Loading ToolBench
Traject Data ecommerce MCP — Amazon (Rainforest API) + Walmart (BlueCart API). Provides product, review, and search data for two major retail marketplaces.
Server defines 6 tools with complete input schemas and descriptions. However, critical security and design issues significantly limit production readiness. All tools expose API keys as required parameters (violates pattern:secret-injection), descriptions include example values that LLMs may reuse literally, and output schemas are completely undocumented. Tool naming follows verb_noun convention (amazon_product, walmart_search) but lacks clarity on distinctions. No error handling guidance, no pagination support despite search tools returning potentially large result sets, and no output field documentation means agents cannot plan downstream operations.
Get Amazon product details by ASIN — title, brand, price, rating, ratings total, bestsellers rank, and image. Uses your Rainforest API key. Example: amazon_product({ asin: "B08N5WRWNW", amazon_domain: "amazon.com", _apiKey: "your-rainforest-key" })
Get customer reviews for an Amazon product by ASIN — title, body, rating, date, verified-purchase flag, and helpful votes. Uses your Rainforest API key. Example: amazon_reviews({ asin: "B08N5WRWNW", amazon_domain: "amazon.com", _apiKey: "your-rainforest-key" })
Search Amazon products by keyword — returns position, title, ASIN, price, rating, and ratings total. Uses your Rainforest API key. Example: amazon_search({ search_term: "wireless earbuds", amazon_domain: "amazon.com", _apiKey: "your-rainforest-key" })
Get Walmart product details by item ID — title, brand, price, rating, ratings total, and image. Uses your BlueCart API key. Example: walmart_product({ item_id: "967006046", _apiKey: "your-bluecart-key" })
Get customer reviews for a Walmart product by item ID — title, body, rating, date, and verified-purchase flag. Uses your BlueCart API key. Example: walmart_reviews({ item_id: "967006046", _apiKey: "your-bluecart-key" })
API keys exposed as required tool parameters (_apiKey). Violates secret-injection pattern, credentials in tool params are logged in traces and prompt history. Must use server-side secret injection via environment variables or vault.
Output schemas completely undocumented. Code defines TrajectResponse interface but tool descriptions do not specify what fields agents should expect (product, reviews, search_results, ratings_total). LLMs cannot plan downstream operations or extract required data without documented return types.
Descriptions include example values (B08N5WRWNW, 967006046, wireless earbuds, coffee maker) that LLMs tend to reuse literally in real calls. Should use enum constraints and format declarations instead of examples in text.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 52 | 2026-07-28+ | v2 |
Search Walmart products by keyword — returns position, title, item ID, price, rating, and ratings total. Uses your BlueCart API key. Example: walmart_search({ search_term: "coffee maker", _apiKey: "your-bluecart-key" })
Search tools (amazon_search, walmart_search) lack pagination parameters (limit, offset, page_size) and no documented result limits. Large result sets will blow context windows. Must implement pagination with limit (1 - 100) and offset/cursor parameters.
No error handling guidance. trajectGet() throws generic errors ('HTTP 429', 'request failed') without actionable recovery steps. LLMs cannot determine if errors are retryable, user-fixable, or fatal.