Loading ToolBench
MCP server for cybersecurity risk assessment and IT budget calculations with knowledge base retrieval
11 tools with basic schemas and descriptions, but significant gaps in parameter documentation and error handling. Most tools are simple calculators with minimal descriptions (10-80 chars, well below the 194-char baseline). The 'retrieve' tool lacks pagination parameters despite returning lists. No tool annotations (readOnlyHint, destructiveHint, idempotentHint) despite all being read-only. Parameter descriptions are sparse, many lack context on valid ranges, formats, or constraints. No error recovery guidance. Output schemas are not documented.
Annualized Loss Expectancy = SLE × Annual Rate of Occurrence.
Annual Rate of Occurrence (pass-through; use as input to calc_ale).
Estimate IT budget as ≈1.47% of annual revenue.
Normalized cybersecurity risk score (0–100). All inputs should be in [0, 1].
Payback period in years = Investment Cost ÷ Annual Savings.
Basic risk score = Threat × Vulnerability × Impact.
Risk reduction % = (Risk_before − Risk_after) / Risk_before × 100.
Descriptions are too short (10 - 80 chars vs. 194-char baseline). Most lack context on when to use the tool, what it returns, or dependencies. E.g., 'Estimate IT budget as ≈1.47% of annual revenue' does not explain when to call it or what the output represents.
Parameter descriptions lack constraints and context. E.g., 'exposure_factor' has no range hint (0 - 1 is mentioned in calc_it_risk_score but not in calc_sle). 'incidents_per_year' lacks guidance on valid ranges. LLMs cannot infer constraints from names alone.
No tool annotations despite all tools being read-only. Missing readOnlyHint in tool definitions. This prevents agents from understanding which tools are safe to call without side effects.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 54 | 2026-07-28+ | v2 |
Return on Security Investment = ((Exposure × Loss Reduction) − Cost) / Cost × 100.
Safeguard value = ALE_before − ALE_after.
Single Loss Expectancy = Asset Value × Exposure Factor.
Retrieve relevant cybersecurity knowledge from the knowledge base
'retrieve' tool lacks pagination parameters (limit, offset, page) despite returning lists. No documented output schema. Without pagination, large knowledge bases could exhaust context windows.
No error handling guidance. Tools do not document what happens on invalid input (e.g., negative revenue, exposure_factor > 1). No recovery hints for LLMs.