Loading ToolBench
Stops AI coding agents from installing npm packages that don't exist. MCP server + hooks that block slopsquatting and typosquat supply-chain attacks.
Three well-named tools with strong, actionable descriptions (all 150+ chars). Input schemas are complete with proper types and descriptions. Tool names follow verb_noun pattern (check_*, scan_*) and clearly signal intent. Descriptions explain WHAT, WHEN, and WHY, excellent for LLM selection. However, output schemas are not documented in the visible code, and error handling guidance is absent. No tool annotations (readOnlyHint, etc.) despite all three being read-only operations.
Vet a package-manager install command (npm/pnpm/yarn/bun) before running it. Extracts every package the command would install and checks each one for non-existence, typosquatting, and install-time scripts that execute arbitrary code. Call this before running any command that adds a dependency.
Verify that npm packages actually exist on the public registry before you import or install them. Language models routinely invent plausible-sounding package names that were never published ("slopsquatting"); attackers watch for those names and register them with malicious install scripts. Call this whenever you are about to write an import statement or add a dependency you have not verified in this session.
Scan a project directory for npm packages that do not exist — imported in code or declared in package.json — and for packages imported but missing from package.json. Use this to audit a codebase — for a single package name, use check_packages instead.
Output schemas not documented. LLMs cannot plan downstream operations or extract structured data without knowing what fields are returned.
No error handling guidance. Tools lack descriptions of failure modes, recovery steps, or what the LLM should do if a package is not found or a scan fails.
Tool annotations missing. All three tools are read-only (Risk: READ_ONLY declared), but no readOnlyHint annotation in schema. Agents cannot infer safety from the definition alone.
scan_project path parameter lacks validation constraints. Description says 'Defaults to current working directory' but does not specify format, length limits, or path traversal guards.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 58 | 2026-07-28+ | v2 |
check_packages deep parameter lacks guidance on performance trade-offs. Description mentions 'Slower' but does not quantify latency impact or recommend when to use it.