Loading ToolBench
Cryptographic trust infrastructure for MCP servers — content-addressed tool identity, signed manifests, TOFU pinning, capability descriptors, a two-gate invocation policy, signed+chained receipts, publisher key rotation, and per-agent OAuth 2.1 auth scope enforcement. Also the "npm audit" health-check / public trust card for every Model Context Protocol server.
Strong tool definitions with complete schemas, clear descriptions, and proper annotations. All 9 tools have explicit input schemas with type definitions and parameter descriptions. Tool names follow verb_noun convention (record_decision, query_decisions, server_identity). Descriptions are substantive (100-300 chars), explaining WHAT, WHEN, and WHY. Tool annotations (readOnlyHint, destructiveHint, idempotentHint, openWorldHint) are present and accurate. Main gaps: output schemas are not documented in the source; some parameter descriptions could be more prescriptive about constraints; error handling guidance is minimal. The audit-log tools (record_decision, query_decisions) are well-designed for composition and idempotency. Greet and list_secrets are trivial but correctly specified. Search/fetch/list_collections tools lack output schema documentation.
Fetch a document by its identifier.
Greet a user by name. Safe, read-only, and deterministic.
List all collections in the knowledge base.
Return the number of stored secrets.
Query the audit log for recorded decisions. Filters by agent, kind, or time range. Returns matching decisions with their digests and chain pointers. Read-only and deterministic — the same query always returns the same results (modulo new appends).
Record a structured agent decision to an append-only, hash-chained audit log. Returns a receipt containing the decision digest and the previous decision's digest, forming a tamper-evident chain. Use this to make agent reasoning auditable and reproducible.
Output schemas not documented. Tools return results but LLMs cannot see what fields to expect. Affects downstream tool chaining and field extraction.
Parameter descriptions lack prescriptive constraints. 'query' in search() has minLength=1 but no guidance on format, max length, or examples. 'limit' in query_decisions lacks explanation of default behavior.
Error handling guidance missing. Tools define error codes (ERR_PARSE, ERR_INVALID_PARAMS) but do not document recovery paths. LLMs cannot self-correct without actionable error messages.
Inferred effective spec: 2025-06-18+.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 56 | 2025-06-18+ | v2 |
Store a secret value securely. Returns a receipt with the stored count.
Search the knowledge base for documents matching a query string.
Return this server's capability descriptor: name, version, protocol version, toolset digest, tool count, and audit log statistics. Use this to verify you are talking to the correct Bruce Lee instance and that the toolset has not drifted.
Trivial tool descriptions. 'list_secrets' (60 chars), 'fetch_document' (60 chars), 'list_collections' (60 chars) lack context for when to call them vs alternatives. Below 100-char baseline for discovery tools.
No pagination guidance for list tools. 'list_collections' and 'search' accept 'limit' but do not document total count, next_cursor, or offset behavior. Large result sets risk context window exhaustion.