Loading ToolBench
MCP tool server for Empower (Personal Capital) financial data. Exposes EmpowerClient methods as MCP tools over stdio transport.
11 tools with clear verb-noun naming and comprehensive descriptions (avg 150 chars). All tools have input schemas with typed parameters and descriptions. However, output schemas are not documented in the visible code, only inferred from docstrings. Date range validation is present but error messages could be more actionable. No tool annotations (readOnlyHint/destructiveHint) despite clear risk classifications. Authentication tools lack confirmation/dry-run patterns for sensitive operations. Output truncation logic exists but is not exposed in tool descriptions, risking silent data loss.
Complete 2FA verification and finalize login. Verifies the SMS code dispatched by start_authentication, then authenticates with the password. On success, persists the session to disk.
Fetch account balance history within a date range. Returns balance entries and summary statistics.
Fetch all linked accounts with aggregate summary. Returns account list and summary statistics.
Fetch current investment holdings across all accounts. Returns holdings list and aggregate totals.
Fetch current market quotes for a list of symbols. Returns quote data including price, change, and performance metrics.
Fetch daily net worth history within a date range. Returns net worth entries and summary statistics.
Output schemas not documented. Tool descriptions state what is returned (e.g. 'Returns account list and summary statistics') but do not specify field names, types, or structure. LLMs cannot plan downstream tool calls or extract specific fields without explicit schema documentation.
No tool annotations despite explicit risk classifications. Tools are marked WRITE (start_authentication, complete_authentication) and READ_ONLY, but no readOnlyHint or destructiveHint annotations are present in the MCP tool definitions. This prevents clients from applying appropriate UI/UX safeguards.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 59 | <=2025-11-25 | v2 |
Fetch portfolio performance data within a date range. Returns performance metrics and benchmark comparison.
Fetch current portfolio snapshot with asset allocation and performance data.
Fetch spending summary within a date range. Returns spending details and summary statistics.
Fetch transactions within a date range with categories and summary. Returns transaction list, unique categories, and summary statistics.
Re-authenticate when the cached session is stale. Reads EMPOWER_EMAIL and EMPOWER_PASSWORD from the MCP server's environment. If the device is remembered, completes authentication directly. Otherwise dispatches a 2FA challenge via SMS; call complete_authentication next with the verification code.
Authentication tools lack confirmation/dry-run pattern. start_authentication and complete_authentication are irreversible operations that modify session state, but no confirmation step or preview is offered. Agents cannot preview the 2FA flow before committing.
Output truncation is silent and undocumented. The _enforce_char_cap() function truncates large result lists to fit a 50k character cap (configurable via PC2_MCP_MAX_CHARS), but this behavior is not mentioned in any tool description. Agents may not realize data is being silently dropped.
Date range validation error messages lack recovery guidance. _validate_date_range() returns 'start_date (2024-12-31) is after end_date (2024-01-01). Swap them so start_date <= end_date.' but does not suggest which tool to call next or how to recover. Per pattern:recovery-guide, errors should guide the LLM's next action.