Loading ToolBench

Reading the current corpus…

mcp-gunbroker MCP server · D · ToolBench

← Browse

mcp-gunbroker

github.com/pipeworx-io/mcp-gunbroker

GunBroker MCP Pack — wraps the GunBroker firearms-marketplace API.

2026-07-28+STDIO3 tools

59/100

Definition Quality72

Protocol Readiness50

Supportability43

Spec posture

Inferred effective spec 2026-07-28+·current baseline 2026-07-28

Static source inference · medium confidence · evidence: stateless requests

Current-spec patterns detected

Summary

Three tools with complete input schemas and descriptions. Naming follows verb_noun pattern (search_, get_, list_). Descriptions are adequate (100-200 chars) but lack actionable context for LLM selection. Critical issue: credentials (username, password) exposed as tool parameters in gunbroker_seller_orders, violating secret-injection pattern. Output schemas undocumented. No error recovery guidance. Parameters lack enums, ranges, and format constraints.

Tools (3)

gunbroker_get_itemread onlyauthsource verified77/100

Get full details for a single GunBroker listing by item ID — title, description, prices, seller, shipping, condition, category, and time remaining. Public — needs only a GunBroker developer key (_apiKey).

gunbroker_search_itemsread onlyauthsource verified77/100

Search active GunBroker firearms-marketplace listings by keyword (e.g. "Glock 19", "AR-15 lower", "Henri 22 rifle"). Returns matching live listings with item IDs, titles, current/buy-now prices, bid counts, and time left. Public — needs only a GunBroker developer key (_apiKey). Supports pagination and sort.

gunbroker_seller_ordersread onlyauthsource verified63/100

List the authenticated seller's sold orders (GunBroker /OrdersSold) — order IDs, buyers, item titles, totals, payment and shipping status. Seller tool: needs a GunBroker developer key (_apiKey) PLUS the seller's GunBroker username and password, which are exchanged for a short-lived access token on each call.

Issues (5)

CRITICALsecret-injection ↗

Credentials exposed as parameters: username and password in gunbroker_seller_orders are passed as tool parameters, violating secret-injection pattern. Agent traces will log plaintext credentials.

gunbroker_seller_orders

HIGHresponse-shaper ↗

Output schemas undocumented. Tool descriptions do not specify what fields are returned (e.g., gunbroker_search_items returns 'item IDs, titles, prices, bid counts, time left' but no structured schema definition for LLM planning).

gunbroker_search_itemsgunbroker_get_itemgunbroker_seller_orders

HIGHrecovery-guide ↗

No error recovery guidance. Error handling throws generic messages ('GunBroker: 401 ...') without actionable next steps. LLM cannot determine if error is retryable, user-fixable, or fatal.

gunbroker_search_itemsgunbroker_get_itemgunbroker_seller_orders

MEDIUMconstrained-input ↗

Recommendations

Move username and password to server-side secret injection (environment variables or vault). Remove from tool parameters. Update description: 'Requires GunBroker seller credentials configured server-side.'
Document output schemas in tool descriptions. Example: 'Returns array of {itemID, title, currentPrice, buyNowPrice, bidCount, timeRemaining, sellerUsername}' for search_items.
Add error recovery guidance. Wrap gbGet/getAccessToken errors with actionable messages: 'Invalid API key. Verify X-DevKey with GunBroker API Support.' or 'Token exchange failed. Check seller username/password.'
Add parameter constraints to descriptions: 'PageSize: 1 - 300 (default 25)', 'Sort: 0=best match, 1=ending soonest, 13=lowest price', 'TimeFrame: days (1 - 365, optional)'.
Enhance tool descriptions with selection context. Example: 'Use to find listings by keyword. For full details on a specific item, use gunbroker_get_item with the itemID returned here.'

Score history

Overall score trend

First recorded score · v2 rubric

59/100

Scored	Grade	Overall	Spec posture	Rubric
2026-09-23	D	59	2026-07-28+	v2