Loading ToolBench
An MCP server that transparently handles AWS ALB authenticate-oidc sessions, so an MCP client can call protected API URLs without knowing anything about the authentication layer in front of them.
albauth defines 5 tools with complete input schemas and descriptions. Naming follows verb_noun convention (http_request, auth_login, auth_status, auth_logout, list_domains). Descriptions are present and contextual (avg ~120 chars), exceeding the 10-char minimum but below the 194-char production baseline. All parameters have type definitions and descriptions. However, output schemas are not formally documented in the source, responses are inferred from Go struct tags (LoginResult, StatusEntry, LogoutResult, DomainEntry). Error handling uses a custom error type (auth.Errorf) with codes and recovery hints, but error responses are not shown in the tool definitions themselves. No tool annotations (readOnlyHint, destructiveHint, idempotentHint) are present despite clear risk classifications in the spec. Parameter descriptions lack format constraints (e.g., URL format, domain name pattern). The http_request tool accepts free-form headers and query params without validation guidance.
Open a browser to authenticate against a configured domain. Normally unnecessary — http_request triggers this automatically.
Delete the stored session for a domain. Does not log the user out of the identity provider.
Report authentication state for one or all configured domains.
Make an authenticated HTTP request to a configured domain behind an ALB OIDC listener rule. Authentication is handled transparently; on first use for a domain a browser window will open for login.
List the domains this server can reach, with their base URLs, host match patterns and allowed methods.
Output schemas not formally documented. Responses are Go structs (LoginResult, StatusEntry, LogoutResult, DomainEntry) visible only in code, not in tool definitions. LLMs cannot plan downstream calls without knowing response field names and types.
Tool annotations missing. http_request is READ_ONLY, auth_login is WRITE, auth_logout is DESTRUCTIVE, but no readOnlyHint, destructiveHint, or idempotentHint are declared in the schema. LLMs cannot infer safety properties.
Parameter format constraints not documented. 'url' parameter accepts 'Full URL (https://api.example.com/v1/users) or a path (/v1/users)' but no regex pattern or format constraint is specified. 'domain' parameter has no validation guidance. LLMs may pass invalid values.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 61 | 2026-07-28+ | v2 |
Error handling not visible in tool definitions. Custom error type (auth.Errorf with CodeInvalidRequest, CodeStorageUnavailable) exists in code but error response schema is not documented. LLMs cannot predict error structure or recovery steps.
http_request tool accepts arbitrary headers and query params without validation. No guidance on forbidden headers (e.g., Authorization, which should be handled transparently), content-type negotiation, or payload size limits. Invites misuse.