Loading ToolBench
Production-grade MCP server with 27 security intelligence tools across 21 APIs for CVE lookup, vulnerability scanning, threat intelligence, and security analysis
18 tools with consistent naming (verb_noun pattern) and descriptions present, but significant gaps in schema completeness and parameter documentation. Most tools lack explicit input validation guidance, enum constraints, and output schema documentation. Error handling is present but generic. No tool annotations (readOnlyHint, destructiveHint). Descriptions average ~120 chars (below 194-char baseline), many lack actionable context for LLM selection. Parameters like 'severity' and 'ecosystem' have enums in descriptions but not formalized in schema. No pagination guidance despite tools returning lists (search_cves, scan_dependencies). Output schemas not documented, LLMs cannot plan downstream calls.
Search GitHub for public PoC exploit repositories for a CVE.
Check IP reputation against AbuseIPDB and GreyNoise.
Check a package for known vulnerabilities via OSV.dev.
Check if a CVE is associated with known ransomware campaigns.
Check URL safety against multiple threat intelligence sources.
Build a CVE timeline from NVD, EPSS, and KEV data showing key dates and computed metrics.
Get domain intelligence including certificate transparency data and passive DNS records.
Output schemas not documented. LLMs cannot infer what fields are returned or plan downstream tool calls. E.g., lookup_cve returns formatted text but no structured schema is declared.
Enum constraints (e.g., severity in search_cves, ecosystem in check_package_vulns) are documented in descriptions but not formalized in JSON Schema. LLMs cannot programmatically validate options.
No pagination guidance for list-returning tools (search_cves limit=50, scan_dependencies). No documented total count, next_cursor, or offset/page parameters. Large result sets risk context window exhaustion.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 55 | <=2025-11-25 | v2 |
Get EPSS (Exploit Prediction Scoring System) scores for one or more CVEs.
Get vendor security advisories for a CVE.
Look up a CVE by ID from NVD. Returns full details including CVSS scores, description, weaknesses, and CISA KEV status.
Look up a file hash against MalwareBazaar and VirusTotal.
Look up an IOC (hash, IP, domain, URL) against ThreatFox for malware family info.
Map a CVE to MITRE ATT&CK techniques and associated threat groups.
Perform passive DNS lookup for an IP or domain using CIRCL PDNS.
Scan a dependency list (requirements.txt, package.json, pom.xml, or generic format) for known vulnerabilities.
Scan a GitHub repository for exposed secrets and credentials.
Search NVD for CVEs by keyword and optional severity filter.
Look up host information from Shodan.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint). All 18 tools are READ_ONLY but this is not declared in the tool definition, LLMs cannot infer safety properties.
Error handling is generic (timeout, rate limit, not found). No recovery guidance for LLMs. E.g., 'NVD rate limit exceeded. Retry in ~30 seconds' lacks actionable next steps (which tool to call, backoff strategy).