Loading ToolBench
Mock MCP server (Cloudflare Worker) for the Riskonnect Policy Agent workshop. Provides policy document retrieval, regulatory gap analysis, and policy update recommendations via JSON-RPC 2.0 MCP endpoint.
Three tools with clear verb-noun naming (get_, analyze_, recommend_) and complete JSON Schema input definitions. Descriptions are present and domain-specific (10 - 20 words each), meeting the 10 - 1024 character baseline. However, parameter descriptions are minimal (e.g., 'The policy's POL-### identifier' repeated across tools), and output schemas are entirely undocumented, LLMs cannot plan downstream calls or extract structured data. No error handling guidance visible. Tool composition is sound (each does one thing), but lack of output documentation and parameter depth limits production readiness.
Compare a policy against a regulation to identify compliance gaps, each with a regulation article, severity, and requirement.
Retrieve current policy document metadata and content summary by policy ID (e.g. POL-001).
Generate specific, ready-to-insert policy language recommendations that close the gaps between a policy and a regulation.
Output schemas completely undocumented. LLMs cannot infer what fields to expect from tool responses, preventing downstream tool chaining and forcing unstructured parsing.
Parameter descriptions are generic and repetitive. 'The policy's POL-### identifier' appears identically across all three tools. No guidance on format constraints, valid ranges, or when to use each tool instead of others.
No error handling guidance in tool descriptions. Agents cannot distinguish retryable errors from user-fixable ones (e.g., invalid policy_id vs. unsupported regulation_name).
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 59 | 2026-07-28+ | v2 |
regulation_name parameter accepts free-form strings with only an example list ('GDPR, CCPA, SEC Cyber Rules, NIST CSF, SOX'). Should be an enum to prevent hallucinated regulation names.
Tool descriptions lack context on when to call each tool. No guidance on prerequisites (e.g., 'Call get_policy_details first to understand policy structure before analyzing gaps').