Loading ToolBench
Server has 7 tools with complete input schemas and descriptions. Naming follows verb_noun convention (xdr_get_*, xdr_search, xdr_mark_event). Descriptions are present and adequate (50-150 chars), explaining WHAT each tool does. However, descriptions lack WHEN to use them and dependency hints. Parameters have types and descriptions, but lack enums for the 'section' parameter despite it accepting only 10 known values. Output schemas are not documented, LLMs cannot predict response structure. Error handling is basic (RuntimeError with messages) but lacks recovery guidance or categorization. No tool annotations (readOnlyHint/destructiveHint) despite clear risk levels. xdr_mark_event is gated behind XDR_ALLOW_WRITE env var, which is good security practice, but the tool description should emphasize this prerequisite more clearly.
Get the count of records matching a query in a section.
Get the enumerated values for a filterable field in a section.
Get the field mapping for a section, showing which fields are searchable, their types, and which support filtering.
Get a single record by ID from a section.
Get suggestions for a field value in a section, useful for finding the exact spelling of a value.
Mark an event as read or unread. This tool is only available when XDR_ALLOW_WRITE environment variable is set to 1, true, or yes.
Output schemas not documented. LLMs cannot predict response structure or plan downstream tool calls. xdr_search, xdr_get_mapping, xdr_get_filters, xdr_get_suggestions, xdr_get_count, xdr_get_record all return data but response fields are not specified.
'section' parameter accepts only 10 known values but is defined as free-form string. Should be an enum: [alerts, incidents, emails, files, events, connections, assets, modules, audit, applications]. Enums prevent hallucinated values and are self-documenting.
Tool annotations missing. xdr_mark_event is destructive (WRITE risk) but has no destructiveHint. Read-only tools lack readOnlyHint. Annotations help LLMs reason about safety and retry logic.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 59 | 2026-07-28+ | v2 |
Search a section using a query string with field:value syntax. Supports AND, OR, AND NOT, OR NOT operators and parentheses for grouping. Wildcards (*) are supported in string values.
Descriptions lack WHEN to use each tool and dependency hints. E.g., xdr_get_mapping should say 'Call this first to discover available fields before constructing a search query.' xdr_get_filters should explain when to call it vs xdr_get_suggestions.
xdr_mark_event description does not emphasize that it requires XDR_ALLOW_WRITE=1 to be available. LLMs may attempt to call it without knowing the prerequisite, leading to confusing 'tool not found' errors.