Loading ToolBench
A Next.js-based platform for managing expert agents, subscriptions, and user accounts with authentication, KYC verification, and admin controls
WizAgents exposes 21 tools with inconsistent quality. Most tools have descriptions (good), but parameter schemas are incomplete or missing entirely. Tool names follow verb_noun convention reasonably well (account_delete, auth_2fa_enable), but many lack input schema visibility in the source. Descriptions range from adequate (account_delete: 150 chars) to verbose (admin_config_update: 120 chars), but parameter descriptions are sparse. No evidence of output schemas, error recovery guidance, or idempotent operation markers. Security-critical tools (account_delete, admin_config_update) lack confirmation patterns or dry-run support. The codebase shows Next.js API routes with Zod validation, but tool definitions are not explicitly registered in MCP format, they appear inferred from route handlers.
Delete the account after password verification and confirmation. Purges personal data, stops subscriptions, suspends agents, and anonymizes identity while preserving citations and financial records
Check what stands in the way of account deletion (active subscribers, open escalations, pending payouts, active subscriptions)
Export complete portable JSON archive of account data including profile, subscriptions, conversations, transactions, endorsements, reputation, agents, knowledge versions, and fidelity samples
Change account password. Requires current password verification, validates new password strength, and revokes all other sessions by incrementing sessionVersion
Retrieve current user's account profile details including name, email, role, avatar, bio, location, website, organization name, and email verification status
Edit account profile details including name, bio, location, organization name, website, avatar color, and avatar media. Validates inputs and checks avatar ownership
Output schemas not documented. Tools like account_export, agents_list, security_log_get, auth_2fa_setup return data but LLMs cannot predict field structure. This forces agents to guess at response shape and breaks downstream tool chaining.
Destructive operations lack confirmation or dry-run patterns. account_delete and admin_config_update modify critical state but have no pre-flight check or confirmation step. Agents can accidentally delete accounts or change platform rates without safeguards.
No error recovery guidance. Tools return HTTP status codes (400, 401, 409) but descriptions do not explain what the LLM should do next. E.g., account_delete returns 409 'blocked', should the agent retry, ask the user, or call account_delete_check first?
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 37 | 2026-07-28+ | v2 |
Update account name or transition user role from buyer to creator
Admin action to suspend or publish an agent. Notifies the creator of the action
Update platform configuration including take rate percentage, pass price, default trial, daily rate limit, and escalation fee percentage
Grant verification tier after human review of KYC submission. Can grant 'identity', 'expert', or 'reject' status with optional reviewer note
Retrieve KYC submission review queue with submitted and in-review submissions, including user details and document information
Recompute agent metrics including subscriber counts and average ratings for all agents
Admin action to set a user's role to buyer, creator, enterprise, or admin
Human review of expert credentials. Grant or reject verification status with optional reason
List all published agents with basic information including slug, name, creator name, category, and price, ordered by subscriber count
Disable two-factor authentication after verifying current 2FA token
Enable two-factor authentication after verifying the setup token. Returns backup codes for account recovery
Start two-factor authentication setup. Returns secret and QR code for scanning into authenticator app
Verify 2FA token during login. Accepts either TOTP token or backup code. Creates session on success
Retrieve account's security history including login attempts, password changes, and other security events (last 50 entries)
Revoke all sessions across all devices. Current session is re-issued so user stays signed in on this device
Parameter descriptions lack format/constraint details. account_profile_update accepts 'avatarColor' as hex but description does not specify format (#RRGGBB vs RRGGBB). admin_config_update accepts numeric rates but does not specify range (0-100? 0-1?). LLMs will guess and fail.
Tool definitions inferred from Next.js routes, not explicitly registered in MCP format. No visible tool registration with schemas, capabilities, or annotations.