Loading ToolBench
Zero-config MCP server for developers — encode/decode, hash, UUID, JWT, DNS, IP info, URL tracing, npm lookup and more.
16 tools with complete input schemas and descriptions. Naming follows verb_noun convention (dt_encode_decode, dt_hash_string, etc.). Descriptions are adequate (100-250 chars typical) but lack LLM-optimized guidance on WHEN to use each tool vs alternatives. Parameters are typed with enums where appropriate (format, algorithm, type fields). Output schemas documented in descriptions but not formally in JSON Schema. No error handling guidance, tools return success/failure but don't guide recovery. All tools are READ_ONLY (good security posture). Missing: parameter constraints (min/max for numeric fields like count, max_redirects), dependency hints between tools, and explicit output field documentation.
Check MDN browser compatibility for a CSS property or JavaScript API feature. Args: - feature (string): CSS property or JS API to check (e.g. "CSS grid", "IntersectionObserver", "fetch API") Returns MDN search results with compatibility info links. Returns: { feature, results: [{ title, url, summary }] }
Convert a string between naming conventions. Args: - input (string): The string to convert - to ('camel' | 'snake' | 'kebab' | 'pascal' | 'constant' | 'title'): Target case Returns: { result: string, from_input: string, to: string } Examples: - "helloWorld" → snake: "hello_world", kebab: "hello-world", constant: "HELLO_WORLD"
Line-by-line diff of two text strings. Shows added (+), removed (-), and unchanged lines. Args: - original (string): The original/old text - modified (string): The new/modified text Returns: { diff: string, added: number, removed: number, unchanged: number }
Look up DNS records for a domain using Google's DNS-over-HTTPS API. Args: - domain (string): Domain name to look up (e.g. "github.com") - type ('A' | 'AAAA' | 'CNAME' | 'MX' | 'TXT' | 'NS' | 'SOA'): Record type (default: 'A') Returns: { domain, type, answers: [{ name, type, ttl, data }] }
Encode or decode a string using Base64, URL encoding, or HTML entities. Args: - input (string): The string to process - operation ('encode' | 'decode'): Direction of conversion - format ('base64' | 'url' | 'html'): Encoding format Returns: { result: string, format: string, operation: string } Examples: - "Encode 'hello world' as base64" → result: "aGVsbG8gd29ybGQ=" - "URL encode https://example.com/a b" → result: "https%3A%2F%2Fexample.com%2Fa%20b" - "HTML encode <script>alert(1)</script>" → result: "<script>alert(1)</script>"
No numeric parameter constraints (min/max). dt_generate_uuid accepts 'count' with no visible bounds; dt_http_trace 'max_redirects' unbounded. LLMs may pass absurd values (count=1000, max_redirects=999) causing timeouts or resource exhaustion.
Output schemas documented in description text only, not as formal JSON Schema. LLMs cannot parse unstructured descriptions reliably. Downstream tools cannot validate or chain on response fields.
No error handling guidance. Tools return success/failure but descriptions lack recovery hints (e.g., 'If DNS lookup fails, try dt_ip_info instead'). Agents cannot self-correct on failures.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 57 | 2025-06-18+ | v2 |
Generate one or more random UUID v4 or NanoID values. Args: - count (number): How many to generate (1–20, default: 1) - type ('uuid' | 'nanoid'): Which format to generate (default: 'uuid') Returns: { uuids: string[], count: number, type: string }
Fetch public metadata for any GitHub repository (60 requests/hour unauthenticated). Args: - repo (string): GitHub repo in "owner/repo" format (e.g. "facebook/react") Returns: { name, full_name, description, stars, forks, open_issues, language, license, topics, created_at, updated_at, homepage, default_branch }
Generate a .gitignore file for any tech stack using the gitignore.io API. Args: - stack (string[]): List of technologies (e.g. ["node", "react", "macos", "vscode"]) Common options: node, python, java, go, rust, react, vue, angular, macos, windows, linux, vscode, jetbrains, terraform, docker Returns: { gitignore: string, stack: string[] }
Hash a string using MD5, SHA1, or SHA256. Args: - input (string): The string to hash - algorithm ('md5' | 'sha1' | 'sha256'): Hash algorithm (default: sha256) Returns: { hash: string, algorithm: string, input_length: number }
Fetch the HTTP response headers of any public URL without downloading the body. Useful for checking CORS, caching, security headers, content-type, and more. Args: - url (string): Public URL to inspect Returns: { url, status, status_text, headers: Record<string, string> }
Follow the full redirect chain of a URL and show every hop until final destination. Useful for short URLs, tracking redirects, or debugging link behaviour. Args: - url (string): The URL to trace (e.g. "https://bit.ly/xyz") - max_redirects (number): Max hops to follow (default: 10) Returns: { hops: [{ step, url, status, status_text }], final_url, total_hops }
Get geolocation, ISP, ASN, and timezone info for any IPv4 or IPv6 address. Args: - ip (string): IPv4 or IPv6 address (e.g. "8.8.8.8"). Leave empty or pass "me" to look up your own IP. Returns: { ip, country, region, city, isp, org, timezone, lat, lon, as }
Returns the public IP address of the machine running this MCP server. Note: If running as a remote server, this returns the server's IP, not yours. Returns: { ip: string }
Fetch metadata for any npm package: version, description, weekly downloads, license, dependencies. Args: - package_name (string): npm package name (e.g. "react", "@types/node") Returns: { name, version, description, license, homepage, weekly_downloads, dependencies, dev_dependencies, dist_tags, published_at }
Decode a JWT token and display its header and payload. Does NOT verify signature. Args: - token (string): The JWT token string (with or without 'Bearer ' prefix) Returns: { header: object, payload: object, signature: string, expires_at?: string, expired?: boolean }
Check the SSL/TLS certificate of any domain: expiry date, issuer, SANs, and validity. Args: - domain (string): Domain name to check (e.g. "github.com") - port (number): HTTPS port (default: 443) Returns: { domain, valid, subject, issuer, valid_from, valid_to, days_remaining, san, protocol }
Descriptions lack WHEN-to-use guidance. dt_http_trace vs dt_http_headers both inspect URLs; dt_ip_info vs dt_my_ip both return IP data. LLMs cannot distinguish when to call which tool.
dt_caniuse description vague ('Check MDN browser compatibility'). Does not clarify: Does it search MDN or return cached data? What format are results? How current is the data? Agents cannot plan reliably.