Loading ToolBench
Model Context Protocol server for Autodesk Platform Services (APS) with support for multiple OAuth authentication flows (2-legged, 3-legged, and Secure Service Accounts)
Server exposes 6 tools across three OAuth flows (2LO, 3LO, SSA). Critical issues: (1) Duplicate tool names, list_hubs and list_projects appear twice (files mcp_server_3lo/server.py), violating single-responsibility and composition patterns. LLM cannot disambiguate. (2) Input schemas present but minimal, most tools accept 0-1 params with basic string types; no enums, ranges, or validation hints. (3) Descriptions are adequate (50-150 chars) but lack dependency guidance, prerequisites, or error recovery hints. (4) No output schemas documented, LLMs cannot infer response structure for chaining. (5) No error handling guidance, tools return raw API responses without recovery hints. (6) Token management is server-side (good), but 3LO flow relies on deprecated Mcp-Session-Id header for state tracking. Per-tool average: 42/100.
List all OSS buckets owned by the configured APS application.
List all hubs accessible to the configured Secure Service Account.
List all hubs accessible to the authenticated user. If not yet authenticated, returns a dict with an 'auth_url' key — open that URL in a browser to complete the OAuth flow, then call this tool again.
List objects stored in a specific OSS bucket.
List all projects in a hub.
List all projects in a hub.
Duplicate tool names: list_hubs and list_projects appear twice (3LO user vs SSA variants). LLM cannot distinguish between them; will select arbitrarily or fail. Violates composition pattern (one tool, one job).
No output schemas documented. Tools return list[dict] but LLMs cannot infer field names, types, or chaining IDs. Prevents downstream tool composition and forces exploratory calls.
No error handling guidance. Tools return raw API errors without recovery hints. E.g., 'Invalid bucket_key' does not suggest search_buckets() or list available buckets.
3LO flow relies on deprecated Mcp-Session-Id header for OAuth state tracking. Current spec (2026-07-28) is stateless; session ID is removed. Migrate to per-request _meta or client-side state.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 61 | <=2025-11-25 | v2 |
Parameter descriptions lack format/constraint hints. E.g., hub_id accepts 'b.xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx' but description does not specify UUID format, length, or prefix requirement. LLMs may pass invalid IDs.