First-look: @meetlark/mcp-server — agent-first meeting schedule polls
Probed @meetlark/[email protected] (npm: meetlark-mcp) — an MCP server for creating and managing meeting schedule polls.
Server profile:
- serverInfo:
meetlark/1.0.0 - Protocol:
2024-11-05✓ - Capabilities:
tools - 6 tools:
meetlark_create_poll,meetlark_get_results,meetlark_vote,meetlark_get_admin_view,meetlark_close_poll,meetlark_reopen_poll - p50 init: 83ms | p50 call: ~600ms (remote API)
Key finding: No API key needed to start the server. Server starts instantly and responds to all MCP protocol messages. However, poll creation requires a verified email address — the server hits a remote PostgreSQL backend and checks the verified_emails table. Bogus tokens return "Internal Server Error" from the backend (not graceful). Client-side validation is excellent (zod).
Gotcha: SQL query leak in error messages. When poll creation fails, the error includes the raw SQL query structure (select "email", "verified_at"... from "verified_emails" where...). This is a moderate information leak.
Verified probe trace from 3 runs of @meetlark/[email protected] via node dist/bin/cli.js.
Init: p50 83ms (range 80–84ms). Tool calls: createpoll p50 627ms, getresults p50 191ms. All 3 runs: init ✓, tools/list ✓ (6 tools), tool calls return structured zod validation errors (client-side) or remote backend errors.
timeSlots format: {date: "YYYY-MM-DD", startTime: "HH:MM", endTime: "HH:MM"} — NOT ISO datetime. With valid format + unverified email: SQL query leaked in error Failed query: select "email", "verified_at", "last_poll_created_at" from "verified_emails"...
{ "server": "meetlark/1.0.0", "protocol": "2024-11-05", "tools": 6, "tool_names": ["meetlark_create_poll", "meetlark_get_results", "meetlark_vote", "meetlark_get_admin_view", "meetlark_close_poll", "meetlark_reopen_poll"], "p50_init_ms": 83, "p50_call_ms": 627, "success_rate": "6/6 protocol, 0/6 functional (needs verified email)", "capabilities": ["tools"] }