Loading ToolBench
Thin stdio MCP server that connects to the Merkle Vault Agent via Companion Socket. Exposes vault operations (list, describe, use, reveal, put, rotate, delete, bind) and proxy tool entrypoints. One process per Claude Code window.
Merkle MCP adapter defines 8 tools with basic schemas and descriptions. All tools have input schemas with typed parameters and descriptions (vault_id, secret_id, secret_value, policy_id). Tool descriptions are present but minimal (10-50 chars), lacking context on WHEN to use each tool, prerequisites, or recovery guidance. No output schemas documented. Error handling is declared but not visible in source. Tool naming follows verb_noun pattern (vault_list, vault_describe, vault_use, vault_reveal, vault_put, vault_rotate, vault_delete, vault_bind) which is good, but descriptions do not explain distinctions between similar operations (e.g., vault_rotate vs vault_put for secret updates). No tool annotations (readOnlyHint, destructiveHint, idempotentHint) despite clear risk levels (READ_ONLY, WRITE, DESTRUCTIVE). Composition is reasonable, each tool has one responsibility, but no guidance on tool chaining or required parameter sequences.
Bind a vault to a policy or permission
Delete a secret from a vault
Describe a specific vault by ID
List all vaults in the Merkle Vault Agent
Store a secret in a vault
Reveal a secret from a vault
Rotate a secret in a vault
Activate a vault for use
Descriptions are too brief (10-50 chars) and lack context. 'Activate a vault for use' does not explain what 'activate' means, when to call it, or what state changes occur. LLMs cannot distinguish vault_use from vault_describe without richer guidance.
No output schemas documented. Tools return data but LLMs do not know what fields to expect (e.g., does vault_list return vault_id, name, status, created_at?). This breaks tool chaining and forces agents to guess field names.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint) despite clear risk levels declared (READ_ONLY, WRITE, DESTRUCTIVE). Agents cannot infer which tools are safe to retry or which require confirmation.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 46 | 2026-07-28+ | v2 |
Parameter descriptions are minimal. 'The vault identifier' and 'The secret identifier' do not explain format, constraints, or how to obtain them. LLMs cannot validate inputs or recover from lookup failures.
No error handling guidance visible. Tools declare errorReporting=true but source does not show recovery hints, error categories (retryable vs fatal), or actionable messages. Agents will not know what to do on failure.