Loading ToolBench
23 tools with complete schemas and descriptions, but quality is uneven. Most tools have adequate naming (verb_noun pattern) and parameter descriptions, but descriptions are often generic (50-100 chars, below the 194-char baseline). Output schemas are not documented, LLMs cannot predict response structure. Error handling is minimal; no recovery guidance. Parameter relationships (e.g., project vs project_id) are underdocumented. No tool annotations (readOnlyHint, destructiveHint). Composition is reasonable, tools are single-purpose, but chaining support is weak (missing IDs in responses).
Discover API endpoints in an application
Authenticate with NightVision API using a token
Create a new target in NightVision
Delete a target from NightVision
Run diagnostic checks on NightVision installation
Export scan results to CSV format
Export scan results to SARIF format
Get security findings from a scan
Output schemas not documented. LLMs cannot predict response structure (fields, types, pagination). Baseline: 100% of A+ tools document return types.
Descriptions are generic and short (50-100 chars). Baseline: 194 chars. Descriptions lack WHEN to use, WHAT it returns, and dependencies. E.g., 'List targets in NightVision' does not explain project scoping or when to call it.
Parameter relationships underdocumented. Tools accept both 'project' (name) and 'project_id' (UUID) but do not explain mutual exclusivity or precedence. LLMs may pass both, causing ambiguous calls.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 48 | 2026-07-28+ | v2 |
Get details for a specific project
Get vulnerability checks (findings) from a scan
Get the status of a security scan
Get details for a specific target
List available vulnerability check categories
List NightVision projects
List security scans
List targets in NightVision
List available Nuclei security templates
Run preflight checks on an application
Record HTTP traffic for a running application
Run a complete security scan on an application
Start a security scan on a target
Summarize findings from a security scan
Wait for a security scan to complete
No tool annotations (readOnlyHint, destructiveHint, idempotentHint). Agents cannot infer which tools are safe to retry or have side effects. delete-target and export-* should be marked destructive.
Error handling lacks recovery guidance. No examples of error responses or actionable next steps. Pattern: 'User not found. Try search_users() with a partial name.' is missing.