Loading ToolBench
MCP server exposing local PokePages copilot guides as resources and prompts
Schemas are present but use informal string descriptions instead of proper JSON Schema with types. Tool descriptions are adequate (100-200 chars) but lack actionable guidance on when to use each tool vs. alternatives. Parameters lack type definitions, enums, and constraints. No documented output schemas. Error handling and recovery guidance absent. Naming is generally clear (verb_noun pattern) but some tools combine multiple concerns (e.g., 'ingest-project-context' both converts AND deletes). No tool annotations (readOnlyHint, destructiveHint, idempotentHint). Security concerns: tools accept projectRoot paths without validation, risking path traversal. No audit logging or permission gates documented.
Scan a project for styling usage and (optionally) apply best-effort Uniwind migration steps (dry-run by default).
Fetch a public documentation URL and optionally search it for a query
Generate .github/copilot-instructions.md from local copilot guides and project context in /project (writes file by default).
Generate project/TODO.md from project/info.md + project/style.md (writes file by default).
Convert project/info.txt + project/style.txt into markdown in /project and optionally delete the .txt files.
List known docs sources by id (used by search-docs)
Schemas use informal string descriptions instead of proper JSON Schema. Parameters lack type definitions (string, number, boolean, array), enums, min/max constraints, and format declarations. Example: 'projectRoot' described as 'string (optional...)' rather than {type: 'string', description: '...', pattern: '^/'}. This prevents LLM validation and forces agents to guess valid formats.
No output schemas documented. Tools like 'list-guides', 'search-docs', 'smart-help' return complex objects but LLMs cannot see the structure. Missing: field names, types, whether results are paginated, what IDs are returned for chaining. Agents cannot plan downstream calls or extract data reliably.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 45 | 2026-07-28+ | v2 |
Return the available copilot guides as resource links
Generate a checklist/quiz from guides + project context. Ensures project/info aligns with required build decisions before instructions are generated.
Return the full content of a copilot guide by id
Search known docs sources by id without providing URLs
Auto-select relevant PokePages guides and query live docs sources
Update app name across package.json, app.json, public/manifest.webmanifest, and bundle identifiers based on display name.
Generate or revise README.md based on project info and style context.
Path traversal vulnerability: 'projectRoot' and 'outputPath' parameters accept arbitrary strings without validation. An agent could pass '../../../etc/passwd' or absolute paths outside the intended project. No documented constraints (e.g., must be relative to MCP_PROJECT_ROOT, must not contain '..').
No tool annotations (readOnlyHint, destructiveHint, idempotentHint). Tools like 'ingest-project-context', 'generate-project-instructions', 'convert-styling', 'update-app-naming', 'update-readme' modify files but LLMs cannot see they are destructive. Agents may retry without understanding side effects.
No error handling or recovery guidance. Tools do not document what errors can occur (file not found, permission denied, invalid input) or how agents should respond. Example: if 'read-guide' fails because guide ID is invalid, should the agent call 'list-guides' first? No guidance provided.