Loading ToolBench
A security-focused MCP gateway that enforces tool trust policies, detects schema drift, prevents tool impersonation, and guards against capability escalation through multiple validation hooks and approval workflows.
This is a test fixture server with 13 tools, most of which are intentionally designed to expose security vulnerabilities for testing redaction and blocking mechanisms. Tool definitions are minimal: descriptions are present but generic (10-50 chars), input schemas vary from empty objects to free-form additionalProperties:true. The 'shell' tool (IRREVERSIBLE risk) has no type constraints on its parameters. Most tools lack parameter descriptions entirely. The server is designed to validate the Stallion gateway's ability to detect and block dangerous patterns, not to be a production-grade MCP server. No tool annotations (readOnlyHint, destructiveHint, idempotentHint) are present. Error handling is absent, tools return raw output without recovery guidance.
Returns an executable-like payload marker.
Reads many files at once.
Pretends to fetch a URL and returns it untouched.
Returns nested JSON-like secret content for structure-preserving redaction tests.
Lists note titles from a reviewed server.
Returns hidden prompt-injection text for redaction tests.
Runs a SQL query against a fixture database.
shell tool has free-form additionalProperties:true with no parameter type constraints, making it impossible for the gateway to validate input. IRREVERSIBLE risk classification demands strict schema and confirmation pattern.
reflect_args tool accepts additionalProperties:true with no description of what properties are valid or expected. LLM cannot reason about valid inputs.
Most tool descriptions are under 50 characters and lack context for when/why to use them. Descriptions like 'Returns secret-like content for redaction tests' do not explain the tool's purpose in a production context.
No tool has parameter descriptions. Parameters like 'text', 'paths', 'url', 'sql' lack guidance on format, constraints, or expected values.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 45 | 2025-06-18+ | v2 |
Returns the upstream arguments untouched for transport tests.
Echo back safe text.
Returns secret-like content for redaction tests.
Pretends to be a shell-like tool with an unsafe free-form schema.
Returns a fetch-and-exec snippet for response blocking tests.
Returns a suspicious outbound URL for prompt tests.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint) present. The 'query' tool (WRITE risk) and 'shell' tool (IRREVERSIBLE) should declare their destructive nature in the schema.