Loading ToolBench
MCP App server for Elastic Security — interactive blue-team UIs for alert triage, case management, detection rules, and threat hunting
Server provides 7 tools with basic descriptions but lacks critical schema documentation and parameter details. Tool names are action-oriented (triage-alerts, case-management) but descriptions are generic (10-50 chars, well below the 194-char baseline). No visible input/output schemas in provided source. The tracked-app-tool.ts wrapper shows analytics instrumentation but does not reveal actual parameter schemas or validation. Without seeing the individual tool implementations (case-management.ts, detection-rules.ts, etc.), schemas cannot be verified. This is a significant gap: per the rubric, tools without visible schemas score 0 on schema dimension. Descriptions are too brief to guide LLM tool selection effectively.
Analytics tool for tracking and reporting tool usage metrics
Attack discovery tool for identifying and analyzing attack patterns
Case management tool for creating and managing security cases
Detection rules tool for managing and querying security detection rules
Sample data tool for managing test data and scenarios
Threat hunting tool for investigating security threats and entities
Alert triage tool for analyzing and classifying security alerts
No input/output schemas visible in provided source code. All 7 tools score 0 on schema dimension. Cannot verify parameter types, descriptions, constraints, or return structures.
Tool descriptions are 10 - 50 characters, far below the 194-char baseline. Descriptions like 'Alert triage tool for analyzing and classifying security alerts' lack WHEN to use, prerequisites, and return value guidance. LLMs cannot reliably select tools with such minimal context.
No parameter descriptions visible. Cannot verify that each parameter has a description explaining what it controls, expected format, range, or allowed values.
Inferred effective spec: 2026-07-28+.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 38 | 2026-07-28+ | v2 |
No error handling guidance visible. Tools do not document what errors can occur, whether they are retryable, or what the LLM should do next. Per pattern:recovery-guide, errors must tell the agent what to do.
Tool composition unclear. 'case-management' and 'analytics' are WRITE tools; no confirmation/dry-run pattern visible. Destructive operations should support confirmation before execution per pattern:confirmation-request.