Loading ToolBench
Official MCP server for Signet — OAuth diagnostics and flow-testing tools over streamable HTTP
Signet MCP provides 15 well-named OAuth/OIDC diagnostic tools with consistent verb_noun naming (signet_get_*, signet_decode_*, signet_introspect_*, signet_revoke_*, signet_exchange_*, signet_refresh_*). All tools have descriptions (avg ~80 chars, within 10-1024 range). However, input schemas are visible only in test files (server_test.go), not in actual tool registration code. Parameter descriptions are present but terse (avg ~50 chars). Output schemas are undocumented, no response structure definitions visible. Error handling is basic; no recovery guidance or actionable error messages evident. Security posture is strong (no secrets in params, SSRF guards on CIMD fetcher), but composition could be tighter (signet_tokeninfo and signet_introspect_token appear redundant).
Build an authorization URL for the authorization code flow with PKCE
Request a token using the client credentials grant
Decode and verify a JWT token offline using the issuer's JWKS
Poll for completion of a device authorization flow
Start a device authorization flow
Exchange an authorization code for tokens in the authorization code flow
Fetch the JSON Web Key Set (JWKS) from the issuer
Output schemas undocumented. No response structure definitions visible in source. LLMs cannot plan downstream tool calls or extract fields without knowing what each tool returns.
Input schemas visible only in test files (server_test.go), not in actual tool registration. Cannot verify if schemas are registered with the MCP server at runtime. Per HARD SCORING RULE, tools without visible schema registration cap at 50.
Redundant tools: signet_tokeninfo and signet_introspect_token appear to perform the same function (token introspection). LLMs waste reasoning cycles deciding between them. Consolidate to one canonical name.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 57 | <=2025-11-25 | v2 |
Fetch OAuth authorization server metadata from /.well-known/oauth-authorization-server
Check the health status of the Signet server
Introspect a token at the token introspection endpoint
Refresh an access token using a refresh token
Revoke a token at the revocation endpoint
Get token information from the token introspection endpoint
Fetch user information from the userinfo endpoint
Validate a CIMD (Credential Issuer Metadata) document from a URL
No error handling guidance. Error responses do not indicate whether failures are retryable, user-fixable, or fatal. LLMs cannot determine next steps on failure.
Parameter descriptions are terse (avg ~50 chars). Missing format/constraint details. E.g., 'scopes' param lacks guidance on valid scope names; 'audience' param lacks explanation of when it is required vs optional.