Loading ToolBench
Server defines 6 tools with explicit schemas and descriptions. All tools have ToolAnnotations (readOnlyHint/destructiveHint/idempotentHint), which is current-spec compliant. However, descriptions vary in quality: ping/help/load_tools are under 100 chars (too terse); create_ipaconf and login lack output schema documentation; healthcheck has good detail but parameter descriptions are sparse. No error handling guidance visible. Parameters like 'ipa_confdir' are marked 'kept for API compatibility' but still exposed, adding noise. Dynamic tool loading (load_tools) is mentioned but actual schema for dynamically-loaded IPA commands is not visible in source, making composition assessment incomplete.
Configure the FreeIPA server connection. Validates the server FQDN, downloads and caches the CA certificate, verifies connectivity, and automatically loads all available IPA commands as MCP tools.
Execute IPA healthcheck on a remote server via SSH (Kerberos auth). Requires a valid Kerberos ticket. A GUI dialog will prompt for the sudo password unless passwordless sudo is configured on the server.
Get FreeIPA help. Set subject to 'topics' to list topics, 'commands' to list all commands, or a specific topic/command name for full markdown documentation. Examples: subject='topics', subject='user', subject='user-add'.
Reload all available FreeIPA commands as MCP tools from the server schema. Automatically called by create_ipaconf. NOTE: create_ipaconf must be run first to configure the server.
Authenticate to a Kerberos realm to obtain a TGT. Opens a secure GTK4 dialog to obtain credentials interactively. Password is never passed as a parameter for security reasons. Requires a graphical display (DISPLAY or WAYLAND_DISPLAY). The realm is auto-detected from saved server config if not provided.
Output schemas not documented for any tool. LLMs cannot plan downstream calls or extract required fields (e.g., what does ping return? what fields does create_ipaconf return?). Violates pattern:tool requirement.
Redundant 'ipa_confdir' parameter marked 'kept for API compatibility' appears in 5 of 6 tools (ping, help, login, healthcheck, load_tools). This adds noise and confuses LLMs about whether the parameter is actually needed. Remove or document why it must be present.
Dynamic tool loading (load_tools) references 'all available IPA commands as MCP tools' but actual schemas for these dynamically-loaded tools are not visible in source. Cannot verify naming, descriptions, or parameter quality for ~100+ IPA command tools. Composition and chaining assessment incomplete.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 66 | 2026-07-28+ | v2 |
Ping the FreeIPA server to check connectivity and retrieve version information.
No error handling guidance in any tool description. E.g., login says 'Opens a secure GTK4 dialog' but does not explain what happens if DISPLAY is not set, or how to recover. healthcheck mentions 'GUI dialog will prompt for sudo password' but no guidance on failure modes. Violates pattern:recovery-guide.
ping description (58 chars) is below baseline (p10=34, p90=392). 'Ping the FreeIPA server to check connectivity and retrieve version information.' lacks context on when to call it vs other tools, what it returns, or prerequisites. Violates pattern:tool-description.