Loading ToolBench
OAuth2-secured MCP server with On-Behalf-Of (OBO) token exchange. Exposes tools and prompts for task management, project tracking, balance inquiries, identity inspection, and administrative operations — all backed by a downstream API via Microsoft Entra ID.
Server demonstrates solid fundamentals with explicit tool registration, structured error handling via McpToolResult, and clear parameter descriptions. All 8 tools have descriptions (avg 156 chars) and input schemas with types. However, several tools lack output schema documentation, parameter constraints are minimal (no enums for status/priority fields), and error messages lack recovery guidance. Tool composition is sound (single responsibility), but descriptions could be more LLM-optimized per pattern:tool-description baseline (10-1024 chars, avg 194 chars). Security annotations present (ReadOnly, Destructive flags) but not surfaced in schema. No evidence of pagination support despite list operations.
Creates a new task with a title, description, and optional priority. Returns the created task with its generated ID.
Permanently deletes a task. This action cannot be undone.
Retrieves financial balance for a project including allocated, spent, remaining, committed, and available amounts.
Retrieves detailed project information including manager, start date, and team members.
Retrieves all available projects with their ID, name, status, and budget.
Retrieves all tasks for the authenticated user. Returns task ID, title, description, priority (Low/Medium/High), status (Pending/In Progress/Completed), and timestamps.
Output schemas not documented. McpToolResult wrapper is defined but tool response structures (what fields are in 'data' for each tool) are not visible in source. LLMs cannot plan downstream calls without knowing return field names.
Enum constraints missing for status/priority fields. 'priority' in create_task and 'status' in update_task_status accept free-form strings with only description guidance ('Low/Medium/High', 'Pending/In Progress/Completed'). Should use JSON Schema enum to prevent hallucinated values.
Error responses lack recovery guidance. McpToolError includes statusCode and message but no actionable next steps. Per pattern:recovery-guide, errors should suggest 'Try search_users() with a partial name' or similar recovery paths.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 62 | <=2025-11-25 | v2 |
Transfers budget from one project to another. This action modifies financial data and cannot be undone. Only call this tool after the user has explicitly confirmed the transfer.
Updates the status of an existing task. Valid statuses: 'Pending', 'In Progress', 'Completed'.
No pagination support visible. List operations (get_projects, get_tasks) have no limit/offset parameters or pagination metadata in response. Per pattern:paginated-result, list tools should accept page/offset and return total count to prevent context window exhaustion.
Destructive operations lack confirmation step. transfer_budget and delete_task are marked Destructive=true but no dry-run or confirmation_required pattern visible. Per pattern:confirmation-request, irreversible ops should support user confirmation before execution.