Loading ToolBench
MCP server, AI skill & Hermes tool for the Stars Cash Flow reseller API — Telegram Stars CPA / SMM panel (JustAnotherPanel-compatible).
Five tools with clear verb-noun naming (list_, get_, create_, order_, cancel_). All have descriptions (194 - 250 chars, within baseline 34 - 392). Input schemas use Zod with type definitions and descriptions. Strong error handling with actionable messages (e.g., 'Unknown service ID, call list_services'). Two-step confirmation pattern on destructive ops (create_order, cancel_order) prevents accidental spend. Key gaps: no output schemas documented; parameter descriptions could be more prescriptive on constraints (e.g., 'up to 100' for orders array lacks min/max in schema); no tool annotations (readOnlyHint/destructiveHint) despite clear risk levels.
Cancel one or more orders. The unfulfilled remainder is refunded to the key's USD balance — this changes money state. Two-step by design: call without `confirm` to see what would be cancelled; call again with confirm=true to actually cancel.
Place a Stars Cash Flow order. THIS SPENDS the key's USD balance. Two-step by design: call without `confirm` (or confirm=false) to get a cost estimate and validation; call again with confirm=true to actually place the order. `link` is the target channel/post/bot link (required for most services).
Get the remaining USD balance of the configured reseller API key.
List the Stars Cash Flow service catalog with live USD rates (per 1000), min/max quantity and whether each service needs a link. No API key required. Use this to discover service IDs and price an order before calling create_order.
Get the status of one or more orders. Pass a single `order` or a list of `orders` (up to 100). Returns charge, start_count, status, remains.
Output schemas not documented. LLMs cannot infer what fields order_status or create_order return, forcing them to guess downstream field names and risk broken tool chains.
Tool annotations missing. create_order and cancel_order have clear destructive/reversible risk levels but lack readOnlyHint/destructiveHint/idempotentHint in schema, preventing MCP clients from rendering safety warnings.
Parameter constraints not formalized in schema. 'orders' array says 'up to 100' in description but lacks maxItems in Zod schema; 'quantity' lacks explicit min/max bounds despite validation logic in handler.
Mutual exclusivity not enforced. order_status accepts both 'order' and 'orders' but handler returns error if neither provided, should use oneOf in schema or explicit validation.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 65 | 2026-07-28+ | v2 |
API key injection pattern unclear. Code checks client.hasKey() but no documentation on how to configure the key (env var? config file?), risking misconfiguration.