Loading ToolBench
MCP Server for Alfresco Content Services with ticket-based authentication. Provides tools for searching, browsing, uploading, downloading, and managing documents in Alfresco repositories.
Server has 19 tools with schemas and descriptions present, but quality is inconsistent. Naming follows verb_noun convention (search_content, upload_document, delete_node) which is good. However, descriptions are often generic (e.g., 'Search content with AFTS. Returns minimal info per hit.' is only 54 chars, below the 194-char baseline). Many parameters lack detailed constraints, e.g., max_results defaults to 25 with no explanation of bounds or why this limit. Critical issue: tools 17 and 18 (repository_info and get_repository_info_tool) are duplicates, violating single-responsibility. Error handling is minimal, no recovery guidance, no categorization of retryable vs fatal errors. Output schemas are not documented in the code; responses are inferred from API calls. Destructive operations (delete_node) lack confirmation/dry-run patterns. Auth model (ticket-based, runtime-settable) is unusual and creates security concerns, credentials can be overridden at runtime, and the require_ticket decorator returns structured error messages rather than raising exceptions, which may confuse error handling.
Advanced AFTS search with sorting.
List children for a node id (default: user's home).
Cancel a document checkout.
Check in a document after editing.
Check out a document for editing.
Basic CMIS Browser binding query. Returns raw JSON from repository.
Create a new folder under parent_id.
Duplicate tools: repository_info and get_repository_info_tool perform identical functions, violating single-responsibility principle. LLM wastes reasoning cycles choosing between them.
Descriptions are generic and below baseline (194 chars). E.g., 'Search content with AFTS. Returns minimal info per hit.' (54 chars) lacks context on when to use vs advanced_search, what AFTS means, or expected output structure.
No output schemas documented. Code shows responses are inferred from Alfresco API calls, but LLM cannot predict field names, types, or structure. Violates pattern:response-shaper.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 59 | 2026-07-28+ | v2 |
Delete a node by ID.
Download a document by node ID. Returns base64-encoded content.
Get properties of a node by ID.
Get repository information and capabilities (alternative name).
Get repository information and capabilities.
Search for content and provide analysis via prompt.
Search using simple metadata filters.
Search content with AFTS. Returns minimal info per hit.
Set/replace the Alfresco host base URL at runtime (e.g., https://acs.example.com).
Set/replace the authentication ticket for the current server process.
Update properties of a node.
Upload a document to parent_id. Use file_path or base64_content.
Destructive operation (delete_node) lacks confirmation/dry-run pattern. No recovery guidance in error responses. Agents can permanently delete content without safeguards.
Runtime ticket override (set_ticket) allows credentials to be injected at runtime, creating security risk. Credentials should use server-side secret injection only, not tool parameters.