Loading ToolBench
An MCP server that provides web scraping, Google Drive integration, and AI-powered research capabilities for account research workflows
Hawk MCP has critical definition gaps across all three tools. Tool names lack action verbs (drive-search, drive-upload, scrape are acceptable but inconsistent). Descriptions are present but minimal (10-50 chars, below the 50-200 char LLM-optimized baseline). Input schemas exist but lack proper JSON Schema structure, parameters have type and description but no formal schema validation. Output schemas are completely undocumented. Error handling is minimal (generic exception returns). No parameter constraints (enums, ranges, formats). No security annotations or permission declarations. The server exposes credentials via file-based token.json rather than environment injection.
Search for files in Google Drive by name query
Upload a text file to Google Drive
Scrape web content from a URL and extract title and text
Output schemas completely undocumented. LLMs cannot predict response structure or plan downstream tool calls. drive-search returns {results: files[]}, drive-upload returns {id, name, link}, scrape returns {url, title, text}, none of this is declared in tool definitions.
Credentials stored in token.json file and loaded at runtime. Violates secret-injection pattern, credentials should be injected via environment variables or vault, never exposed as parameters or loaded from disk in production.
Descriptions are too short (10-50 chars vs 50-200 char baseline). 'Search for files in Google Drive by name query' (50 chars) lacks context on when to use vs other tools, what happens on failure, or result limits. 'Scrape web content from a URL and extract title and text' (60 chars) omits error handling guidance.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 29 | 2026-07-28+ | v2 |
No input validation or error guidance. drive-search accepts any query string without length limits or SQL injection protection. scrape accepts any URL without validation. Errors return raw exception strings ('error': str(e)) instead of actionable recovery guidance.
No parameter constraints or enums. 'query' and 'url' are free-form strings with no format validation, length limits, or examples. No documentation of expected formats (e.g., 'URL must be http:// or https://', 'query max 255 chars').