Prompts have names, descriptions, and argument schemas
Why it matters
Prompt templates without argument definitions leave clients guessing at what inputs to supply. A prompt named review with no description gives the client no basis for surfacing it to the user at the right moment or pre-filling arguments. Duplicate prompt names cause non-deterministic selection. These failures map directly to MCP Spec noncompliance: the prompts/list response becomes misleading, and clients that rely on argument descriptions to build UI will silently omit required context.
Severity rationale
Medium because undescribed or argument-free prompts degrade discoverability and usability without causing immediate security or data failures.
Remediation
Add a description and a Zod argument schema to every server.prompt() registration.
// src/prompts/index.ts
server.prompt(
'review-code',
'Generate a targeted code review for a specific file. Focuses on bugs, security issues, and style violations.',
{
filePath: z.string().describe('Path to the file to review relative to project root'),
focusArea: z.enum(['bugs', 'security', 'style', 'all']).optional()
.describe('Area to focus on; defaults to all'),
},
async ({ filePath, focusArea }) => ({
messages: [{
role: 'user',
content: { type: 'text', text: `Review ${filePath} for ${focusArea ?? 'all issues'}...` }
}]
})
)
DetectionPro
The detection method for this pattern is part of AuditBuffet Pro.
The full method (what to look for, pass and fail conditions, and how results get reported) ships inside the MCP Server Audit. The pattern definition, severity rationale, and remediation remain openly licensed under CC-BY-4.0.
External references
- external · mcp-spec-prompts — MCP Specification — Prompts
Taxons
History
- 2026-04-18·v1.0.0·Initial import from mcp-server·automated