Loading ToolBench

Reading the current corpus…

osint-mcp MCP server · F · ToolBench

← Browse

osint-mcp

github.com/CloudWaddie/osint-mcp

OSINT MCP Server - Open Source Intelligence gathering tools via Model Context Protocol

2026-07-28+STDIO0 tools

13/100

Definition Quality0

Protocol Readiness0

Supportability21

Spec posture

Inferred effective spec 2026-07-28+·current baseline 2026-07-28

Static source inference · medium confidence

Current-spec patterns detected

Summary

Scoring was not performed

Issues (6)

CRITICALtool ↗

Output schemas not documented. Most tools do not declare their return type structure, only input schemas are visible. LLMs cannot plan downstream tool calls or extract relevant fields without knowing what response fields to expect.

archive_lookupsearch_companiessearch_pgplookup_btclookup_ethreverse_dnsemail_permutationssearch_emails_by_domainget_exif_metadatafandom_user_infodiscord_lookupsteam_lookupxbox_lookupgithub_user_infogoogle_vision_annotatehackertarget_subdomainshackertarget_dns_lookup

HIGHtool-description ↗

Parameter descriptions lack actionable constraints. Descriptions like 'Domain name to find subdomains for' or 'Email address to validate' omit format requirements, validation rules (e.g., regex, length), range constraints for numerics, or examples of valid input.

subdomain_finderarchive_lookupsearch_companiessearch_pgplookup_btclookup_ethreverse_dnsemail_permutationsvalidate_email_formatsearch_emails_by_domainget_exif_metadatafandom_user_infodiscord_lookupsteam_lookupxbox_lookupgithub_user_infogoogle_vision_annotate

HIGHtool-description ↗

No dependency hints or disambiguation between similar tools. Tools like 'lookup_btc' and 'lookup_eth' lack descriptions explaining when to use BTC vs ETH. Tools like 'discord_lookup', 'steam_lookup', 'xbox_lookup' do not clarify which platform applies or how to resolve a username to a platform-specific ID.

lookup_btclookup_ethdiscord_lookupsteam_lookupxbox_lookupsearch_companiessearch_pgp

HIGHpaginated-result ↗

Pagination and result limiting not consistently visible. Tools like 'github_user_repos', 'fandom_user_contributions', 'exa_search' accept a 'limit' parameter, but schema/description does not clarify whether pagination (offset/cursor) is supported or what the maximum results cap is.

github_user_reposfandom_user_contributionsexa_searchsearch_emails_by_domain

HIGHrecovery-guide ↗

Error messages not actionable. BaseApiClient throws McpError with InternalError code and message like 'API request failed: 404 Not Found' or 'Rate limit exceeded'. These do not tell the agent what to do next (retry? lookup? ask user?).

subdomain_finderarchive_lookupsearch_companiessearch_pgplookup_btclookup_ethdns_lookupreverse_dnsemail_permutationssearch_emails_by_domainexa_searchget_exif_metadatafandom_user_infofandom_user_contributionsdiscord_lookupsteam_lookupxbox_lookupgithub_user_infogithub_user_reposgithub_commit_emailsgithub_repo_commitsgoogle_vision_annotategreynoise_ip_contexthackertarget_subdomainshackertarget_dns_lookup

MEDIUMtool-description ↗

Tool descriptions missing rationale for use. Tool descriptions state WHAT the tool does but not WHEN to use it or why one tool is chosen over a similar one. E.g., 'search_emails_by_domain' vs 'email_permutations', when should an agent pick each?

email_permutationssearch_emails_by_domainsubdomain_finderhackertarget_subdomainsgithub_commit_emailsgithub_repo_commits

Recommendations

For each tool, add a documented return type structure. Example: 'Returns: { subdomains: string[], count: number }'. This enables agents to plan downstream tool calls.
Expand parameter descriptions to include constraints. Example: 'domain (string, required): Domain name (e.g., example.com). Must be a valid FQDN, 1 - 253 chars, lowercase recommended.' instead of just 'Domain name to find subdomains for'.
Add dependency hints for lookup tools. Example in github_user_info: 'If you only have a username, this tool resolves it. If you need all repositories, call github_user_repos() after.'
Clarify when to use similar tools. Add text like: 'Use this to enumerate subdomains via certificate data (crt.sh). Use hackertarget_subdomains as an alternative source if this returns limited results.' to subdomain_finder.
Improve error messages. In BaseApiClient, catch known API errors and return guidance. Example: 'API returned 404. The resource may not exist. Try searching with a different query or verifying the identifier format.'
For tools accepting limit/pagination (exa_search, github_user_repos, fandom_user_contributions), document: '(1) Maximum results cap (e.g., limit: 1 - 100, default 5), (2) Whether pagination is supported (offset, cursor, or none), (3) Recommended default limit for typical use (e.g., start with 10 for web search).'
Declare enum constraints for parameters that accept fixed sets of values. Example: dns_lookup.type uses enum [A, AAAA, MX, ...], good. Apply this pattern to parameters like crypto address types (BTC, ETH, other chains) if tools support multiple.

Score history

Overall score trend

↓ 24 points across a rubric change (v1 → v2)

13/100

Scored	Grade	Overall	Spec posture	Rubric
2026-09-22	F	13	2026-07-28+	v2
2026-03-09	F	37	-	v1