Loading ToolBench
MCP server for secure coding and compliance — full MITRE CWE corpus, ISO 27001, NIST 800-53, OWASP ASVS, NIST SSDF, ISO 27017 — with official cross-framework mappings and enforcement hooks
Strong domain coverage with 34 well-named, read-only compliance tools. All tools have descriptions (avg 120 chars) and explicit input schemas with typed parameters. Naming follows verb_noun pattern consistently (lookup_, search_, list_, map_). However, output schemas are not documented in the source, LLMs cannot see what fields to expect from responses. Parameter descriptions are present but often generic (e.g., 'Search keyword or phrase' repeated 8+ times). No error handling guidance visible. No tool annotations (readOnlyHint, etc.). Composition is sound, tools chain naturally (e.g., search → lookup → map). Security is appropriate for read-only compliance data.
List all OWASP ASVS 5.0 chapters with requirement counts
List all OWASP ASVS 5.0 requirements in a chapter
Look up an OWASP ASVS 5.0 requirement by ID (e.g. V1.1.1, V6.2.5). Returns the requirement with level indicators.
Search OWASP ASVS 5.0 requirements by keyword across titles and descriptions
List all controls in an ISO 27017:2015 section
List all ISO 27017:2015 sections with control counts
Look up an ISO 27017:2015 cloud security control by ID. Returns the control with cloud-specific guidance.
Output schemas not documented. LLMs cannot see what fields lookup_control, search_controls, or map_to_nist return. This forces agents to guess at response structure and risks failed downstream chaining.
Search tool descriptions are generic ('Search keyword or phrase'). Repeated 8+ times across iso_search, nist_search, cloud_search, asvs_search, ssdf_search, cwe_search, nist_cloud_search. LLMs cannot distinguish when to use each variant without reading the tool name.
No tool annotations (readOnlyHint). All 34 tools are read-only compliance lookups, but this is not declared in the tool definition. Agents cannot infer safety without explicit annotations.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 63 | 2026-07-28+ | v2 |
Search ISO 27017:2015 cloud security controls by keyword across titles and guidance
Analyze a code change description and return relevant ASVS L2 and NIST 800-53 controls. Use before implementing security-touching changes (auth, sessions, authorization, crypto, input handling, file I/O, logging, secrets, network/API exposure, data persistence).
List the MITRE CWE Top 25 most dangerous weaknesses (2024 ranking)
Look up a MITRE CWE weakness by ID (e.g. CWE-79, CWE-89). Returns the weakness with description, mitigations, examples, and detection methods.
Map a MITRE CWE weakness to relevant NIST 800-53 and OWASP ASVS controls
Search MITRE CWE weaknesses by keyword across names, descriptions, and mitigations
List all ISO 27001:2022 Annex A categories with control counts
List all controls in an ISO 27001:2022 Annex A category
Look up an ISO 27001:2022 Annex A control by ID and get its mapped NIST 800-53 guidance. Summary by default, detailed=true for full NIST guidance.
Search ISO 27001:2022 Annex A controls by keyword
Get a summary of all cross-framework mappings available in the server (ISO 27001 → NIST 800-53, NIST SSDF → NIST 800-53, CWE → NIST/ASVS, etc.)
List all NIST cloud security guidance topics grouped by source (SP 800-144, 800-210, 800-146)
List all NIST cloud security guidance sources (SP 800-144, 800-210, 800-146) with topic counts
Look up a NIST cloud security guidance topic by ID (e.g. SP800-144.4.5, SP800-210.3.1). Returns guidance from NIST SP 800-144, 800-210, or 800-146 with mapped NIST 800-53 controls.
Search NIST cloud security guidance (SP 800-144, 800-210, 800-146) by keyword across topic titles and guidance text
List all NIST 800-53 control families with control counts
List all controls in a NIST 800-53 family (e.g. AC, SC, IA)
Look up a NIST 800-53 control or enhancement by ID. Accepts citation form IA-5(1) and OSCAL form IA-5.1. Returns summary by default, set detailed=true for full guidance and enhancements.
Search NIST 800-53 controls by keyword across titles, statements, and guidance
Generate a compliance summary for a pull request based on cited NIST 800-53 and ASVS controls. Useful for PR descriptions and audit trails.
Get all external framework references for a NIST SSDF task (BSIMM, OWASP ASVS/SAMM, ISO 27034, PCI SSLC, EO 14028, NIST CSF, IEC 62443, etc.)
List all NIST SSDF groups with task counts
List all NIST SSDF tasks in a group (PO, PS, PW, RV)
Look up a NIST SSDF task by ID (e.g. PO.1.1, PS.2.3). Returns the task with mapped NIST 800-53 controls and cross-framework references.
Map a NIST 800-53 control to its corresponding NIST SSDF tasks
Map a NIST SSDF task to its corresponding NIST 800-53 controls
Search NIST SSDF tasks by keyword across titles and descriptions
No error handling guidance. If a control_id is invalid or not found, the tool description does not explain what the LLM should do next (retry, search, ask user). Error responses must guide recovery.
Limit parameter descriptions lack enforcement detail. 'Max results to return (default 20, max 200)' is present but does not explain what happens if the LLM requests 500 results, is it capped silently, or does it error?