Loading ToolBench
MCP server for Velociraptor endpoint detection and response platform, providing tools for client discovery, artifact collection, hunt management, and VQL query execution
Raptor-MCP has well-structured schemas with proper types and descriptions for all 14 tools. Tool names follow verb_noun convention (list_orgs, collect_artifact, run_vql). Descriptions are present and actionable (avg ~80 chars), though some lack context on when to use vs. similar tools. Parameters are typed and described. Critical gaps: no output schemas documented, no error recovery guidance, no parameter constraints (enums, ranges), and descriptions don't explain prerequisites or dependencies. Tool composition is sound (each does one thing), but chaining IDs are not always guaranteed in responses. Security: credentials injected via env (good), but no audit logging visible in tool handlers.
Get full artifact metadata including parameters and sources
List clients with optional filtering by search term, OS type, label, or online status
Start async artifact collection on a client
Stream a read-only SELECT VQL query to a JSONL file with automatic file rolling
Poll and retrieve results of a collection flow with retry logic
Retrieve results from a hunt with optional source and field filtering
No output schemas documented. LLMs cannot plan downstream tool calls or extract required fields (e.g., client_id, flow_id) from responses. Responses are returned as JSON text, not structured with documented field types.
No error recovery guidance. Tool handlers return errors via textResult() but do not categorize as retryable/user-fixable/fatal or suggest next steps. E.g., 'Client not found' should suggest 'Try clients() with search term' or 'Check org_id'.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 55 | <=2025-11-25 | v2 |
List hunts with optional filtering by hunt ID and summary mode
List past and in-progress flows for a client
List artifact definitions with optional name regex filtering
List flows launched by a hunt with pagination and detail options
List organizations
Blocking collection — waits for flow completion and returns results
Execute a read-only SELECT VQL query
Check server health status
Parameter constraints missing. 'limit' parameters lack min/max bounds (e.g., limit 1 - 1000). 'fields' parameter accepts free-form strings instead of enums or documented valid field names. LLMs may pass invalid values without guidance.
Descriptions lack dependency hints and prerequisites. E.g., 'collect_artifact' does not mention that client_id must exist (call clients() first) or that artifact must be valid (call list_artifacts() first). No guidance on when to use realtime_collect vs. collect_artifact + get_collection_results.
No pagination documentation. Tools like 'clients' and 'hunts' accept 'limit' but do not document whether results are truncated, whether a 'next_cursor' or 'total_count' is returned, or how to fetch subsequent pages. Large result sets may blow context windows.