Loading ToolBench
MCP server providing AI assistants access to Microsoft Outlook via Graph API
Critical gaps across naming, descriptions, and schemas. 14 of 21 tools (67%) have empty input schemas with no visible parameter definitions in source. Descriptions vary widely: some adequate (authenticate, about), but 6+ tools (list_emails, search_emails, read_email, send_email, draft_email, mark_as_read, list_rules, create_rule, edit_rule_sequence) show empty {} schemas with no descriptions visible in provided code. Tool names follow verb_noun convention (good), but parameter documentation is severely incomplete. No output schemas documented. Error handling absent, no recovery guidance or actionable error messages. Security concern: OAuth tokens stored in plaintext JSON file (TOKEN_STORE_PATH). Composition is reasonable (single responsibility per tool), but missing pagination, batch operations, and result limits.
Returns information about the Outlook MCP server and its capabilities.
Accept a calendar event invitation.
Initiates the Microsoft OAuth authentication flow. Returns a URL that the user must open in their browser to sign in.
Cancel a calendar event (organizer only). This sends cancellation notices to all attendees.
Checks whether the server is currently authenticated with Microsoft.
Create a new calendar event.
Create a new mail folder.
14 tools have empty input schemas ({}). No parameter definitions visible in source code. Cannot verify parameter types, descriptions, or constraints.
No output schemas documented for any tool. LLMs cannot plan downstream calls or extract required fields (e.g., event_id, email_id, folder_id).
No error handling or recovery guidance. Tools return raw errors with no actionable next steps for LLMs. No categorization of retryable vs fatal errors.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 44 | <=2025-11-25 | v2 |
Create a new inbox rule.
Decline a calendar event invitation.
Delete a calendar event permanently.
Create a draft email message without sending it.
Edit the sequence/priority of inbox rules.
List emails from the inbox or a specified folder.
List upcoming calendar events starting from now.
List all mail folders in the mailbox.
List all inbox rules.
Mark one or more emails as read.
Move one or more emails to a different mail folder.
Read the full content of a specific email message.
Search for emails by subject, sender, or body content.
Send an email message.
OAuth tokens stored in plaintext JSON file (TOKEN_STORE_PATH). No encryption at rest. Tokens appear in auth_server.py logs. Violates secret-injection pattern.
No pagination support. list_events, list_emails, list_folders, list_rules lack offset/limit/cursor parameters. Large result sets will blow context window.