Loading ToolBench
Model Context Protocol (MCP) server for Enpass vaults: unlock, list vaults, list and read entries, create entries. Master passwords are kept in the OS keychain and never pass through the model.
Strong tool naming (all verb-first, clear actions) and comprehensive descriptions (avg 180 chars, well above 10-char minimum). All 15 tools have explicit schemas with typed parameters and descriptions. Good security posture (passwords never exposed as params, keychain-based injection). Main gaps: output schemas not formally documented in code; no pagination support despite list_items accepting limit; error messages are generic ('Entry not found') rather than actionable recovery guidance; no tool annotations (readOnlyHint/destructiveHint) despite clear risk levels.
Creates a new entry in an unlocked vault. Requires ENPASS_MCP_ALLOW_WRITES=1. Returns the new entry uuid.
Deletes an entry from an unlocked vault. Requires ENPASS_MCP_ALLOW_WRITES=1.
Decrypts a file attachment from an unlocked vault. By default it writes the file to disk and returns the path (works for any size). Set inline=true to get small files as base64 instead.
Finalizes changes to a vault after create_item or delete_item. Requires ENPASS_MCP_ALLOW_WRITES=1. Writes the vault file and optionally syncs to folder-sync.
Returns a full entry from an unlocked vault including sensitive field values (password, TOTP, etc.). Use this when the user explicitly wants the credentials.
Generates the current TOTP / two-factor one-time code for an entry that stores an OTP secret. Returns the code and how many seconds until it rotates, so it can be entered for 2FA.
Output schemas not formally documented. Tools return JSON via json() helper but no schema definitions visible in code. LLMs cannot plan downstream calls without knowing response structure.
Error messages lack recovery guidance. Errors like 'Vault locked' or 'Entry not found' do not tell LLM what to do next. Should include actionable hints: 'Vault locked. Call unlock_vault(vault_name) first.'
No tool annotations (readOnlyHint, destructiveHint, idempotentHint). Tools have clear risk levels (READ_ONLY vs WRITE vs DESTRUCTIVE) but these are not exposed to the MCP client via tool metadata.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 65 | 2026-07-28+ | v2 |
Returns just the password (and TOTP if present) of an entry in an unlocked vault.
Lists the file attachments of an entry in an unlocked vault (name, size, MIME). Use export_attachment to get the file itself.
Lists entries in an unlocked vault. Returns titles, usernames and URLs but no passwords or other sensitive values. Supports optional search, category and folder filters.
Lists the Enpass vaults registered on this machine, whether their file exists, whether a master password is stored in the OS keychain, and whether they are currently unlocked in this session.
Locks a vault and clears its derived key from memory for this session.
Pulls the latest vault from folder-sync if configured and newer than the local copy. Backs up the local vault before replacing it.
Pushes the local vault to folder-sync if configured.
Reports the sync status of a vault: whether it is folder-synced, whether the remote is newer, and metadata.
Unlocks a registered vault using the master password stored in the OS keychain. The password is never passed as an argument and never reaches the model. Must be called before listing or reading entries.
list_items accepts limit parameter but no pagination cursor/offset. Large vaults could return 200+ items, bloating context. Should support cursor-based pagination and return next_cursor.
create_item fields parameter is array of objects but no schema for field structure visible. LLM cannot validate {label, type, value, sensitive} structure before calling.