Loading ToolBench
MCP server for Hejdar — runtime policy enforcement for AI agents
Single tool with well-structured schema and clear descriptions. Tool name 'hejdar_evaluate' uses verb_noun pattern appropriately. Input schema is complete with proper types, enums, and descriptions for all parameters. Description (195 chars) is within baseline range (p10=34, p90=392) and explains WHAT, WHEN, and consequences. However, output schema is not formally documented in the tool definition, only inferred from code comments. Error handling is present but generic. No tool annotations (readOnlyHint, destructiveHint, idempotentHint) despite the tool being read-only and idempotent.
Evaluate an AI agent action against Hejdar security policies BEFORE executing it. Returns ALLOW, DENY, or WOULD_DENY. Call this before any sensitive action (read, write, delete, transfer, execute) to check if the action is permitted by organizational policy. If the decision is DENY, do NOT execute the action.
Output schema not formally documented in tool definition. Code returns {decision, policy_id, reason, risk_level} but this structure is not declared in the Tool schema. LLMs cannot plan downstream actions without knowing return fields.
Missing tool annotations. Tool is read-only and idempotent but does not declare readOnlyHint=true or idempotentHint=true. Agents cannot distinguish this from destructive tools without reading implementation.
Error responses are generic JSON strings without structured error classification. 'Hejdar API is temporarily unavailable' does not tell the agent whether to retry, ask the user, or fail. No recovery guidance.
Context parameter accepts additionalProperties=true but lacks guidance on valid keys. Documentation mentions 'department, user_id, reason, data_classification, etc.' but does not specify which are recognized or how they affect policy evaluation.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 63 | <=2025-11-25 | v2 |
agent_name parameter is optional but the code defaults to 'unknown' if missing. This silently masks configuration errors. Should be required or provide clear guidance on when to omit it.