Loading ToolBench
MCP server to publish Android apps to Samsung Galaxy Store & Huawei AppGallery from AI agents (Claude Code, Cursor, VS Code, Antigravity, OpenCode) — Seller API, AppGallery Connect Publishing API, APK/AAB submission, IAP receipt verification.
Server has 7 tools with basic descriptions and some schema definition, but significant gaps prevent higher scoring. Tool names follow verb_noun convention (samsung_get_access_token, appgallery_api_request), which is good. However, descriptions are minimal (10-50 chars for most tools), parameter descriptions are sparse or missing, and output schemas are not documented. The samsung_api_request and appgallery_api_request tools accept generic 'params' and 'data' objects with additionalProperties:true, providing no guidance on valid fields. Error handling exists but lacks recovery guidance. No tool annotations (readOnlyHint/destructiveHint) despite clear risk levels. Baseline: 549 production tools average 194 chars for descriptions; these average ~40 chars.
Make a request to the AppGallery Connect Publishing API
Generate/refresh AppGallery Connect API access token
Generate/refresh Huawei service account JWT token
Make a request to the Samsung Galaxy Store Developer API
Generate/refresh Samsung Seller API access token
View Seller's App Details (GET /seller/contentInfo)
Generic API request tools (samsung_api_request, appgallery_api_request) lack parameter guidance. 'params' and 'data' accept additionalProperties:true with no documentation of valid fields, endpoints, or constraints. LLMs cannot determine what values are valid without trial-and-error.
Output schemas are not documented for any tool. Callers cannot know what fields to expect (e.g., does samsung_get_app_details return app_name, title, or name?). This forces LLMs to guess field names for downstream operations.
Descriptions are too short (10-50 chars vs. baseline 194 chars). Most lack context on WHEN to use the tool, WHAT it returns, or WHAT prerequisites exist. E.g., 'Generate/refresh Samsung Seller API access token' omits that this requires SAMSUNG_SERVICE_ACCOUNT_ID and SAMSUNG_PRIVATE_KEY env vars.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 49 | 2026-07-28+ | v2 |
Verify Samsung IAP receipt JWT using configured public key
No tool annotations (readOnlyHint, destructiveHint, idempotentHint). Risk levels are declared in the metadata (READ_ONLY, WRITE) but not exposed to the LLM via tool annotations. LLMs cannot infer safety properties without explicit hints.
Error handling in code (e.g., 'Missing Samsung env vars: ...') provides error messages but no recovery guidance. Errors do not tell the LLM what to do next (e.g., 'Set SAMSUNG_SERVICE_ACCOUNT_ID in .env and restart').