Loading ToolBench
Infrastructure-as-Code automation server for AWS. Generates, validates, plans, applies, and destroys Terraform infrastructure from blueprints. Supports ECS, Lambda, and EKS deployments with security best practices pre-configured.
Gentepede demonstrates solid tool design with clear action verbs, comprehensive descriptions (avg 180 chars), and well-structured schemas. All 8 tools have explicit input schemas with typed properties and descriptions. However, output schemas are entirely undocumented, LLMs cannot predict response structure for downstream chaining. Parameter descriptions lack format constraints (e.g., 'alphanumeric and hyphens only' for project_name is stated but not formalized). Error handling guidance is absent, tools describe what they do but not how to recover from failures. Tool composition is strong: each tool has a single responsibility, and the workflow (list → generate → validate → plan → apply) is well-sequenced.
Applies the previously reviewed plan. Verifies the plan file checksum before applying to prevent stale plan application. Creates a timestamped state backup before applying. For EKS blueprints, runs helm upgrade --install after Terraform completes. Verifies AWS credentials first. WARNING: this deploys real infrastructure. Run plan_infrastructure_package first and review the output carefully.
Runs comprehensive security and compliance audit on an existing workspace. Executes checkov (all checks, no abort), kube-score (all checks, no abort), and for EKS blueprints: kubectl auth can-i (RBAC audit). Never aborts — always returns full report. Makes zero AWS API calls. Run this anytime to get a complete security posture snapshot.
Destroys all infrastructure in the workspace. Verifies AWS credentials first. For EKS blueprints: uninstalls the Helm release first and waits for pods to terminate before Terraform destroys the node group. Creates a state backup before destroying. Deletes the workspace directory after successful destruction.
Detects drift between the Terraform state and actual AWS resources. Uses terraform plan -detailed-exitcode: exit 0 = no drift, exit 2 = drift detected. For EKS blueprints, also runs helm diff upgrade (requires helm-diff plugin). Verifies AWS credentials first.
Output schemas completely undocumented. LLMs cannot predict response structure, field names, or types. Breaks tool chaining, agent cannot extract project_id or workspace_path from generate_infrastructure_package to pass to downstream tools.
No error recovery guidance. Tools describe what they do but not how to recover from failures. E.g., generate_infrastructure_package could fail if blueprint_name is invalid, but no guidance on how to discover valid names or retry.
Parameter constraints stated in prose but not formalized. 'alphanumeric and hyphens only' for project_name lacks a regex pattern or enum. LLMs cannot validate input before calling and may pass invalid values.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 63 | 2026-07-28+ | v2 |
Generates a complete infrastructure workspace from a blueprint. Creates Terraform files (main.tf, variables.tf, terraform.tfvars, providers.tf) and for EKS blueprints also a production-ready Helm chart. Workspace is created at ~/.gentepede/workspaces/{project_name}/. Targets real AWS with an S3 remote state backend.
Lists all available infrastructure blueprints. Each blueprint describes a complete AWS architecture (ECS/EKS/Lambda) with security best practices pre-configured. Use this first to choose a blueprint before calling generate_infrastructure_package.
Runs terraform plan and generates a human-readable summary of what will be created, modified, or destroyed. Verifies AWS credentials first. Writes a plan file checksum to gentepede.lock.json for integrity checking at apply time. Also runs infracost for cost estimation (skipped if not installed). For EKS blueprints, renders Helm manifests for review alongside the Terraform plan.
Runs static analysis on an existing workspace. Executes: terraform init -backend=false (skips S3 backend — no credentials needed), terraform validate, checkov (aborts on HIGH/CRITICAL), and for EKS blueprints: kube-score (aborts on CRITICAL). Makes zero AWS API calls — no credentials required. Run this after generate_infrastructure_package and before planning.
No confirmation or dry-run pattern for destructive operations. apply_infrastructure_package and destroy_infrastructure_package modify real AWS infrastructure but lack a confirmation step or dry-run mode. Agents could accidentally deploy or destroy without review.
Missing tool annotations. No readOnlyHint, destructiveHint, or idempotentHint metadata. Clients cannot infer operation safety, agents may retry destructive operations or skip read-only caching.