Loading ToolBench
Zero-trust delegation system for MCP-based multi-agent systems
AgentBond defines 4 tools with complete input schemas and descriptions. Tool names follow verb_noun convention (delegate_capability, invoke_tool, get_audit_log, run_delegation_demo). Descriptions are detailed (150-400 chars) and explain WHAT, WHEN, and WHY. However, descriptions embed example values ('customer_id: "123"') which LLMs may reuse literally. Output schemas are documented in Pydantic models but not visible in tool registration. Error handling is implicit (PermissionError raised) rather than explicit recovery guidance. No tool annotations (readOnlyHint, destructiveHint, idempotentHint) despite clear risk levels (WRITE vs READ_ONLY). Parameter descriptions are thorough but lack explicit format/constraint guidance (e.g., 'ttl: 1 - 3600 seconds' is present, but 'allowed_tools must be a non-empty list' is not stated).
Issue a capability token that grants a worker agent scoped permissions. The token encodes: allowed tool names, resource constraints, TTL, and whether the worker may delegate further (re_delegation). If parent_token is provided, the parent token must have re_delegation=true or this call raises PermissionError.
Return all accumulated delegation and invocation events in chronological order. Each entry has event_type (DELEGATION or ATTEMPT), timestamp, token_id, and event-specific fields.
Enforce a capability token and dispatch to the named underlying tool. Enforcement rules (ordered, return on first failure): 1. JWT signature valid 2. JWT not expired 3. tool_name in token's allowed_tools 4. All resource_scope constraints satisfied Returns allowed=True + result on success, or allowed=False + denial_reason on failure. Every call produces an ATTEMPT audit entry regardless of outcome.
Execute the canonical AgentBond demo in a single call. No arguments needed. Issues a capability token for worker-agent-001 with: allowed_tools=["read_customer_record"], resource_scope={customer_id: "123"}, ttl=300, re_delegation=false Then runs 4 scenarios: 1. read_customer_record(customer_id=123) -> ALLOWED 2. write_customer_record(customer_id=123) -> DENIED: TOOL_NOT_IN_SCOPE 3. read_customer_record(customer_id=456) -> DENIED: RESOURCE_OUT_OF_SCOPE 4. delegate_capability(parent_token=...) -> DENIED: RE_DELEGATION_DENIED Returns all scenario outcomes plus the complete audit log (5 entries). Resets the audit log at the start — always produces a clean, deterministic result.
Example values embedded in descriptions ('customer_id: "123"') risk LLM literal reuse. Replace with enum/pattern constraints.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint) despite explicit risk levels (WRITE vs READ_ONLY). Agents cannot infer safety properties.
Error handling raises PermissionError without actionable recovery guidance. LLM receives exception; should return structured error with next steps.
Output schemas (AuditLogOutput, CallToolOutput, DelegateOutput) defined in models.py but not visible in tool registration. LLM cannot see return structure.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 55 | 2026-07-28+ | v2 |
Parameter 'allowed_tools' lacks constraint documentation (must be non-empty, valid tool names only). Validation happens at runtime; LLM has no guidance.