Loading ToolBench
A collection of three MCP servers written in Go: Demo (greeting service), FileManager (file operations), and Weather (real-time weather information)
This collection of 7 tools across 3 separate Go modules demonstrates basic MCP functionality but falls short of production quality. Tool definitions are present with schemas and descriptions, but descriptions are often generic or incomplete. Parameters lack detailed guidance on constraints, formats, and dependencies. Output schemas are not documented. Error handling provides basic error messages but lacks recovery guidance. The server uses STDIO transport (capped at 50 for protocol readiness). Security concerns exist around file path traversal and insufficient input validation. Resource implementation is hardcoded (demo/main.go references a hardcoded absolute path). Tool composition is reasonable, separate file operations instead of combined actions, but descriptions do not fully guide LLM selection or explain when to use each tool versus alternatives.
Create a new file with content
Delete a file
获取指定城市的实时天气信息
给某个人发送问候
List files in a directory
Read content of a file
Update content of an existing file
Descriptions are generic and lack LLM-optimized guidance. E.g., 'Create a new file with content' does not explain when to use create_file vs update_file, what happens if the file exists, or what the function returns. Baseline for A+ tools: 50-200 chars with WHAT, WHEN, and WHY context.
No output schema documentation. filemanager tools return JSON with fields like 'message', 'path', 'content', 'success', but the tool definitions do not declare what structure LLMs should expect. This forces LLMs to guess or parse unstructured text.
Path traversal vulnerability. create_file, read_file, update_file, delete_file, and list_files accept arbitrary file paths without validation. An LLM could be tricked into passing '../../etc/passwd' or similar. No input sanitization or sandboxing visible.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | D | 55 | 2026-07-28+ | v2 |
| 2026-03-09 | F | 39 | - | v1 |
Error handling provides basic error messages (e.g., 'Failed to create file: ...') but does not guide recovery. Per pattern:recovery-guide, errors should tell the LLM what to do next. E.g., 'File already exists. Use update_file() to modify it, or delete_file() then create_file() to replace it.'
Destructive operations (delete_file) lack confirmation or dry-run support. Per pattern:confirmation-request, irreversible operations should support a confirmation step to prevent catastrophic mistakes by agents.
Parameter descriptions lack constraint guidance. E.g., 'path' parameter for all file tools has no guidance on allowed characters, length limits, or format. 'location' in get_current_weather has no examples or list of supported cities.
list_files has optional 'path' parameter but description does not clarify what 'default: current directory' means in the context of an MCP server. Does it mean CWD of the server process? The user's home? This ambiguity will confuse LLMs.
hello_world tool name is not verb_noun style. Better: 'send_greeting' or 'greet_user'. 'hello_world' reads like a placeholder demo name, not a production tool.
get_current_weather description in Chinese ('获取指定城市的实时天气信息') while all other descriptions are in English. This inconsistency makes the tool harder to discover and use by LLMs trained primarily on English.
create_file content parameter is not required, but behavior when omitted is not documented. Does it create an empty file? Error? Return a default? LLMs need explicit guidance.
No error categorization (retryable vs user-fixable vs fatal). Per pattern:error-classification, errors should tell the LLM whether to retry, ask the user, or give up. Current implementation returns all errors the same way.
No pagination support in list_files. If a directory contains thousands of files, returning all of them will blow the context window. Should accept 'limit' and 'offset' parameters and return a total count.
Resource implementation in demo/main.go is hardcoded to an absolute path ('/Users/fenghui/gowork/src/mcp-server/demo/README.md'). This is not portable and will fail on any other system. Should use relative paths or configuration.