Loading ToolBench
MCP server for VirusTotal threat analysis providing file, IP, domain, and URL security reports
This server exhibits severe definition quality issues across multiple dimensions. The most critical problem is duplicate tool registration: tools 1-4 are duplicated as tools 5-8, suggesting either incomplete source code or broken tooling. Descriptions are in Chinese and extremely short (11-16 characters), below the 20-character minimum for actionable guidance. Parameters have types ('string') but lack any explanation of expected format, constraints, or valid values. No output schemas are documented anywhere in the provided code. The API key is hardcoded in source files (major security violation). Error handling exists at the HTTP level but provides no LLM-actionable guidance (exceptions are printed, not structured). The transport is STDIO-only, which incurs a hard cap of 50 on protocol readiness. No tool composition, no pagination support, no documented return types. This server would require extensive rework to meet production quality standards.
获取域名报告
获取域名报告
获取文件报告
获取文件报告
获取 IP 地址报告
获取 IP 地址报告
获取 URL 报告
Tool descriptions are in Chinese and critically short (11-16 characters). Chinese descriptions are inaccessible to English-speaking developers and LLMs trained primarily on English. Descriptions provide zero context for when/why to use each tool or what they return.
Duplicate tool registration detected: tools 1-4 are repeated as tools 5-8 with identical names, descriptions, and schemas. This indicates either incomplete source code submission or a critical registration bug. Only 4 unique tools exist, not 8.
No input parameter descriptions provided. The 'file_hash', 'ip_address', 'domain', and 'url' parameters have type declarations but no human-readable guidance on expected format, constraints, or valid values.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-21 | F | 33 | 2026-07-28+ | v2 |
| 2026-03-09 | F | 33 | - | v1 |
获取 URL 报告
API key hardcoded in source files ('Your VirusTotal api Key' placeholder in virusTotalServer.py, actual key in MCP-Virustotal.py). Use environment variables or vault. Secrets in code end up in version control and logs.
No output schemas documented. The make_api_request function returns raw JSON from VirusTotal API with no filtering, structuring, or field documentation. LLMs cannot plan downstream calls or extract the right data without knowing the response structure. The VirusTotal API response is verbose and includes audit metadata irrelevant to chat interactions.
Error handling is not LLM-actionable. Exceptions are printed to stdout but not returned to the agent. The function returns None on failure with no context about what failed or how to recover. Pattern requires: 'Error responses must tell the LLM what to do next' with categorization (retryable, user-fixable, fatal).
No input validation. Parameters are passed directly to the API with no checks for format, length, or type. LLMs can submit invalid hashes, IPs, domains, or URLs; errors are printed instead of returned as structured feedback the agent can use to self-correct.
Tool names are verb-driven (get_*) which is correct, but there is no distinction between query types (file vs. IP vs. domain vs. URL) in the names themselves. The names are clear but the lack of parameter descriptions makes it ambiguous what format each expects (e.g., does get_file_report accept MD5, SHA1, SHA256, or all?).
No pagination support documented. If VirusTotal returns multiple related results (e.g., multiple IP addresses in a network range), the tools lack limit/offset parameters and return count fields. Large unfiltered responses can exhaust context windows.