Loading ToolBench
MCP server that exposes MariaDB database tools to any MCP-compatible client, supporting connection management, querying, DDL operations, and database administration.
MariaDB MCP server has 15 tools with basic structure but significant quality gaps. Tool naming is generally action-oriented (get_, list_, create_, etc.), which is good. However, parameter descriptions are almost entirely absent across all tools, the input schemas visible in the code show properties but no descriptions field. Tool descriptions exist but are very brief (10-30 characters), below the 50-200 character baseline for LLM optimization. Most critically, output schemas are not documented anywhere, callers have no way to know what fields to expect from execute_query, describe_table, or backup_table. Error handling exists in the code (ValueError exceptions with messages) but is minimal and not comprehensive. No tool annotations (readOnlyHint/destructiveHint) are present, and dangerous operations like execute_command and delete operations lack confirmation or dry-run patterns. Security concern: configure_connection accepts password as a plain parameter, which will be logged in agent traces.
Export rows as INSERT statements.
Set runtime MariaDB credentials.
Create a database.
Create a user.
Describe a table.
Run a write or DDL command.
Run a read query.
Show current connection config.
No parameter descriptions in any tool. All 15 tools expose input schema properties without description fields, violating the baseline requirement that 100% of A+ tool params have descriptions. Example: configure_connection has 'host', 'port', 'user', 'password' properties with no text explaining what format, constraints, or values are expected.
Tool descriptions are too brief (10-35 characters), well below the 50-200 character baseline. Descriptions like 'Show current connection config' and 'List tables in a database' lack context for LLM selection. They do not explain WHEN to use the tool, WHAT it returns, or dependencies.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | F | 40 | <=2025-11-25 | v2 |
Show process list.
Show server status.
List table indexes.
Grant user privileges.
List databases.
List tables in a database.
Test current connection.
Output schemas not documented. No tool in the source code declares what fields and types are returned. execute_query, describe_table, list_tables, and backup_table produce complex result sets but callers have no schema to understand the structure. This forces LLMs to guess field names for downstream operations.
Password exposed as plain tool parameter in configure_connection. Agent traces will log the full password. Credentials must use server-side secret injection via environment variables or vault, not tool parameters.
Dangerous operations (execute_command, create_user, grant_privileges, backup_table with optional where_clause) lack confirmation or dry-run patterns. An agent can drop a table or create a rogue admin account without safeguards.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint). Tools are marked with Risk: READ_ONLY or Risk: WRITE in the assessment, but these are not declared in the tool definitions themselves. LLMs cannot determine which tools are safe to retry or re-invoke.
Generic execute_query and execute_command tools invite SQL injection and unrestricted queries. No input validation shown, no allowlist pattern, no query complexity limits. A compromised agent can run 'DROP DATABASE' or data exfiltration queries.
List tools (list_databases, list_tables, get_process_list) return unbound result sets. No pagination, limit, or offset parameters. A large database with thousands of tables will blow the context window and degrade LLM reasoning.
Error messages are not recovery-guided. Code shows basic ValueError exceptions, but no evidence that errors tell the LLM what to do next. Example: if configure_connection fails due to missing host, the error should suggest 'Try calling get_connection_info to see current config, then retry with a valid host.'