Loading ToolBench
Intelligent MCP Server for Juniper Mist API with semantic tool design using Code Mode pattern
Both tools have critical definition gaps. The 'search' tool description is a JavaScript code example (not a tool description), violating pattern:tool-description. The 'execute' tool description is similarly code-focused rather than explaining WHAT the tool does, WHEN to use it, and what it returns. Neither tool has documented output schemas. Input schemas are present but minimal (single 'code' string parameter with no constraints, enums, or validation guidance). No error handling guidance. No parameter descriptions beyond the code example. The server implements a 'code mode' pattern that requires LLMs to write arbitrary JavaScript, this is high-risk and lacks safeguards documented in the tool definitions.
Execute JS against the Mist API. Use mist.request({method, path, body, params}). method defaults to GET. Chain multiple calls, filter/transform results in JS. mist.allowedMethods shows permitted HTTP methods. For paginated results: check if total > results.length, loop with page/start params. For write ops: return a preview first, execute write only after user confirms.
JavaScript async arrow function to search the OpenAPI spec. Example: async () => { const results = []; for (const [path, methods] of Object.entries(spec.paths)) { for (const [method, op] of Object.entries(methods)) { if (op.tags?.some(t => t.toLowerCase().includes("wireless"))) results.push({method: method.toUpperCase(), path, summary: op.summary}); } } return results; }
Tool descriptions are JavaScript code examples, not functional descriptions. 'search' description is a code snippet showing how to iterate spec.paths, this does not explain what the tool does, when to use it, or what it returns. Violates pattern:tool-description baseline (10 - 1024 chars, non-empty, actionable).
No output schema documented. LLMs cannot plan downstream calls or extract data without knowing what fields to expect. Both tools return JavaScript execution results, but the structure is undefined.
Input parameter 'code' has no constraints, validation rules, or format guidance. LLMs will pass arbitrary JavaScript without understanding sandbox limits, allowed APIs, or error recovery. No enum, pattern, or minLength/maxLength.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 32 | <=2025-11-25 | v2 |
No error handling guidance. If JavaScript execution fails (syntax error, timeout, API error), the tool response must tell the LLM what to do next. Currently no recovery hints documented.
Code-mode pattern (arbitrary JavaScript execution) is high-risk and lacks security documentation. No mention of sandbox isolation, rate limits, timeout enforcement, or what happens if code attempts forbidden operations (e.g., network calls outside mist.request).