Loading ToolBench
MCP server wrapping the Bitsight Security Ratings REST API. Zero runtime dependencies. An asset by BitScore Cybertech LLP.
Server has 9 well-named, read-only tools with consistent verb_noun naming (bitsight_get_*, bitsight_set_token). All tools have descriptions (avg ~120 chars, within baseline 34-392 range). Input schemas are present and typed for all tools. However, descriptions lack LLM-optimization guidance (no 'when to use' or 'prerequisites'), parameter descriptions are minimal (avg ~40 chars vs baseline 72), and output schemas are completely undocumented. Error handling is present but generic. No tool annotations (readOnlyHint, etc.). Security posture is strong (token never logged/persisted), but schema completeness and parameter documentation fall short of A-grade standards.
Fetch alerts for a company.
Fetch attack-surface assets for a company.
Fetch a company's security rating, grade, and summary from Bitsight.
Fetch findings for a company, optionally filtered by risk vector.
Fetch industry benchmarks for a given industry slug.
Fetch rating-change insights for a company.
Fetch the portfolio of companies visible to this token, with their ratings and grades.
Output schemas completely undocumented. No tool returns a documented response structure. LLMs cannot plan downstream calls or extract fields reliably.
Parameter descriptions are minimal (avg ~40 chars). E.g., 'risk_vector' says 'Optional risk vector to filter by (e.g., critical_vulnerability_management, malware, ransomware, etc.)' but does not explain what a risk vector is or when to use it. LLMs need context to select correct values.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint). All 9 tools are read-only but this is not declared in the schema. Clients cannot infer safety properties.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 61 | 2026-07-28+ | v2 |
Fetch CVE/threat exposure data across the portfolio.
Set the Bitsight API token for this session. The token is held only in memory and cleared when the process exits. Never persisted to disk or logs.
Descriptions lack 'when to use' guidance. E.g., 'Fetch a company's security rating, grade, and summary from Bitsight' does not explain when to call this vs bitsight_get_portfolio or bitsight_get_findings. LLMs must guess.
Pagination parameters (limit, offset) lack constraints. No min/max documented. LLMs could pass limit=999999 or offset=-1, causing API errors or unexpected behavior.