Loading ToolBench
MCP Server boilerplate with OAuth2 (Azure Entra) and API key authentication, FastAPI-based stateless HTTP transport with stream concurrency control
Three tools with complete schemas and descriptions, but descriptions are generic and lack LLM-optimization guidance. All tools are READ_ONLY with no state-modifying operations. Naming is clear (whoami, ping, server_profile) but generic. Parameters are minimal (0-1 per tool). No error handling guidance, no recovery paths, no parameter constraints or enums. Output schemas are documented in code but not formally declared in tool registration. Missing actionable descriptions that explain WHEN to call each tool and WHAT to do with results.
Echo the message back with a server timestamp. Useful as a connectivity check.
Return server metadata and extension hints for MCP clients.
Return identity information from the current session's access token. - OAuth2 Bearer token: returns user claims (name, UPN, OID) from the JWT. - API key: returns a message indicating no user token is present.
Descriptions lack LLM-optimization guidance. 'Return identity information...' and 'Return server metadata...' are passive and do not explain WHEN to call these tools or WHAT the agent should do with results. Descriptions should be 50-200 chars and action-oriented.
No error handling guidance. Tools do not document what happens on auth failure, missing tokens, or invalid JWT claims. LLMs need recovery paths: 'If auth fails, try calling with API key instead' or 'If JWT is invalid, request re-authentication.'
Output schemas are documented in code (Dict[str, Any] return types) but not formally declared in tool registration. LLMs cannot see the structure of returned fields (oid, name, upn, auth_type, etc.) without explicit schema documentation.
Inferred effective spec: 2026-07-28+.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 60 | 2026-07-28+ | v2 |
ping tool description does not explain use case clearly. 'Useful as a connectivity check' is vague. Better: 'Verify server is responding and measure latency. Returns server timestamp for clock sync validation.'
No tool annotations (readOnlyHint, destructiveHint, idempotentHint). All three tools are READ_ONLY and idempotent, but this is not declared in the tool definition. Agents cannot infer safety properties without explicit hints.