Loading ToolBench
Analyze exported browser history/downloads for IOCs and exfil signs
Single tool 'browserforensics_scan' has a basic description (72 chars, below 10-char minimum for quality) and minimal input schema. The tool name lacks a clear action verb (should be 'scan_browser_forensics' or similar). Input parameter 'target' has a description but no type validation, format constraints, or examples. No output schema is documented, LLMs cannot predict the JSON structure returned. No error handling guidance. The tool is read-only but lacks explicit idempotent/readOnly annotations. Overall, this is a minimal proof-of-concept MCP wrapper around a CLI tool, not a production-grade agent tool.
Analyze exported browser history/downloads for IOCs and exfil signs. Returns JSON findings.
Tool name 'browserforensics_scan' does not start with a clear action verb. Should be 'scan_browser_forensics' or 'analyze_browser_history' to match LLM expectations (pattern:tool requires verb_noun naming).
Input parameter 'target' lacks type definition, format constraints, and validation rules. Description does not specify: file format (CSV, JSON, SQLite?), expected size limits, or error cases (file not found, permission denied). LLMs cannot validate input before calling.
No output schema documented. Tool returns 'JSON findings' but LLMs cannot predict field names, types, or structure. Downstream tools cannot chain on this output. Missing: documented return type with field definitions.
No error handling guidance. Tool description does not explain what happens on invalid paths, permission errors, or malformed files. LLMs receive raw exceptions with no recovery path.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 38 | 2026-07-28+ | v2 |
Tool lacks readOnlyHint annotation. Although the tool is read-only (no state modification), this is not declared in the schema, forcing LLMs to infer safety from the description alone.