Loading ToolBench
MCP server for Uber APK Signer tool integration
Four tools with complete schemas and basic descriptions, but significant gaps in parameter documentation and error guidance. All tools have input schemas with type definitions and required fields properly declared. Descriptions are present but generic (avg 60 chars, below 194-char baseline). Critical issue: no parameter descriptions for most inputs, LLMs cannot infer what 'keystorePath' or 'keyAlias' control without explicit guidance. Error handling returns raw error text without recovery hints. No output schema documentation. Tool names follow verb_noun pattern (sign_apk, verify_apk_signature, list_keystores, create_keystore) which is good, but descriptions lack WHEN/WHY context.
Create a new keystore for APK signing
List available keystores in a directory
Sign an APK file using Uber APK Signer. Only apkPath is required - other parameters can use defaults or be configured.
Verify the signature of an APK file
Parameter descriptions missing or minimal. 'keystorePath', 'keystorePassword', 'keyAlias', 'keyPassword', 'commonName', 'organization' lack guidance on format, constraints, or when to use defaults. LLMs cannot infer that keystorePassword defaults to 'android' or that keystorePath should be a file path.
No output schema documentation. Tools return text responses but do not document what fields/structure the LLM should expect. E.g., sign_apk returns 'outputPath' and 'size' but this is not formally declared, forcing LLMs to parse unstructured text.
Error handling returns raw error messages without recovery guidance. 'Error executing tool sign_apk: ...' tells the LLM nothing about whether to retry, ask the user, or try a different tool. No error classification (retryable vs fatal).
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 54 | 2026-07-28+ | v2 |
Credentials exposed as parameters. keystorePassword and keyPassword are tool parameters, these will be logged in agent traces and prompt history. Should use server-side secret injection via environment variables.
Tool descriptions lack WHEN/WHY context. 'Verify the signature of an APK file' does not explain when to call this vs sign_apk, what prerequisites exist, or what the output means. Descriptions average 60 chars vs 194-char baseline.