Loading ToolBench
A headless CMS built with .NET that provides content management, full-text search, audit logging, comments, engagements, subscriptions, and notifications
FormCMS exposes 32 tools with significant quality gaps. All tools have descriptions (positive), but most descriptions are terse (avg 45 chars, well below the 194-char baseline). Parameter schemas are present but minimal: most lack type constraints, enums, or validation guidance. No output schemas are documented. Critical security issue: SaveUser and SaveRole accept generic 'dto' objects with no field documentation, inviting injection attacks. Error handling is absent, no recovery guidance, no categorization. Tool naming is inconsistent (GetActionCounts vs ListAuditLogs vs CreateFtsIndex). No tool annotations (readOnlyHint, destructiveHint) despite clear risk levels. Composition is poor: BeginTransaction exists but no commit/rollback tools; UpdateOnConflict and BatchUpdateOnConflict duplicate functionality. The server is database-centric, not user-centric, requires opaque table names and key field arrays instead of natural identifiers.
Add columns to an existing table
Batch upsert multiple records
Begin a database transaction
Change the current user's password
Create a foreign key constraint
Create a full-text search index on specified table and fields
Create an index on table columns
Create a new table with specified columns
SaveUser and SaveRole accept untyped 'dto' objects with no field documentation. LLMs cannot infer valid fields, and no validation prevents injection attacks or data corruption.
No output schemas documented for any tool. LLMs cannot plan downstream calls or extract required fields (e.g., user_id after GetUsers). Breaks tool composition.
Inconsistent naming: GetActionCounts, ListAuditLogs, CreateFtsIndex, IndexAsync, RemoveAsync mix verb_noun and async suffixes. LLMs struggle to parse intent from inconsistent conventions.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 41 | 2026-07-28+ | v2 |
Delete a role by name
Delete a user by id
Initiate external login with a provider
Get audit log action counts for the last n entries
Get the audit log entity definition
Get column definitions for a table
Get all entities
Get all roles
Get a single audit log entry by id
Get a single role by name
Get a single user by id
Get all users
Atomically increment a numeric field, creating the record if it doesn't exist
Index or update a record in full-text search
List audit logs with optional offset and limit parameters
Login with username or email and password
Logout the current user
Register a new user
Remove a record from full-text search index
Save or update a role
Save or update a user
Search full-text index with optional field weighting and exact field matching
Merge/upsert a record - update if exists, insert if not
Upload an avatar for the current user
Database-centric interface requires opaque table names, key field arrays, and raw SQL-like parameters (tableName, keyConditions, valueField). No natural identifiers (email, username). Forces LLMs to reason about schema internals.
No error handling guidance. Tools lack recovery hints, categorization (retryable vs fatal), or actionable error messages. LLMs cannot self-correct on failures.