Loading ToolBench
MCP server exposing Dev Hub Solutions' 18 dev tools (JSON, regex, JWT, UUID, password, hash, base64, color, and more) to Claude Desktop, Claude Code, and Cursor.
21 tools with complete JSON schemas and descriptions. Naming follows verb_noun convention consistently (base64_encode, hash_text, generate_uuid). Descriptions average ~120 chars, meeting the 10-1024 baseline. All parameters have type definitions and descriptions. However, output schemas are not documented, LLMs cannot predict response structure. Error handling is basic (generic error messages). No tool annotations (readOnlyHint, destructiveHint). Parameter constraints are well-specified (enums, min/max ranges). Tool composition is sound: each tool does one thing. No security issues detected (no secrets in params). Missing: output schema documentation, error recovery guidance, and tool annotations.
Decode a Base64 string to UTF-8 text. Set urlSafe=true if the input uses Base64url encoding.
Base64-encode a UTF-8 string. Set urlSafe=true for Base64url (JWT-style, no `+`, `/`, or `=` padding).
Convert text between common case styles. Returns all variants in a single JSON object: camelCase, PascalCase, snake_case, kebab-case, SCREAMING_SNAKE_CASE, Title Case, lower, UPPER.
Convert a color between HEX, RGB, HSL, and OKLCH formats. Input as HEX (e.g. '#3B82F6'). Returns all formats in a single JSON object.
Convert a date+time from one IANA timezone to another. Returns the converted ISO datetime plus a human-readable formatted string in the target zone.
Estimate token counts and per-call cost for a prompt across major LLMs (Claude 4.x, GPT-4o family, Gemini 2.5). Uses a 4-char-per-token approximation. For exact counts, use each provider's official tokenizer.
Output schemas not documented. LLMs cannot predict response structure or plan downstream tool calls. Each tool should declare what fields it returns (e.g., 'Returns JSON object with keys: hex, rgb, hsl, oklch').
No tool annotations (readOnlyHint, destructiveHint, idempotentHint). All 21 tools are read-only, but this is not declared in the schema. Clients cannot optimize caching or retry logic without explicit hints.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 63 | 2026-07-28+ | v2 |
Count characters, words, sentences, paragraphs, and estimated reading time for a piece of text. Returns a JSON object with the stats.
Line-level diff between two pieces of text. Returns a unified-style diff with `+` for added lines, `-` for removed, ` ` for unchanged.
Generate Lorem Ipsum placeholder text. unit='paragraphs' (default), 'sentences', or 'words'. count is the number of units to produce.
Generate cryptographically secure random passwords using Node's crypto.randomBytes. Configurable length, character classes, and bulk count.
Generate a QR code for any text or URL. Returns either an SVG string (default) or a Base64-encoded PNG data URI.
Generate one or many UUIDs. version='v4' for random (default), 'v7' for time-ordered (RFC 9562, the modern choice for database primary keys).
Compute the MD5, SHA-1, SHA-256, SHA-384, or SHA-512 hash of a UTF-8 string. Note: none of these are appropriate for password storage — use Argon2/scrypt/bcrypt for that.
Hash a UTF-8 string with MD5, SHA-1, SHA-256, SHA-384, and SHA-512 in one call. Returns a JSON object mapping each algorithm to its hex digest.
Format (pretty-print), validate, or minify a JSON string. mode='pretty' (default), 'minify', or 'validate'. Returns the formatted JSON or a validation result.
Decode a JWT into its header and payload. Does NOT verify the signature — use a signing library on your server for that. Returns a JSON object with header, payload, signature (raw), and expiry status.
Convert GitHub-Flavored Markdown to HTML. Supports headings, lists, tables, code blocks with language hints, strikethrough, task lists, and standard inline formatting.
Restructure a rough prompt into the five-element pattern that modern LLMs reward: role, context, task, constraints, output format. Returns the refined prompt as plain text.
Test a JavaScript regular expression against input text. Returns all matches with capture groups and their indices.
Decode a URL-encoded string. mode='component' decodes percent-encoded sequences; mode='uri' decodes a full URI.
URL-encode a string. mode='component' (default) encodes for query params; mode='uri' preserves URL structural characters (/, ?, &, #).
Error handling is generic. CallToolRequestSchema handler returns 'Error in {tool.name}: {message}' without recovery guidance. LLMs cannot self-correct or know if an error is retryable.
jwt_decode description states 'Does NOT verify the signature' but does not explain why or what the security implications are. LLMs may misuse this tool thinking it validates tokens.
generate_password description recommends 'length 16+' but the parameter default is 20 and minimum is 4. The minimum is too low for security; consider raising to 12 or 16.