Loading ToolBench
MCP server with tools for TeamSync project management and user management, including tax calculation, day of week, IP address lookup, and project/user CRUD operations
This MCP server exhibits critical quality gaps across nearly all definition quality dimensions. Tool naming is inconsistent and lacks clear action verbs (GetDayOfWeek vs PublicIpTool). Parameter descriptions are present but often generic. Schemas are partially defined with type information but lack proper JSON Schema structure validation. The server duplicates 7 tools identically across two separate implementations (MCPServer and MCPServer-WebSocket), indicating architectural confusion. No output schemas are documented. Error handling is completely absent, tools make external HTTP calls without timeout, retry, or failure recovery guidance. Security issues are severe: passwords are accepted as plain parameters (CreateNewUserinTeamSync), external API calls lack validation, and no permission gating exists. The codebase shows no evidence of idempotency considerations or graceful degradation.
Add a new Project in TeamSync. if user don't give you the name, use:Name=Test Project, Description=This is a important task, created by: Riaz Khan
Add a new Project in TeamSync. if user don't give you the name, use:Name=Test Project, Description=This is a important task, created by: Riaz Khan
Add a new User in TeamSync
Add a new User in TeamSync
Get the current day of the week
Get the current day of the week
give name of the members of TeamSync
Duplicate tool definitions across two server implementations (MCPServer and MCPServer-WebSocket). Tools 1-7 are identical copies of tools 8-14, indicating architectural confusion and maintenance burden.
Password accepted as plain-text tool parameter in CreateNewUserinTeamSync. Credentials must never be exposed as parameters, use server-side secret injection. This creates a security vulnerability where passwords appear in audit logs and LLM traces.
No output schemas documented for any tool. Tools like MemberOfTeamSync and ProjectsOfTeamSync return free-form strings instead of structured objects. LLMs cannot plan downstream calls or parse results reliably. Missing documented return types violates baseline requirement (100% of A+ tools have documented return types).
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | F | 36 | 2026-07-28+ | v2 |
| 2026-03-09 | F | 0 | - | v1 |
give name of the members of TeamSync
Give name of the Projects of TeamSync
Give name of the Projects of TeamSync
Get your public IP address
Get your public IP address
Calculate your income tax. Take the income as input and give tax amount as result
Calculate your income tax. Take the income as input and give tax amount as result
External HTTP calls (to https://localhost:7162 and https://api.ipify.org) lack any error handling, timeout configuration, retry logic, or graceful degradation. MemberOfTeamSync, ProjectsOfTeamSync, and PublicIpTool will fail silently or hang indefinitely. No recovery guidance provided to LLM.
Inconsistent tool naming conventions. GetDayOfWeek uses PascalCase verb_noun (inconsistent with industry standard snake_case). PublicIpTool uses Noun+Noun pattern, not verb_noun. MemberOfTeamSync lacks a clear action verb. Naming should follow get_, create_, update_, delete_, list_, search_ patterns for LLM clarity.
No permission gating on destructive operations. CreateNewUserinTeamSync and CreateNewProjectinTeamSync perform write operations without checking agent/user authorization. No scope declarations (read:users, write:projects) present.
CreateNewProjectinTeamSync includes instruction text in description ('if user don't give you the name, use...') intended for the LLM. This is prompt injection risk and violates clean separation of schema from instructions. Behavior should be implemented as code defaults, not description hacks.
No input validation or enum constraints on parameters accepting free-form strings (Name, Email, Role, Dept, etc.). Invalid values will be passed to backend API, causing failures with no actionable guidance back to LLM. Should use enums for Role, validate email format, enforce name length.
TaxTool implements naive tax calculation (income/3) without any description of jurisdiction, tax year, deductions, or applicable rules. LLM cannot determine if this is accurate. Description should specify 'This is a demonstration tool; use only for examples, not real tax advice.'
No pagination or result limits on list tools (MemberOfTeamSync, ProjectsOfTeamSync). If backend returns 10,000 users or projects, the entire response is converted to a single string, exhausting context window and degrading LLM reasoning. Should return structured paginated results with limit and offset parameters.