Loading ToolBench
An Express-based server for Instagram Graph API integration with Facebook OAuth authentication, providing endpoints for account information, posts, insights, and analytics
This server has critical definition gaps. Tool descriptions are present but generic (avg ~80 chars, well below the 194-char baseline). Most critically: 6 of 10 tools lack visible input schemas in the source code (loginWithFacebook, facebookCallback, getCurrentUser, logout, getUserPosts, getAccountInsights). Parameters that ARE documented (userId, postId, accessToken, mediaId, limit, businessAccountId) lack type definitions in the schema. No output schemas are documented. Error handling is minimal, responses are generic HTTP status codes with no recovery guidance. No tool annotations (readOnlyHint, destructiveHint, idempotent). Tool names are reasonable (verb_noun pattern) but descriptions do not explain WHEN to use each tool or what distinguishes similar ones (e.g., getAccountInfo vs getAccountInsights). No parameter constraints (enums, ranges, formats) are declared. Secrets (accessToken) are exposed as parameters, violating pattern:secret-injection.
Handles Facebook OAuth callback, creates or updates user, retrieves business account ID, and establishes session
Retrieves Instagram business account information including name, username, profile picture URL, followers count, follows count, and media count
Retrieves account insights for the last 28 days including audience demographics (gender, age, locale, country) and online followers
Retrieves Instagram Business Account ID from Facebook pages, required for most API operations
Returns the currently authenticated user's profile information
Retrieves recent comments on a post with fields including ID, text, timestamp, username, and replies
Retrieves detailed insights for a specific post including engagement, impressions, reach, and saved metrics
6 of 10 tools have no visible input schemas in source code (loginWithFacebook, facebookCallback, getCurrentUser, logout, getUserPosts, getAccountInsights).
Secrets (accessToken, Facebook credentials) exposed as tool parameters. Per pattern:secret-injection, credentials must use server-side injection via environment variables. Agent traces log all parameters, secrets leak into logs.
No output schemas documented for any tool. LLMs cannot plan downstream calls or extract required fields (e.g., does getAccountInfo return follower_count or followers?). Per pattern:tool, output structure must be explicit.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 29 | 2026-07-28+ | v2 |
Retrieves user's media posts with basic insights including ID, caption, media type, URL, timestamp, like count, and comments count
Initiates Facebook OAuth login flow with Instagram scopes (instagram_basic, instagram_manage_insights, pages_show_list)
Logs out the current user and clears session
Descriptions are generic and under 100 chars (avg ~80 chars vs 194-char baseline). They state WHAT but not WHEN to use or how to distinguish from similar tools. E.g., getAccountInfo vs getAccountInsights are not differentiated.
No error handling guidance. Controllers return generic HTTP 401/500 with minimal context. Per pattern:recovery-guide, errors must tell LLM what to do next (e.g., 'User not authenticated. Call loginWithFacebook first.').