Loading ToolBench
Scaffold, audit, and generate Launch Proof Reports for Starter Series projects — slash commands, skill, MCP server, and CLI.
Strong tool definitions with clear naming (verb_noun pattern), comprehensive parameter schemas using Zod, and structured output shapes. All 8 tools have descriptions and input schemas. However, parameter descriptions lack depth (many are terse), output schemas are defined but not always returned in structuredContent, and error handling is minimal. Audit tools have good descriptions but lack guidance on when to call them vs. alternatives. No tool annotations (readOnlyHint/destructiveHint) despite clear risk profiles.
Lift a starter's CI/CD layer into an EXISTING repo without re-scaffolding. Dry-run by default — returns a plan, writes nothing. Refuses to apply onto a dirty git tree unless force. Existing-but-different files are skipped unless force.
Check whether the local repo's version has been published to its destination registries (npm, PyPI, Open VSX, VS Marketplace, AMO, GitHub Releases). Makes outbound HTTPS requests to public registry APIs; never mutates. Reports per-destination drift (in-sync / needs-publish / local-stale / not-found).
Check local instruction discovery, source topology, exact duplicates/overlap, owner decisions and previous-run delta. Read-only by default; update_state explicitly saves the baseline, never source instructions. No semantic or safety enforcement.
Audit a local repo for release-readiness against the Starter Series quality bar. Detects matched starter, CHANGELOG drift vs merged PRs, version-bump status, and publish-workflow presence. Read-only; never mutates the repo.
Audit a local repo for baseline security CI hygiene against the Starter Series quality bar: gitleaks, CodeQL, dependency audit, license check, --ignore-scripts, Dependabot, secret-scanning hints, claude-code-security-review Action, and claude-security-guidance.md. Read-only.
Missing tool annotations (readOnlyHint, destructiveHint, idempotentHint). All audit_* tools are READ_ONLY and should declare readOnlyHint=true; create_project, generate_launch_proof_report, and add_component are WRITE operations and should declare destructiveHint=true or idempotentHint=true.
Parameter descriptions are terse or missing context. E.g., 'path' in audit_* tools says 'Path to the repo to audit (default: the MCP server's cwd)' but does not explain when to use absolute vs. relative paths or what happens if the path is invalid. 'component' in add_component lists valid values but lacks guidance on which to choose.
Inferred effective spec: 2025-06-18+.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 64 | 2025-06-18+ | v2 |
Scaffold a new project from a Starter Series template
Run audit_release, audit_cd, audit_security, and audit_instructions together, then return a client-ready Markdown Launch Proof Report. Read-only by default; set write=true to write launch-proof-report.md or output_path inside the target repo.
List all available Starter Series project templates
Error handling is minimal. create_project returns 'Unknown template' or 'Failed to scaffold' but does not guide the LLM on recovery (e.g., 'Call list_templates to see valid options'). Audit tools do not document what errors are possible or how to interpret them.
Output schemas defined in mcp-schemas.js but not consistently returned in structuredContent. create_project and list_templates return structuredContent; audit_* tools do not, forcing LLMs to parse text responses.
Audit tools lack discovery guidance. No description explains when to call audit_release vs. audit_cd vs. audit_security, or that generate_launch_proof_report combines all three. LLMs may call them redundantly.