Loading ToolBench
Infrastructure diagnostics library: DNS, DNSSEC, TLS certificate inspection, email security, DNS propagation, and MCP-integrated AI agent support
Shohei provides 11 infrastructure diagnostic tools with consistent naming (check_* verb prefix) and reasonable descriptions (100-150 chars avg). All tools have input schemas with typed parameters and descriptions. However, output schemas are not documented in the source code, only input structures are visible. Error handling is minimal; tools return generic Result types without recovery guidance. Parameter descriptions lack constraints (e.g., no enum for record_types, no min/max for timeouts). No tool annotations (readOnlyHint, destructiveHint) despite all being read-only. Composition is sound (each tool does one thing), but descriptions could be more LLM-optimized per the 50-200 char baseline.
Check BGP route information for an IP address via RIPE Stat API to detect route hijacking
Check common subdomains for DNS resolution, HTTP status, and TLS validity
DNS query resolution with support for multiple record types, DNSSEC validation, and custom resolvers
Assess domain registration risk for phishing and squatting by analyzing domain age, expiration, and registration signals
HTTP/HTTPS request to check status code, headers, and response metadata
Detect if a domain is parked for sale by analyzing HTTP headers and parking provider signatures
Query passive DNS records via RIPE Stat API to find historical DNS resolutions
Output schemas not documented. Source shows only input request/response structs (DomainRiskResult, ParkedDomainResult) but no formal output schema declarations in tool registration. LLMs cannot plan downstream calls without knowing what fields to expect.
Parameter constraints missing. 'record_types' accepts array but no enum of valid types (A, AAAA, MX, etc.). 'timeout_secs' unbounded, no min/max. 'transport' enum not shown in schema. LLMs will hallucinate invalid values.
No error recovery guidance. Tools return generic Result<T> with no actionable error messages. E.g., WHOIS timeout returns 'unknown' risk level with optional error string, but no guidance on retry or fallback. Agents cannot self-correct.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 54 | 2026-07-28+ | v2 |
Detect subdomain takeover vulnerabilities by checking CNAME targets against known vulnerable services
Verify TLS certificate chain for a hostname, including expiry validation and DANE/TLSA support
Run traceroute to a hostname and measure hop-by-hop latency
WHOIS lookup for domain registration information including registrar, creation date, and expiration date
Tool annotations missing. All 11 tools are read-only (no state mutation), but no readOnlyHint declared. Agents cannot distinguish safe-to-retry tools from destructive ones without explicit hints.
Descriptions lack LLM-optimized context. Most descriptions (65-75 chars) are below the 50-200 char baseline and omit WHEN to use the tool vs similar ones. E.g., 'check_dns' vs 'check_passive_dns' distinction unclear from descriptions alone.