Loading ToolBench
NextMCP is a framework/toolkit, not a production MCP server. The 24 tools shown are example implementations across 4 different OAuth servers (combined_auth, complete_oauth, github_oauth, google_oauth). Tool definitions are present with descriptions and basic schemas, but quality is inconsistent. Many descriptions are generic or incomplete (e.g., 'Get public information' lacks context). Parameter descriptions exist but are often minimal. No evidence of error handling guidance, output schema documentation, or security hardening. The framework itself lacks transport specification (UNKNOWN). Example tools show naming patterns (get_*, list_*, create_*) but lack depth in parameter constraints and composition guidance.
Clean up expired sessions. Removes all sessions with expired access tokens from storage.
Create personalized content for the authenticated user. Generates content tailored to the authenticated user based on their profile and the requested topic.
Create a new post. Requires: write:posts permission
Create a new GitHub repository. Requires OAuth authentication with 'repo' scope.
Perform dangerous admin operation. Requires: admin role + admin:all permissi
Edit content. Requires: editor or admin role
Transport mechanism unknown. Framework does not specify HTTP, SSE, STDIO, or WebSocket transport in documentation or code samples.
Minimal tool descriptions. Many tools have descriptions under 50 characters (e.g., 'Get public information', 'Get server information'). Descriptions lack context on WHEN to use the tool, WHAT it returns, and prerequisites.
No output schema documentation. Tools return data but no schema is specified for responses. LLMs cannot plan downstream calls or extract required fields.
No error handling guidance. Tools lack recovery instructions. E.g., 'User not found. Try search_users() first.' or categorization of errors as retryable vs fatal.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 52 | 2026-07-28+ | v2 |
Get list of active user sessions. Returns information about all currently active sessions stored on the server.
Get server authentication requirements. This tool returns information about what authentication is required, which OAuth providers are supported, and what permissions are needed.
Get GitHub OAuth authorization URL. This tool generates the URL users should visit to authorize the app. No authentication required to call this tool.
Get Google OAuth authorization URL. This tool generates the URL users should visit to authorize the app. Requests offline access for refresh tokens.
Get GitHub OAuth authorization URL. No authentication required to get the URL.
Get the authenticated user's GitHub profile. Requires OAuth authentication with 'read:user' scope.
Get the authenticated user's Google profile. Requires OAuth authentication with profile and email scopes.
Get authenticated user's profile. Requires: Any valid authentication
Get public information. No authentication required.
Get server information. Returns basic information about this MCP server.
Get authenticated user's profile. Returns information about the currently authenticated user from their OAuth provider profile.
List files in user's Google Drive. Requires OAuth authentication with Drive read scope.
List messages in user's Gmail inbox. Requires OAuth authentication with Gmail read scope.
List the authenticated user's repositories. Requires OAuth authentication with 'repo' scope.
List user's Google Drive files. Lists files from the authenticated user's Google Drive using their OAuth access token.
Manage user accounts. Requires: admin role
Refresh an expired access token. Uses a refresh token to obtain a new access token. Google OAuth provides refresh tokens with offline access.
View content. Requires: viewer, editor, or admin role
Missing tool annotations. No readOnlyHint, destructiveHint, or idempotentHint metadata. Agents cannot distinguish safe reads from destructive writes (e.g., dangerous_operation, manage_users, edit_content).