Loading ToolBench
MCP server providing tools for querying UniFi security dashboard data including firewall policies, threat events, CVE alerts, and threat feeds
Server has 17 tools with consistent naming (verb_noun pattern) and basic descriptions. All tools are READ_ONLY except run_port_scan (WRITE). Schemas are present but minimal, most parameters lack detailed descriptions beyond a single phrase. Output schemas are not documented. Error handling is absent; tools call _get() which will raise on HTTP errors without recovery guidance. No tool annotations (readOnlyHint, destructiveHint). Descriptions average ~60 chars, below the 194-char baseline for A+ tools. Parameters like 'limit', 'days', 'severity' lack range constraints in descriptions.
Run and return the full scored security assessment.
Return assessment score history for up to 365 days.
List unacknowledged HIGH/CRITICAL CVE alerts for connected UniFi devices.
List UniFi device inventory with firmware versions and matched CVE counts.
Show the latest policy drift event and change set.
Query recent firewall events filtered by source IP, rule name, or limit.
No output schemas documented. LLMs cannot infer what fields to expect from responses, forcing them to guess at downstream tool chaining and field extraction.
Parameter descriptions lack constraints. 'limit' and 'days' parameters have no min/max ranges stated in descriptions (e.g., 'days' should say '1 - 365'). LLMs may pass invalid values.
No error handling or recovery guidance. _get() raises on HTTP errors without actionable messages. LLMs receive raw exceptions instead of 'User not found. Try search_users()' style guidance.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 64 | 2026-07-28+ | v2 |
List all zone-based firewall policies with hit counts.
Get IDS/IPS enabled state and configuration gaps.
List detected policy conflicts.
Retrieve results of a previous scan by scan_id.
Query the blocked IP/CIDR list from active threat feeds.
List threat feed rule changes waiting for manual approval.
Get threat feed status, apply mode, blocked IP count, and pending approvals.
List recent IDS/IPS threat events.
Return threat-feed hit totals and top blocked remote sources.
List VLANs and networks with zone assignments.
Trigger a port scan against an RFC1918 target and return a scan_id.
run_port_scan is a WRITE tool but lacks confirmation/dry-run pattern. Agents could trigger unintended network scans without approval. No idempotent or destructive annotations present.
Descriptions are terse (avg ~60 chars vs 194-char baseline). Missing context on WHEN to use each tool and dependencies. E.g., 'get_scan_results' should note 'Requires scan_id from run_port_scan'.