Loading ToolBench
Network device management MCP server with inventory and command execution capabilities
Server has 3 tools with basic naming and descriptions, but lacks depth in parameter documentation and output schema clarity. Naming follows verb-noun pattern (list_, run_, backup_). Descriptions are present but minimal (12 - 47 chars vs. baseline 194 chars). Parameters lack detailed descriptions and constraints. Output schemas are inferred from code rather than explicitly documented. Tool definitions are directly visible in source (not inferred), so no cap applies. Error handling is present but minimal, no actionable recovery guidance. Security risk: run_command accepts arbitrary host/command with no validation or rate limiting.
Backup configurations from all network devices with progress tracking.
List all devices in the network inventory.
Run a command on a network device.
run_command has no input validation, accepts arbitrary host/command strings, and poses command injection and authorization risks. No permission gates, rate limiting, or injection sanitization.
Parameter descriptions are absent or trivial. 'host' and 'command' params in run_command have descriptions ('The host/IP address...', 'The command...') but lack format/constraint details (e.g. valid IP format, allowed command patterns, what happens on failure).
Output schemas are not explicitly documented. list_devices returns list[dict] and run_command returns str, but field names, structures for errors, and downstream field references are not documented, preventing LLM chaining.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | D | 55 | 2026-07-28+ | v2 |
| 2026-03-09 | D | 52 | - | v1 |
Error handling is minimal. run_command returns a plain string on device not found; no error classification, recovery guidance, or structured error responses. Agents cannot distinguish failures from successful string results.
Tool descriptions are very short (12 - 55 chars vs. baseline 194). They lack WHEN to use the tool, prerequisites, dependencies, or side-effect declarations. 'Run a command on a network device' does not explain when this is safe, what permissions are needed, or what can go wrong.
backup_all_configs advertised as progress-tracking but uses deprecated/non-standard Context.report_progress. Protocol does not define this API; relies on fastmcp extension, not standard MCP.