Loading ToolBench
Model Context Protocol server for Laravel — expose your application to MCP clients as RBAC-aware tools. Runs on PHP 7.3 / Laravel 8 and up.
Four well-designed introspection tools with strong descriptions (150-250 chars each) and complete JSON schemas. All parameters are typed and described. Tool names follow verb_noun convention (db_schema, app_packages, app_routes). Schemas properly declare required fields and use additionalProperties:false. Error handling via ToolException is present. Main gaps: no output schema documentation, no pagination guidance for potentially large result sets (app_routes, app_packages), and no tool annotations (readOnlyHint, idempotentHint). All tools are READ_ONLY but this is not formally declared in schema metadata.
List the Composer packages this application is built from, marking which are local path packages inside the repository and giving each one's source directory and PSR-4 namespace. Call this first when orienting in an unfamiliar codebase, or when you need to know which package owns a feature before searching for its code.
Find registered HTTP routes by URI, route name or controller, and see which controller action and middleware handle each. Use it to locate the entry point for a feature before reading code. A filter is required — this application has far too many routes to list them all.
Inspect the database schema. Called with no arguments it lists every table name; called with a table it returns that table's columns (name, type, nullable, default), indexes and foreign keys. Use it before writing any query or Eloquent code so you work from the real schema instead of guessing column names. Returns structure only — never row data.
Return the application user this session is acting as, along with the tools available to them. Call this when a tool you expected is missing or a result looks narrower than it should, so you can tell the user which access they are lacking rather than guessing.
Output schemas not documented. LLMs cannot plan downstream tool calls or extract fields without knowing response structure. E.g., db_schema returns columns/indexes/foreign_keys but this is not formally specified.
No tool annotations (readOnlyHint, idempotentHint, destructiveHint). All four tools are READ_ONLY and idempotent, but this is not formally declared in inputSchema metadata. Agents cannot distinguish safe tools from destructive ones.
app_routes and app_packages lack pagination guidance. No mention of result limits, pagination tokens, or total counts. Large codebases could return hundreds of routes/packages, exhausting context window.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 63 | <=2025-11-25 | v2 |
app_routes 'search' parameter is required but description does not explain what happens if no matches found. Error recovery guidance missing.
Parameter descriptions lack format/constraint details. E.g., 'table' in db_schema has no guidance on case sensitivity, special characters, or what happens if table does not exist.