Loading ToolBench
MCP server that enables ChatGPT to query and write to PostgreSQL databases via the freebase.cloud platform. Provides tools for reading and writing job application tracking data.
Both tools have minimal descriptions (under 100 chars) and critically lack input parameter descriptions. The 'sql' parameter in both tools has no description explaining constraints, format, or valid table names. No output schemas are documented. Tool names lack action verbs (pg_store, pg_query are noun-based). No error handling guidance. No security considerations for SQL injection despite accepting raw SQL strings. This server exposes a direct SQL interface without validation, which is a high-risk pattern.
Query PostgreSQL database to read job application tracking data
Write data to PostgreSQL database via INSERT/UPDATE statements
Parameter descriptions missing entirely. The 'sql' parameter in both tools has no description explaining what SQL is valid, which tables exist, or what constraints apply. LLMs cannot infer valid SQL syntax from the parameter name alone.
No output schema documented. Callers cannot know what fields pg_query returns or what pg_store returns on success/failure. This forces LLMs to guess at response structure.
Tool names lack action verbs. 'pg_store' and 'pg_query' are noun-based and do not clearly signal intent. Should be 'execute_sql_insert', 'execute_sql_update', 'query_database' or similar verb_noun patterns.
No SQL injection protection or input validation visible. Tools accept raw SQL strings with no sanitization, validation, or parameterized query support. This is a critical security vulnerability when agents are involved.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 34 | 2026-07-28+ | v2 |
No error handling guidance. No documentation of what errors can occur, how to recover, or what the LLM should do if a query fails. Raw database errors will be returned to the LLM without context.