Loading ToolBench
MCP Secrets & Token Broker - A security layer for managing short-lived credentials and tokens
Server has 7 tools with complete input schemas and descriptions. Naming follows verb_noun convention (get_, mint_, revoke_, store_, start_, resolve_). Descriptions are present and substantive (100-200 chars typical). However, output schemas are not documented, LLMs cannot predict response structure. Parameter descriptions are adequate but lack format constraints (e.g., ttl_seconds has no min/max bounds). Error handling and recovery guidance are absent from tool definitions. Security-critical tools (store_secret, mint_token) lack explicit permission/scope declarations. No tool annotations (readOnlyHint, destructiveHint, idempotentHint) despite clear risk profiles.
Get statistics about the credentials broker including active tokens, secret references, and audit log summary.
Issues a short-lived secret reference for a stored secret. Returns a reference ID (not the raw secret) with an expiry time. The reference can be used to retrieve the actual secret value within the TTL period.
Generates a short-lived, scoped token for a specific provider (OAuth, GitHub, AWS STS, GCP, Azure). The token is automatically revoked after the TTL expires.
Resolve a secret reference ID (from get_secret) to get the actual token value. Use this to pass the real token to another MCP tool.
Immediately revokes a previously issued token, making it invalid for any further use.
Authenticate a provider via browser-based OAuth2 web flow. Opens the browser for the user to log in — no client_id or client_secret needed from you. Stores the resulting access token under secret_name for use with get_secret/resolve_secret.
Output schemas not documented. LLMs cannot predict response structure for any tool. Breaks downstream tool chaining and forces agents to guess field names.
Numeric parameters lack bounds. ttl_seconds has no min/max; could accept negative or absurdly large values. Unbounded numbers let LLMs pass values that break APIs.
No tool annotations despite clear risk profiles. mint_token and revoke_token are destructive/reversible; store_secret is write; get_secret and resolve_secret are read-only. Missing destructiveHint/idempotentHint/readOnlyHint annotations.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 56 | 2026-07-28+ | v2 |
Store a secret in the credentials broker. This secret can then be referenced using get_secret.
No error handling or recovery guidance in tool definitions. If get_secret fails (secret not found), LLM has no guidance on next steps. Missing pattern:recovery-guide.
Security-critical tools lack explicit scope/permission declarations. store_secret and mint_token modify state but do not declare required permissions (e.g., 'write:secrets', 'write:tokens'). Breaks least-privilege agent configuration.