Loading ToolBench
Model Context Protocol server for OAuthLint. Lets AI coding tools scan their own generated OAuth/OIDC/JWT/session/CORS code for the anti-patterns OAuthLint catches, in-loop.
OAuthLint MCP has 4 well-named, security-focused tools with clear descriptions (avg 180 chars, within baseline 194). All tools have input schemas with typed parameters and descriptions. However, output schemas are not documented in the visible code, and error handling lacks recovery guidance. Tool names follow verb_noun pattern (scan_*, list_*, explain_*) and are unambiguous. Parameters are well-described with context (e.g., 'rule identifier (id, slug, or oauthlint-rule-id)'). No secrets exposed as parameters. Missing: documented return types, pagination guidance for list_rules, and actionable error messages.
Return the full details of a rule: severity, CWE, OWASP, why it matters and how to fix it, plus vulnerable and safe code examples. Accepts a rule id, slug or oauthlint-rule-id.
List the rules OAuthLint ships, optionally filtered by language and minimum severity. Returns id, title, severity, languages and CWE for each rule.
Scan an in-memory code snippet for OAuth/OIDC/JWT/session/CORS anti-patterns. Write the code an AI tool just generated here to check it before showing it to the user. The snippet is scanned in a private temp file and never written to the user's project. Self-contained: the scan engine is downloaded and cached on first use.
Scan a file or directory on disk for OAuth/OIDC/JWT/session/CORS anti-patterns. Self-contained: the scan engine is downloaded and cached on first use.
Output schemas not documented. LLMs cannot plan downstream operations or extract fields without knowing return structure (e.g., does scan_code return rule_id, severity, line_number, fix_suggestion?).
list_rules lacks pagination parameters (limit, offset, page). Without pagination, large rule sets could exhaust context or timeout. Baseline pattern requires page/offset + limit + total count.
Error handling does not guide recovery. No indication of retryable vs. fatal errors, or what the LLM should do if a scan fails or a rule is not found.
scan_path accepts a file or directory but does not document expected behavior for directories (recursive? depth limit? file count cap?). Ambiguity invites misuse.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 66 | 2025-06-18+ | v2 |
explain_rule accepts 'rule id, slug, or oauthlint-rule-id' but does not clarify which format is preferred or how to discover valid identifiers. Agents may guess wrong format.