Loading ToolBench
PASETO v4 identity_provider plugin for MCPG (dev.mcpg.identity.paseto) — verifies v4.public/v4.local tokens against static keys; no network.
Single tool 'resolve_identity' has a detailed description (195 chars) explaining PASETO token verification, claim validation, and identity mapping. However, the input schema is severely underspecified: three parameters (headers, request_metadata, context) are documented as arrays/objects with minimal type information and no field-level descriptions. No output schema is visible in the source. The tool lacks parameter constraints (enums, ranges, formats), making it difficult for LLMs to construct valid requests. No error handling guidance is documented. The tool definition appears inferred from lib.rs rather than explicitly registered with full schema details.
Verifies caller-presented PASETO v4.public (Ed25519-signed) or v4.local (XChaCha20-encrypted) tokens against operator-supplied STATIC keys, validates registered claims (exp/iss/aud), and maps token claims to subject_id / roles / groups / scopes / attributes.
Input schema critically incomplete: 'headers' parameter documented as array with no field descriptions; 'request_metadata' and 'context' are bare objects with no field definitions, types, or constraints. LLMs cannot construct valid requests without field-level documentation.
No output schema documented. Callers cannot know what fields resolve_identity returns (subject_id, roles, groups, scopes, attributes are mentioned in description but not in a structured schema). LLMs cannot plan downstream tool calls without knowing response structure.
No error handling guidance. Description does not explain what happens on invalid tokens, missing headers, expired claims, or audience mismatch. LLMs have no recovery path if verification fails.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 43 | <=2025-11-25 | v2 |
Parameter 'headers' is documented as an array but no element schema is provided. Should specify: is each element a string? An object with 'name' and 'value'? How does the tool extract the PASETO token from HTTP headers?
Tool name 'resolve_identity' is vague. Does it create, verify, or look up an identity? 'verify_paseto_token' or 'validate_identity_token' would be clearer action verbs matching the actual behavior (verification against static keys).