Loading ToolBench
A Rust-based MCP server with plugin architecture supporting Lua plugins, MySQL and Neo4j database integration, text compaction, and brain/memory management
MCPalace exhibits severe definition quality gaps across all dimensions. Tool descriptions are present but generic (avg ~60 chars, well below the 194-char baseline). Input schemas are partially visible for only 6 of 10 tools; 4 tools (initialize, tools/list, validate_token, list_users) have no visible schema definitions in the provided source. Parameter descriptions exist but lack type constraints, format specifications, and validation guidance. No output schemas are documented. Error handling is absent, no recovery guidance, no error categorization, no actionable messages. Security concerns: tools like create_user and store_memory accept user_id with defaults to 'root admin', risking privilege escalation. Tool composition issues: tools/call is a meta-tool that bypasses the MCP tool registry pattern entirely. No pagination support visible despite list_* tools. Naming is inconsistent: 'ask-brain' uses hyphens while others use underscores.
Query a brain with a question, returning relevant context and prompt from associated memories
Create a new user with username and generate API key
Get a specific user by username
Initialize the MCP server and return protocol version, capabilities, and server info
List memories accessible to the user, filtered by ownership and visibility
List all users in the system. Admin users see API keys; regular users see limited info
Store a new memory with title, content, and visibility settings
Four tools (initialize, tools/list, validate_token, list_users) have NO visible input schemas in source code.
No output schemas documented for any tool. LLMs cannot plan downstream calls or extract required fields. Violates pattern:tool and pattern:response-shaper.
tools/call is a meta-tool that accepts arbitrary tool names and arguments, bypassing MCP's tool registry. This violates the single-responsibility principle and prevents LLMs from discovering available tools via the standard MCP tools/list mechanism.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 35 | <=2025-11-25 | v2 |
Execute a tool by name with provided arguments
List all available tools from loaded plugins
Validate an API token and return associated user information
Security risk: create_user, store_memory, and list_memories accept user_id with defaults to 'root admin'. No permission checks visible. Agents could escalate privileges or access unauthorized data without explicit authorization.
No pagination support visible for list_* tools (list_users, list_memories). Large result sets will blow context windows. Missing limit, offset, and total_count fields.