Loading ToolBench
Model Context Protocol server for retrieving structured YesWeHack account and program data.
YesWeHack MCP has 13 well-named tools with consistent verb_noun patterns (list_, get_, search_, filter_, export_). All tools have descriptions (avg ~80 chars, within baseline 34-392). Input schemas are present and typed with Zod validation. However, parameter descriptions are sparse, many lack detail on constraints, formats, or valid ranges. Output schemas are not documented in the source. Error handling exists but lacks recovery guidance. No tool annotations (readOnlyHint, destructiveHint). All tools are READ_ONLY, which is good for safety but not annotated in the schema.
Export a program with raw structured fields plus derived scope collections.
Filter programs by scope type, reward type, reward bounds, bounty/VDP, country, tags, technology, and asset type.
Return every structured field available for a YesWeHack program.
Return YesWeHack's structured program filter metadata.
List API endpoint assets from a program scope.
List structured YesWeHack endpoints observed by the HTTP client or seeded during build-time discovery.
Output schemas not documented. Tools return JSON responses but LLMs cannot see what fields to expect. This forces agents to guess at response structure and risks failed downstream tool chaining.
Parameter descriptions lack constraint details. 'page' and 'pageSize' describe purpose but omit ranges (e.g., 'positive integer, max 100'). 'query' parameters lack minimum length or format guidance. LLMs cannot validate inputs without explicit constraints.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 56 | <=2025-11-25 | v2 |
List domain and URL-like assets from a program scope.
List IP, CIDR, and network assets from a program scope.
List Android and iOS assets from a program scope.
List YesWeHack programs visible to the authenticated account.
Return YesWeHack structured scope type metadata.
Search YesWeHack programs visible to the authenticated account.
Search a program's structured scope/assets.
No tool annotations. All 13 tools are READ_ONLY but lack readOnlyHint in schema. This prevents clients from optimizing caching, retry logic, or safety checks based on tool semantics.
Error handling returns generic error responses via errorResponse() helper. No recovery guidance (e.g., 'Try search_programs() first' or 'Check authentication'). Agents cannot self-correct on failures.
filter_programs has 12 optional parameters with no documented interdependencies or mutual exclusivity. LLMs cannot reason about which combinations are valid or how filters interact.