Loading ToolBench
An MCP server that provides tools for user registration, login, password management, and automated email notifications using LLM-generated content
Four tools with basic descriptions and minimal parameter documentation. All tools have descriptions (10-200 chars baseline met), but parameter descriptions are sparse or missing type constraints. No output schemas documented. Error handling returns generic messages without recovery guidance. No tool annotations (readOnlyHint, destructiveHint, idempotentHint). Naming follows verb_noun pattern (RegisterAsync, LoginAsync, ChangePasswordAsync, ResetPasswordAsync) but uses C# async convention rather than snake_case. No pagination, no structured output examples, no dependency hints between tools.
Change the user's password. A valid Bearer token, obtained from a successful login, is required. After a successful password change, do not expose the token. Briefly explain what the system has done. Advise the user to log in or re-login before proceeding if the password change does not work.
This system allows direct login via chat by prompting the user for their email and password. Upon successful login, a Bearer token will be returned for authentication purposes. Do not mention login or re-login after the user has logged in or received the token.
Register a user account. Upon successful registration, an email will be sent containing your login details. Please check your inbox for your email address and password. The password is provided for your convenience; it is recommended that you change it after your first login.
Reset the user's password. A new random password will be generated and emailed to the user. Advise the user to log in or re-login before proceeding if the password reset does not work.
No output schemas documented. Tools return plain strings; LLMs cannot parse structured results or chain calls. E.g., LoginAsync returns 'Login successful. Token: {token}' as unstructured text, forcing LLMs to regex-parse the token.
Error handling returns generic messages ('Failed to register user. Status code: {StatusCode}') without recovery guidance. LLMs cannot determine if error is retryable, user-fixable, or fatal.
ChangePasswordAsync requires 'token' parameter but description says 'obtained from the login response (returned as 'Your token: {token}')', this is an example value in the description, which LLMs may reuse literally. Use formal parameter constraints instead.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 46 | <=2025-11-25 | v2 |
No tool annotations (readOnlyHint, destructiveHint, idempotentHint). LoginAsync is read-only; RegisterAsync, ChangePasswordAsync, ResetPasswordAsync are destructive. Agents need this metadata to plan safely.
No dependency hints between tools. Description for LoginAsync says 'Do not mention login or re-login after the user has logged in', this is agent instruction, not tool documentation. Should document that RegisterAsync must be called before LoginAsync, and LoginAsync must be called before ChangePasswordAsync.