Loading ToolBench

Reading the current corpus…

omnodex MCP server · F · ToolBench

omnodex

Omnodex MCP proxy interceptor: sits between any MCP-capable agent and its upstream MCP servers, logging TraceEvents to the local event log.

2025-06-18+STREAMABLE_HTTP1 tools

39/100

Definition Quality38

Protocol Readiness42

SupportabilityNot measured-

Spec posture

Inferred effective spec 2025-06-18+·current baseline 2026-07-28

Static source inference · medium confidence · detected: stateful session

Deprecated protocol patterns detected

Summary

Single tool 'connect' has a moderately detailed description (180+ chars) but critical schema gaps. Input schema visible with two parameters (platform, project_label) both typed as strings with descriptions. However, NO output schema is documented anywhere in the provided source. The tool performs a WRITE operation (generates credentials, encrypts passphrases, calls cloud API) but lacks error handling guidance, recovery instructions, and security warnings about credential exposure. Description does not state what the tool returns or when to use it.

Tools (1)

connectwriteauth48/100

Built-in MCP tool that generates a dashboard connection link from within the proxy process. Reads credentials from stream-config.json / env vars, auto-generates a passphrase if none exists, encrypts the passphrase under a one-time transfer key (AES-256-GCM), creates a claim token via the cloud API, and returns the connection URL with the transfer key in the fragment.

Issues (5)

CRITICALtool ↗

No output schema documented. Tool returns a connection URL with transfer key but LLM cannot plan downstream actions or extract fields without knowing response structure.

connect

CRITICALrecovery-guide ↗

WRITE operation (generates credentials, encrypts passphrases, calls cloud API) lacks error handling guidance. Description does not explain what can fail, how to recover, or whether operation is idempotent.

connect

HIGHtool-description ↗

Description does not state WHAT the tool returns or WHEN to use it instead of alternatives. At 180 chars, it explains the internal mechanism but not the user-facing contract.

connect

HIGHsecret-injection ↗

Tool handles credentials and encryption keys but no security warnings in description. No mention that credentials are server-side injected or that passphrases are auto-generated if missing.

connect

Recommendations

Document the complete output schema: return type (object), fields (connection_url, transfer_key, passphrase_encrypted, claim_token, expiry), and field types. Example: {connection_url: string, transfer_key: string, claim_token: string}.
Add error handling guidance: 'If cloud API is unreachable, returns error with retry guidance. If credentials are invalid, returns error with setup instructions. Operation is idempotent, safe to retry.'
Rewrite description to answer: WHAT (generates a secure dashboard link), WHEN (call this to onboard a new agent or platform), WHAT IT RETURNS (a URL and transfer key for secure credential exchange).
Add security note: 'Credentials are read from server-side config (stream-config.json or env vars), never passed as parameters. Passphrases are auto-generated and encrypted with AES-256-GCM.'
Constrain 'platform' parameter: add enum ['cowork-plugin', 'claude-code', 'antigravity'] or document valid values in description. Add 'project_label' validation: 'Optional, 1-100 alphanumeric characters.'

Spec posture evidence

Inferred effective spec: 2025-06-18+.

Relies on Stateful initialize / Mcp-Session-Id (removed; protocol is stateless) - make each request self-contained

Score history

Overall score trend

First recorded score · v2 rubric

39/100

Scored	Grade	Overall	Spec posture	Rubric
2026-09-23	F	39	2025-06-18+	v2