Loading ToolBench
SEO Competitors MCP — domain ranked keywords via DataForSEO Labs (dataforseo.com)
Single tool with complete schema and reasonable description, but critical security flaw (API key as parameter), missing output schema documentation, and weak parameter descriptions. Tool name lacks action verb. No error recovery guidance. Baseline: 194 chars avg description (this: 256 chars, acceptable); 4 params avg (this: 6, acceptable). However, exposing _apiKey as a parameter violates pattern:secret-injection and creates audit/logging risks. Output structure inferred from code but not formally documented for LLM consumption.
What keywords does `<domain>` rank for — returns the keywords a domain ranks for in Google organic, with search volume, current rank, and ranking URL. Competitor SEO intelligence. Example: seo_domain_ranked_keywords({ target: "nike.com", location_code: 2840, limit: 50, _apiKey: "your-base64-key" })
API key exposed as tool parameter (_apiKey). Credentials must use server-side secret injection via environment variables or vault. Agent traces log all parameters, secrets leak into logs and prompt history.
Tool name 'seo_domain_ranked_keywords' does not start with action verb. Should be 'get_domain_ranked_keywords' or 'search_domain_keywords'. LLMs infer intent from verb-noun naming; this name is noun-heavy and ambiguous about the action.
Output schema not documented. Code returns {target, location_code, total, keywords: [{keyword, search_volume, rank, url}]} but LLM has no formal schema to plan downstream calls or validate field presence. Baseline: 100% of A+ tools document return types.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 47 | 2026-07-28+ | v2 |
Parameter descriptions lack actionable constraints. 'location_code' says 'default 2840 = United States' but no range/validation. 'limit' says 'default 20, max 100' but no minimum stated. 'order_by' example is cryptic ('keyword_data.keyword_info.search_volume,desc'), LLM cannot infer valid syntax.
Error handling lacks recovery guidance. dfsPost() throws generic errors ('DataForSEO auth failed', 'no task') without actionable next steps. Pattern:recovery-guide requires: 'User not found. Try search_users() with a partial name.' This tool offers none.