Loading ToolBench
A React-based web application for security analysis and AI-assisted code review with MCP server integration
This server has severe definition quality issues. The three tools (code-scanner, dependency-checker, network-analyzer) are defined in a React UI component (MCPServerConfig.tsx) rather than in actual server implementation code, suggesting this is a UI mockup or demo, not a functional MCP server. Tool definitions lack proper structure: descriptions are minimal (10-16 chars, well below the 34-char baseline for p10), parameters have type annotations but lack meaningful descriptions, and output schemas are completely undocumented. The codebase is a React application (package.json shows react, antd, react-scripts) with no evidence of an actual MCP server implementation, no Node.js server file, no SSE endpoint handler, no tool invocation logic. The tools appear to be hardcoded mock data in state initialization, not registered with a working MCP transport layer.
代码安全扫描工具
依赖检查工具
网络流量分析工具
Tool definitions exist only in React UI component state, not in functional server code. No evidence of actual MCP server implementation, no Node.js server, no SSE handler, no tool invocation logic.
Descriptions are critically short (10-16 characters). Baseline p10 is 34 chars; these fail to explain when or why to use each tool. Examples: 'code-scanner' = '代码安全扫描工具' (9 chars in Chinese), 'dependency-checker' = '依赖检查工具' (6 chars).
Parameters have type definitions but zero descriptions. 'source', 'ruleSet', 'projectPath', 'capture', 'filter' lack any explanation of expected format, allowed values, or constraints. LLMs cannot determine valid inputs.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | F | 25 | <=2025-11-25 | v2 |
| 2026-03-09 | F | 0 | - | v1 |
Output schemas are completely undocumented. Tools have no declared return type structure, making it impossible for LLMs to plan downstream operations or extract results.
Tool names lack clear action verbs. 'code-scanner' and 'dependency-checker' use hyphens (non-idiomatic for function names) and lack verb-noun clarity. 'network-analyzer' is vague, does it analyze live traffic, logs, or packet captures?
No error handling guidance. Tools return READ_ONLY risk classification but provide no error messages, recovery paths, or validation feedback.
Descriptions are in Chinese ('代码安全扫描工具' = 'code security scanning tool'). While not inherently problematic, mixing languages in tool definitions creates ambiguity for LLMs trained on English prompts and reduces interoperability.