Loading ToolBench
Trust registry & governance service for MCP servers, Skills, and Tools that AI agents depend on. Control-plane backend for tool/skill inventory, approval workflows, drift detection, and security scanning.
Vouchq defines 8 tools with complete input schemas and descriptions. Naming follows verb_noun convention (list_, get_, approve_, block_, fetch_). Descriptions are substantive (100-200 chars typical), explaining WHAT and WHEN. However, parameter descriptions lack depth, many are single-clause (e.g., 'Tool UUID' for id params). Output schemas are not documented in the visible code. Error handling is absent from tool definitions. No tool annotations (readOnlyHint, destructiveHint) despite clear risk stratification (READ_ONLY vs WRITE). Pagination is implemented (limit, page, X-Total-Count header) but not consistently described. Security-sensitive tools (approve_tool, block_tool) accept actor names as strings with no validation guidance.
Approve a tool version, pinning it as the canonical governed version. Requires MEMBER or ADMIN role.
Block a tool, preventing its use. Requires MEMBER or ADMIN role.
Connect to an MCP server endpoint and call tools/list via JSON-RPC 2.0. Parses and normalizes tool definitions with stable hashing.
Retrieve the approved (pinned) artifact for a tool, reconstructed from its approved ToolVersion so a consumer can install the exact governed version.
Issue a vouched install config for the MCP server this tool belongs to. Only MCP servers in good standing (at least one APPROVED tool, no BLOCKED or DRIFTED tools) are installable.
Retrieve full tool detail: current and pinned definition, version history, open drift events, and scan results.
Output schemas not documented. Tools return complex objects (ToolView, ScanResult, ApprovedVersion) but LLMs cannot see field structure, types, or which fields are required. Downstream tool chaining is blind.
No tool annotations despite clear risk stratification. approve_tool and block_tool are destructive (WRITE) but lack destructiveHint annotation. All READ_ONLY tools lack readOnlyHint. LLMs cannot infer safety properties.
Parameter descriptions are minimal (single clause, e.g., 'Tool UUID', 'Actor name'). No format constraints, validation rules, or dependency hints. LLMs cannot infer valid input ranges or relationships between params.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 64 | 2026-07-28+ | v2 |
Server/Skill-bundle inventory listing. Returns all registered MCP servers and skill bundles for the authenticated org.
Inventory listing with optional kind/status/name search filters. Returns paginated tool list with total count header.
No error handling guidance in tool definitions. Destructive tools (approve_tool, block_tool) accept actor names as free-form strings with no validation. No recovery hints for common failures (tool not found, permission denied, invalid status).
fetch_mcp_tools accepts bearerToken as a parameter. Credentials should never be exposed as tool parameters, use server-side secret injection via environment or vault. Agent traces log all parameters, leaking secrets.