Loading ToolBench
Analyze HTTP response headers -- security score, HSTS/CSP check, server detection, caching config. Score 0-100.
Single tool 'network_analyze_headers' has a well-structured description (280+ chars) with clear use cases and anti-patterns (what NOT to use it for). Input schema is present with proper type and description. However, the tool description embeds example output JSON inline rather than documenting the output schema formally, making it harder for LLMs to parse expected fields. The description is strong but output structure is implicit rather than explicit. No tool annotations (readOnlyHint, destructiveHint, idempotentHint) present despite the tool being READ_ONLY.
Use this when you need to analyze HTTP response headers of a URL for security and configuration. Returns a full header audit in JSON. Returns: 1. allHeaders (raw key-value map) 2. securityScore (0-100) 3. securityHeaders (HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy, Permissions-Policy -- present/missing) 4. server software detected 5. caching config (Cache-Control, ETag, Expires) 6. recommendations array. Example output: {"url":"https://example.com","securityScore":85,"securityHeaders":{"hsts":true,"csp":true,"xFrameOptions":true,"xContentType":true,"referrerPolicy":false},"server":"nginx","caching":{"cacheControl":"max-age=3600","etag":true},"recommendations":["Add Referrer-Policy header"]} Use this FOR security audits, DevOps monitoring, compliance checks, and verifying proper header configuration after deployment. Do NOT use for SSL certificate check -- use security_check_ssl instead. Do NOT use for web scraping -- use web_scrape_to_markdown instead. Do NOT use for GDPR compliance -- use compliance_scan_gdpr instead.
Output schema not formally documented. Example JSON embedded in description instead of explicit return type schema. LLMs cannot reliably parse expected fields (allHeaders, securityScore, securityHeaders, server, caching, recommendations).
Tool marked READ_ONLY in metadata but no tool annotation (readOnlyHint) present in schema. Agents cannot determine idempotency or safety from the tool definition alone.
Input parameter 'url' description is minimal ('Full URL to analyze (e.g. https://example.com)'). No format constraint, validation rules, or error guidance if URL is invalid or unreachable.
No error handling guidance. Tool description does not explain what happens if URL is unreachable, times out, or returns non-HTTP responses. LLMs cannot plan recovery.
Inferred effective spec: 2025-06-18+.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 62 | 2025-06-18+ | v2 |
Tool name 'network_analyze_headers' is acceptable but generic. 'analyze_http_headers' or 'audit_http_headers' would be more specific and align with the security audit use case.