Loading ToolBench
MCP server exposing full recon-ng OSINT framework functionality
18 tools with consistent but minimal documentation. All tools have descriptions (10-200 chars, mostly 50-150), but descriptions lack actionable context for LLM selection. Parameter descriptions are present but generic ('Name of the workspace to create' vs 'Workspace name (2-50 alphanumeric chars, lowercase preferred)'). No input schemas visible in source, only parameter names and types inferred from docstrings. No output schemas documented. Error handling returns generic success/error dicts without recovery guidance. No enum constraints, no pagination support, no idempotent hints. Tool names follow verb_noun pattern (good), but composition issues: run_command is a catch-all that duplicates module_run and other specific tools.
Delete records from the recon-ng database. Args: table: Table name to delete from. where: WHERE clause to specify which records to delete. Returns: Dictionary with success status and table name.
Insert a record into the recon-ng database. Args: table: Table name to insert into. data: Dictionary of column names and values to insert. Returns: Dictionary with success status and table name.
Query the recon-ng database. Args: table: Table name to query. where: Optional WHERE clause for filtering. Returns: List of result dictionaries from the query.
Get information about the recon-ng installation. Returns: Dictionary with info output and any error information.
Install a module from the recon-ng marketplace. Args: module_path: Path to the module to install. Returns: Dictionary with success status and module path.
Remove a module from the recon-ng marketplace. Args: module_path: Path to the module to remove. Returns: Dictionary with success status and module path.
No input schemas visible in source code. Tool definitions show parameter names and types in docstrings only, not as formal JSON Schema. Cannot verify schema completeness, type validation, or constraints.
Descriptions lack actionable context for LLM selection. Generic phrases like 'Name of the workspace to create' do not explain when to use this tool vs alternatives, constraints, or prerequisites. Descriptions should be 50-200 chars with clear intent.
No output schemas documented. Tools return dicts with success/error fields, but LLMs cannot plan downstream calls without knowing exact response structure. E.g., workspace_create returns {success, workspace} but no guarantee of field types or presence.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 45 | 2026-07-28+ | v2 |
Search the recon-ng marketplace for modules. Args: query: Search query string. Returns: List of module dictionaries with name and description.
List available modules in recon-ng, optionally filtered by category. Args: category: Optional category to filter modules. Returns: List of module dictionaries with path information.
Load a module in recon-ng. Args: module_path: Path to the module to load. Returns: Dictionary with success status and module path.
List options for the currently loaded module. Returns: List of option dictionaries with name, value, and description.
Set an option for the currently loaded module. Args: key: Option name to set. value: Value to set for the option. Returns: Dictionary with success status, key, and value.
Run the currently loaded module. Returns: Dictionary with success status, output, and error information.
Unload the currently loaded module. Returns: Dictionary with success status.
Run an arbitrary recon-ng command. Args: command: The recon-ng command to execute. Returns: Dictionary with success status, output, and error information.
Create a new workspace in recon-ng. Args: name: Name of the workspace to create. Returns: Dictionary with success status and workspace name. Example: >>> workspace_create("new_project") {"success": True, "workspace": "new_project"}
Delete a workspace from recon-ng. Args: name: Name of the workspace to delete. Returns: Dictionary with success status and workspace name.
List all workspaces in recon-ng. Returns: List of workspace dictionaries with name and info. Example: >>> workspace_list() [{"name": "default"}, {"name": "osint_project"}]
Switch to a different workspace. Args: name: Name of the workspace to switch to. Returns: Dictionary with success status and workspace name. Example: >>> workspace_switch("osint_project") {"success": True, "workspace": "osint_project"}
run_command is a catch-all that duplicates specific tools (module_run, workspace_switch, etc.). This violates single-responsibility principle and forces LLMs to choose between run_command and specific tools, wasting reasoning cycles.
Error handling returns generic {success: false, error: string} without recovery guidance. Errors like 'Failed to list workspaces' do not tell LLM what to do next. Should include actionable hints (e.g., 'Workspace not found. Try workspace_list() to see available workspaces.').