Loading ToolBench
Modular AI-assisted network security audit platform — Community Edition. Exposes scan, probe, vulnerability lookup, and plugin listing tools via MCP.
Server has 6 tools with complete input schemas and descriptions. Naming follows verb_noun pattern (scan_host, list_plugins, lookup_cve, scan_cloud, get_cloud_findings, compliance_matrix). Descriptions are present and substantive (100-200 chars typical). However, output schemas are not documented in the visible code, LLMs cannot predict response structure. Parameters lack detailed constraints (e.g., 'plugins' accepts 'all' or comma-separated IDs, but no enum or pattern specified). Error handling is basic; no recovery guidance visible. Enterprise/Pro gating is implemented but error messages are generic license prompts rather than actionable recovery steps.
Generate a compliance matrix showing which security controls are met across scanned hosts and frameworks (CIS, NIST, PCI-DSS, etc.).
Retrieve paginated cloud security findings from a previous scan_cloud call. Requires Enterprise license.
List all available security audit plugins with their IDs, names, descriptions, and capabilities.
Look up CVE vulnerability details from the NVD (National Vulnerability Database) by CVE ID.
Scan cloud provider accounts (AWS, Azure, GCP) for security misconfigurations and compliance violations. Requires Enterprise license.
Scan a single host for open ports, services, vulnerabilities, and security issues. Runs all enabled plugins against the target.
Output schemas not documented. LLMs cannot predict response structure, field names, or types. Downstream tool chaining is blind.
Parameter constraints missing. 'plugins' param accepts 'all' or comma-separated IDs but no enum/pattern declared. 'framework' in compliance_matrix should be enum (cis|nist|pci-dss|hipaa|all) not free-form string.
Error handling lacks recovery guidance. License denial returns generic 'View pricing' link instead of 'Try scan_host (available in CE)' or 'Contact sales for Enterprise trial'.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 64 | 2026-07-28+ | v2 |
Pagination not fully specified. get_cloud_findings accepts offset/limit but no total_count or next_cursor documented. LLMs cannot determine if more results exist.
Tool composition risk: scan_cloud + get_cloud_findings require scan_id coupling. If scan_cloud fails silently or returns no scan_id, get_cloud_findings cannot proceed. No error guidance for missing/invalid scan_id.