Loading ToolBench
MySQL MCP server providing read-only SQL query execution and database schema inspection
Single tool 'mysql_query' has a clear, action-oriented name and basic input schema, but lacks comprehensive documentation and sophisticated error handling. The tool description is minimal (13 words), and while the QueryInput struct defines a 'query' parameter with a brief description, the output schema (QueryOutput) is not formally documented in the tool registration itself, it exists only in the code. Parameter descriptions lack detail on constraints, format, and error guidance. Error handling returns generic messages without recovery hints. The server enforces read-only queries through parser-based validation, which is a security strength, but the tool lacks idempotency hints, detailed error classification, and comprehensive error messages that would guide an LLM to correct malformed input or suggest alternatives.
Read-only SQL query (SELECT/SHOW/DESCRIBE/EXPLAIN).
Tool description is minimal (13 words: 'Read-only SQL query (SELECT/SHOW/DESCRIBE/EXPLAIN).') and lacks context on when to use this tool, what prerequisites exist, and what happens on error. Rubric requires 10 - 1024 chars; this is only 59 chars but lacks actionable content like 'WHEN to use' and 'error recovery hints.'
Parameter 'query' has a description in code ('Read-only SQL query (SELECT/SHOW/DESCRIBE/EXPLAIN).') but it lacks detail on format constraints, length limits, allowed statement prefixes, and denied substrings. LLM cannot infer that queries must not contain ';' in the middle or certain forbidden keywords.
Output schema (QueryOutput with fields 'columns', 'rows', 'rowCount', 'truncated') is defined in code but NOT formally documented in the tool registration itself. The MCP tool definition shows only the input schema; output schema is implicit in the StructuredContent map returned at runtime. LLM cannot discover what fields to expect from the tool definition alone.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | F | 46 | 2025-06-18+ | v2 |
| 2026-03-09 | F | 39 | - | v1 |
Error messages lack recovery guidance and actionable hints. Examples: 'only read-only queries are allowed' (does not explain what IS allowed or suggest use case), 'failed to acquire connection: %v' (raw driver error does not help LLM retry or ask user to check config), 'query failed: %v' (does not categorize as retryable or user-fixable).
No idempotency or read-only hints in tool annotations. The tool IS read-only (enforced by parser validation) and IS idempotent (SELECT queries produce same result on repeat), but MCP toolAnnotations are not populated. LLM cannot infer retry safety or side-effect profile from the tool definition.
No pagination or result limit parameters. While MaxRows config restricts results in-server (default 1000), the tool does not expose 'limit' or 'offset' parameters to the LLM. Large result sets can blow context windows. Tool description does not state the 1000-row default limit.
No input validation guidance. The tool silently rejects queries containing ';' in the middle or matching deny_substrings, but the LLM is not told why rejection occurred or how to reformulate. Error message 'only read-only queries are allowed' does not explain that '; ' in a query causes rejection.
AllowStatementPrefixes and DenySubstrings are configuration-driven security controls, but these constraints are not documented in the tool description. LLM has no way to know that 'UNION' might be denied or that only certain prefixes are allowed without trial-and-error.