Loading ToolBench
FastMCP 3.1: RSS/Atom feeds, Open-Meteo weather (no API key), and HTTP health probes for local fleet — minimal keys, httpx + feedparser.
glance-mcp provides 16 tools with complete input schemas and descriptions. Naming follows verb_noun convention (rss_fetch_feed, open_meteo_forecast, fleet_http_probe). Descriptions are present and actionable (avg ~120 chars), exceeding the 10-char minimum. All parameters have type definitions and descriptions. However, output schemas are not formally documented, responses are inferred from code (e.g., 'success, entries, feed_title, message'). Error handling returns structured error objects with error_type, but lacks recovery guidance ('Try X instead'). No tool annotations (readOnlyHint, destructiveHint, idempotentHint) despite all tools being read-only. Parameter constraints are documented in descriptions (e.g., 'max_items: 1 - 100') but not enforced via JSON Schema enums/minmax. Composition is strong: tools are single-purpose and chainable (opml_list_feeds → rss_fetch_feed). Security: no secrets in parameters; environment-based config (GLANCE_RSS_ALLOW_PRIVATE_HOSTS, MCP_BRIDGE_URLS). Overall: solid mid-range implementation with good naming and descriptions, but missing formal output schemas and error recovery patterns.
B64_DECODE — Decode a base64 string back to text.
B64_ENCODE — Encode a string as base64.
FLEET_HTTP_PROBE — Parallel GET for MCP /health or status URLs (localhost + LAN allowed). Blocks cloud metadata endpoints (169.254.169.254). Use for quick fleet dashboards.
UUID — Generate a UUID v4 (random) or v7 (time-ordered).
HASH — Hash a string using MD5, SHA1, SHA256, or SHA512.
HTTP_REDIRECT_TRACE — Follow http(s) redirects hop-by-hop; same allowlist as fleet probe. Use HEAD by default (lighter). Switch to GET if the server returns 405.
JSON — Validate, format, or minify a JSON string.
Output schemas not formally documented. Responses are inferred from code comments (e.g., 'success, entries, feed_title, message') rather than explicit JSON Schema definitions. LLMs cannot reliably parse response structure without formal schema.
Error responses lack recovery guidance. All tools return {success: false, error: str, error_type: str} but do not suggest next steps (e.g., 'Try search_users() with a partial name'). Agents cannot self-correct.
No tool annotations despite all 16 tools being read-only. Missing readOnlyHint in tool definitions. Agents cannot distinguish safe tools from destructive ones without explicit hints.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 65 | 2026-07-28+ | v2 |
JWT — Decode a JWT token without signature verification.
OPEN_METEO_FORECAST — Grid weather from Open-Meteo (no API key; HTTPS only).
OPML_LIST_FEEDS — Parse OPML XML text; return outline rows with xmlUrl (Atom/RSS feed URLs). Safe XML via defusedxml. Use for importing subscription lists into rss_fetch_feed.
RANDOM — Generate random values: uuid, hex, password, int, float.
RSS_FETCH_FEED — Download and parse an RSS or Atom feed (titles, links, summaries).
STATS — Count characters, words, lines, and sentences in text.
TIME — Convert a UNIX timestamp to human-readable date/time. Defaults to now.
URL_DECODE — Decode a percent-encoded URL string back to readable form.
URL_ENCODE — Percent-encode a string for use in URLs.
Parameter constraints documented in descriptions but not enforced via JSON Schema. E.g., max_items '1 - 100' is text, not minmax. LLMs may pass invalid values; validation happens at runtime.
timestamp_info parameter 'timezone' marked 'Not used yet (UTC only currently)'. Dead parameter confuses agents. Either implement or remove.