Loading ToolBench
High-performance zero-dependency static analysis tool enforcing NASA Power of Ten rules across 20 programming languages, plus AI agent skill, MCP server config, prompt template, and LLM model security auditing.
SPC provides 10 tools with consistent naming (verb_noun pattern: scan, format, load, get, create, build, is) and reasonable descriptions (avg ~120 chars). All tools have input schemas with type definitions. However, parameter descriptions are sparse or generic ('Array of scan result objects' lacks detail on structure), output schemas are undocumented, and error handling guidance is absent. No tool annotations (readOnlyHint, destructiveHint). Tools are READ_ONLY but this is not formally declared. Schemas present but lack depth, e.g., 'options' params are typed as 'object' with minimal property documentation.
Combines default ignore patterns with extra exclude patterns and environment variables to create comprehensive file exclusion list.
Creates a SHA-256 hash for a specified file using stream or buffer fallback, returning hex-encoded digest.
Formats scan results into table, JSON, Markdown, or SARIF v2.1.0 output formats for reporting and GitHub Code Scanning integration.
Returns machine-readable agent tool specification schema for LLM/MCP tool invocation, including all available operations and their parameters.
Returns structured summary of tool capabilities, supported languages (20 total), AI domains, rule count, output formats, and rule categories.
Checks if a relative or absolute file path matches any ignore pattern using regex matching.
Loads and parses a checksums manifest file in SHA-256 format, returning map of relative filename to expected hash.
Output schemas undocumented. Tools like scanCodebase and formatResults return complex structures (arrays of findings, formatted reports) but no schema is provided for LLM to understand result structure, forcing agents to guess field names and types.
Parameter descriptions lack actionable detail. 'options' params are typed as 'object' with minimal property documentation (e.g., scanCodebase.options: 'Scan options including category, aiOnly, skipAi, configPath', no types, ranges, or enum values for nested properties).
No error handling guidance. Tools provide no recovery hints (e.g., 'If config file not found, use loadConfig with default path' or 'Invalid regex pattern, use buildIgnorePatterns to validate'). Agents cannot self-correct on failure.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 52 | 2026-07-28+ | v2 |
Loads and validates .spc.config.json configuration file from a directory or custom path, merging with default configuration.
Loads custom plugin modules for extending SPC analysis rules and patterns.
Scans a codebase directory for security, reliability, and quality issues across 20 programming languages and AI agent configurations. Returns structured array of findings with file paths, line numbers, issue types, and severity levels.
No tool annotations. All tools are READ_ONLY (no state mutation) but lack formal readOnlyHint annotations. This forces LLMs to infer safety from descriptions alone, increasing misuse risk.
Pagination and result limits not documented. scanCodebase and formatResults may return large result sets but no limit, offset, or pagination parameters are visible. Risk of context window exhaustion.