Loading ToolBench
MCP server for executing code against API catalogs and GraphQL/SPARQL endpoints with sandboxed V8 isolate execution, auto-staging of large responses, and citation/provenance tracking
Five tools with READ_ONLY risk classification. All have descriptions (50-200+ chars), but schemas are partially visible and parameter descriptions vary. catalog_search and search have well-documented parameters with type constraints (string, number, optional). execute, graphql_execute, and sparql_execute accept 'code' (string) and optional 'workspace' (string) but lack detailed output schema documentation. No tool annotations (readOnlyHint, idempotentHint) present. Error handling guidance is absent, no recovery hints or actionable error messages documented. Naming is verb-forward (search, execute, catalog_search) but 'execute' is generic and overloaded across three tools (API, GraphQL, SPARQL), risking LLM confusion. Output schemas are not formally documented in the visible code.
Search the API catalog (legacy mode). Returns matching endpoints with full parameter docs. Use this to discover API capabilities before calling execute. Categories are listed. USAGE IN execute: api.get(path, params) for GET, api.post(path, body, params) for POST. Path params like /lookup/{id} are auto-interpolated from params. Remaining params become query string. Large responses (>100KB) are auto-staged: check result.__staged, return the staging info, use query_data to explore. Use limit/pagination params to control response size.
Execute JavaScript code against an API catalog or OpenAPI spec. Code runs in a sandboxed V8 isolate with api.get/api.post wrappers, catalog search helpers (searchSpec, listCategories, getEndpoint), console.log capture, and optional filesystem access. Large responses (>100KB) are auto-staged into SQLite for querying. API keys never enter the isolate — all HTTP goes through the host's apiFetch.
Execute JavaScript code against a GraphQL endpoint. Code runs in a sandboxed V8 isolate with gql.query(queryString, variables?) for GraphQL execution, schema.types()/schema.type()/schema.search() for introspection helpers, db.stage()/db.queryStaged() for staging, and optional REST api.get/api.post for hybrid GraphQL+REST servers. Large responses are auto-staged into SQLite. GraphQL endpoint URL never enters the isolate — all HTTP goes through the host's gqlFetch.
Search the OpenAPI spec or API catalog. In OpenAPI mode, write JavaScript code to search the spec using searchPaths(query, maxResults), listTags(), getOperation(idOrPath), describeOperation(idOrPath), or access spec.paths directly. In catalog mode (legacy), use keyword search with query/category/max_results parameters. Returns matching endpoints with full documentation.
Three tools named '*_execute' (execute, graphql_execute, sparql_execute) with generic 'code' parameter. LLMs cannot distinguish which to call without reading full descriptions. Naming should be more specific: api_execute, graphql_query_execute, sparql_query_execute.
Output schemas not documented in visible code. Tools return complex staged data (__staged, result objects) but no formal schema definition provided. LLMs cannot plan downstream calls without knowing return structure.
No error handling guidance. Descriptions mention 'auto-staging' and 'large responses' but do not explain what happens on failure, how to retry, or what error messages mean. No recovery hints for LLMs.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 40 | 2026-07-28+ | v2 |
Execute JavaScript code against a SPARQL endpoint. Code runs in a sandboxed V8 isolate with sparql.query(queryString, opts?) for SELECT/CONSTRUCT/DESCRIBE, sparql.ask(queryString) for ASK queries, sparql.raw(queryString, opts?) for unparsed envelopes, prefixes object with common ontology prefixes, prefixHeader pre-built PREFIX block, and optional filesystem access. Large responses (>30KB) are auto-staged into SQLite. SPARQL endpoint URL never enters the isolate — all HTTP goes through the host's sparqlFetch.
No tool annotations (readOnlyHint, idempotentHint, destructiveHint). All tools are READ_ONLY but this is not declared in schema. Agents cannot infer safety properties.
'code' parameter in execute/graphql_execute/sparql_execute is free-form JavaScript. No constraints on what code can do, no sandboxing guarantees documented, no injection prevention guidance. Descriptions mention 'sandboxed V8 isolate' but do not explain limits or what happens if code fails.