Loading ToolBench
Minimalist alternative to MCP for providing context to AI agents via signed HTTP URLs
This server exposes HTTP endpoints as MCP tools, but lacks critical definition quality. Tool descriptions are present but minimal (10-60 chars, well below the 50-200 char LLM-optimized baseline). Input schemas are partially visible but lack parameter descriptions, the POST /session tool shows user_id and pages parameters with descriptions, but GET /context/{pageId} mixes path params (pageId) with query params (sid, exp, sig) without clear type/format guidance. No output schemas are documented. Error handling is mentioned in descriptions (e.g., 'HMAC signature verification') but no recovery guidance is provided. The server is fundamentally a REST API wrapper, not a true MCP server with proper tool composition patterns.
Revoke a session, invalidating all its context URLs
Retrieve context page content with HMAC signature verification and rate limiting
Health check endpoint
Retrieve session details including expiration status and revocation state
Create a new session with specified pages and generate signed context URLs
No output schemas documented. LLMs cannot plan downstream calls or extract required fields (e.g., session_id, context_urls, expires_at). Responses are opaque.
GET /context/{pageId} mixes path and query parameters without clear type/format guidance. Query params (sid, exp, sig) lack descriptions explaining their purpose or format (e.g., 'exp' is a timestamp but format is unspecified).
Descriptions are too brief (10-60 chars vs. 50-200 char baseline). 'Retrieve session details including expiration status and revocation state' (60 chars) lacks WHEN to use this tool and what distinguishes it from other session tools.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 40 | 2026-07-28+ | v2 |
Error handling descriptions mention error codes (token_expired, session_revoked, invalid_signature) but do not appear in tool definitions. No recovery guidance (e.g., 'If token_expired, call POST /session to create a new one').
No parameter constraints (enums, min/max, regex patterns) for critical fields. 'pages' array in POST /session has no length limits, format validation, or examples of valid page identifiers.