Loading ToolBench
Static analysis scanner for MCP server code and multi-tenant SaaS applications. 57 deterministic rules covering tenant isolation, tool visibility, cache key scoping, RLS, IDOR, and credential vault isolation. MCP server for AI agent integration.
Four tools with explicit Zod schemas and descriptions. Tool naming follows verb_noun pattern (scan_, list_, explain_, suppress_). Descriptions are substantive (100-200 chars typical). Input schemas are well-typed with enums and optional fields. Security boundary (PathBoundary) is documented. However, output schema for scan_tenant_isolation is partially truncated in source; error handling guidance is minimal; no pagination support documented for list_tenant_isolation_rules; suppress tool has complex interdependent parameters (fingerprint vs permanentException) that could confuse LLMs despite documentation.
Get detailed explanation of a specific tenant isolation rule including context, remediation hints, and compliance mappings.
List all available tenant isolation rules with metadata including rule ID, title, category, severity, and description.
Run tenant isolation scan on a project. Returns findings with rule IDs, severity, file locations, and missing guards. The path must be within the allowed project root configured at server startup.
Add a suppression for a specific tenant isolation finding. Requires documented approver, reason, compensating controls, and expiry date (or permanent exception justification). Only exposed when server started with --allow-write-tools.
suppress_tenant_isolation_finding has complex interdependent parameters (fingerprint required unless permanentException=true; expires required unless permanentException=true). LLMs struggle with conditional parameter logic. Should split into two tools or provide clearer mutual-exclusivity guidance.
list_tenant_isolation_rules accepts only 'category' filter but no pagination (limit, offset, cursor). If rule count grows beyond ~50, response will bloat context. Should add limit/offset parameters and document max result size.
scan_tenant_isolation output schema is truncated in source code (ends mid-object). Cannot verify completeness of findings array, error fields, or whether all chaining IDs (file, ruleId, fingerprint) are present for downstream tool calls.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 62 | 2025-06-18+ | v2 |
No error recovery guidance in tool descriptions. E.g., scan_tenant_isolation may fail if path escapes boundary (TARGET_OUTSIDE_ALLOWED_ROOT), but description does not explain what to do. Should include: 'If path is outside allowed root, use the root path or check configuration.'
suppress_tenant_isolation_finding is gated behind --allow-write-tools flag, but tool description does not warn that it may not be available. LLMs may attempt to call it and fail silently. Should document: 'Only available if server started with --allow-write-tools.'