Loading ToolBench
Skills and plugins to accelerate security workflows with the Orca Cloud Platform
This MCP server exposes a single tool, fetch_grouping, with a minimal definition that lacks critical details required for LLM-safe operation. The tool has a basic description and only one input parameter ('out'), but the schema lacks formal type declarations, parameter descriptions are absent, output structure is undocumented, and error handling provides no recovery guidance. The tool's purpose is domain-specific (Orca Cloud Platform credential resolution) but the definition does not meet baseline production standards for agentic tool composition.
Fetch Orca's admin clustering artifact (GET /api/iaminator). Reads an Orca API token from the first place it is found, derives the regional API host, makes one read-only GET, and writes the JSON response to --out.
Input parameter 'out' lacks formal type declaration and description. Schema shows only description field; no 'type' or 'required' declarations are visible.
Output schema is completely undocumented. The tool writes JSON to a file but no schema describes the structure, field names, or types of the returned artifact. LLMs cannot plan downstream operations or parse results.
Error handling provides no recovery guidance. Exit codes are documented in the script (0=success, 2=no credential, 3=API error, 4=host unreachable) but this information is not exposed in the tool definition. LLMs receive only the exit code and cannot determine whether to retry, ask the user, or abort.
Parameter validation constraints are missing. The 'out' parameter should specify: required=true, type=string, format/pattern (file path), and maximum length. No constraints are declared.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 41 | 2026-07-28+ | v2 |
Tool description, while present (51 chars), is under the baseline minimum of 50 - 1024 chars for effective LLM selection. Baseline avg is 194 chars. The description assumes domain knowledge (Orca API, iaminator endpoint, regional host derivation) without explaining when or why to call this tool vs alternatives.
No tool-level security declaration. The tool handles credential resolution and API authentication internally, but there is no declaration of what permissions it requires (e.g., 'read:orca-admin') or what secrets it manages. The rubric baseline is 100% of A+ tools declare permissions.
No idempotency or dry-run capability. The tool modifies filesystem state (writes to --out file). Agents may retry on ambiguous failures, causing duplicate writes or clobbering previous results. No confirmation or dry-run option to prevent side effects.