Loading ToolBench
Two tools with basic schemas and descriptions, but significant gaps in parameter documentation, error guidance, and output schema clarity. takePayment exposes sensitive card data as parameters (critical security issue). Both tools lack output schema documentation. Descriptions are present but generic (avg 95 chars, below 194-char baseline). No error recovery guidance. Parameter descriptions are minimal; cardCode lacks format hints (CVV = 3-4 digits). No enum constraints on optional fields. Handlers show basic error handling but responses are unstructured text rather than typed objects.
Generate a hosted payment page (invoice) for a customer to pay
Charge a credit card for a given amount using Authorize.net
CRITICAL: Card data (cardNumber, cardCode, expirationDate) exposed as tool parameters. Credentials and sensitive payment data must never appear in parameters, they are logged in traces and prompt history. Use server-side secret injection or tokenization.
No output schema documented for either tool. Handlers return unstructured text responses (CallToolResult with plain text). LLMs cannot plan downstream calls or extract structured data. Define and return typed objects with transactionId, status, timestamp, errorCode fields.
Parameter descriptions lack format constraints and validation hints. cardCode description says 'Card security code (CVV)' but does not specify 3-4 digits. expirationDate says 'MMYY format' but no validation that input matches. LLMs cannot infer constraints from names alone.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 44 | 2025-06-18+ | v2 |
Error responses are generic text ('Payment failed: Unknown response error.') with no recovery guidance. LLM cannot determine if error is retryable, user-fixable, or fatal. Include error classification and actionable next steps (e.g., 'Declined: Try a different card or contact issuer').
createInvoice tool description does not explain what 'hosted payment page' means or what the LLM should do with the returned URL. No mention of return value structure. Incomplete docstring forces LLM to guess.