Loading ToolBench
MCP server for AI-assisted security audit analysis of SaaS platforms. Provides tools to query security findings, audit snapshots, and remediation guidance.
ClosedSSPM provides 6 read-only security audit tools with consistent naming (verb_noun pattern: list_, get_, query_, suggest_) and reasonable descriptions (60-120 chars). All tools have input schemas with type definitions and parameter descriptions. However, output schemas are not documented in the source code, parameter descriptions lack format constraints and examples, and error handling guidance is absent. No tool annotations (readOnlyHint, etc.) are visible. The server is domain-focused (security findings) but lacks the polish expected of production tools.
Get detailed information about a specific finding by its ID.
Get the overall audit summary including posture score, finding counts by severity and category.
List security audit findings. Optionally filter by severity, category, or platform.
List all tables collected in the snapshot with record counts.
Query raw collected data from a specific table in the snapshot.
Get detailed remediation steps and context for a specific finding.
Output schemas not documented. LLMs cannot plan downstream calls or extract fields without knowing response structure. All 6 tools lack documented return types.
Parameter descriptions lack format constraints. 'severity' accepts 'CRITICAL, HIGH, MEDIUM, LOW, INFO' but is not declared as an enum. 'limit' has no min/max bounds. LLMs may pass invalid values.
No error handling guidance. Tools return errors but do not tell LLMs what to do next (retry, ask user, try alternative tool). No recovery paths documented.
No tool annotations visible. readOnlyHint should be applied to all 6 tools (all are read-only). Absence signals to LLMs that tools may have side effects.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 61 | 2026-07-28+ | v2 |
query_snapshot parameter 'field' and 'value' are optional but interdependent. Passing 'field' without 'value' (or vice versa) is ambiguous. Dependency not documented.