Loading ToolBench
MCP server for automated TypeScript/JavaScript code analysis with AST-powered complexity, security, dead code, and dependency analysis
CodeScope provides 7 tools with basic schemas and descriptions, but falls short of production quality. All tools have input schemas with type definitions and descriptions present, meeting minimum requirements. However, descriptions are generic (avg ~120 chars, below the 194-char baseline for A+ tools) and lack actionable context for LLM selection. No output schemas are documented, LLMs cannot predict return structure. Tool names follow verb_noun convention (analyze-project, find-complex-functions) but lack specificity about what distinguishes similar tools (find-hotspots vs find-complex-functions). No error handling guidance, no pagination support despite tools returning lists, and no parameter constraints (e.g., threshold ranges, metric enum values). Security audit and dead code detection tools return lists but lack limit/offset parameters. The generate-html-report tool description references 7 analysis tools but doesn't explain when to call it vs individual tools.
Analyze a TypeScript/JavaScript project and return overall metrics including file count, lines of code, complexity score, and security issues
Detect circular dependencies in a project using depth-first search
Find functions with high cyclomatic complexity in a project
Find dead code including unused exports, unreachable code, unused variables, and duplicate imports
Find hotspots in a project based on complexity, security issues, or dead code metrics
Generate a comprehensive HTML report aggregating findings from all 7 analysis tools: analyze-project, find-complex-functions, security-audit, find-dead-code, detect-circular-dependencies, and find-hotspots
No output schemas documented. LLMs cannot predict return structure or plan downstream calls. Tools return complex objects (files, functions, issues) but no schema guides what fields to expect.
Descriptions lack actionable context. Generic descriptions (50-60 chars) do not explain WHEN to use each tool or how it differs from similar tools. E.g., find-hotspots vs find-complex-functions distinction unclear.
No pagination or result limits. Tools returning lists (find-complex-functions returns top 20, but no limit param; security-audit, find-dead-code have no pagination) risk context window exhaustion. No total_count or next_cursor in responses.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 58 | <=2025-11-25 | v2 |
Audit a project for common security vulnerabilities including hardcoded secrets, eval usage, innerHTML, SQL injection risks, and debugger statements
Parameter constraints missing. 'threshold' in find-complex-functions has no min/max; 'metric' in find-hotspots should be an enum (complexity|security|dead-code) but is free-form string. LLMs will hallucinate invalid values.
Error handling provides no recovery guidance. Code returns generic error strings ('Path does not exist', 'Error analyzing project') without suggesting next steps or alternative actions for LLM.