Loading ToolBench
Read-only restic repository inspector. Repositories are preconfigured; callers may only pass repository_id. No backup, restore, forget, prune, unlock, or mutation tools exist.
Strong foundation with all 7 tools explicitly registered, complete input schemas with types and descriptions, and consistent tool annotations (ReadOnlyHint, IdempotentHint, DestructiveHint). Descriptions are clear and action-oriented (avg ~120 chars), explaining cost classes and allowlist constraints. However, output schemas are not formally documented in the tool definitions, responses are wrapped in an envelope struct but the schema is not visible in the tool registration. Parameter descriptions are present but some lack detail on constraints (e.g., 'limit' and 'offset' lack min/max bounds). Error handling is implemented (errTool function with redaction) but recovery guidance is minimal. Security is strong: read-only operations, no secrets in params, audit logging present.
List directory entries inside a snapshot at an allowlisted path. Non-recursive by default, hard node limit. No file contents. Cost: moderate.
Find files by a simple glob pattern within allowlisted scope. Not full regex. Bounded results. Cost: moderate to expensive.
Get metadata for one snapshot by full id or unambiguous prefix. latest requires host and/or tag and/or path filters. Cost: light.
List preconfigured repository IDs, optional labels, backend kinds, and allowlist restrictions. Does not probe repositories. Cost: light.
List snapshots for a repository_id with optional host/tag/path filters (must be allowlisted). Bounded and paginated. Cost: light.
Return repository statistics for an allowlisted mode (restore-size, files-by-contents, raw-data, blobs-per-file). Metadata/counting only; not a full data integrity check. Cost: moderate to expensive.
Output schemas not formally documented in tool definitions. Responses are wrapped in an envelope{cost, truncated, data, warnings} but this structure is not declared in the MCP Tool schema. LLMs cannot predict response shape without explicit documentation.
Numeric parameters (limit, offset) lack min/max bounds in descriptions. 'limit' and 'offset' should specify ranges (e.g., 'limit: 1-1000, default 50') to prevent LLMs from passing absurd values.
Error responses lack recovery guidance. errTool() returns code/message/detail but does not suggest next steps (e.g., 'Repository not found. Call list_repositories() to see available repos'). Agents cannot self-correct without hints.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 61 | 2026-07-28+ | v2 |
Return server version, restic version, configured repository IDs, supported backends, allowed commands, cost classes, limits, and warnings. Cost: light.
Parameter 'ignore_case' in find_files has empty description. All parameters must have non-empty descriptions explaining what they control.
Allowlist constraints mentioned in descriptions but not formally enforced in schema. E.g., 'host filter (must be allowlisted)', the schema should document which fields trigger allowlist validation and what happens if violated.