Loading ToolBench
A Model Context Protocol server for exploring and querying databases using natural language. Provides tools for managing database connections, exploring schema, and executing SQL queries with AI-assisted natural language to SQL conversion.
This server presents a mixed quality profile. Strengths: all 10 tools have clear action-verb names (list_, connect_, disconnect_, test_, get_, execute_), detailed descriptions (150-400 chars each), and explicit input schemas with type definitions and parameter descriptions. Descriptions reference prerequisites and workflows. Weaknesses: output schemas are NOT documented anywhere in the provided source, tool descriptions explain what they return in prose ('Returns X'), but there is no formal JSON Schema for response structures. Error handling is present but inconsistent (some tools return {success, error, suggestion} tuples, others return {success, message, ...}); guidance on recovery actions is present but not standardized. No pagination support documented for list_ tools (list_connections_tool, list_tables_tool). The natural_language_query_tool description is unusually verbose (600+ chars), violating the 10-1024 target. Tool composition is sound, each tool has one responsibility. Security: credentials are handled via config files and env var references ('password': 'env:DB_PASSWORD'), not exposed as parameters, which is correct. However, no evidence of permission gates, scope declarations, or audit logging in the source snippet. Risk classification is present (READ_ONLY, WRITE) but not formally integrated into tool annotations. Overall, definition quality is above-average community standard but falls short of production-grade due to missing output schemas and inconsistent error contracts.
Connect to a database. Args: connection_name: Name for this connection config: Optional connection configuration dict. If not provided, loads from src/config/connections/{connection_name}.json Example with config file: connect_tool("docker_mysql") Example with inline config: connect_tool("my_db", config={ "type": "mysql", "host": "localhost", "user": "your_user", "password": "env:DB_PASSWORD", "database": "your_database" })
Disconnect from a database. Args: connection_name: Name of the connection to disconnect
Execute a SQL query on the database. Args: connection_name: Name of the database connection sql_query: SQL query to execute max_rows: Maximum rows to return (default: 1000) timeout: Query timeout in seconds (default: 30) Returns query results with data, columns, and execution metadata.
Get metadata about a database. Args: connection_name: Name of the connection Returns information like database version, size, character set, etc.
Get database schema information. Args: connection_name: Name of the database connection table_name: Optional specific table name (if not provided, returns all tables) Returns table structures, columns, data types, and relationships.
Output schemas are not formally documented. Tool descriptions use prose to explain return values ('Returns X with Y'), but no structured JSON Schema for response shapes is visible. LLMs cannot reliably parse or chain calls without knowing the exact response structure.
natural_language_query_tool description exceeds 600 characters, violating the 10-1024 target (baseline median 194 chars). The description is verbose and includes redundant 'Workflow' and 'Returns' sections that should be in schema documentation instead. Trim to ~150 chars focusing on the core intent.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | D | 56 | <=2025-11-25 | v2 |
| 2026-03-09 | D | 51 | - | v1 |
Get detailed information about a specific table. Args: connection_name: Name of the database connection table_name: Name of the table to inspect Returns column details, primary keys, foreign keys, indexes, etc.
List all available database connections. Returns information about configured database connections, including which ones are currently active.
List all tables in a database. Args: connection_name: Name of the database connection Returns a list of tables with basic information.
Convert natural language to SQL using client's AI. This tool provides database schema context to the client's AI for SQL generation. The server extracts the schema, formats it, and returns a prompt that the client can use with their AI/LLM to generate SQL. The client then calls execute_sql_query_tool with the generated SQL. Args: connection_name: Name of the database connection question: Natural language question (e.g., "Show me customers from New York") max_rows: Maximum rows to return (default: 100) Returns: Dictionary containing: - schema_context: Database schema information - prompt: Formatted prompt for client AI to generate SQL - instructions: Step-by-step guide for using the prompt - example_usage: Example of how to use the generated prompt Workflow: 1. Server extracts schema and creates prompt 2. Client uses prompt with their AI to generate SQL 3. Client calls execute_sql_query_tool() with generated SQL
Test if a database connection is alive. Args: connection_name: Name of the connection to test
No pagination parameters (limit, offset, page_size, next_cursor) visible for list_ tools (list_connections_tool, list_tables_tool). If these tools can return large result sets, they should support pagination to avoid context explosion. Baseline: list tools should accept page/offset and return total_count.
Error handling inconsistency: response format varies across tools. Some return {success, error, suggestion}, others {success, message, ...}. No standardized error classification (retryable vs user-fixable vs fatal). LLMs cannot reliably interpret recovery actions.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint) visible. Risk classification exists (READ_ONLY, WRITE) but is not integrated into MCP tool metadata. Tools like disconnect_tool and execute_sql_query_tool should carry destructiveHint=true to signal to agents that they alter state.
No visible permission gates or scope declarations. Code shows config loading and connection management but no explicit authorization checks (e.g., 'user X has permission to connect to database Y'). Agents can invoke destructive tools without auth verification.
No audit logging visible. While code includes logging statements, there is no explicit recording of who called what tool, with which parameters, and what outcome. Required for compliance and incident response.
execute_sql_query_tool accepts arbitrary SQL queries with a max_rows limit (default 1000). No visible input sanitization or SQL injection guards. LLMs could be tricked into passing malicious SQL. Tool should validate or escape SQL before execution.