Loading ToolBench
MCP server for the Overlord C2 framework — management, monitoring, debugging, and plugin development
Server has 17 tools with consistent naming (verb_noun pattern) and tool annotations present. However, most tools lack input parameter descriptions, only 6 of 17 tools have documented parameters. Output schemas are not documented anywhere in the codebase. Error handling is minimal (generic try-catch blocks returning plain strings). Descriptions are present but often generic (e.g., 'View X configuration section'). No pagination guidance for list tools despite accepting page/page_size. Security masking is implemented but not reflected in tool descriptions.
Delete a saved build profile. Args: name: Profile name to delete.
View audit log entries with filtering. Args: page: Page number (default: 1). page_size: Results per page (default: 50, max: 100). client_id: Filter by target client UUID. action: Filter by action type (e.g., 'login', 'command', 'settings_change'). start_date: Epoch timestamp for start of range. end_date: Epoch timestamp for end of range. success_only: Only show successful actions.
Get summary statistics from the audit log.
Get full details of an auto-deployment. Args: deploy_id: Auto-deploy ID.
Get full details of an auto-script including script content. Args: script_id: Auto-script ID.
No output schemas documented for any tool. LLMs cannot plan downstream calls or extract required fields without knowing response structure.
List tools (list_banned_ips, list_auto_scripts, list_auto_deploys, list_build_profiles) lack pagination guidance in descriptions despite accepting page/page_size parameters. No mention of result limits or total count in response.
Generic error handling: all tools catch exceptions and return plain strings like 'Error fetching config: {e}'. No recovery guidance, no error classification (retryable vs fatal), no actionable next steps for LLM.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 52 | <=2025-11-25 | v2 |
Get detailed build status and files. Args: build_id: Build ID.
View Build Rate Limits configuration section with secrets masked.
View the full Overlord server configuration with secrets masked. Calls GET /api/settings — requires admin authentication. All sensitive values (JWT secrets, tokens, passwords) are shown as '***'.
View Enrollment configuration section with secrets masked.
View Registration configuration section with secrets masked.
View Security configuration section with secrets masked.
List all auto-deployments with triggers and file info.
List all auto-scripts with triggers and enabled state.
List all banned IP addresses with reasons and timestamps.
List your saved build configuration profiles.
List builds (your own, or all if admin). Args: all_builds: If True, show all builds (admin only). Default: False.
Save a build configuration profile. Args: name: Profile name (max 64 chars). config: Build configuration object.
Destructive tools (delete_build_profile) lack confirmation/dry-run pattern. No warning in description that deletion is irreversible. Agents may delete profiles without user consent.
Config tools (get_config, get_security_config, etc.) return masked secrets as '***' but descriptions do not explain this masking behavior. LLM may expect actual values and fail downstream.