Loading ToolBench
Post and schedule to X from your coding agent; the X token stays in a server-side vault and every post clears a deterministic guardrail. Agent-co-resident MCP server (stdio) that exposes connect_x / whoami / post_now tools. Holds NO X token and NO secret — only a short-TTL session handle + non-secret ~/.capx/config.json.
Three tools with complete input schemas and descriptions, but significant gaps in output documentation and error handling. Tool names follow verb_noun convention (connect_x, whoami, post_now). Descriptions are present (60-120 chars) but lack actionable context for LLM selection. No documented output schemas, pagination, or error recovery guidance. post_now is IRREVERSIBLE but lacks confirmation/dry-run pattern. No parameter validation constraints (enums, ranges) visible. Schemas show basic types but lack depth for production use.
Initiate X (Twitter) OAuth connection with optional lane and x_client_id parameters. Returns consent URL, pending session ID, expiration time, and connection instructions.
Publish a post to X immediately with optional AI-generation flag and post type. Includes idempotency key support. Returns discriminated PublishOutcome indicating success, blocked, held, or other status.
Check current authentication status and user information. Returns connection status, username, lane, standing, kill-list status, and session details.
No output schemas documented. LLMs cannot plan downstream calls or extract required fields (e.g., session_id from connect_x, username from whoami, post_id from post_now). Baseline: 100% of A+ tools document return types.
post_now is IRREVERSIBLE (publishes to X) but lacks confirmation/dry-run pattern. Agents cannot preview or confirm before executing. No idempotency key guidance in description despite 'idempotency key support' claim.
No parameter constraints (enums, ranges, patterns) visible. 'lane' and 'type' accept free-form strings with no validation guidance. LLMs will hallucinate invalid values. Baseline: constrained inputs prevent 90% of parameter errors.
Error handling absent. No recovery guidance (e.g., 'If OAuth fails, check CAPX_CHOKEPOINT_URL'). No categorization of retryable vs fatal errors. Baseline: A+ tools include 'what to do next' in error responses.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 53 | 2026-07-28+ | v2 |
Descriptions lack dependency hints and selection context. 'Check current authentication status' (whoami) does not explain WHEN to call it vs connect_x. No guidance on multi-step workflows (e.g., 'Call connect_x first, then whoami to verify').