Loading ToolBench
MCP server for fraud prevention — IP reputation, email breach detection, URL safety, phone validation and risk scoring via free APIs (IPQualityScore, HaveIBeenPwned).
Server has 7 tools with consistent naming (verb_noun pattern: check_*, calculate_*, get_*) and descriptions present for all. However, descriptions are generic and lack LLM-optimization guidance. Input schemas are visible and typed, but parameter descriptions are minimal (avg ~40 chars vs baseline 72). Output schemas are not documented. Error handling is absent, no recovery guidance, no categorization of retryable vs fatal errors. Tools lack idempotency markers and confirmation patterns for sensitive operations (breach checks, composite risk scoring). No tool annotations (readOnlyHint, destructiveHint). Composition is reasonable (single responsibility per tool), but chaining support is weak, responses don't document what fields downstream tools need.
Calculate a combined fraud risk score from multiple signals (IP, email, phone, URL). Analyzes all provided signals and returns a composite risk score with ALLOW / MONITOR / REVIEW / BLOCK decision. Provide at least one signal. Requires IPQS_API_KEY env var.
Check if an email address has been exposed in known data breaches (HaveIBeenPwned). Returns breach count, risk level, exposed data types, and breach details. Requires HIBP_API_KEY env var (get key at haveibeenpwned.com/API/Key).
Check an email address for fraud risk, disposable services and spam traps. Returns fraud score, validity, disposable flag, spam trap detection, and deliverability. Requires IPQS_API_KEY env var (free at ipqualityscore.com).
Check an IP address for fraud risk, proxy, VPN, Tor and bot activity. Returns fraud score (0-100), risk level, and flags for proxy/VPN/Tor/bot. Requires IPQS_API_KEY env var (free at ipqualityscore.com).
Validate a phone number and check for fraud risk, VoIP and prepaid indicators. Returns validity, line type, carrier, VoIP flag, and fraud score. Requires IPQS_API_KEY env var (free at ipqualityscore.com).
No output schemas documented. LLMs cannot plan downstream calls or extract required fields. E.g., check_ip_reputation returns a dict but structure is undocumented.
No error handling or recovery guidance. Missing API keys (IPQS_API_KEY, HIBP_API_KEY) will cause silent failures. No actionable error messages to guide LLM retry or user correction.
Parameter descriptions are minimal (avg ~40 chars vs baseline 72). E.g., 'strictness' param lacks guidance on when to use each level (0=lenient vs 3=strict). LLMs cannot reason about parameter selection.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 64 | 2026-07-28+ | v2 |
Check a URL for phishing, malware, spam and other threats. Returns risk score, safety flags (phishing/malware/spam), and domain info. Requires IPQS_API_KEY env var (free at ipqualityscore.com).
Get information about this server, available tools and API key setup instructions. Returns tool list, API key configuration status, and links to get free API keys.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint). All tools are read-only but this is not declared. Agents cannot distinguish safe tools from destructive ones.
Tool descriptions lack LLM-optimization guidance. Missing WHEN to use each tool and what makes it distinct from similar tools. E.g., check_email_risk vs check_breach_exposure both assess email safety but purpose is unclear.