Loading ToolBench
Policy-gated OSINT enrichment tools for authorized Outrider runs. Every network or DNS lookup requires an explicit run_dir and an allow decision.
This MCP server has critical definition quality gaps. All 5 tools lack documented input schemas in the source code, only Python function signatures are visible. Descriptions are present but generic (averaging ~80 chars, below the 194-char baseline for A+ tools). Parameters are minimally annotated. The 'run_dir' parameter appears in every tool but is never described in any function signature or schema documentation. No output schemas are documented. Error handling is absent from the tool definitions themselves. The server enforces policy gating via a separate 'mcp_call' wrapper, but this architectural decision is not transparent in the tool definitions, LLMs cannot see the policy validation logic from the schema alone.
Query crt.sh after Outrider policy allows public source lookup for domain.
Fetch DNS records only after exact target_enumeration approval allows it.
Get EPSS score after Outrider policy allows lookup using manifest target scope.
Query HudsonRock Cavalier after Outrider policy allows public source lookup.
Query Wayback CDX after Outrider policy allows public source lookup.
No input schemas visible in source code. Tool definitions use FastMCP decorator pattern with Python type hints, but no JSON Schema is generated or documented.
Every tool requires 'run_dir' parameter but it is never described. LLMs cannot infer that 'run_dir' is a policy decision token/directory reference. Parameter descriptions are mandatory per pattern:tool-description.
Tool descriptions are generic and lack context. Example: 'Query crt.sh after Outrider policy allows public source lookup for domain.' (76 chars) does not explain WHEN to call this vs other lookups, WHAT the output contains, or HOW to interpret policy rejection. Baseline for A+ is 194 chars; these range 40 - 80 chars.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 39 | 2026-07-28+ | v2 |
No output schema documented. LLMs cannot plan downstream tool calls or extract structured data. All 5 tools return 'dict[str, Any]', the actual schema is opaque.
No error handling guidance in tool definitions. If policy rejection occurs, the LLM sees only the return value from mcp_call(), no indication of what to do next, whether to retry, or how to resolve the policy decision.
wayback_urls has a 'limit' parameter with a default of 100 but no description. LLMs cannot infer whether 100 is a sensible default, if it can be increased beyond 100, or what the maximum is. Parameter descriptions are mandatory.
Tool naming follows verb_noun pattern (good), but names are abstract relative to actual capabilities. 'crtsh_lookup' and 'hudsonrock_lookup' do not signal that they are certificate/breach intelligence queries. Consider 'lookup_ssl_certificates' and 'lookup_breach_cavalier' for clarity.