Loading ToolBench
Local-first MCP credential broker: agents use gated APIs through scoped, audited requests without ever seeing the secret.
Strong foundation with well-defined tools, comprehensive schemas, and excellent security-first design. All 5 tools have clear descriptions (100-200 chars), explicit input schemas with type constraints, and proper enum usage for HTTP methods. Tool annotations (readOnlyHint, destructiveHint, idempotentHint) are correctly applied. Error handling returns structured JSON with actionable messages. Main gaps: parameter descriptions could be more detailed (e.g., approval_id lacks context on when it's required), output schemas are not formally documented in the tool registration, and some parameters lack min/max constraints. Naming follows verb_noun pattern well (broker_read, broker_mutate). Composition is clean, each tool has one responsibility.
Dry run. Report whether a request would be permitted, which policy rule decides it, and whether an approval is required or satisfied. Performs no upstream call and touches no secret.
List the credentials this agent may exercise: id, kind, and base URL. Secret values are never exposed.
Make a POST, PUT, PATCH, or DELETE request through a granted credential. Treated as destructive and non-idempotent: the matched operation may require an approval_id (checked at execution time) and an idempotency_key. Upstream content is never assumed safe.
Make a GET or HEAD request through a granted credential. The broker injects the secret; the agent never sees it. Responses are size-capped, header-filtered, and redacted. Response bodies are relayed only when the matched operation grants response_body.
Show the authenticated agent and its per-credential operation grants.
Output schemas not formally documented in tool registration. Tools return structured JSON via jsonResult() but the schema is not declared in registerTool() calls, forcing LLMs to infer response structure.
Parameter descriptions lack constraint details. 'approval_id' is described as 'Optional approval identifier' but does not explain when it is required vs optional, or what happens if omitted when the operation requires approval.
broker_mutate body parameter lacks size guidance. maxLength=1000000 is set but description does not warn about payload limits or what happens if body is too large.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 62 | 2025-06-18+ | v2 |
No pagination support documented. broker_list_credentials and broker_whoami return all grants/credentials without limit or pagination, risking context window exhaustion if an agent has many credentials.
Error messages in code are generic. errorResult() returns plain text; structured error responses with error codes and recovery hints would better guide LLM retry logic.