Loading ToolBench
MCP server for Zeek network analysis framework - query and analyze Zeek logs via AI
Only 1 tool visible in source (zeek_detect_anomalies). The server registers 20+ tools via imports (connections, dns, http, ssl, files, notices, ssh, investigation, software, beaconing, suricata, sensor, dhcp, pcap, thehive, misp, ja3, baseline) but their definitions are not provided in the code sample. Cannot evaluate 95% of the tool suite. The single visible tool has a reasonable description (97 chars, within 10-1024 range) and a typed input schema with enum constraint on minSeverity. However, without access to the actual tool implementations, per-tool scoring is severely limited. The server strips $schema from tool definitions (line in index.ts), which is a workaround for Anthropic compatibility but suggests schema issues downstream.
Run statistical anomaly detection across connection logs. Detects port scanning, data exfiltration (statistical outliers in bytes sent), and high-volume connections to unusual ports without identified services.
19 of 20 tools not visible in source code. Cannot verify naming, descriptions, parameter types, or output schemas for the vast majority of the tool suite.
zeek_detect_anomalies: description lacks WHEN to use it and what it returns. Should state 'Returns a list of detected anomalies with severity levels' and clarify prerequisites (e.g., 'Requires Zeek connection logs to be available').
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 57 | 2025-06-18+ | v2 |
zeek_detect_anomalies: input schema lacks descriptions for timeFrom and timeTo parameters. LLMs cannot infer that these are ISO 8601 timestamps without explicit parameter documentation.
No output schema documented for zeek_detect_anomalies. LLMs cannot plan downstream tool calls or extract anomaly data without knowing the response structure (fields, types, pagination).
Server strips $schema from tool definitions in transport layer (index.ts line ~40). This is a workaround for Anthropic compatibility but indicates upstream schema generation issues. Should fix schema generation at source, not strip at transport.