Loading ToolBench
MCP server providing Code Mode execution for API discovery and data querying with support for REST APIs, GraphQL, and SPARQL endpoints. Includes catalog search, OpenAPI spec navigation, and sandboxed code execution in V8 isolates.
This server exposes 5 code-execution tools (catalog_search, execute, graphql_execute, sparql_execute, search) with READ_ONLY risk classification. Tool names are action-oriented (search, execute) and descriptions are present but verbose (200-400+ chars). However, critical gaps undermine production readiness: (1) Input schemas are visible in TypeScript but incomplete in the JSON spec provided, catalog_search shows Zod schema but execute/graphql_execute/sparql_execute lack visible parameter type definitions in the source excerpt; (2) Descriptions are overly long and tutorial-like rather than concise LLM-optimized summaries; (3) No output schemas documented, agents cannot predict what these tools return; (4) No error handling guidance, what happens on API failure, timeout, or invalid code?; (5) No parameter validation rules stated (e.g., code length limits, timeout bounds); (6) The 'workspace' parameter in execute/graphql_execute is underdocumented, what is ADR-006 Phase 0? This forces agents to guess. Catalog_search is the strongest tool (Zod schema visible, clear parameter descriptions), but the code-execution tools are underspecified.
Search the API catalog (legacy mode). Returns matching endpoints with full parameter docs. Use this to discover API capabilities before calling execute. Categories are listed. USAGE IN execute: api.get(path, params) for GET, api.post(path, body, params) for POST. Path params like /lookup/{id} are auto-interpolated from params. Remaining params become query string. Large responses (>100KB) are auto-staged: check result.__staged, return the staging info, use query_data to explore. Use limit/pagination params to control response size.
Execute JavaScript code against an API catalog or OpenAPI spec. Code runs in a sandboxed V8 isolate with: searchSpec(query) / searchPaths(query) — search the API spec; listCategories() / listTags() — inspect tags/categories; getEndpoint(path) / getOperation(idOrPath) — get endpoint docs; api.get(path, params) for GET, api.post(path, body, params) for POST; Large responses (>100KB) are auto-staged into SQLite; console.log() capture; optional filesystem access (fs.readFile, fs.writeFile, fs.glob); optional domain-specific preamble helpers.
Execute JavaScript code against a GraphQL endpoint. Code runs in a sandboxed V8 isolate with: gql.query(queryString, variables?) — execute GraphQL queries; schema.types(), schema.type(), schema.search() — introspection helpers; db.stage(), db.queryStaged() — staging helpers; optional api.get/api.post for hybrid REST+GraphQL; console.log() capture; optional filesystem access; optional domain-specific preamble. When introspection is disabled, schema.* reports unavailable but gql.query() still works.
Search the OpenAPI spec or API catalog. In OpenAPI mode: write JavaScript code to search the spec using searchPaths(query, maxResults=10), listTags(), getOperation(idOrPath), describeOperation(idOrPath), or access spec.paths directly. In catalog mode (legacy): keyword search over static ApiCatalog with query/category/max_results parameters. Returns matching endpoints with full parameter documentation.
Output schemas not documented. Agents cannot predict what execute/graphql_execute/sparql_execute return, forcing them to guess downstream field names and types.
Input schemas incomplete or missing for code-execution tools. execute, graphql_execute, sparql_execute show only 'code' and 'workspace' params in descriptions but lack visible Zod/JSON Schema definitions in source excerpt. Cannot verify type constraints.
Descriptions are tutorial-like (200-400+ chars) rather than concise LLM-optimized summaries (target 50-200 chars). Verbose descriptions waste tokens and bury key intent signals.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 37 | 2026-07-28+ | v2 |
Execute JavaScript code against a SPARQL endpoint. Code runs in a sandboxed V8 isolate with: sparql.query(queryString, opts?) — run SELECT/CONSTRUCT/DESCRIBE; sparql.ask(queryString) — run ASK returning boolean; sparql.raw(queryString, opts?) — return unparsed JSON envelope; prefixes — object of common ontology prefixes (rdfs, owl, xsd, skos, dcterms, void, obo, uberon, go, ncbigene, efo, obi, sio, up, ensembl, bgee); prefixHeader — pre-built PREFIX block; console logging; optional filesystem access; optional domain-specific preamble. Large responses (>30KB) are auto-staged into SQLite.
No error handling guidance. What happens if code execution times out, throws an exception, or hits a sandbox limit? Agents have no recovery path.
'workspace' parameter underdocumented. References 'ADR-006 Phase 0' without explanation. Agents cannot determine when/why to use it.