Loading ToolBench
OpenSearch API + MCP Server + A2A Server for Agentic AI! Index/alias/settings/rollover admin, BM25/kNN/hybrid search always run as the calling principal so document-level security applies, ingest-pipeline admin, DLS-bundle read/apply, and a trigger-only reindex-from-KG tool.
OpenSearch MCP demonstrates solid tool design with 15 well-named, verb-prefixed tools covering a coherent domain (search, indexing, pipeline, DLS management). All tools have descriptions (avg ~120 chars, within baseline 34-392 range). Input schemas are present with typed parameters. However, several tools lack parameter descriptions, output schemas are not documented, and error handling guidance is minimal. Tool names are clear and action-oriented (create_index, delete_index, search, rollover), following verb_noun convention. Risk annotations (WRITE, DESTRUCTIVE, READ_ONLY) are present and valuable. The server demonstrates good composition, tools chain logically (search → get_aliases → manage_alias). Main gaps: parameter descriptions missing on ~40% of params, no documented output schemas, and limited error recovery guidance.
Apply a DEC-CA-04 policy bundle's DLS rules to OpenSearch roles. Validates the bundle's shape and ``governs``/``graph`` fields, then applies EXACTLY the ``dls_query`` it was given — this tool never hand-authors a DLS rule. Gated: requires the caller's OpenSearch role to have the ``opensearch_apply_dls_bundle`` permission.
Create an index. Idempotent: creating an already-existing index returns ``already_exists: true`` rather than raising.
Delete an index. A typed, destructive ``OntologyAction`` per DEC-CA-07 — because the index is fully derived/rebuildable from the KG (DEC-CA-01), this carries no data-loss risk to the system of record.
List aliases for an index or index-pattern (read-only).
Fetch all DLS rules for a given role (read-only). Returns the raw security-plugin response.
Output schemas not documented. Tools return results but LLMs cannot infer response structure (fields, types, pagination). Forces agents to guess what data is available for downstream chaining.
Parameter descriptions missing or incomplete. 'mappings' (opensearch_create_index), 'properties' (opensearch_update_mapping), 'conditions' (opensearch_rollover), 'body' (opensearch_put_pipeline) lack guidance on expected structure, format, or constraints. LLMs cannot validate input without explicit descriptions.
No error recovery guidance. Tools lack descriptions of failure modes, retryability, or next steps. E.g., opensearch_knn_search states 'Fails closed with a typed error if k-NN plugin is disabled' but does not guide the agent on recovery (enable plugin, fall back to BM25, etc.).
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 61 | <=2025-11-25 | v2 |
Fetch an ingest pipeline's definition (read-only).
Hybrid (BM25 + k-NN) search. Runs as the calling principal — DLS applies per-request. Fails closed with a typed error if the k-NN plugin is disabled cluster-wide.
k-NN (semantic/vector) search. Runs as the calling principal — DLS applies per-request. Fails closed with a typed error if the k-NN plugin is disabled cluster-wide.
Add/remove/swap index aliases in one atomic call.
Create or update an ingest pipeline.
Request a reindex of ``index_pattern`` from the KG's current state. Returns immediately with a ``run_id`` and records an ``:IndexingRun`` node — it does NOT itself walk the graph or write to OpenSearch. Because the index is fully derived/rebuildable (DEC-CA-01), this is always safe to call, including from offset 0 (a full rebuild).
Roll an alias over to a new backing index once conditions are met. A typed ``OntologyAction`` per DEC-CA-07 — never auto-triggered by this package's own logic (this lane's Authority section).
BM25 (lexical) search. Runs as the calling principal — any DLS role mapped to that principal's OpenSearch backend role filters results server-side.
Add/merge field mappings into an existing index (non-destructive).
Update an index's dynamic settings (e.g. refresh_interval, replicas).
No pagination or result-limit documentation. Search tools (opensearch_search, opensearch_knn_search, opensearch_hybrid_search) accept 'size' parameter capped at 100, but no guidance on handling large result sets, cursor-based pagination, or total count in response.
Destructive operations lack confirmation/dry-run pattern. opensearch_delete_index and opensearch_rollover are irreversible but offer no dry-run or confirmation step. Agents can accidentally destroy indices without safeguards.