Loading ToolBench
MCP Server for NewebPay (藍新金流) — AI-callable payment tools via Model Context Protocol
Server has 8 tools with complete input schemas and descriptions. Naming follows verb_noun convention (create_*, query_*, cancel_*, close_*, alter_*). Descriptions are present and substantive (100-300 chars), exceeding the 10-char minimum. However, output schemas are not documented, callers cannot predict response structure. Parameter descriptions are good but lack explicit constraints (e.g., 'max 30 chars' stated in text but not as JSON Schema maxLength). No error handling guidance. No tool annotations (readOnlyHint, destructiveHint, idempotentHint) despite clear risk levels (WRITE, REVERSIBLE, READ_ONLY). Missing pagination guidance for list-like operations. Overall solid foundation but lacks production-grade polish.
Modify a recurring payment mandate content — amount, billing cycle, expiry, or notification URL.
Modify a recurring payment mandate status — suspend, terminate, or restart.
Cancel a credit card authorization that has not been closed yet.
Request close, refund, cancel close, or cancel refund for a credit card transaction.
Create an MPG payment and return the encrypted form data for browser redirect. Returns the form action URL and encrypted fields. The caller should POST these fields to the URL (e.g., open in a browser) to display NewebPay's payment page. Test credit card: 4000-2211-1111-1111, expiry: any future date, CVV: 222.
Create a recurring payment mandate and return encrypted form data for browser redirect. Returns the form action URL and encrypted fields. The caller should POST these fields to the URL to display NewebPay's periodic payment page. Test credit card: 4000-2211-1111-1111, expiry: any future date, CVV: 222.
No output schemas documented. Callers cannot predict response structure, forcing LLMs to guess field names and types. This breaks tool chaining and wastes tokens on exploratory calls.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint). Tools are marked with Risk levels (WRITE, REVERSIBLE, READ_ONLY) in metadata but not exposed to the LLM via schema annotations. LLMs cannot reason about safety or retry semantics.
Parameter constraints stated in descriptions but not enforced in JSON Schema. E.g., 'max 30 chars' for merchant_order_no is text-only; no maxLength constraint. LLMs cannot validate before calling.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 67 | 2026-07-28+ | v2 |
Refund an e-wallet payment (LINE Pay, Taiwan Pay, E.SUN Wallet, etc.).
Query a single transaction's status, including payment, close, and refund status.
No error handling guidance. Tools return dict responses but no documentation of error cases, recovery steps, or retryability. LLMs cannot distinguish transient failures from permanent ones.
Mutually exclusive parameters not documented. E.g., cancel_authorization accepts both merchant_order_no and trade_no with index_type selector, but descriptions don't warn LLMs that passing both is ambiguous.