Loading ToolBench
MCP security scanner that reads the runes before your agent steps on them — finds vulnerabilities in AI agent tool configurations
Glyph exposes only 2 tools with minimal schema definition and poor descriptions. list_tools has a 4-word description; call_tool has a 7-word description, both far below the 50-200 char baseline for LLM-optimized descriptions. call_tool's input schema declares 'name' and 'arguments' but provides no type constraints, enums, or validation guidance. Neither tool documents output schemas. The server is a security proxy, not a primary tool provider, which limits its applicability as a standalone MCP server. No error handling guidance, no parameter constraints, no idempotency hints.
Handle tool calls with security analysis
Return approved tools from downstream server
Tool descriptions are critically short (4 - 7 words). LLMs cannot determine when or why to select these tools. Descriptions must be 50 - 200 chars and answer: What does it do? When to use it? What does it return?
call_tool input schema lacks type constraints and validation rules. 'arguments' is typed as 'object' with no properties defined. No enum, pattern, or range constraints. LLMs will pass arbitrary payloads without guidance.
No output schemas documented for either tool. LLMs cannot plan downstream calls or extract required fields. list_tools should document the structure of returned tools; call_tool should document result format and error responses.
No error handling guidance. If call_tool rejects a tool or fails security analysis, the response must tell the LLM what to do next (retry, ask user, or abort). Raw errors provide no recovery path.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 36 | <=2025-11-25 | v2 |
call_tool performs security analysis on tool calls but does not document what security checks are applied, what findings trigger rejection, or how the LLM should respond to blocked calls. This is a critical gap for a security-focused tool.