Loading ToolBench
Xiaozhi MCP server project - A Model Context Protocol server for web search functionality built with Spring Boot
Single tool 'searchWeb' has a reasonable verb-based name and acceptable description length (85 chars, within 10-1024 range), but lacks critical parameter descriptions, input validation documentation, and output schema documentation. The tool accepts external API calls with minimal error handling guidance. Parameter 'maxResults' lacks a proper description (only has 'required: false' metadata visible). No output schema is documented despite returning a complex SearchResult record. The implementation uses unsafe SSL context (skips certificate verification) which is a security concern but not directly scored here. Overall, the tool definition is incomplete for production agent use.
Search web for information using a search query with configurable result count
Missing parameter descriptions for 'maxResults': Only metadata visibility shown, no LLM-facing description of the range (1-20 enforced server-side but not documented). LLMs cannot infer that max is capped at 20 without this documentation.
Output schema not documented: Tool returns List<SearchResult> but no schema is visible in tool definition. SearchResult is a Java record with (title, url, snippet) but LLMs need explicit field documentation to plan downstream operations and extract data correctly.
No error handling guidance in tool or parameter descriptions: Exception handling catches and logs errors to stderr but returns empty list on failure. LLMs cannot distinguish between 'no results found' and 'API failed', no recovery guidance provided.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | F | 42 | 2026-07-28+ | v2 |
| 2026-03-09 | F | 40 | - | v1 |
API key exposed as server-side configuration but SSL certificate validation is disabled (trustAllCertificates pattern in constructor). This creates a man-in-the-middle risk, the bearer token sent to api.tavily.com could be intercepted.
Input validation not documented: The tool enforces maxResults <= 20 server-side but doesn't tell the LLM this constraint exists. LLMs may request 100 results expecting them, then receive only 20, leading to confusion.
No result limit stated in description: Tool description doesn't mention it returns up to 20 results (or defaults to 10).
No pagination support: If search returns many results, there is no way to fetch page 2. Tool should accept offset/cursor parameters and return a total count or next_cursor for large result sets.