Loading ToolBench
A PHP-based web chat application with authentication, favorites management, and integration with n8n MCP server for AI responses
This PHP server exposes 13 tools with severe definition gaps. Most tools lack input schemas entirely (getFavorites, loadFavorites, checkBruteForce, checkSessionTimeout, validateCSRFToken, resetLoginAttempts, generateCSRFToken, initSecurity, generatePasswordHash have no visible schema definitions in the provided code). Descriptions are present but generic and under 100 chars on average. No output schemas documented. Tool names are reasonable (verb-noun pattern) but parameter documentation is sparse. Security tools (validateCSRFToken, checkBruteForce) expose session/auth logic as tools rather than server-side guards. No error handling guidance. This is a custom PHP implementation without proper MCP tool registration patterns.
Check if user has exceeded maximum login attempts within lockout time
Check if session has timed out based on last activity
Generate a new CSRF token for the form
Generate a secure password hash using bcrypt
Get current favorites from API
Initialize security settings including session configuration and security headers
Load and display favorite questions from the API endpoint
Record a failed login attempt in the session
8 of 13 tools have NO visible input schemas (getFavorites, loadFavorites, checkBruteForce, checkSessionTimeout, recordFailedAttempt, resetLoginAttempts, generateCSRFToken, initSecurity).
Security tools (validateCSRFToken, checkBruteForce, checkSessionTimeout, recordFailedAttempt, resetLoginAttempts, generateCSRFToken, initSecurity) should NOT be exposed as agent tools. These are server-side security guards that must run before/after tool execution, not as callable tools. Exposing them invites misuse and breaks the security model.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 32 | 2026-07-28+ | v2 |
Reset login attempt counter after successful authentication
Save a question as favorite by fetching current favorites, checking for duplicates, and saving the updated list
Save favorites to API
Send a message to the bot via n8n webhook proxy
Validate CSRF token from session
No output schemas documented for any tool. LLMs cannot plan downstream calls or extract fields without knowing response structure. E.g., saveFavorites should document it returns {success: boolean, message: string, favorites: array}.
Descriptions are generic and under 100 chars. E.g., 'Get current favorites from API' does not explain when to call it, what it returns, or dependencies.
No error handling guidance. Tools do not document what errors can occur, whether they are retryable, or what the LLM should do next. E.g., sendMessage should explain what happens if the n8n webhook is unreachable.