Loading ToolBench
Connect any MCP-compatible LLM to the Cullis federated agent trust network. Enables E2E-encrypted agent↔agent messaging, x509 mutual auth, DPoP-bound tokens, and cross-org agent discovery.
Cullis MCP server has 8 tools with basic schemas and descriptions, but significant gaps limit production readiness. All tools have descriptions (10-100 chars, mostly adequate) and input schemas with type definitions. However, parameter descriptions are sparse or missing context. No output schemas documented. Error handling is absent, tools provide no recovery guidance. Tool naming follows verb_noun pattern (cullis_*) but lacks clarity on distinctions (e.g., cullis_send vs cullis_check_responses). No tool annotations (readOnlyHint, destructiveHint). Security-critical tools (cullis_connect, cullis_send, cullis_accept_session) lack permission gates or audit trail documentation. Composition is reasonable, tools chain logically (connect → discover → open_session → send/check → close), but missing idempotency guarantees and batch operations.
Accept an incoming session request.
Check for incoming session requests from other agents.
Check for new messages from the peer agent in the active session.
Close the active session.
Connect to the Cullis broker. Uses environment variables as defaults. Call this first before using other Cullis tools.
Search for agents in the Cullis network.
No output schemas documented. Tools return unstructured responses; LLMs cannot plan downstream calls or extract required fields (e.g., session_id from cullis_open_session). Violates pattern:tool and pattern:response-shaper.
No error handling or recovery guidance. Tools provide no actionable error messages. If cullis_discover returns empty results or cullis_send fails, LLM has no guidance on retry, fallback, or user correction. Violates pattern:recovery-guide and pattern:error-classification.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 59 | 2026-07-28+ | v2 |
Open a secure session with another agent on the Cullis network.
Send an E2E-encrypted message in the active session.
Security-critical tools lack permission gates and audit trail documentation. cullis_connect, cullis_send, cullis_accept_session, and cullis_close_session modify state or establish connections but do not declare required permissions (e.g., 'write:session', 'read:network'). No audit logging guidance. Violates pattern:permission-gate and pattern:audit-trail.
Parameter descriptions lack context and constraints. 'q' in cullis_discover is vague ('Free-text search'); no guidance on format, length, or special characters. 'capabilities' in cullis_open_session lacks enum or format spec. 'pattern' in cullis_discover mentions glob but no examples. Violates pattern:constrained-input and pattern:tool-description.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint). LLMs cannot distinguish safe reads (cullis_check_responses) from destructive writes (cullis_send, cullis_close_session) without explicit hints. Violates current MCP spec (2026-07-28) tool annotation pattern.