Loading ToolBench
A policy gate for MCP tool calls - blocks destructive AI agent actions before they run
Single tool 'execute_sql' has a basic description but critically lacks input parameter descriptions and proper schema documentation. The tool is destructive (DROP TABLE) yet has no error handling guidance, confirmation pattern, or permission checks. Description is 67 chars (within 10-1024 range) but parameter 'sql' has no description at all. No output schema documented. Tool definition appears inferred from Makefile demo rather than explicit MCP registration code visible in source.
Execute a SQL statement against the connected database.
Parameter 'sql' lacks description. LLMs cannot infer whether to pass raw SQL, parameterized queries, or what constraints apply. Violates pattern:tool-description requirement that every parameter must have a non-empty description.
No output schema documented. Tool returns query results but LLMs have no visibility into response structure (columns, types, pagination). Violates pattern:tool requirement for documented return types.
Destructive tool (DROP TABLE) lacks confirmation pattern, dry-run option, or permission gate. No error handling guidance for failed queries. Violates pattern:confirmation-request and pattern:permission-gate.
Tool definition inferred from Makefile demo, not from explicit MCP server registration code. No visible tool registration with schema in warder/src/main.rs or warder/src/lib.rs.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 43 | 2026-07-28+ | v2 |
No input validation or error classification. Tool accepts arbitrary SQL strings with no constraints, validation, or guidance on retryable vs fatal errors. Violates pattern:error-classification and pattern:recovery-guide.