Loading ToolBench
MCP Server that exposes Credence security scanning tools to AI agents. Implements JSON-RPC 2.0 over stdio for MCP communication, enabling autonomous security scanning by AI agents and integration with AI-powered security workflows.
Credence MCP exposes 13 security scanning tools with complete input schemas and descriptions. However, critical gaps undermine production readiness: (1) All tools lack output schema documentation, LLMs cannot predict return structure or chain results; (2) No error handling guidance, tools return raw HTTP/API errors without recovery hints; (3) Parameter descriptions are functional but minimal (avg ~40 chars vs baseline 72); (4) No tool annotations (readOnlyHint, destructiveHint, idempotentHint) despite all tools being read-only; (5) Security-sensitive tools (git_dump, extract_secrets, stealth_scan) lack permission gates or audit trail declarations. Tool naming is strong (verb_noun pattern: credence_scan, credence_git_dump), but composition issues exist: credence_scan and credence_stealth_scan overlap significantly; credence_cloud_scan has 4 boolean flags that should be separate tools or a single 'action' enum.
Discover and analyze exposed API endpoints including GraphQL introspection, OpenAPI/Swagger documentation, REST endpoints, and WebSocket endpoints.
Scan for exposed CI/CD pipeline configurations that reveal build processes, secret management patterns, infrastructure details, and internal service endpoints.
Scan for exposed cloud storage buckets, container registries, and cloud infrastructure exposure across AWS, Azure, GCP, and other cloud providers.
Extract and optionally validate credentials from content. Detects AWS keys, API tokens, database URLs, private keys, and 30+ secret types.
Download and reconstruct exposed .git repositories. Extracts source code, commit history, and scans for secrets in git history.
Scan Infrastructure as Code files (Terraform, CloudFormation, Kubernetes manifests) for misconfigurations, exposed secrets, and security vulnerabilities.
No output schema documentation. LLMs cannot predict return structure (fields, types, pagination). Breaks tool chaining and forces agents to guess at response format.
No error handling guidance. Tools return raw HTTP errors without recovery hints (e.g., 'Target unreachable. Verify domain is valid and accessible.'). Agents cannot self-correct.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 68 | 2026-07-28+ | v2 |
Scan for exposed AI/LLM infrastructure including vector databases, system prompts, RAG configurations, and API keys.
Scan for exposed ML model files that could contain malicious payloads. Detects pickle, PyTorch, TensorFlow, and ONNX models with RCE potential.
Detect React2Shell (CVE-2025-55182) vulnerability in Next.js/React applications. Scans for exposed RSC endpoints, Flight protocol, and vulnerable configurations.
Comprehensive scan for exposed sensitive files including .git directories, environment files, backups, configs, and more. Returns vulnerability findings with severity levels.
Analyze source maps to recover original source code and identify sensitive information leaks in JavaScript/TypeScript applications.
Perform stealth scanning with WAF evasion techniques, rotating user agents, and distributed request patterns to avoid detection.
Detect invisible Unicode characters used in supply chain attacks (GlassWorm pattern). Scans for variation selectors, zero-width chars, bidirectional overrides, and homoglyphs.
Missing tool annotations. All 13 tools are read-only but lack readOnlyHint annotation. Agents cannot distinguish safe tools from destructive ones without explicit hints.
Overlapping tool responsibilities. credence_scan and credence_stealth_scan both scan targets; credence_cloud_scan has 4 boolean flags (enumerate_buckets, check_permissions, list_files, analyze_security) that should be separate tools or a single 'action' enum.
No permission gates or audit trail declarations. Security-sensitive tools (git_dump, extract_secrets, stealth_scan) lack scope declarations (e.g., 'requires: security:scan, audit:log'). No guidance on who can invoke them.