Loading ToolBench
SPIFFE workload identity plugin for MCPG gateway. Validates X.509-SVID and JWT-SVID credentials, manages trust bundles from SPIFFE sources, supports federation across trust domains, and resolves workload identities with optional allowlisting and per-identity metadata.
Single tool 'resolve' has a detailed description (194 chars) explaining SVID validation and identity metadata extraction. Input schema is present with three object-typed parameters (request_metadata, headers, tls), each with descriptions. However, the schema lacks granular type definitions for nested fields within these objects, they are declared as generic 'object' types without property schemas. Parameter descriptions are adequate but do not specify format constraints, valid value ranges, or error recovery guidance. No output schema is documented in the source. The tool is read-only (appropriate for identity resolution) but lacks explicit error handling patterns or guidance on what to do when SVID validation fails.
Resolve workload identity from X.509-SVID (TLS client cert chain) or JWT-SVID (Authorization header or custom header). Validates the SVID against configured trust bundles, enforces trust domain and optional allowlist, and returns identity metadata including subject ID, roles, groups, scopes, and attributes.
Input schema uses generic 'object' types without nested property definitions. request_metadata, headers, and tls are declared as objects but lack documented sub-fields (e.g., what properties does request_metadata contain? what is the structure of tls.client_cert_chain_der?). This forces LLMs to guess the internal structure.
No output schema documented. The description mentions returning 'identity metadata including subject ID, roles, groups, scopes, and attributes' but the actual response structure is not specified. LLMs cannot plan downstream operations without knowing what fields to expect.
Error handling guidance is absent. The description does not explain what happens when SVID validation fails, trust domain mismatches, or allowlist checks reject the identity. No recovery guidance (e.g., 'If validation fails, check that the certificate chain is valid and the trust domain matches').
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 50 | <=2025-11-25 | v2 |
Parameter descriptions lack format and constraint details. 'headers' is described as 'HTTP headers for JWT-SVID extraction' but does not specify which header names are accepted (Authorization? Custom header name?). 'tls' mentions 'client_cert_chain_der' but does not clarify the encoding (DER binary? Base64?). These ambiguities force LLMs to guess.
Tool name 'resolve' is generic and does not clearly convey the action. 'resolve_workload_identity' or 'validate_spiffe_svid' would be more explicit and help LLMs understand the tool's purpose without reading the full description.