Loading ToolBench
MCP server providing Code Mode execution tools for API discovery and execution, with support for REST APIs, GraphQL, and SPARQL endpoints. Includes catalog search, dynamic code execution in sandboxed V8 isolates, and auto-staging of large responses.
Server defines 4 tools with detailed descriptions and parameter schemas. Naming follows verb_noun pattern (search, execute). Descriptions are comprehensive (150-400 chars) and explain WHEN to use each tool. However, schemas lack explicit type constraints (enums, ranges), output schemas are undocumented, and error handling guidance is minimal. Tool composition is sound, search discovers capabilities, execute acts on them, but parameter interdependencies are not fully documented. No security annotations (readOnlyHint present in Risk field but not in schema). Baseline: 4 tools, avg description ~250 chars, all params described, but missing output schema documentation and validation constraints.
Execute JavaScript code against an API catalog or OpenAPI spec in a sandboxed V8 isolate. Code runs with: searchSpec(query) / searchPaths(query) — search the API spec; listCategories() / listTags() — inspect categories/tags; getEndpoint(path) / getOperation(idOrPath) — get endpoint docs; api.get(path, params) for GET, api.post(path, body, params) for POST; console.log() capture; optional filesystem access (fs.readFile/writeFile/glob); optional domain-specific preamble helpers. Large responses (>100KB) are auto-staged into SQLite for SQL queries.
Execute JavaScript code against a GraphQL endpoint in a sandboxed V8 isolate. Code runs with: gql.query(queryString, variables?) — execute GraphQL queries; schema.types() / schema.type(name) / schema.search(query) — introspection helpers; db.stage() / db.queryStaged() — staging helpers; optional api.get/api.post for hybrid REST capability; optional filesystem access; console.log() capture. Large responses (>30KB) are auto-staged into SQLite. When introspection is disabled, schema.* reports unavailable but gql.query() still works.
Execute JavaScript code against a SPARQL endpoint in a sandboxed V8 isolate. Code runs with: sparql.query(queryString, opts?) — run SELECT/CONSTRUCT/DESCRIBE queries returning array of plain {variable: value} rows; sparql.ask(queryString) — run ASK queries returning boolean; sparql.raw(queryString, opts?) — return unparsed {head, results} envelope; prefixes — object of common ontology prefixes (rdfs, owl, xsd, skos, dcterms, void, obo, uberon, go, ncbigene, efo, obi, sio, up, ensembl, bgee); prefixHeader — pre-built PREFIX block; optional filesystem access; console.log() capture. Large responses (>30KB) are auto-staged into SQLite.
Search the API catalog (catalog mode) or OpenAPI spec (OpenAPI mode). Returns matching endpoints with full parameter documentation. Use this to discover API capabilities before calling {prefix}_execute. In catalog mode: accepts query/category/max_results parameters and performs keyword-based search over static ApiCatalog. In OpenAPI mode: accepts code parameter for agent-written JavaScript with full resolved OpenAPI spec and helper functions available.
Output schemas not documented. Tools return JavaScript execution results but no schema describes the structure, fields, or types agents should expect. Forces LLMs to guess at response shape.
No input validation constraints. Parameters like 'code' and 'query' accept free-form strings with no length limits, format patterns, or examples. Sandbox execution risk not mitigated by schema.
Error handling guidance missing. No description of what errors can occur, how to recover, or what the LLM should do if execution fails. Sandbox errors, network timeouts, and invalid code are not addressed.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 45 | 2026-07-28+ | v2 |
Tool naming collision: three separate tools all named 'depmap_execute' (REST, GraphQL, SPARQL variants). LLMs cannot distinguish between them. Should be 'depmap_execute_rest', 'depmap_execute_graphql', 'depmap_execute_sparql'.
Security annotations present in Risk field but not in schema. readOnlyHint should be declared in tool metadata or schema to enable agent permission checks and audit trails.