Loading ToolBench
A server for creating, managing, and serving educational worksheets with various task types (comprehension, multiple choice, fill blanks, matching, dictation)
This server exposes only one tool (create-worksheet) via HTTP Express server. While a basic schema is present in the source code, there are critical gaps in naming clarity, description quality, parameter validation, and error handling that prevent production use. The tool lacks idempotency guarantees, input sanitization, and structured error recovery guidance. The server is neither MCP-compliant nor designed for agent integration, it is a bespoke worksheet creation API. Tool naming follows verb_noun pattern (create-worksheet) but parameter descriptions lack sufficient detail for LLM-driven selection. Output schema is ad-hoc (returns success boolean and paths object). No confirmation mechanism exists for this write operation, violating irreversible operation best practices.
Creates a new worksheet by saving HTML content and metadata to the server
Tool description ("Creates a new worksheet by saving HTML content and metadata to the server") is 101 characters and lacks critical context: WHEN to use it, what prerequisites exist, and whether metadata schema is validated. Does not guide LLM on idempotency, side effects, or recovery from failures.
Parameter 'metadata' is typed as 'object' with description 'Metadata object containing worksheet information (title, level, skills, etc.)', no schema enforced. No enum constraints, no required fields, no format validation. LLM cannot determine valid structure; accepts any JSON object without validation.
No input sanitization visible. folderName parameter accepts arbitrary strings; code uses path.join(baseDir, 'worksheets', folderName) without path traversal guards. Malicious input like '../../../' could write worksheets outside intended directory.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | F | 40 | 2026-07-28+ | v2 |
| 2026-03-09 | F | 25 | - | v1 |
No dry-run or confirmation step for this write operation. Agents cannot preview what will be written before committing. Missing confirmation-request pattern for irreversible operations.
Error handling returns generic 500 with 'Failed to create worksheet' message and error.message. Does not categorize errors (retryable vs user-fixable vs fatal) or provide recovery guidance. Missing recovery-guide pattern.
Output schema inconsistency: success response returns { success, paths: { worksheet, index } } but error response returns { error, details }. No documented schema. LLM cannot reliably parse or chain downstream calls.
No idempotency or duplicate detection. If an agent retries with identical input after network failure, worksheets.json receives duplicate entries (same path appended multiple times). Non-idempotent behavior violates idempotent-operation pattern.
Parameter descriptions lack format and constraint details. 'folderName' (string), no length limits, no character restrictions, no regex pattern stated. 'worksheet' (string), no HTML validation, no size limits. 'metadata' (object), no required fields documented. Baseline: 100% of A+ tools have detailed param constraints.
No documented output schema for success case. Baseline: 100% of A+ tools document return types. LLM must infer structure from example response, increasing parsing errors.
No permission checks. Any caller can create worksheets at arbitrary paths. Missing scope-declaration and permission-gate patterns for this sensitive write operation.