Loading ToolBench
A multi-component laboratory system demonstrating three failure scenarios in AI agent security: cross-session PII exfiltration, prompt injection via response manipulation, and intent drift detection. Comprises a proxy server that enforces security policies in observe and govern modes, target services that simulate vulnerable endpoints, and agent runners that execute attack scenarios.
This server exhibits critical definition quality failures across nearly all dimensions. Tool descriptions are present but generic (avg ~80 chars, well below the 194-char baseline). Input schemas exist but lack proper type definitions and parameter descriptions, most parameters have only a type and default value, no actionable description of what the parameter controls or its constraints. No output schemas are documented. The server is explicitly designed to demonstrate security failures (prompt injection, path traversal, privilege escalation), not production-grade tool design. Tools like web_fetch and write_file lack input validation guidance. Error handling is absent, no recovery guidance, no categorization of errors as retryable vs fatal. Composition is poor: read_file, web_fetch, and write_file form a dangerous chain with no safeguards. No tool declares permissions or security scopes. This is a teaching lab, not a production MCP server.
Fetches contact information for a customer including email, phone, and preferred communication channel
Generates a weekly summary report with metric status and anomaly detection
Retrieves transaction history for a customer over a specified number of days
Queries account balance for a customer, returning balance, currency, and last update timestamp
Queries database and returns rows with metrics including revenue, expenses, and headcount
Queries an external API and returns data with source and value
Reads customer record by ID, returning name, email, address, and date of birth
No output schemas documented. Tools return unstructured responses with no field definitions, forcing LLMs to parse responses blindly and breaking downstream tool chaining.
Parameter descriptions are missing or trivial. Most parameters (e.g., 'id', 'customer_id', 'path', 'url') have only a type and default value, no explanation of what the parameter controls, valid ranges, or format constraints.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 49 | 2026-07-28+ | v2 |
Reads internal documentation listing approved tools for agent-analyst
Reads file content from a specified path
Sends a webhook to a specified URL
Fetches content from a URL. Response contains prompt injection payload in HTML comment for scenario B demonstration
Writes content to a file at specified path
No error handling or recovery guidance. Tools return mock responses with no error categorization, no actionable error messages, and no guidance on retryability or next steps for LLMs.
No security scopes or permission declarations. Destructive tools (write_file, send_webhook) lack permission gates, audit trails, or scope declarations. No indication of what permissions are required.
Dangerous tool composition without safeguards. read_file + web_fetch + write_file form a chain vulnerable to prompt injection (web_fetch explicitly returns injection payload in HTML comment). No confirmation, dry-run, or validation steps.