Loading ToolBench
MCP server providing tools for Dataverse/Dynamics 365 development, including entity metadata inspection, data management, custom action/API discovery, and troubleshooting capabilities
This server has 14 tools with schemas and descriptions visible in the source code. However, quality is inconsistent across multiple dimensions. Tool naming uses mixed conventions (some start with Get/Find verbs, but inconsistent capitalization and PascalCase instead of snake_case). Descriptions are present but vary significantly in quality, some are specific and actionable (e.g., ExecuteFetchXml includes guidance on XML escaping), while others are vague (e.g., ExecuteWebApi lacks detail on what 'response' contains). Parameter schemas are present with type declarations, but descriptions are sometimes too brief or missing critical constraints. No tool has documented return schemas or pagination guidance. Error handling is minimal, the sample code shows try-catch with generic error messages that do not guide recovery. Output appears to be plain-text JSON concatenation rather than structured responses. Several tools like CreateRecord reference complex API patterns (lookup resolution, @odata.bind) that could benefit from clearer documentation. The server appears to be a Windows/.NET-specific tool without clear remote accessibility (transport unknown).
Create a record in Dataverse. This uses Dataverse/Dynamics 365 Web API. Always reference the schema name from the entity metadata (not the logical name) when building lookup fields in your payload. For lookups, use the format: <SchemaName>@odata.bind
Execute/Run a FetchXml query. If paging-cookie attribute is present, its value should have correct XML escaping
Execute a Dataverse/Dynamics 365 Web API request and return the response.Request url should not contain /api/data/v9.*/
Find Dataverse Custom Actions using keyword. Returns metadata to help frame Web API requests.
Find Dataverse Custom APIs using keyword. Returns metadata to help frame Web API requests.
Get all the privileges/permissions a security role has using the security role id (guid)
Tool naming inconsistency: PascalCase (GetCustomActionMetadata, ExecuteFetchXml) instead of snake_case convention (get_custom_action_metadata). LLMs parse verb_noun patterns more reliably than camelCase. Mixed conventions ('Find' vs 'Get') create ambiguity for tool selection.
Output schema not documented. Tools return plain-text JSON concatenation (e.g., 'Found {count} matching custom action(s)\n' + JsonSerializer.Serialize(...)). No structured response format, no pagination metadata, no total counts. LLMs cannot parse or chain results reliably.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | F | 43 | <=2025-11-25 | v2 |
| 2026-03-09 | F | 32 | - | v1 |
Get attributes/fields/columns metadata information for an entity/table in a paginated fashion. IMPORTANT: Maximum 50 records per page. Do not exceed this
Get metadata details for a Dataverse Custom Action by unique name. Returns input/output parameters and other metadata to help frame Web API requests.
Get Entity/Table metadata information using logical name of the entity/table
Get all the privileges/permissions a security role has on an entity using the security role id (Guid)
Get Plugin Trace Logs for a plugin by correlation id
Get Plugin Trace Logs for a plugin by name
Get relationships metadata information for an entity/table in a paginated fashion. IMPORTANT: Maximum 50 records per page. Do not exceed this
List all the security roles having a specific privilege on an entity/table using privilege id (guid)
Parameter descriptions lack specificity and constraints. E.g., ExecuteWebApi 'requestUrl' says 'Request url should not contain /api/data/v9.*/.' but does not explain why or what the correct format is. CreateRecord references '@odata.bind' syntax but does not provide a clear example or pattern. No enum constraints for known-set values.
Error handling is generic and non-actionable. Catch blocks return 'Error: {ex.Message}' without context on what to do next, whether the error is retryable, or what the agent should try. No recovery guides (pattern:recovery-guide) provided.
Transport is UNKNOWN. No evidence of HTTP, SSE, or STDIO implementation visible in the provided code snippet. The McpServerToolType and McpServerTool attributes suggest a custom MCP framework, but the underlying transport mechanism is not documented or visible. This is a blocker for protocol readiness scoring.
Pagination guidance is incomplete. GetAttributesMetadata and GetRelationshipsMetadata accept pageNumber, numOfRecordsPerPage, and pagingCookie, but descriptions do not explain how to iterate or what pagingCookie format/origin is. No total count returned to inform stopping condition.
Tool composition risk: ExecuteWebApi is a pass-through to the Dataverse Web API with minimal validation or abstraction. This shifts responsibility to the LLM to construct correct API paths, headers, and JSON bodies. Prone to malformed requests and security issues (e.g., parameter injection if requestUrl or requestBody are not sanitized).
Security: CreateRecord and ExecuteWebApi accept arbitrary JSON payloads and custom headers without input validation. No mention of permission checks, audit logging, or scope declarations. Destructive operations (PATCH, DELETE via ExecuteWebApi) are not gated or require confirmation.