Loading ToolBench
Zero-trust AI agent governance platform with real-time behavioral filtering, approval gates, and federation trust management. Exposes tools via MCP (Model Context Protocol) for integration with Claude Desktop, Goose, and other MCP-compatible AI agents.
TelsonBase exposes 12 high-risk tools with minimal safety guardrails. All tools have basic descriptions (10-50 chars) and input schemas with type info, but lack critical safeguards for irreversible operations. No tool annotations (readOnlyHint, destructiveHint, idempotentHint). No error handling guidance, recovery paths, or confirmation workflows. Parameter descriptions are generic ('SQL query to execute') without format constraints, validation rules, or dependency documentation. No pagination, output schema documentation, or result limits. The server exposes payment_send and transaction_execute without dry-run, confirmation, or audit trail patterns. File operations (file_delete, database_delete) lack path traversal validation hints. Email and Slack tools lack rate limiting or recipient validation guidance. Overall: definitions are skeletal, suitable only for internal/trusted environments, not production agent systems.
Execute a DELETE query against the PostgreSQL database
Execute a read-only SQL query against the PostgreSQL database
Execute an INSERT, UPDATE, or DELETE query against the PostgreSQL database
Send an email message to external recipients
Delete a file from the filesystem
Read file contents from the filesystem
No tool annotations (readOnlyHint, destructiveHint, idempotentHint). LLMs cannot distinguish safe reads from destructive writes without explicit hints. file_delete, database_delete, payment_send, transaction_execute are marked DESTRUCTIVE/IRREVERSIBLE but lack schema-level annotations.
Irreversible operations (payment_send, transaction_execute, invoice_create) lack confirmation/dry-run patterns. No guidance on recovery, rollback, or audit trails. Agents can execute financial transactions without safeguards.
Parameter descriptions are generic and lack validation rules. 'SQL query to execute' does not specify format, constraints, or injection prevention. 'File path to read' lacks path traversal validation hints. LLMs cannot self-validate inputs.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 52 | 2026-07-28+ | v2 |
Write content to a file on the filesystem
Make an HTTP request to an external API endpoint
Create a financial invoice
Execute a financial payment transaction
Send a message to a Slack channel or user
Execute a financial transaction
No output schema documentation. Tools return unspecified structures. LLMs cannot plan downstream calls or extract required fields (e.g., transaction_id, invoice_id for chaining).
No error handling guidance. Tools provide no recovery paths, retryability classification, or actionable error messages. LLMs cannot self-correct on failures.