Loading ToolBench

Reading the current corpus…

MCP-Inspector MCP server · F · ToolBench

← Browse

MCP-Inspector

github.com/Manjesh24/MCP-Inspector

Burp Suite extension for MCP security testing and inspection

<=2025-11-25STREAMABLE_HTTP6 tools

32/100

Definition Quality32

Protocol Readiness25

Supportability36

Spec posture

Inferred effective spec <=2025-11-25·current baseline 2026-07-28

Static source inference · medium confidence · detected: Logging

Deprecated protocol patterns detected

Summary

This is a Burp Suite extension (Java/Jython) masquerading as an MCP server. The source shows a Burp IBurpExtender implementation, not an MCP server. Tool definitions are inferred from docstrings in mcp_inspector.py (a Python file embedded in a Java extension), not from explicit MCP tool registration. No JSON Schema input definitions are visible. Descriptions exist but are minimal (10-50 chars). The 'call_tool' tool accepts arbitrary 'arguments' as an untyped object with no validation guidance. No output schemas documented. This is a security testing proxy, not a production MCP server.

Tools (6)

call_toolwrite38/100

Execute a specific MCP tool with provided arguments

get_promptread only43/100

Get a specific prompt template with arguments

list_promptsread only37/100

List all available prompts from the connected MCP server

list_resourcesread only37/100

List all available resources from the connected MCP server

list_toolsread only37/100

List all available MCP tools from the connected server

read_resourceread only45/100

Read the contents of a specific resource

Issues (5)

CRITICALtool ↗

No explicit MCP tool registration visible. Tools inferred from Python docstrings in a Burp extension context, not from MCP protocol definitions. Cannot verify actual schema compliance.

list_toolscall_toollist_resourcesread_resourcelist_promptsget_prompt

CRITICALconstrained-input ↗

Input schemas missing or not visible for 5 of 6 tools. 'call_tool' accepts 'arguments' as untyped object with no validation constraints, format guidance, or error recovery hints.

list_toolslist_resourceslist_promptscall_tool

HIGHtool-description ↗

Descriptions are minimal (10-50 chars) and lack context. 'List all available MCP tools from the connected server' does not explain when to call this vs other discovery tools, what structure is returned, or how to use results downstream.

list_toolslist_resourceslist_prompts

Recommendations

Migrate from Burp extension to a standalone MCP server using the official MCP SDK (Python or Node.js). Register tools explicitly via the MCP protocol, not as docstrings.
Add complete JSON Schema input definitions for all tools. For 'call_tool', define 'arguments' as a constrained object with required fields, type hints, and validation rules.
Expand tool descriptions to 50-200 chars. Include WHAT the tool does, WHEN to use it (vs similar tools), and WHAT structure it returns. Example: 'List all tools available on the connected MCP server. Call this first to discover available capabilities before invoking specific tools. Returns array of {name, description, inputSchema}.'
Document output schemas for all tools. Specify field names, types, and whether results are paginated. Include chaining IDs (e.g., tool_name in list_tools response so call_tool can reference it).
Add error handling with recovery guidance. For 'call_tool', return structured errors: {error_code, message, suggestion}. Example: 'Tool not found. Available tools: [list]. Did you mean: get_user?'

Spec posture evidence

Inferred effective spec: <=2025-11-25.

Relies on Logging (deprecated) - log to stderr or use OpenTelemetry

Score history

Overall score trend

First recorded score · v2 rubric

32/100

Scored	Grade	Overall	Spec posture	Rubric
2026-09-23	F	32	<=2025-11-25	v2