error"}],"messages":[],"result":null}\', annotat'
|
1067ms |
| T03-04-scriptname-FUZZ-STR-003 | PASS | Fuzz FUZZ-STR-003 → workers_get_worker_code.scriptName |
Tool 'workers_get_worker_code' handled FUZZ-STR-003 (whitespace only) on param 'scriptName' correctly.Response excerpt: 'meta=None content=[TextContent(type=\'text\', text=\'Error retrieving worker script: 403 {"success":false,"errors":[{"code":10000,"message":"Authentication error"}],"messages":[],"result":null}\', annotat'
|
1017ms |
| T03-04-scriptname-FUZZ-STR-004 | PASS | Fuzz FUZZ-STR-004 → workers_get_worker_code.scriptName |
Tool 'workers_get_worker_code' returned a structured error for FUZZ-STR-004 (null value) on param 'scriptName' — handled…McpError: MCP error -32602: Invalid arguments for tool workers_get_worker_code: [
{
"code": "invalid_type",
"expected": "string",
"received": "null",
"path": [
"scriptName"
],
"message": "Expected string, received null"
}
]
|
801ms |
| T03-04-scriptname-FUZZ-STR-005 | PASS | Fuzz FUZZ-STR-005 → workers_get_worker_code.scriptName |
Tool 'workers_get_worker_code' returned a structured error for FUZZ-STR-005 (integer as string field) on param 'scriptNa…McpError: MCP error -32602: Invalid arguments for tool workers_get_worker_code: [
{
"code": "invalid_type",
"expected": "string",
"received": "number",
"path": [
"scriptName"
],
"message": "Expected string, received number"
}
]
|
849ms |
| T03-04-scriptname-FUZZ-STR-006 | PASS | Fuzz FUZZ-STR-006 → workers_get_worker_code.scriptName |
Tool 'workers_get_worker_code' returned a structured error for FUZZ-STR-006 (boolean as string field) on param 'scriptNa…McpError: MCP error -32602: Invalid arguments for tool workers_get_worker_code: [
{
"code": "invalid_type",
"expected": "string",
"received": "boolean",
"path": [
"scriptName"
],
"message": "Expected string, received boolean"
}
]
|
1036ms |
| T03-04-scriptname-FUZZ-STR-007 | PASS | Fuzz FUZZ-STR-007 → workers_get_worker_code.scriptName |
Tool 'workers_get_worker_code' returned a structured error for FUZZ-STR-007 (list as string field) on param 'scriptName'…McpError: MCP error -32602: Invalid arguments for tool workers_get_worker_code: [
{
"code": "invalid_type",
"expected": "string",
"received": "array",
"path": [
"scriptName"
],
"message": "Expected string, received array"
}
]
|
724ms |
| T03-04-scriptname-FUZZ-STR-008 | PASS | Fuzz FUZZ-STR-008 → workers_get_worker_code.scriptName |
Tool 'workers_get_worker_code' returned a structured error for FUZZ-STR-008 (dict as string field) on param 'scriptName'…McpError: MCP error -32602: Invalid arguments for tool workers_get_worker_code: [
{
"code": "invalid_type",
"expected": "string",
"received": "object",
"path": [
"scriptName"
],
"message": "Expected string, received object"
}
]
|
866ms |
| T03-04-scriptname-FUZZ-STR-009 | PASS | Fuzz FUZZ-STR-009 → workers_get_worker_code.scriptName |
Tool 'workers_get_worker_code' handled FUZZ-STR-009 (very long string 10k) on param 'scriptName' correctly.Response excerpt: 'meta=None content=[TextContent(type=\'text\', text=\'Error retrieving worker script: 403 {"success":false,"errors":[{"code":10000,"message":"Authentication error"}],"messages":[],"result":null}\', annotat'
|
1146ms |
| T03-04-scriptname-FUZZ-STR-010 | PASS | Fuzz FUZZ-STR-010 → workers_get_worker_code.scriptName |
Tool 'workers_get_worker_code' handled FUZZ-STR-010 (newlines and tabs) on param 'scriptName' correctly.Response excerpt: 'meta=None content=[TextContent(type=\'text\', text=\'Error retrieving worker script: 403 {"success":false,"errors":[{"code":10000,"message":"Authentication error"}],"messages":[],"result":null}\', annotat'
|
962ms |
| T03-04-scriptname-FUZZ-STR-011 | PASS | Fuzz FUZZ-STR-011 → workers_get_worker_code.scriptName |
Tool 'workers_get_worker_code' handled FUZZ-STR-011 (null byte in string) on param 'scriptName' correctly.Response excerpt: "meta=None content=[TextContent(type='text', text='Error retrieving worker script: 400 <html>\\r\\n<head><title>400 Bad Request</title></head>\\r\\n<body>\\r\\n<center><h1>400 Bad Request</h1></center>\\r\\n<h"
|
1002ms |
| T03-04-scriptname-FUZZ-STR-012 | PASS | Fuzz FUZZ-STR-012 → workers_get_worker_code.scriptName |
Tool 'workers_get_worker_code' handled FUZZ-STR-012 (all unicode planes) on param 'scriptName' correctly.Response excerpt: "meta=None content=[TextContent(type='text', text='Error retrieving worker script: 400 <html>\\r\\n<head><title>400 Bad Request</title></head>\\r\\n<body>\\r\\n<center><h1>400 Bad Request</h1></center>\\r\\n<h"
|
1011ms |
| T03-05-query-FUZZ-OBJ-001 | PASS | Fuzz FUZZ-OBJ-001 → query_worker_observability.query |
Tool 'query_worker_observability' returned a structured error for FUZZ-OBJ-001 (null as object) on param 'query' — handl…McpError: MCP error -32602: Invalid arguments for tool query_worker_observability: [
{
"code": "invalid_type",
"expected": "object",
"received": "null",
"path": [
"query"
],
"message": "Expected object, received null"
}
]
|
968ms |
| T03-05-query-FUZZ-OBJ-002 | PASS | Fuzz FUZZ-OBJ-002 → query_worker_observability.query |
Tool 'query_worker_observability' returned a structured error for FUZZ-OBJ-002 (list as object) on param 'query' — handl…McpError: MCP error -32602: Invalid arguments for tool query_worker_observability: [
{
"code": "invalid_type",
"expected": "object",
"received": "array",
"path": [
"query"
],
"message": "Expected object, received array"
}
]
|
733ms |
| T03-05-query-FUZZ-OBJ-003 | PASS | Fuzz FUZZ-OBJ-003 → query_worker_observability.query |
Tool 'query_worker_observability' returned a structured error for FUZZ-OBJ-003 (string as object) on param 'query' — han…McpError: MCP error -32602: Invalid arguments for tool query_worker_observability: [
{
"code": "invalid_type",
"expected": "object",
"received": "string",
"path": [
"query"
],
"message": "Expected object, received string"
}
]
|
726ms |
| T03-05-query-FUZZ-OBJ-004 | PASS | Fuzz FUZZ-OBJ-004 → query_worker_observability.query |
Tool 'query_worker_observability' returned a structured error for FUZZ-OBJ-004 (empty object) on param 'query' — handled…McpError: MCP error -32602: Invalid arguments for tool query_worker_observability: [
{
"code": "invalid_type",
"expected": "string",
"received": "undefined",
"path": [
"query",
"queryId"
],
"message": "Required"
},
{
"code": "invalid_type",
"expected": "object
|
1015ms |
| T03-05-query-FUZZ-OBJ-005 | PASS | Fuzz FUZZ-OBJ-005 → query_worker_observability.query |
Tool 'query_worker_observability' returned a structured error for FUZZ-OBJ-005 (prototype pollution) on param 'query' — …McpError: MCP error -32602: Invalid arguments for tool query_worker_observability: [
{
"code": "invalid_type",
"expected": "string",
"received": "undefined",
"path": [
"query",
"queryId"
],
"message": "Required"
},
{
"code": "invalid_type",
"expected": "object
|
894ms |
| T03-05-query-FUZZ-OBJ-006 | PASS | Fuzz FUZZ-OBJ-006 → query_worker_observability.query |
Tool 'query_worker_observability' returned a structured error for FUZZ-OBJ-006 (deeply nested object) on param 'query' —…McpError: MCP error -32602: Invalid arguments for tool query_worker_observability: [
{
"code": "invalid_type",
"expected": "string",
"received": "undefined",
"path": [
"query",
"queryId"
],
"message": "Required"
},
{
"code": "invalid_type",
"expected": "object
|
751ms |
| T03-06-keysquery-FUZZ-OBJ-001 | PASS | Fuzz FUZZ-OBJ-001 → observability_keys.keysQuery |
Tool 'observability_keys' returned a structured error for FUZZ-OBJ-001 (null as object) on param 'keysQuery' — handled g…McpError: MCP error -32602: Invalid arguments for tool observability_keys: [
{
"code": "invalid_type",
"expected": "object",
"received": "null",
"path": [
"keysQuery"
],
"message": "Expected object, received null"
}
]
|
862ms |
| T03-06-keysquery-FUZZ-OBJ-002 | PASS | Fuzz FUZZ-OBJ-002 → observability_keys.keysQuery |
Tool 'observability_keys' returned a structured error for FUZZ-OBJ-002 (list as object) on param 'keysQuery' — handled g…McpError: MCP error -32602: Invalid arguments for tool observability_keys: [
{
"code": "invalid_type",
"expected": "object",
"received": "array",
"path": [
"keysQuery"
],
"message": "Expected object, received array"
}
]
|
839ms |
| T03-06-keysquery-FUZZ-OBJ-003 | PASS | Fuzz FUZZ-OBJ-003 → observability_keys.keysQuery |
Tool 'observability_keys' returned a structured error for FUZZ-OBJ-003 (string as object) on param 'keysQuery' — handled…McpError: MCP error -32602: Invalid arguments for tool observability_keys: [
{
"code": "invalid_type",
"expected": "object",
"received": "string",
"path": [
"keysQuery"
],
"message": "Expected object, received string"
}
]
|
2041ms |
| T03-06-keysquery-FUZZ-OBJ-004 | PASS | Fuzz FUZZ-OBJ-004 → observability_keys.keysQuery |
Tool 'observability_keys' returned a structured error for FUZZ-OBJ-004 (empty object) on param 'keysQuery' — handled gra…McpError: MCP error -32602: Invalid arguments for tool observability_keys: [
{
"code": "invalid_union",
"unionErrors": [
{
"issues": [
{
"code": "invalid_type",
"expected": "object",
"received": "undefined",
"path": [
|
915ms |
| T03-06-keysquery-FUZZ-OBJ-005 | PASS | Fuzz FUZZ-OBJ-005 → observability_keys.keysQuery |
Tool 'observability_keys' returned a structured error for FUZZ-OBJ-005 (prototype pollution) on param 'keysQuery' — hand…McpError: MCP error -32602: Invalid arguments for tool observability_keys: [
{
"code": "invalid_union",
"unionErrors": [
{
"issues": [
{
"code": "invalid_type",
"expected": "object",
"received": "undefined",
"path": [
|
720ms |
| T03-06-keysquery-FUZZ-OBJ-006 | PASS | Fuzz FUZZ-OBJ-006 → observability_keys.keysQuery |
Tool 'observability_keys' returned a structured error for FUZZ-OBJ-006 (deeply nested object) on param 'keysQuery' — han…McpError: MCP error -32602: Invalid arguments for tool observability_keys: [
{
"code": "invalid_union",
"unionErrors": [
{
"issues": [
{
"code": "invalid_type",
"expected": "object",
"received": "undefined",
"path": [
|
885ms |
| T03-07-valuesquery-FUZZ-OBJ-001 | PASS | Fuzz FUZZ-OBJ-001 → observability_values.valuesQuery |
Tool 'observability_values' returned a structured error for FUZZ-OBJ-001 (null as object) on param 'valuesQuery' — handl…McpError: MCP error -32602: Invalid arguments for tool observability_values: [
{
"code": "invalid_type",
"expected": "object",
"received": "null",
"path": [
"valuesQuery"
],
"message": "Expected object, received null"
}
]
|
800ms |
| T03-07-valuesquery-FUZZ-OBJ-002 | PASS | Fuzz FUZZ-OBJ-002 → observability_values.valuesQuery |
Tool 'observability_values' returned a structured error for FUZZ-OBJ-002 (list as object) on param 'valuesQuery' — handl…McpError: MCP error -32602: Invalid arguments for tool observability_values: [
{
"code": "invalid_type",
"expected": "object",
"received": "array",
"path": [
"valuesQuery"
],
"message": "Expected object, received array"
}
]
|
878ms |
| T03-07-valuesquery-FUZZ-OBJ-003 | PASS | Fuzz FUZZ-OBJ-003 → observability_values.valuesQuery |
Tool 'observability_values' returned a structured error for FUZZ-OBJ-003 (string as object) on param 'valuesQuery' — han…McpError: MCP error -32602: Invalid arguments for tool observability_values: [
{
"code": "invalid_type",
"expected": "object",
"received": "string",
"path": [
"valuesQuery"
],
"message": "Expected object, received string"
}
]
|
714ms |
| T03-07-valuesquery-FUZZ-OBJ-004 | PASS | Fuzz FUZZ-OBJ-004 → observability_values.valuesQuery |
Tool 'observability_values' returned a structured error for FUZZ-OBJ-004 (empty object) on param 'valuesQuery' — handled…McpError: MCP error -32602: Invalid arguments for tool observability_values: [
{
"code": "invalid_type",
"expected": "string",
"received": "undefined",
"path": [
"valuesQuery",
"key"
],
"message": "Required"
},
{
"expected": "'string' | 'boolean' | 'number'",
|
2293ms |
| T03-07-valuesquery-FUZZ-OBJ-005 | PASS | Fuzz FUZZ-OBJ-005 → observability_values.valuesQuery |
Tool 'observability_values' returned a structured error for FUZZ-OBJ-005 (prototype pollution) on param 'valuesQuery' — …McpError: MCP error -32602: Invalid arguments for tool observability_values: [
{
"code": "invalid_type",
"expected": "string",
"received": "undefined",
"path": [
"valuesQuery",
"key"
],
"message": "Required"
},
{
"expected": "'string' | 'boolean' | 'number'",
|
1458ms |
| T03-07-valuesquery-FUZZ-OBJ-006 | PASS | Fuzz FUZZ-OBJ-006 → observability_values.valuesQuery |
Tool 'observability_values' returned a structured error for FUZZ-OBJ-006 (deeply nested object) on param 'valuesQuery' —…McpError: MCP error -32602: Invalid arguments for tool observability_values: [
{
"code": "invalid_type",
"expected": "string",
"received": "undefined",
"path": [
"valuesQuery",
"key"
],
"message": "Required"
},
{
"expected": "'string' | 'boolean' | 'number'",
|
1000ms |
| T03-08-query-FUZZ-STR-001 | PASS | Fuzz FUZZ-STR-001 → search_cloudflare_documentation.query |
Tool 'search_cloudflare_documentation' handled FUZZ-STR-001 (empty string) on param 'query' correctly.Response excerpt: "meta=None content=[TextContent(type='text', text='All search methods failed: vector', annotations=None, meta=None)] structuredContent=None isError=True"
|
1025ms |
| T03-08-query-FUZZ-STR-002 | PASS | Fuzz FUZZ-STR-002 → search_cloudflare_documentation.query |
Tool 'search_cloudflare_documentation' handled FUZZ-STR-002 (single space) on param 'query' correctly.Response excerpt: "meta=None content=[TextContent(type='text', text='All search methods failed: vector', annotations=None, meta=None)] structuredContent=None isError=True"
|
836ms |
| T03-08-query-FUZZ-STR-003 | PASS | Fuzz FUZZ-STR-003 → search_cloudflare_documentation.query |
Tool 'search_cloudflare_documentation' handled FUZZ-STR-003 (whitespace only) on param 'query' correctly.Response excerpt: "meta=None content=[TextContent(type='text', text='All search methods failed: vector', annotations=None, meta=None)] structuredContent=None isError=True"
|
1584ms |
| T03-08-query-FUZZ-STR-004 | PASS | Fuzz FUZZ-STR-004 → search_cloudflare_documentation.query |
Tool 'search_cloudflare_documentation' returned a structured error for FUZZ-STR-004 (null value) on param 'query' — hand…McpError: MCP error -32602: Invalid arguments for tool search_cloudflare_documentation: [
{
"code": "invalid_type",
"expected": "string",
"received": "null",
"path": [
"query"
],
"message": "Expected string, received null"
}
]
|
835ms |
| T03-08-query-FUZZ-STR-005 | PASS | Fuzz FUZZ-STR-005 → search_cloudflare_documentation.query |
Tool 'search_cloudflare_documentation' returned a structured error for FUZZ-STR-005 (integer as string field) on param '…McpError: MCP error -32602: Invalid arguments for tool search_cloudflare_documentation: [
{
"code": "invalid_type",
"expected": "string",
"received": "number",
"path": [
"query"
],
"message": "Expected string, received number"
}
]
|
844ms |
| T03-08-query-FUZZ-STR-006 | PASS | Fuzz FUZZ-STR-006 → search_cloudflare_documentation.query |
Tool 'search_cloudflare_documentation' returned a structured error for FUZZ-STR-006 (boolean as string field) on param '…McpError: MCP error -32602: Invalid arguments for tool search_cloudflare_documentation: [
{
"code": "invalid_type",
"expected": "string",
"received": "boolean",
"path": [
"query"
],
"message": "Expected string, received boolean"
}
]
|
906ms |
| T03-08-query-FUZZ-STR-007 | PASS | Fuzz FUZZ-STR-007 → search_cloudflare_documentation.query |
Tool 'search_cloudflare_documentation' returned a structured error for FUZZ-STR-007 (list as string field) on param 'que…McpError: MCP error -32602: Invalid arguments for tool search_cloudflare_documentation: [
{
"code": "invalid_type",
"expected": "string",
"received": "array",
"path": [
"query"
],
"message": "Expected string, received array"
}
]
|
813ms |
| T03-08-query-FUZZ-STR-008 | PASS | Fuzz FUZZ-STR-008 → search_cloudflare_documentation.query |
Tool 'search_cloudflare_documentation' returned a structured error for FUZZ-STR-008 (dict as string field) on param 'que…McpError: MCP error -32602: Invalid arguments for tool search_cloudflare_documentation: [
{
"code": "invalid_type",
"expected": "string",
"received": "object",
"path": [
"query"
],
"message": "Expected string, received object"
}
]
|
748ms |
| T03-08-query-FUZZ-STR-009 | PASS | Fuzz FUZZ-STR-009 → search_cloudflare_documentation.query |
Tool 'search_cloudflare_documentation' handled FUZZ-STR-009 (very long string 10k) on param 'query' correctly.Response excerpt: "meta=None content=[TextContent(type='text', text='', annotations=None, meta=None)] structuredContent=None isError=False"
|
3799ms |
| T03-08-query-FUZZ-STR-010 | PASS | Fuzz FUZZ-STR-010 → search_cloudflare_documentation.query |
Tool 'search_cloudflare_documentation' handled FUZZ-STR-010 (newlines and tabs) on param 'query' correctly.Response excerpt: "meta=None content=[TextContent(type='text', text='All search methods failed: vector', annotations=None, meta=None)] structuredContent=None isError=True"
|
1062ms |
| T03-08-query-FUZZ-STR-011 | PASS | Fuzz FUZZ-STR-011 → search_cloudflare_documentation.query |
Tool 'search_cloudflare_documentation' handled FUZZ-STR-011 (null byte in string) on param 'query' correctly.Response excerpt: "meta=None content=[TextContent(type='text', text='', annotations=None, meta=None)] structuredContent=None isError=False"
|
2471ms |
| T03-08-query-FUZZ-STR-012 | PASS | Fuzz FUZZ-STR-012 → search_cloudflare_documentation.query |
Tool 'search_cloudflare_documentation' handled FUZZ-STR-012 (all unicode planes) on param 'query' correctly.Response excerpt: "meta=None content=[TextContent(type='text', text='', annotations=None, meta=None)] structuredContent=None isError=False"
|
2830ms |
| T04-002 | PASS | Hidden Instruction Scan | No suspicious patterns found in 9 tool description(s). | 1ms |
| T04-004 | PASS | Schema Field Injection Check | All 9 tool inputSchema(s) contain only sanctioned JSON Schema fields. | 0ms |
| T04-005 | PASS | Tool Count Stability Check |
Tool count stable at 9 across 5 polls (2.5s window).Counts per poll: [9, 9, 9, 9, 9]
|
6078ms |
| DISCOVERY · 8 tests | ||||
| T01-001 | INFO | Server Identity |
Server did not advertise: name, version. Got name='unknown' version='unknown' protocol='unknown'.
Remediation:
Ensure the MCP server returns a populated 'serverInfo' object in its initialize response (name and version fields). |
0ms |
| T01-002 | PASS | Tool Enumeration |
Discovered 9 tool(s): accounts_list, workers_list, workers_get_worker, workers_get_worker_code, query_worker_observabili…accounts_list: 'List all accounts in your Cloudflare account'
workers_list: 'List all Workers in your Cloudflare account.\n\nIf you only need details of a sing'
workers_get_worker: 'Get the details of the Cloudflare Worker.'
workers_get_worker_code: 'Get the source code of a Cloudflare Worker. Note: This may be a bundled version '
query_worker_observability: 'Query the Workers Observability API to analyze logs and metrics from your Cloudf'
observability_keys: 'Find keys in the Workers Observability Data\n\n## Best Practices\n- Set a high limi'
observability_values: 'Find values in the Workers Observability Data.\n\n## Troubleshooting\n- For no resu'
search_cloudflare_documentation: 'Search the Cloudflare documentation.\n\n\t\tThis tool should be used to answer any q'
migrate_pages_to_workers_guide: 'ALWAYS read this guide before migrating Pages projects to Workers.'
|
0ms |
| T01-003 | PASS | Resource Enumeration | Discovered 0 resource(s). | 0ms |
| T01-004 | PASS | Prompt Enumeration |
Discovered 1 prompt(s): workers-prompt-full.workers-prompt-full: 'Detailed prompt for generating Cloudflare Workers code (and other developer plat' (0 arg(s))
|
0ms |
| T01-005 | PASS | Tool Description Completeness | All 9 tool(s) have non-empty descriptions. | 0ms |
| T01-006 | PASS | Tool Schema Validity | All 9 tool(s) have valid JSON Schema inputSchema. | 0ms |
| T01-007 | PASS | Duplicate Tool Names | All 9 tool name(s) are unique. | 0ms |
| T01-008 | PASS | Tool Description Length | All 9 tool description(s) are within the 2,000-character limit. | 0ms |
| SCHEMA · 19 tests | ||||
| T06-004 | INFO | Return Type Consistency | No tools returned comparable JSON responses — consistency check not applicable. | 0ms |
| T06-006-workers_get_worker | INFO | Description Quality: workers_get_worker |
Tool 'workers_get_worker' description does not mention its parameters (scriptName).Description: 'Get the details of the Cloudflare Worker.'
Tool has 1 parameter(s) but the description contains no parameter documentation signals.
Remediation:
Include a brief description of each parameter in the tool's description so LLMs can construct valid calls. Example: 'Accepts: query (string) - the search query.' |
0ms |
| T06-006-workers_get_worker_code | INFO | Description Quality: workers_get_worker_code |
Tool 'workers_get_worker_code' description does not mention its parameters (scriptName).Description: 'Get the source code of a Cloudflare Worker. Note: This may be a bundled version of the worker.'
Tool has 1 parameter(s) but the description contains no parameter documentation signals.
Remediation:
Include a brief description of each parameter in the tool's description so LLMs can construct valid calls. Example: 'Accepts: query (string) - the search query.' |
0ms |
| T06-001 | PASS | Schema Structural Validity | All 9 tool inputSchema(s) are structurally valid. | 0ms |
| T06-002-observability_keys | PASS | Required Enforcement: observability_keys |
Tool 'observability_keys' correctly raised an error when called with missing required fields.McpError: MCP error -32602: Invalid arguments for tool observability_keys: [
{
"code": "invalid_type",
"expected": "object",
"received": "undefined",
"path": [
"keysQuery"
],
"me
|
836ms |
| T06-002-observability_values | PASS | Required Enforcement: observability_values |
Tool 'observability_values' correctly raised an error when called with missing required fields.McpError: MCP error -32602: Invalid arguments for tool observability_values: [
{
"code": "invalid_type",
"expected": "object",
"received": "undefined",
"path": [
"valuesQuery"
],
|
759ms |
| T06-002-query_worker_observability | PASS | Required Enforcement: query_worker_observability |
Tool 'query_worker_observability' correctly raised an error when called with missing required fields.McpError: MCP error -32602: Invalid arguments for tool query_worker_observability: [
{
"code": "invalid_type",
"expected": "object",
"received": "undefined",
"path": [
"query"
],
|
738ms |
| T06-002-search_cloudflare_documentation | PASS | Required Enforcement: search_cloudflare_documentation |
Tool 'search_cloudflare_documentation' correctly raised an error when called with missing required fields.McpError: MCP error -32602: Invalid arguments for tool search_cloudflare_documentation: [
{
"code": "invalid_type",
"expected": "string",
"received": "undefined",
"path": [
"query"
]
|
1120ms |
| T06-002-workers_get_worker | PASS | Required Enforcement: workers_get_worker |
Tool 'workers_get_worker' correctly raised an error when called with missing required fields.McpError: MCP error -32602: Invalid arguments for tool workers_get_worker: [
{
"code": "invalid_type",
"expected": "string",
"received": "undefined",
"path": [
"scriptName"
],
"m
|
812ms |
| T06-002-workers_get_worker_code | PASS | Required Enforcement: workers_get_worker_code |
Tool 'workers_get_worker_code' correctly raised an error when called with missing required fields.McpError: MCP error -32602: Invalid arguments for tool workers_get_worker_code: [
{
"code": "invalid_type",
"expected": "string",
"received": "undefined",
"path": [
"scriptName"
],
|
958ms |
| T06-003 | PASS | additionalProperties Strictness | All 9 tool(s) have 'additionalProperties': false. | 0ms |
| T06-005 | PASS | Overly Permissive Schema Detection | All 9 tool schema(s) are acceptably strict. | 0ms |
| T06-006-accounts_list | PASS | Description Quality: accounts_list |
Tool 'accounts_list' has an adequate description (44 chars).Description: 'List all accounts in your Cloudflare account'
|
0ms |
| T06-006-migrate_pages_to_workers_guide | PASS | Description Quality: migrate_pages_to_workers_guide |
Tool 'migrate_pages_to_workers_guide' has an adequate description (66 chars).Description: 'ALWAYS read this guide before migrating Pages projects to Workers.'
|
0ms |
| T06-006-observability_keys | PASS | Description Quality: observability_keys |
Tool 'observability_keys' has an adequate description (344 chars).Description: 'Find keys in the Workers Observability Data\n\n## Best Practices\n- Set a high limit (1000+) to ensure you see all available keys\n- Add the $metadata.service filter to narrow results to a specific Worker'
|
0ms |
| T06-006-observability_values | PASS | Description Quality: observability_values |
Tool 'observability_values' has an adequate description (204 chars).Description: 'Find values in the Workers Observability Data.\n\n## Troubleshooting\n- For no results, verify the field exists using observability_keys first\n- If expected values are missing, try broadening your time r'
|
0ms |
| T06-006-query_worker_observability | PASS | Description Quality: query_worker_observability |
Tool 'query_worker_observability' has an adequate description (1001 chars).Description: 'Query the Workers Observability API to analyze logs and metrics from your Cloudflare Workers.\n\n\t* A query typical query looks like this:\n\t\t\t\t{"view":"events","queryId":"workers-logs-events","limit":5,'
|
0ms |
| T06-006-search_cloudflare_documentation | PASS | Description Quality: search_cloudflare_documentation |
Tool 'search_cloudflare_documentation' has an adequate description (541 chars).Description: 'Search the Cloudflare documentation.\n\n\t\tThis tool should be used to answer any question about Cloudflare products or features, including:\n\t\t- Workers, Pages, R2, Images, Stream, D1, Durable Objects, K'
|
0ms |
| T06-006-workers_list | PASS | Description Quality: workers_list |
Tool 'workers_list' has an adequate description (114 chars).Description: 'List all Workers in your Cloudflare account.\n\nIf you only need details of a single Worker, use workers_get_worker.'
|
0ms |
| PERFORMANCE · 17 tests | ||||
| T08-002 | MEDIUM | Tool Discovery Latency |
list_tools() mean 1041ms — slow discovery [MEDIUM].{
"list_tools": {
"mean_ms": 1041.32,
"min_ms": 755.49,
"max_ms": 1314.41,
"samples": [
755.49,
1053.85,
1250.45,
832.39,
1314.41
]
}
}
Remediation:
Slow tool discovery degrades the LLM's startup experience. Cache the tool manifest at server startup instead of re-computing it on every list_tools() call. |
5207ms |
| T00-003 | INFO | Connection Closed Mid-Scan (Rate Limit / Server Reset) |
The HTTP server closed the connection mid-scan. This is expected behaviour for production servers that apply rate-limiti…Unexpected HTTP/SSE transport error: HTTPStatusError: Client error '400 Bad Request' for url 'https://observability.mcp.cloudflare.com/mcp'
For more information check: https://developer.mozilla.org/en-US/docs/Web/HTTP/Status/400 (caused by ExceptionGroup: unhandled errors in a TaskGroup (1 sub-exception))
Remediation:
Re-run with --no-load to skip T05 load tests and reduce the number of requests sent to the server. The connection drop does not indicate a vulnerability. |
325035ms |
| T08-001-05 | INFO | Baseline Latency: query_worker_observability |
Tool 'query_worker_observability' requires valid credentials or real parameters — latency probe skipped (API rejection, …McpError: MCP error -32602: Invalid arguments for tool query_worker_observability: [
{
"code": "invalid_type",
"expected": "string",
"received": "undefined",
"path": [
"query",
"queryId"
],
"message": "Required"
},
{
"code": "invalid_type",
"expected": "object",
"received": "undefined",
"path": [
"query",
"parameters"
],
"message": "Required"
},
{
"code": "invalid_union",
"unionErrors": [
{
"issues": [
{
"code": "invalid_type",
"expected": "object",
"received": "undefined",
"path": [
"query",
"timeframe"
],
"message": "Required"
}
],
"name": "ZodError"
},
{
"issues": [
{
"code": "invalid_type",
"expected": "object",
"received": "undefined",
"path": [
"query",
"timeframe"
],
"message": "Required"
}
],
"name": "ZodError"
}
],
"path": [
"query",
"timeframe"
],
"message": "Invalid input"
}
]
McpError: MCP error -32602: Invalid arguments for tool query_worker_observability: [
{
"code": "invalid_type",
"expected": "string",
"received": "undefined",
"path": [
"query",
"queryId"
],
"message": "Required"
},
{
"code": "invalid_type",
"expected": "object",
"received": "undefined",
"path": [
"query",
"parameters"
],
"message": "Required"
},
{
"code": "invalid_union",
"unionErrors": [
{
"issues": [
{
"code": "invalid_type",
"expected": "object",
"received": "undefined",
"path": [
"query",
"timeframe"
],
"message": "Required"
}
…
|
4526ms |
| T08-001-06 | INFO | Baseline Latency: observability_keys |
Tool 'observability_keys' requires valid credentials or real parameters — latency probe skipped (API rejection, not a se…McpError: MCP error -32602: Invalid arguments for tool observability_keys: [
{
"code": "invalid_union",
"unionErrors": [
{
"issues": [
{
"code": "invalid_type",
"expected": "object",
"received": "undefined",
"path": [
"keysQuery",
"timeframe"
],
"message": "Required"
}
],
"name": "ZodError"
},
{
"issues": [
{
"code": "invalid_type",
"expected": "object",
"received": "undefined",
"path": [
"keysQuery",
"timeframe"
],
"message": "Required"
}
],
"name": "ZodError"
}
],
"path": [
"keysQuery",
"timeframe"
],
"message": "Invalid input"
}
]
McpError: MCP error -32602: Invalid arguments for tool observability_keys: [
{
"code": "invalid_union",
"unionErrors": [
{
"issues": [
{
"code": "invalid_type",
"expected": "object",
"received": "undefined",
"path": [
"keysQuery",
"timeframe"
],
"message": "Required"
}
],
"name": "ZodError"
},
{
"issues": [
{
"code": "invalid_type",
"expected": "object",
"received": "undefined",
"path": [
"keysQuery",
"timeframe"
],
"message": "Required"
}
],
"name": "ZodError"
}
],
"path": [
"keysQuery",
"timeframe"
],
"message": "Invalid input"
}
]
McpError: MCP error -32602: Invalid arguments for tool observability_keys: [
{
"code": "invalid_union",
"unionErrors": [
{
"issues": [
{
"code": "invalid_type",
…
|
4479ms |
| T08-001-07 | INFO | Baseline Latency: observability_values |
Tool 'observability_values' requires valid credentials or real parameters — latency probe skipped (API rejection, not a …McpError: MCP error -32602: Invalid arguments for tool observability_values: [
{
"code": "invalid_type",
"expected": "string",
"received": "undefined",
"path": [
"valuesQuery",
"key"
],
"message": "Required"
},
{
"expected": "'string' | 'boolean' | 'number'",
"received": "undefined",
"code": "invalid_type",
"path": [
"valuesQuery",
"type"
],
"message": "Required"
},
{
"code": "invalid_union",
"unionErrors": [
{
"issues": [
{
"code": "invalid_type",
"expected": "object",
"received": "undefined",
"path": [
"valuesQuery",
"timeframe"
],
"message": "Required"
}
],
"name": "ZodError"
},
{
"issues": [
{
"code": "invalid_type",
"expected": "object",
"received": "undefined",
"path": [
"valuesQuery",
"timeframe"
],
"message": "Required"
}
],
"name": "ZodError"
}
],
"path": [
"valuesQuery",
"timeframe"
],
"message": "Invalid input"
}
]
McpError: MCP error -32602: Invalid arguments for tool observability_values: [
{
"code": "invalid_type",
"expected": "string",
"received": "undefined",
"path": [
"valuesQuery",
"key"
],
"message": "Required"
},
{
"expected": "'string' | 'boolean' | 'number'",
"received": "undefined",
"code": "invalid_type",
"path": [
"valuesQuery",
"type"
],
"message": "Required"
},
{
"code": "invalid_union",
"unionErrors": [
{
"issues": [
{
"code": "invalid_type",
"expected": "object",
"received": "undefined",
"path": [
"valuesQuery",
"timeframe"
…
|
4367ms |
| T08-003-00 | INFO | Resource Read Latency | No resources to benchmark. | 0ms |
| T05-001 | PASS | 10 Simultaneous Calls |
All 10 concurrent calls to 'accounts_list' succeeded with no data leakage.min=1857ms mean=2027ms max=2337ms
|
2635ms |
| T05-002 | PASS | 50 Sequential Rapid Calls |
p50=1375ms p95=2492ms p99=3811ms{
"tool": "accounts_list",
"calls": 50,
"errors": 0,
"min_ms": 1082.2,
"mean_ms": 1479.17,
"max_ms": 3811.26,
"p50_ms": 1375.39,
"p95_ms": 2492.11,
"p99_ms": 3811.26
}
|
73959ms |
| T05-003 | PASS | 100 Concurrent Calls (Stress Test) |
All 100 calls succeeded. Throughput: 6.6 calls/secThroughput: 6.6 calls/sec
|
15154ms |
| T05-004 | PASS | Connection Stability Under Rapid Reconnect |
Tool list consistent across all 5 reconnects: ['accounts_list', 'migrate_pages_to_workers_guide', 'observability_keys', …Reconnects: 5. Tools per connect: 9.
|
49801ms |
| T08-001-01 | PASS | Baseline Latency: accounts_list |
Tool 'accounts_list': mean=1714ms min=1042ms max=2294ms (5 samples).{
"accounts_list": {
"mean_ms": 1714.5,
"min_ms": 1042.12,
"max_ms": 2293.98,
"samples": [
1986.45,
2150.57,
2293.98,
1099.38,
1042.12
]
}
}
|
8573ms |
| T08-001-02 | PASS | Baseline Latency: workers_list |
Tool 'workers_list': mean=1186ms min=1037ms max=1277ms (5 samples).{
"workers_list": {
"mean_ms": 1186.04,
"min_ms": 1037.4,
"max_ms": 1277.38,
"samples": [
1037.4,
1204.89,
1277.38,
1210.02,
1200.5
]
}
}
|
5930ms |
| T08-001-03 | PASS | Baseline Latency: workers_get_worker |
Tool 'workers_get_worker': mean=1120ms min=962ms max=1347ms (5 samples).{
"workers_get_worker": {
"mean_ms": 1119.76,
"min_ms": 961.67,
"max_ms": 1347.11,
"samples": [
1347.11,
1107.59,
1132.2,
1050.23,
961.67
]
}
}
|
5599ms |
| T08-001-04 | PASS | Baseline Latency: workers_get_worker_code |
Tool 'workers_get_worker_code': mean=1365ms min=942ms max=1890ms (5 samples).{
"workers_get_worker_code": {
"mean_ms": 1364.85,
"min_ms": 941.97,
"max_ms": 1890.08,
"samples": [
1603.62,
1239.28,
1890.08,
941.97,
1149.28
]
}
}
|
6824ms |
| T08-001-08 | PASS | Baseline Latency: search_cloudflare_documentation |
Tool 'search_cloudflare_documentation': mean=2598ms min=2183ms max=3333ms (5 samples).{
"search_cloudflare_documentation": {
"mean_ms": 2598.37,
"min_ms": 2183.18,
"max_ms": 3333.1,
"samples": [
3333.1,
2183.18,
2462.51,
2485.64,
2527.42
]
}
}
|
12992ms |
| T08-001-09 | PASS | Baseline Latency: migrate_pages_to_workers_guide |
Tool 'migrate_pages_to_workers_guide': mean=1056ms min=911ms max=1197ms (5 samples).{
"migrate_pages_to_workers_guide": {
"mean_ms": 1056.14,
"min_ms": 911.47,
"max_ms": 1196.85,
"samples": [
1196.85,
911.47,
999.53,
1089.1,
1083.74
]
}
}
|
5281ms |
| T08-004 | PASS | Cold Start Detection |
No significant cold-start penalty detected (ratio 0.7×, threshold 10×).Call 1 (cold): 963ms
Calls 2-5 (warm): 1276ms, 1497ms, 1345ms, 1194ms
Warm mean: 1328ms Ratio: 0.7×
|
6275ms |