Loading ToolBench
Code-mode MCP server for the Make.com Web API v2. Two tools (search + execute) with QuickJS WASM sandbox plus an optional Cloudflare Workers entry. Single-user (env) and multi-user (per-request HTTP headers) modes.
Two tools with detailed descriptions and clear purpose, but significant schema and parameter documentation gaps. Both tools accept only a 'code' string parameter with minimal constraint documentation. Descriptions are comprehensive (500+ chars each) but lack actionable parameter guidance. No output schemas documented. Error handling is structured (prefixed tags) but recovery guidance is generic. Tool names are clear action verbs ('search', 'execute') but lack verb_noun convention. Missing parameter type constraints, ranges, and validation rules that LLMs need to avoid hallucinated code.
Run Make.com API calls by writing JavaScript that uses the `make` namespace. Surface: - `make.<tag>.<operationId>(args)` — typed operation call, e.g. `make.scenarios.listScenarios({ teamId: 1, pg: { limit: 50 } })`. Args are auto-routed: keys matching path or query params from the spec are placed correctly; remaining keys form the JSON body if the operation accepts one. To override, pass `{ pathParams: {...}, query: {...}, body: {...}, headers: {...} }`. - `make.callOperation(operationId, args)` — flat lookup by id. - `make.request({ method, path, pathParams?, query?, body?, headers? })` — raw HTTP escape hatch. - `make.spec` — `{ title, version, sourceUrl, operationCount }` for diagnostics. Operations are async — use `await`. The final expression is the tool result. ## Examples ```javascript const me = await make.callOperation('getUser', {}); return me.data; ``` ```javascript const orgs = await make.callOperation('getOrganizations', {}); return orgs.organizations.map(function (o) { return { id: o.id, name: o.name }; }); ``` ```javascript // Raw escape hatch — call an endpoint not present in the spec const r = await make.request({ method: 'GET', path: '/users/me' }); return r; ``` ## Errors Errors are prefixed with a structured tag: - `[make.http] HTTP 403 on /scenarios: ... (operation requires scope `scenarios:read` — check your Make.com API token has it)` - `[make.missing-credentials] ...` when no API key is configured - `[make.unknown-operation] ...` when the operationId doesn't exist in the spec - `[make.error] ...` for everything else ## Limits - Hard ceiling on API calls per execute; exceeded → error. - Sandbox memory + time bounded. - Credentials never enter the sandbox. - The free Make.com plan only includes "Limited" API access — paid plans unlock full /api/v2. Admin/internal endpoints will 403 on most tokens.
Search the Make.com Web API v2 OpenAPI spec by writing JavaScript. The sandbox is read-only — no network. Use this tool to **discover** what to call before invoking `execute`. ## Globals - `spec` — `{ title, version, sourceUrl, serverPrefix, operations[] }` Operations are compact: `{ operationId, method, path, tag, summary, parameters, hasRequestBody, deprecated, requiredScopes? }`. `spec` may be `null` if no spec is loaded. - `searchOperations(query, limit?)` — text-ranked search. - `getOperation(operationId)` — full operation including spec parameter detail. Pass either an `operationId` or `"METHOD /path"`. - `findOperationsByPath(substring)` — list operations whose path contains the substring (case-insensitive). - `console.log()` — captured into the tool output. ## Examples ```javascript // All operations tagged "scenarios" spec.operations.filter(function (op) { return op.tag === 'scenarios'; }); ``` ```javascript // Top 10 hits for "data store" searchOperations('data store', 10); ``` ```javascript // Full detail on listScenarios getOperation('listScenarios'); ```
No input schema validation or constraints visible. Both tools accept a single 'code' parameter (string) with no type enforcement, length limits, or format constraints. LLMs can pass arbitrarily large or malformed code without early validation.
Output schemas not documented. Tool descriptions explain what globals/APIs are available but do not specify the structure of returned results. LLMs cannot plan downstream operations or extract specific fields reliably.
Parameter 'code' lacks actionable constraints. No mention of max code size (MAX_CODE_SIZE constant exists in limits.js but is not surfaced in parameter description), timeout behavior, or sandbox memory limits. LLMs cannot reason about safe code complexity.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 63 | 2026-07-28+ | v2 |
Error messages are structured (prefixed tags like [make.http], [make.missing-credentials]) but lack recovery guidance. 'HTTP 403 on /scenarios' tells the LLM an error occurred but not what to do next (e.g., 'Check your API token scope' is mentioned but not actionable for retry logic).
Tool names do not follow verb_noun convention. 'search' and 'execute' are bare verbs; 'search_spec' and 'execute_api_call' would be clearer and more discoverable when many tools are available.