Loading ToolBench
MCP server for managing Cloudflare API tokens with support for creating, revoking, rotating tokens, and managing permissions
Strong foundation with 11 well-named tools following verb_noun convention (list_, get_, create_, revoke_, rotate_, verify_). All tools have descriptions (avg 95 chars, within 10-1024 baseline). Input schemas present for all tools with proper JSON Schema structure. However, output schemas are completely undocumented, LLMs cannot predict response structure for chaining. Parameter descriptions are present but often generic (e.g., 'Token ID to retrieve' lacks format/length guidance). No tool annotations (readOnlyHint/destructiveHint) despite clear risk stratification. Error handling code exists but recovery guidance is not visible in tool definitions. Missing: output schema documentation, parameter constraints (min/max for pagination), and explicit error recovery hints.
Create a new API token with custom policies or from a template. Returns the token secret (shown only once!).
Get details of a specific Cloudflare account
Get details of a specific token template
Get details of a specific token
List all Cloudflare accounts accessible with the current token
List all available Cloudflare API permission groups with their IDs and scopes
Output schemas completely undocumented. LLMs cannot predict response structure, field names, or types for any tool. This breaks tool chaining, agents cannot know what IDs to extract for downstream calls.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint) despite clear risk stratification in source (READ_ONLY, WRITE, DESTRUCTIVE). Agents cannot distinguish safe from dangerous operations without explicit hints.
Pagination parameters (page, perPage) lack constraints. No min/max bounds, no guidance on defaults or limits. LLMs may request 10,000 results per page, causing API overload.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 61 | <=2025-11-25 | v2 |
List available token templates (full_access, workers_deploy, dns_only, etc.)
List all API tokens (user or account)
Revoke/delete an API token
Create a new token with the same permissions as an existing token, optionally revoking the old one
Verify if a token is valid and check its status
Parameter descriptions are generic and lack format guidance. E.g., 'Token ID to retrieve' does not specify format, length, or example. 'IP CIDR ranges' lacks validation rules. LLMs cannot validate input before calling.
Error handling and recovery guidance not visible in tool definitions. Code references ValidationError and RateLimitError, but tool descriptions do not explain what to do on failure or how to retry.