Loading ToolBench
TypeScript middleware toolkit for MCP servers - authentication, caching, rate limiting, CORS, logging (beta)
This MCP toolkit provides 7 example tools across basic-auth-server.ts and production-server.ts. Tools have basic descriptions and simple input schemas. However, significant gaps exist: parameter descriptions are minimal, output schemas are not documented, error handling guidance is absent, and descriptions lack the LLM-optimized clarity expected in production-grade tools. The codebase demonstrates middleware concepts (auth, caching, rate-limiting) rather than a polished tool implementation. All tools are READ_ONLY, limiting security diversity testing. Descriptions average ~40-60 chars (below the 194-char baseline for A+ tools). Parameter annotations are either missing entirely or minimal (e.g., 'City name (e.g. London, Tokyo)' for get-weather lacks detail on format, length constraints, and error cases).
Retrieve secret data (requires JWT auth)
Get the current stock price for a ticker symbol (cached for 2 minutes)
Look up a user profile by ID
Get current weather for a city (cached for 2 minutes)
Greet a user by name
Return server health and middleware statistics
Return information about the authenticated caller
Output schemas not documented. No tool explicitly documents what fields it returns, preventing LLMs from planning downstream chains and extracting the correct data.
Parameter descriptions are minimal or missing. 'City name (e.g. London, Tokyo)' for get-weather lacks format details, length constraints, and fallback behavior. LLMs cannot infer whether 'New York', 'new york', or 'NY' is valid.
No error handling guidance. Tools do not document recovery paths. E.g., get-weather does not specify what happens if a city name is not found, preventing LLMs from self-correcting.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | D | 56 | <=2025-11-25 | v2 |
| 2026-03-09 | F | 40 | - | v1 |
Tool descriptions are under 50 characters for most tools, far below the 194-character baseline for production tools. 'Return information about the authenticated caller' (53 chars) for whoami lacks context on when to call it vs other discovery tools.
Inconsistent parameter naming. get-secret-data accepts 'category' but does not list valid enums. get-weather and get-stock-price do not specify case sensitivity or accept aliases (e.g., 'NYSE:AAPL' vs 'AAPL').
No pagination documented. server-status and whoami imply returning arbitrary data without limit or page parameters. Large responses risk context window exhaustion.