Loading ToolBench
MCP server for managing secrets in macOS Keychain and Bitwarden vaults. Exposes tools for generating, rotating, listing, and injecting secrets into child processes without revealing values to the client.
Tools have clear, action-oriented names (secret_generate, secret_rotate, bw_run) and descriptions that explain what happens and when to use them. However, parameter descriptions are sparse or missing entirely. Most tools lack explicit type constraints (enums, patterns, ranges) in schemas. Output schemas are not documented. Error handling guidance is absent. The server demonstrates good naming discipline and security-conscious design (no secret exposure, redaction), but falls short on LLM-optimization patterns like parameter constraints, output documentation, and recovery guidance.
Report each reference's value length. Confirms a reference resolves before you rely on it.
Delete a Bitwarden item by exact name.
Create a random Bitwarden value blind. Returns name and length only. Overwrites the item if it exists, which is the rotation path.
List Bitwarden item names. Start here: references must match a name exactly.
Run a command with Bitwarden values in its environment. Output is redacted before it returns.
Delete a keychain secret.
Create a keychain secret blind. Returns name and length only. Fails if the name exists; use secret_rotate instead.
Output schemas not documented. LLMs cannot infer what fields secret_generate, bw_check, or bw_run return, forcing them to guess at downstream field names and risk broken tool chains.
Parameter descriptions are minimal or absent. 'name' in secret_generate has no description beyond the regex constraint. 'env' in secret_run lacks guidance on how to map variable names to secret references. LLMs cannot reason about parameter semantics.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 55 | 2026-07-28+ | v2 |
List keychain secret names.
Overwrite a keychain secret with a fresh blind value.
Run a command with keychain secrets in its environment. Output is redacted before it returns.
No error handling guidance. Tools like secret_delete and bw_delete are destructive but provide no recovery hints. If deletion fails, the LLM has no actionable next step. No distinction between retryable and fatal errors.
No input validation constraints in schemas. 'length' parameter accepts minimum 8 but no maximum; 'timeout_s' has no bounds. LLMs can pass absurd values (length=999999, timeout_s=999999) that break execution.
Destructive operations (secret_delete, bw_delete) lack confirmation or dry-run support. Agents can permanently delete secrets without a safety gate, risking catastrophic data loss.