Loading ToolBench
Supply-chain security scanner for MCP servers and Claude Code projects — catch tool-poisoning, command injection and risky permissions before you install.
Two security-focused tools with clear, well-documented purposes. Both have complete input schemas with enums and descriptions. Descriptions are substantive (150+ chars each) and explain the security value proposition. Tool names are action-oriented (scan, discover). However, output schemas are not formally documented in the code, responses are described as 'JSON report' without field-level schema visibility. Error handling and recovery guidance are absent. No tool annotations (readOnlyHint, destructiveHint) despite both tools being explicitly read-only, a missed opportunity to model the pattern they audit for.
Enumerate well-known MCP client config locations on this machine (Claude Desktop, Claude Code CLI, Cursor, VS Code, Windsurf, Amazon Q Developer CLI, Cline) and scan whichever exist with mcpscan's normal rule set. Closes OWASP MCP09:2025 (Shadow MCP Servers) — surfaces servers a directory scan of a single project would never see, since these configs live outside any project tree. Returns a JSON report. Read-only; never executes the scanned code.
Statically scan a local path (an MCP server, package, or .claude/ directory) for supply-chain security issues: tool poisoning, command injection, dangerous hooks, over-broad permissions, leaked secrets, vulnerable SDKs, path traversal and SSRF. Returns a JSON report. Read-only; never executes the scanned code.
Output schemas not formally documented. Both tools return 'JSON report' but field structure, types, and required fields are not visible in code. LLMs cannot plan downstream processing without knowing response shape.
No tool annotations despite auditing for them. Both tools are explicitly read-only (description states 'Read-only; never executes') but lack readOnlyHint: true in their definitions. Hypocritical for a security scanner that flags missing annotations.
No error recovery guidance. If scan fails (e.g., path not found, permission denied), the tool provides no actionable next steps. Error messages should guide the LLM toward resolution.
min_severity parameter lacks validation constraints in description. While enum is present in schema, description should state 'Must be one of: info, low, medium, high, critical' to ensure LLM compliance.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 61 | 2026-07-28+ | v2 |
scan's 'path' parameter lacks format guidance. Should specify: 'Absolute or relative file/directory path. Supports .claude/ directories, mcp.json files, or package.json with MCP dependencies.'