Loading ToolBench
MCP server for Offensive360 — run SAST scans on a directory and get findings back inside your AI assistant
Two tools with clear, detailed descriptions (194 - 280 chars, well above 10-char minimum). Input schemas present with Zod validation and type constraints (min/max for timeout_seconds). However, output schemas are undocumented, formatFindings() returns plain text, not structured JSON. No error recovery guidance (e.g., 'retry with o360_scan_status'). Parameter descriptions are good but lack explicit format hints for 'path' (must be absolute). No tool annotations (readOnlyHint, idempotentHint) despite both tools being read-only or idempotent. Naming is clear (verb_noun: scan_path, scan_status) and distinguishes the two operations well.
Run an Offensive360 SAST scan on a local directory (60+ languages, taint/data-flow analysis). Uploads the directory as a zip, waits for the scan, and returns the findings with file/line, severity, and remediation guidance. Typical duration: 1–5 minutes.
Check the queue position of an Offensive360 scan started with o360_scan_path. Returns 0 when the scan is actively processing, a positive number for its queue position, and -1 when no scan is queued or running under that name (finished or unknown).
Output schemas undocumented. o360_scan_path returns formatFindings() text blob; o360_scan_status returns queue position (number) but structure not declared. LLMs cannot plan downstream actions or extract structured data.
No error recovery guidance. Timeout error mentions 'check o360_scan_status' but does not explain how to interpret queue position (0=running, positive=queued, -1=finished/unknown). LLM cannot self-correct.
Parameter 'path' lacks format constraint. Description says 'Absolute path' but does not validate or guide LLM on what 'absolute' means (must start with / on Unix, C:\ on Windows). Invites invalid input.
No tool annotations. Both tools are read-only (Risk: READ_ONLY declared in metadata) but readOnlyHint not set in schema. Agents cannot infer safety without explicit annotation.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 66 | 2026-07-28+ | v2 |
Timeout default (900s) not justified. Description says 'Typical duration: 1 - 5 minutes' but allows up to 5400s (90 min). Mismatch invites LLM to set excessive timeouts.