Loading ToolBench
Guardrails service for AI agents — safety evaluation, audit, and approval workflows
Intaris exposes 24 tools with minimal metadata. All tools have basic descriptions (10-50 chars), but lack parameter-level descriptions entirely. Input schemas are present but sparse: most parameters have only type and description at the tool level, not per-parameter. No output schemas documented. Tools span file I/O, web, email, social media, and infrastructure, a broad, unfocused toolkit that violates single-responsibility principle. Error handling is absent from tool definitions. Security-critical tools (bash, kubectl, ssh_exec, delete_email) lack permission gates or confirmation patterns. No tool annotations (readOnlyHint, destructiveHint, idempotentHint) despite many irreversible operations.
Execute a shell command and return stdout/stderr.
Browse a web page interactively (click links, fill forms, etc.).
Create an email draft without sending.
Delete an email by ID.
Edit a file by replacing text. The oldText must match exactly.
Forward an existing email to another recipient.
Search for files matching a glob pattern.
No parameter-level descriptions. All 24 tools have input schemas with only type and top-level description. Parameters like 'command', 'pattern', 'url', 'folder' lack individual descriptions explaining what values are valid, expected format, or constraints. LLMs cannot infer parameter semantics from names alone.
No output schemas documented. Tools return unstructured responses with no field definitions. LLMs cannot plan downstream tool calls or extract required IDs (e.g., email_id for forward_email, channel_id for message tools). Violates response-shaper pattern.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 52 | <=2025-11-25 | v2 |
Search file contents using a regex pattern.
Execute a Helm command for chart management.
Execute a kubectl command against a Kubernetes cluster.
Browse LinkedIn feed or a specific profile page.
Send a direct message on LinkedIn.
Post content on LinkedIn.
Run a read-only SQL query and return results.
Read a file from the filesystem.
List or read emails from a mailbox folder.
Scrape structured data from a web page.
Compose and send an email.
Execute a command on a remote host via SSH.
Post a tweet on Twitter/X.
Search Twitter/X for posts matching a query.
Fetch content from a URL and return it as text or markdown.
Search the web for information.
Create or overwrite a file with the given content.
Irreversible operations lack confirmation or dry-run patterns. bash, kubectl, helm, ssh_exec, delete_email, send_email, twitter_post, linkedin_post can cause permanent damage but have no confirmation step or preview capability. Agents will execute destructive commands without user approval.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint). Tools marked with Risk levels (READ_ONLY, WRITE, DESTRUCTIVE, IRREVERSIBLE) in metadata but not exposed as MCP tool annotations. Clients cannot distinguish safe from dangerous tools without parsing risk labels.
Overly broad toolkit violates single-responsibility principle. 24 tools span file I/O, web scraping, email, social media, and Kubernetes, no coherent domain. Tools like browse_page and scrape_page are vague (what selector? what action?). Composition is poor: no clear chains between tools.