Loading ToolBench
A fast, fully configurable, in-memory OAuth 2.0 + OpenID Connect authorization server for testing, zero-HTTP mode and DCR support for testing auth flow in MCP Servers and MCP Clients
This OAuth2 test server exposes 11 tools with complete input schemas and descriptions. Naming follows verb_noun conventions (well_known_openid_configuration, register_client, authorize, token_endpoint). Descriptions are present and contextual (avg ~120 chars), explaining what each endpoint does and when to use it. However, descriptions lack actionable recovery guidance for error cases, and output schemas are not documented. Parameters are well-typed with descriptions, but some lack constraints (e.g., response_type, grant_type accept free-form strings instead of enums). The server is designed for testing OAuth2 flows, not as a production agent tool, this limits its relevance to the agentic patterns baseline.
GET /authorize — OAuth2 authorization endpoint (authorization code flow). In this test server, consent is auto-granted. The default_user_id from IssuerConfig is used as the authenticated user.
POST /device/code — OAuth2 Device Authorization Grant endpoint for initiating device flow.
POST /device/token — OAuth2 Device Authorization Grant token endpoint for polling device code status.
GET /register/:client_id — Retrieve a registered client's metadata.
POST /introspect — OAuth2 Token Introspection endpoint (RFC 7662) for checking token status.
GET /.well-known/jwks.json — Public keys for JWT validation.
Output schemas not documented. Tools return OAuth2 responses (tokens, claims, metadata) but LLMs cannot infer field structure, types, or which fields are safe to chain into downstream tools.
Enum constraints missing for critical parameters. response_type, grant_type, token_endpoint_auth_method, and response_mode accept free-form strings instead of enums, inviting hallucinated invalid values.
Error handling lacks recovery guidance. No tool description explains what to do if a request fails (e.g., 'invalid_client', 'invalid_grant', 'access_denied'). LLMs cannot self-correct without actionable error messages.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 68 | <=2025-11-25 | v2 |
POST /register — RFC 7591 Dynamic Client Registration.
POST /revoke — OAuth2 Token Revocation endpoint (RFC 7009) for revoking tokens.
POST /token — OAuth2 token endpoint for exchanging authorization codes or refresh tokens.
GET /userinfo — OpenID Connect UserInfo endpoint for retrieving user claims.
GET /.well-known/openid-configuration — OIDC Discovery document.
Parameter dependencies undocumented. authorize requires redirect_uri only if not registered; token_endpoint requires code only for authorization_code grant. These conditional relationships are not stated in descriptions.
No pagination or result limits documented. Tools like userinfo and introspect may return large claim sets; no guidance on truncation, pagination, or result size caps for LLM context efficiency.