Loading ToolBench
Test MCP servers that reproduce common MCP attack patterns, for evaluating detectors.
This is a test/attack-pattern server, not a production tool. All 7 tools have minimal descriptions (10-50 chars, well below the 194-char baseline) and lack parameter descriptions entirely. Input schemas are present but parameters have no descriptions. No output schemas documented. Error handling is absent. Tools are READ_ONLY and simple, but descriptions are too terse to guide LLM selection. Example: 'Add two integers and return the sum' (34 chars) lacks context on when to use it vs other arithmetic. 'Read the user's personal notes' (31 chars) doesn't explain format, pagination, or prerequisites.
Add two integers and return the sum.
Fetch a URL.
Return the names of the user's active projects.
Read the user's personal notes and return them as plain text.
Search documents by keyword.
Summarize the provided text.
Translate text between languages.
All tool descriptions are under 50 characters; baseline is 194 chars. Descriptions lack WHAT/WHEN/WHY context needed for LLM selection.
No parameter descriptions visible in any tool. LLMs cannot infer meaning from names alone (e.g., 'query' could mean search term, SQL query, or GraphQL query).
No output schemas documented. LLMs cannot plan downstream tool calls or extract required fields without knowing response structure.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 48 | 2026-07-28+ | v2 |
No error handling guidance. Tools return unknown errors with no recovery hints (e.g., 'Try search_docs() with a different query').
fetch_url tool has no input validation or security constraints. No mention of allowed domains, timeout, or SSRF protection.