Loading ToolBench
MCP server for Woolworths Australia with session cookie management
The server defines 12 tools with complete JSON Schema structures visible in src/index.ts. All tools have descriptions and input schemas. However, the schemas are minimal, most parameters lack detailed constraints, bounds, or format specifications. Descriptions are present but brief (10-80 chars, well below the 194-char baseline for A+ tools). No output schema documentation is visible. Error handling is minimal, tools will fail with generic errors rather than actionable guidance. Parameters lack enum constraints where appropriate (e.g., sortType has enum, but most tools are bare string/number fields). No security measures documented: session cookies are stored globally in memory, no audit trail, no permission gates. Tool composition shows a fundamental issue: session state (cookies, browser) is stateful and global, this violates the stateless request-response pattern and will cause race conditions with concurrent agent calls. The tools are specialized for Woolworths but lack domain completeness (no checkout, no order history, no delivery tracking).
Add a product to the shopping cart/trolley
Closes the browser instance
Get the contents of the shopping cart/trolley
Get the list of available product categories
Retrieves session cookies from the current browser session. Run this after logging in or establishing a session.
Get detailed information about a specific product by its stockcode
Stateful global session management (browser, currentPage, sessionCookies) violates stateless request-response design. Concurrent agent calls will race and corrupt state. MCP protocol requires each request to be self-contained.
No output schema documentation. Tool descriptions do not explain what fields are returned or their types. LLMs cannot plan downstream calls or extract required data without knowing the response structure.
Missing parameter constraints and bounds. Numeric parameters (pageNumber, pageSize, quantity, stockcode) have no minimum/maximum; string parameters lack regex patterns or length limits. This invites invalid inputs from LLMs.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | D | 52 | 2026-07-28+ | v2 |
| 2026-03-09 | F | 0 | - | v1 |
Get current specials and deals from Woolworths
Navigate to a specific URL on the Woolworths website
Opens a browser and navigates to Woolworths website. This is the first step to establish a session.
Remove a product from the shopping cart/trolley
Search for products on Woolworths. Requires session cookies to be obtained first.
Update the quantity of a product in the shopping cart/trolley
Minimal error handling. No recovery guidance in error messages. 'API request failed: 404' tells the LLM nothing about what to do next. Should include 'Did you mean...?' suggestions or retry guidance.
Session cookies are sensitive data. Storing in global memory and passing as Cookie header in fetch requests exposes them to logging and traces. No audit trail, no permission gates, no credential injection pattern.
Descriptions are too brief (40-70 chars vs 194-char baseline). Examples: 'Closes the browser instance' (40 chars), 'Get the list of available product categories' (48 chars). They lack context about WHEN to call the tool and dependencies between tools.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint). The MCP spec now supports these; they help LLMs reason about safety and retry logic. woolworths_add_to_cart and woolworths_remove_from_cart should have destructiveHint=true.
No pagination support in list tools. woolworths_get_specials and woolworths_get_categories accept pageSize but no offset/cursor. If results exceed the limit, the LLM cannot fetch the next page. This violates paginated-result pattern.
Broken tool composition chain. woolworths_open_browser and woolworths_close_browser manage global state but do not document required calling order. No dependency hints in descriptions. An LLM could call woolworths_search_products without first calling woolworths_open_browser, causing failures.
Parameter naming inconsistency. stockcode is sometimes a string (get_product_details) and sometimes a number (add_to_cart, remove_from_cart). This type confusion will cause LLM errors.