Loading ToolBench
A multi-server MCP infrastructure system that connects multiple MCP servers (Math, Weather, Shell) through LangGraph agents, enabling tool execution decoupled from the client application.
This server exhibits severe definition quality issues across all four tools. Tool names lack consistency and clarity; descriptions are either missing, trivial, or present without actionable detail; input/output schemas are either absent or severely incomplete; and destructive operations lack any safety guardrails or error handling guidance. No tool meets production standards for LLM-safe operation.
Get weather for location.
Run a terminal command and return the output. Args: command: The terminal command to execute Returns: A dictionary containing the command output and exit code
Run a terminal command and return the output. Args: command: The terminal command to execute
run_terminal_command appears TWICE with nearly identical names and parameters, violating single-responsibility principle. LLM cannot distinguish between them; both expose arbitrary command execution without injection protection.
Destructive tool (run_terminal_command) does not declare this in description. Per pattern:command-tool, any tool that modifies state must explicitly say 'This operation is destructive and cannot be undone.' Agents need to know which calls are safe to retry.
No input sanitization or command injection prevention. Parameter description for 'command' is minimal and does not warn against shell metacharacters, subshells, or pipe operators. LLMs frequently pass unsanitized user input directly to subprocess.run(shell=True).
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | F | 8 | 2026-07-28+ | v2 |
| 2026-03-09 | F | 30 | - | v1 |
get_readme is registered as a RESOURCE (@mcp.resource()) instead of a TOOL (@mcp.tool()). Per MCP spec, resources expose stateful data; tools execute operations. A file read is an operation, not a resource discovery mechanism.
No output schemas documented for any tool. LLMs cannot predict what fields will be in the response, preventing downstream tool composition and forcing exploratory calls.
Tool descriptions are 24 - 78 characters, well below production baseline (194 chars avg, p10=34, p90=392). Descriptions are minimal and do not explain WHEN to use each tool vs alternatives, prerequisites, or side effects.
No permission gating or confirmation step for destructive operations. Per pattern:permission-gate and pattern:confirmation-request, tools that can delete files or modify system state should require explicit agent authorization or confirmation.
Error responses do not guide recovery. A command returning exit_code=-1 with 'Error executing command: ...' tells the LLM nothing about whether to retry, ask the user, or escalate. Per pattern:recovery-guide, error messages must suggest next steps.
No parameter constraints or validation rules documented. The 'command' parameter accepts arbitrary strings with no length limit, regex pattern, or hints about safe vs unsafe patterns. LLMs will pass unvalidated payloads.