Loading ToolBench
MCP server for CAP-Shield, a service for measuring and managing agent traffic compression and memory retrieval. Provides tools for measuring traffic savings, storing memories, and issuing credentials.
CAP-Shield MCP has well-structured tool definitions with clear, LLM-optimized descriptions (avg 180 chars, within 10 - 1024 baseline). All 6 tools have explicit input schemas with typed properties. However, critical gaps exist: (1) output schemas are completely undocumented, LLMs cannot plan downstream calls or extract fields; (2) parameter descriptions are sparse or missing (e.g., 'scope' in issue_pass has no guidance on valid keys); (3) no error handling guidance, tools return HTTP errors without recovery hints; (4) no pagination support despite measure_traffic accepting up to 200 texts; (5) security-critical tools (remember, assemble_context, issue_pass) require API keys but do not document permission scopes or audit requirements. Tool naming is strong (verb_noun pattern: measure_, list_, remember, assemble_, get_, issue_). Descriptions explicitly state prerequisites ('REQUIRES A KEY') and non-actions ('does not call any language model'), which is excellent for agent selection. But the lack of output documentation and error guidance significantly limits production readiness.
Retrieve the memory entries that answer a question, within a token budget. REQUIRES A KEY. Send the returned 'context' to your language model INSTEAD of the whole history. This does not call a model itself — it selects what to send. The budget is a ceiling, not a target: selection stops where relevance runs out, often well below it. The response says how many entries were left behind and why.
Get an account and an API key. Requires an email address. The key is returned ONCE and cannot be shown again — store it immediately. Beta quotas are low by design; they are hard stops, never overage billing.
Issue a short-lived (15 minute) signed credential (a JWT) stating who the caller acts for. REQUIRES A KEY. Anyone can verify it independently against /.well-known/jwks.json — without calling CAP-Shield again. 'acts_for' and 'scope' are NOT validated against reality: the pass only attests that the key holder claimed this, at this time, and that the claim is recorded in the audit chain. This is identity and claimed authorization, not a payment or access-control mechanism.
List the available dictionaries with their MEASURED compression, including the ones that perform badly. Each entry says whether it works one message at a time or only batched, and how many messages came out LARGER. No key needed.
No output schemas documented. LLMs cannot infer response structure, field names, or types. Agents cannot plan downstream calls or extract required IDs for chaining.
Parameter descriptions missing or incomplete. 'scope' in issue_pass has no guidance on valid keys or format. 'traffic' in get_account lacks detail. LLMs cannot validate inputs without explicit constraints.
No error handling guidance. Tools return HTTP errors without recovery hints. E.g., 'Invalid key' should suggest 'Call get_account() first' or 'Check CAP_SHIELD_API_KEY env var'.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 66 | 2026-07-28+ | v2 |
Measure how much of your own agent traffic could be saved. NO ACCOUNT OR KEY NEEDED — use this first. Returns byte savings over the wire and, if a query is given, token savings from selective context retrieval. Nothing is stored: the text is compressed in memory and discarded. Rate limited to 20 calls per hour per IP.
Store a memory entry for later retrieval. REQUIRES A KEY. This does not call any language model — it stores text in an isolated per-tenant archive. Use assemble_context to get relevant entries back.
Security-critical tools lack permission scope declarations. 'remember', 'assemble_context', and 'issue_pass' modify or access sensitive state but do not document required scopes (e.g., 'write:memory', 'read:memory', 'issue:credentials').
No pagination or result limits documented. measure_traffic accepts 200 texts but no guidance on max response size. list_packages may return unbounded results. Large responses risk context window exhaustion.