Loading ToolBench
MCP server for Kali Linux security tools integration, providing automated reconnaissance, vulnerability scanning, exploitation, and CTF solving capabilities
This server has critical definition gaps across all 7 tools. Most tool descriptions are in Chinese and extremely brief (avg 20-30 chars), falling well below the 50-200 char baseline for LLM-optimized descriptions. While input schemas ARE present with types, parameter descriptions are minimal or absent in many cases. No output schemas are documented anywhere in the source. The three 'adaptive_*' tools have particularly vague names ('adaptive_execute_strategy', 'adaptive_intelligent_orchestration') that do not follow verb-noun patterns and obscure intent. No error handling guidance, no recovery patterns, no schema composition guidance. Tool definitions appear auto-generated or minimally documented.
创建自适应执行上下文
执行自适应策略
获取执行上下文状态
获取自适应执行洞察
智能编排多目标自适应攻击
抓取网页正文(清洗后纯文本)，用于阅读 CVE 详情/PoC/漏洞公告
联网搜索漏洞情报/CVE/绕过技巧，返回 title/url/snippet 列表
Tool descriptions are extremely brief (20-30 chars) and lack context about when/why to use each tool. Descriptions must be 50-200 chars and explain prerequisites, expected outcomes, and differentiation from similar tools.
Tool names do not follow verb-noun pattern. 'adaptive_create_execution_context' is unwieldy; 'create_context' is clearer. 'adaptive_execute_strategy' and 'adaptive_intelligent_orchestration' are vague, does 'execute_strategy' apply an attack? Run reconnaissance? The action is obscured.
No output schemas documented. Tools return data but schema documentation is missing from source. LLMs cannot plan downstream calls or extract expected fields without knowing the response structure.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | F | 43 | 2026-07-28+ | v2 |
| 2026-03-16 | F | 13 | - | v1 |
Parameters lack meaningful descriptions or constraints. 'target_info' in adaptive_create_execution_context is documented as 'JSON格式字符串' (JSON format string) but does not specify what fields are required/optional, expected structure, or examples of valid JSON.
No error handling guidance. Tools do not document what errors can occur, whether they are retryable, or what the LLM should do next. A malformed URL in web_fetch produces no documented error path.
Parameter 'orchestration_mode' in adaptive_intelligent_orchestration declares default but lacks enum constraint. Description lists modes (balanced, aggressive, stealth, quick) but uses free-form string type, LLM may hallucinate invalid modes like 'ultra-aggressive'.
Tool names are in English but descriptions are in Chinese. This creates confusion for multi-language LLM deployments and makes it harder for non-Chinese-speaking developers to maintain or debug.
Three tools marked WRITE risk (adaptive_execute_strategy, adaptive_intelligent_orchestration) have no confirmation or dry-run pattern. An agent invoking these can trigger security operations without explicit confirmation.