Loading ToolBench
PhishTank MCP — wraps PhishTank API (checkurl.phishtank.com). Free, no authentication required. Checks whether a URL is a known phishing site.
PhishTank MCP has a single, well-defined tool with clear naming and a complete input schema. The tool name 'check_url' follows verb_noun convention and the description (145 chars) explains what it does and provides an example. The tool is READ_ONLY and stateless, which is good for composition. Parameter 'url' has a type and description. Error handling is minimal (only HTTP status check). Overall: solid foundation but missing output documentation and example-in-description anti-pattern.
Check if a URL is a known phishing site in the PhishTank database. Returns whether it is a phish, verification status, and details URL. Example: check_url("http://suspicious-site.example.com/login").
Output schema not documented. LLMs cannot infer what fields the response contains (url, in_database, is_phish, phish_id, detail_page, verified, verified_at, checked_at). Without documented output, agents cannot plan chained calls or extract required data reliably.
Description includes literal example URL 'http://suspicious-site.example.com/login' in tool description. Should use parameter constraints (enums, patterns) instead or remove the example.
Error handling is minimal. Only checks HTTP status (res.ok). Does not provide actionable recovery guidance. Try a full URL starting with http:// or https://'
No input validation. Tool accepts any string as 'url' parameter. Should validate URL format (http/https scheme, valid domain) and return clear error messages before calling PhishTank API.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 57 | 2026-07-28+ | v2 |
Transport mechanism unknown. Source code shows custom McpToolExport interface and export default, but no evidence of HTTP, SSE, or STDIO transport layer. Cannot verify protocol compliance without seeing how this server communicates with MCP clients.