Loading ToolBench
A distributed security posture management system that performs multiple security scanning operations including DNS checking, email security validation, application fingerprinting, port scanning, status checking, web crawling for API key discovery, subdomain takeover detection, and NVD vulnerability scanning.
Ardra exposes 18 security scanning tools with READ_ONLY risk classification. Tool naming is inconsistent (mixes verbs like 'Performs', 'Validates', 'Scans', 'Checks', 'Crawls', 'Enumerates', 'Retrieves'). Descriptions are present but generic, most lack actionable context for LLM selection (e.g., 'Performs comprehensive DNS security scanning' does not explain WHEN to call it vs Email Security Check). Input schemas are minimal: most tools accept only 1-2 string parameters with no enums, ranges, or validation hints. Output schemas are completely undocumented, LLMs cannot infer what fields to expect from results. Error handling is absent from all tool definitions. No tool declares permissions, audit requirements, or recovery guidance. Composition is poor: 'Get *' tools (10-18) are generic data retrieval with no pagination, limits, or filtering, returning unbounded result sets risks context window exhaustion. Web Crawl tool accepts 5 parameters but lacks constraints on max_depth, max_pages, or timeout_seconds (e.g., max_depth could be 1000, max_pages could be 1M). No tool documents idempotency or side effects.
Performs HTTP fingerprinting on a domain including status code detection, server header extraction, TLS/SSL version and cipher suite identification, certificate details, and technology stack detection using Wappalyzer.
Performs comprehensive DNS security scanning including A, AAAA, MX, NS, CNAME, and TXT record lookups, DNSSEC validation, zone transfer checks, reverse DNS, CDN provider detection, and threat intelligence queries.
Validates email security configuration including MX record verification, SPF policy checking, DMARC policy validation, DKIM selector discovery, MTA-STS verification, and TLS reporting configuration.
Retrieves application fingerprinting results from the database including HTTP status, server headers, TLS information, and detected technologies.
Retrieves DNS security scan results from the database including DNS records, DNSSEC status, zone transfer vulnerability, CDN detection, and threat intelligence.
Retrieves discovered API keys and credentials from web crawling results stored in the database.
Output schemas completely undocumented. LLMs cannot infer what fields to expect from any tool result. All 18 tools lack documented return types, forcing agents to guess field names and types.
Generic 'Get *' tools (tools 10-18) lack pagination, limits, and filtering. Returning unbounded result sets risks context window exhaustion. No tool declares max result count or offers offset/limit parameters.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 31 | 2026-07-28+ | v2 |
Retrieves email security configuration check results from the database including SPF, DMARC, DKIM, MTA-STS, and TLS reporting status.
Retrieves all discovered open ports and services from the database.
Retrieves HTTP status check results from the database.
Retrieves subdomain takeover vulnerability scan results from the database.
Retrieves discovered subdomains from the database, optionally filtered by domain name.
Retrieves discovered vulnerabilities from NVD scanning results stored in the database.
Scans services and versions against the National Vulnerability Database (NVD) to identify known CVEs, extracting vulnerability details including severity, description, and references.
Scans open ports on a target host using nmap, detecting service versions and vulnerabilities. Stores results in the database with host identification, protocol, port state, and service information.
Checks HTTP status codes and response times for a list of URLs, detecting availability and response errors. Stores results with SLD, URL, status code, and error messages.
Enumerates subdomains for a given domain using multiple sources (Wayback Machine, Certificate Transparency, Findomain, Subfinder) and deduplicates results. Stores discovered subdomains in the database.
Scans subdomains for takeover vulnerabilities by checking CNAME records and attempting HTTP connections to detect unclaimed services. Identifies vulnerable DNS configurations.
Crawls a website up to a specified depth, extracts API keys using regex patterns (AWS, Google, Stripe, GitHub), and stores discovered credentials in the database. Supports subdomain inclusion and configurable timeouts.
Web Crawl tool (tool 6) accepts unbounded numeric parameters (max_depth, max_pages, timeout_seconds) with no min/max constraints. LLMs could pass max_depth=10000 or max_pages=1000000, causing runaway crawls.
No error handling guidance in any tool definition. Tools lack recovery hints, error classification (retryable vs fatal), or actionable error messages. LLMs cannot self-correct on failures.
Tool naming inconsistency. Scanning tools use different verb forms ('Performs', 'Validates', 'Scans', 'Checks', 'Crawls', 'Enumerates'). Retrieval tools all start with 'Get' but lack verb_noun clarity (e.g., 'list_subdomains' vs 'get_subdomains'). LLMs struggle to disambiguate similar tools.