Loading ToolBench
MCP server for creating Redcase testcases in Redmine
Single tool with significant definition gaps. Tool name 'create_testcases' is appropriately verb-prefixed, but description is minimal (34 chars, below 50-char baseline for clarity). Input schema is present but deeply nested with a generic 'payload' dict wrapper, poor for LLM parsing. No output schema documented. No error handling guidance. No parameter descriptions for nested testcase fields (title, description, priority_id, etc.). Missing validation rules, constraints, and recovery paths. Tool implementation shows no input sanitization despite accepting user-provided text (preconditions, steps, expected_results) that gets converted to HTML, XSS risk.
Create Redcase testcases in Redmine.
Tool description is 34 characters ('Create Redcase testcases in Redmine.'), below 50-char minimum for LLM clarity. Does not explain WHEN to use, WHAT it returns, or prerequisites (Redmine login, config file). LLMs cannot reliably select this tool without richer context.
Input schema wraps all parameters in a generic 'payload' dict with no descriptions for nested fields (title, description, priority_id, start_date, due_date, preconditions, steps, expected_results). LLMs cannot infer what each field controls or its constraints. Baseline: 100% of A+ tools have parameter descriptions.
No output schema documented. Tool returns {'success': bool, 'message': str, 'created': list} but LLM does not know structure of 'created' items or what fields to extract for downstream use. Baseline: 100% of A+ tools document return types.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 41 | 2026-07-28+ | v2 |
No error handling guidance. Tool can fail (login failure, missing title, CSRF token fetch, HTTP errors) but returns no actionable recovery hints. LLM receives bare error dict with no next steps. Pattern: recovery-guide requires 'Try X instead' or 'Call Y first.'
Input sanitization insufficient. Tool accepts 'preconditions', 'steps', 'expected_results' as free-form strings, converts them to HTML via list_to_html(), but sanitize_text() only strips <script> tags, does not escape HTML entities. XSS risk if Redmine renders user input without further escaping. Pattern: tool-gateway requires untrusted input validation.