Loading ToolBench

Reading the current corpus…

sp-cli MCP server · F · ToolBench

← Browse

sp-cli

github.com/prineycom/sp-cli

CLI and MCP server for managing Super Productivity via its WebDAV sync file

2026-07-28+STDIO28 tools

43/100

Definition Quality42

Protocol Readiness50

Supportability41

Spec posture

Inferred effective spec 2026-07-28+·current baseline 2026-07-28

Static source inference · medium confidence

Current-spec patterns detected

Summary

Server exposes 28 tools with complete input schemas and tool annotations (readOnlyHint, destructiveHint). Naming follows verb_noun convention (sp_list, sp_add, sp_delete). However, descriptions are uniformly terse (8-25 chars), well below the 50-200 char LLM-optimized baseline. Parameter descriptions are present but minimal. No output schemas documented. Error handling is implicit (relies on CLI behavior). Composition is sound, each tool maps to one CLI command. Security: credentials (url, user, password) are exposed as parameters, violating secret-injection pattern.

Tools (28)

sp_addwrite50/100

Add a new task

sp_agendaread only50/100

Show agenda

sp_archivereversible50/100

Archive a task

sp_archivedread only50/100

List archived tasks

sp_attachmentsread only50/100

List attachments

sp_backlogread only50/100

Show backlog tasks

sp_boardsread only50/100

List boards

sp_bulkdestructive45/100

Bulk operations on tasks

sp_countersread only50/100

List counters

sp_currentread only

Issues (5)

HIGHtool-description ↗

All tool descriptions are under 20 characters (e.g., 'List tasks', 'Show task details'). LLM-optimized descriptions should be 50-200 chars, explaining WHAT, WHEN, and any prerequisites.

sp_initsp_listsp_showsp_addsp_backlogsp_todaysp_plan_showsp_agendasp_currentsp_worklogsp_repeatssp_projectssp_tagssp_notessp_note_showsp_boardssp_counterssp_providerssp_metricssp_archivedsp_attachmentssp_pullsp_doctorsp_deletesp_archivesp_project_archivesp_bulksp_untrack

CRITICALsecret-injection ↗

Credentials (url, user, password, password_file) exposed as tool parameters in sp_init. Per pattern:secret-injection, credentials must never appear as parameters, use server-side secret injection via environment variables or vault. Agent traces log all parameters, leaking secrets.

Recommendations

Expand all tool descriptions to 50-200 characters. Example: 'List tasks' → 'List all tasks, optionally filtered by project, tag, or status (done/overdue/today/unscheduled). Returns task IDs, titles, and due dates. Use json=true for structured output.'
Move credentials (url, user, password) out of sp_init parameters. Instead, load them from environment variables (SP_WEBDAV_URL, SP_WEBDAV_USER, SP_WEBDAV_PASSWORD) or a config file. sp_init should only accept folder and backup_dir.
Document output schemas for all tools. For sp_list, sp_show, sp_add, etc., define the JSON structure returned (e.g., task object with id, title, due_date, project, tags, status). Use the json=true parameter output as the canonical schema.
Clarify sp_pull and sp_bulk. For sp_pull: 'Fetch the latest sync file from WebDAV and merge it locally. Call this before operations if you suspect remote changes.' For sp_bulk: add a 'filter' or 'operation' parameter to specify which tasks to operate on and what action to take.
Add error recovery guidance in tool descriptions. Example for sp_delete: 'Deletes a task permanently. Requires yes=true to confirm. If yes=false, returns an error asking for confirmation, pass yes=true to proceed.'

Score history

Overall score trend

First recorded score · v2 rubric

43/100

Scored	Grade	Overall	Spec posture	Rubric
2026-09-23	F	43	2026-07-28+	v2