Loading ToolBench
Open, self-hostable Solid pod server for the AI era — JVM-native, MCP-fronted, conformance-first.
Cistern provides 7 well-named tools with clear, domain-specific descriptions (avg 156 chars, within 10-1024 baseline). All tools have input schemas with typed parameters and descriptions. Naming follows verb_noun convention (read-, list-, write-, delete-, grant-, revoke-, receipts). However, output schemas are not documented in the source code provided, critical for LLM planning. Parameter descriptions are present but lack constraint details (e.g., no format specs for URLs, no enum values for access modes). Error handling is mentioned in descriptions ('401/403 comes back as REFUSED') but recovery guidance is minimal. Security posture is strong (no secrets in params, permission gates documented), but output schema documentation is a major gap for production use.
Delete one resource. A non-empty container cannot be deleted; deleting requires write on the resource and on its parent container.
Grant an agent (a WebID, or 'public' for anyone) one or more access modes on a resource or container, by rewriting its .acl over HTTP exactly as the cistern CLI does — the server enforces Control, so this succeeds only for a caller whose bound identity controls the target. The owner's own authorization is always preserved.
List the members of a container (a URL ending in '/'). Returns the members' URLs. Only what the bound identity may see is reachable; a refusal is a REFUSED result, not an empty container.
Read one resource from the pod. Returns its content (text formats inline; binary reported by type and size) and its content type and ETag. A 401/403 comes back as a REFUSED result: report it, do not retry.
The receipts for one resource: every access decision the pod took about it — allow and deny, with the agent, the required mode and the ACL that decided — as JSON Lines. Requires Control on the resource: an agent that may merely read a document may not see who else touched it.
Output schemas not documented. LLMs cannot plan downstream tool calls or extract required fields (e.g., what does list-container return? URLs only, or metadata too?). Critical for tool composition.
Parameter 'modes' in grant tool lacks enum constraint. Description says 'Access modes to grant (Read, Write, Append, Control)' but no formal enum. LLMs may hallucinate invalid modes.
URL parameter descriptions lack format guidance. No mention of expected URL format, whether relative or absolute, or validation rules. LLMs may pass malformed URLs.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 63 | 2026-07-28+ | v2 |
Remove everything an agent (a WebID, or 'public') holds on a resource or container. Takes effect on the agent's next request — decisions are never cached. A revoke that would drop the owner's Control is refused with nothing written.
Create or replace one resource with text content. Honours ETag preconditions: pass if-match to replace only an unchanged resource, or create-only to refuse to overwrite. Intermediate containers are created for you.
Error handling descriptions mention REFUSED result but do not guide LLM recovery. 'A 401/403 comes back as REFUSED result: report it, do not retry' is present but no actionable next steps offered.
Timestamp parameters in receipts tool ('from', 'to') lack format specification. No mention of ISO 8601, Unix epoch, or other format. LLMs frequently miscalculate timestamp conversions.