Loading ToolBench
MCP server for proteomics data access and analysis, supporting REST APIs, GraphQL, and SPARQL endpoints with code execution in sandboxed V8 isolates
Server exposes 5 code-execution tools with reasonable descriptions (100-200 chars) but critical gaps in schema completeness and parameter documentation. Tool names are action-verb-based (search, execute) but schemas lack proper type definitions for most parameters. The 'code' parameter in execute tools is a free-form string with no validation constraints, format guidance, or examples. Parameter descriptions exist but are sparse (avg ~60 chars vs baseline 72). No output schemas documented. Error handling is absent, no guidance on recovery, retryability, or actionable error messages. Security concern: code execution tools accept arbitrary JavaScript without sandboxing validation visible in schema. Composition is reasonable (search → execute workflow), but tools lack idempotency markers and confirmation patterns for destructive operations.
Search the API catalog (legacy mode). Returns matching endpoints with full parameter docs. Use this to discover API capabilities before calling execute. Categories are listed and can be filtered. Large responses (>100KB) are auto-staged.
Execute JavaScript code against REST APIs in a sandboxed V8 isolate. Code runs with api.get/api.post wrappers, catalog search helpers, and console.log capture. Supports auto-staging of large responses (>30KB) into SQLite via DO namespace.
Execute JavaScript code against GraphQL endpoints in a sandboxed V8 isolate. Code runs with gql.query() for GraphQL execution, schema introspection helpers, and optional REST API overlay. Supports auto-staging of large responses into SQLite.
Search OpenAPI spec with JavaScript code execution. Write code to search paths, list tags, get operations, or access the full frozen spec object. Supports keyword search via searchPaths(), tag listing via listTags(), and operation lookup via getOperation().
Execute JavaScript code against SPARQL endpoints in a sandboxed V8 isolate. Code runs with sparql.query(), sparql.ask(), sparql.raw() for SPARQL execution, common ontology prefixes, and prefix header helpers. Supports auto-staging of large responses into SQLite.
Code execution tools (execute, graphql-execute, sparql-execute) accept 'code' parameter as free-form string with no validation, format constraints, or examples. No schema documents what valid code looks like, what APIs are available, or what output format is expected.
No output schemas documented for any tool. LLMs cannot predict what fields to expect, forcing them to guess at response structure and plan downstream calls blindly.
Error handling is absent. No guidance on retryability, user-fixable vs fatal errors, or actionable recovery steps. Code execution failures will return raw stack traces instead of 'Invalid syntax: expected function call' or 'API returned 404, check endpoint path'.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 40 | 2026-07-28+ | v2 |
Code execution tools lack idempotency markers and confirmation patterns. Agents cannot distinguish safe (read-only) from destructive operations. No dry-run or confirmation step before executing arbitrary code.
Search tools accept optional 'max_results' parameter but lack explicit min/max bounds in schema. Description states 'default 10, max 25' but schema has no numeric constraints (minValue, maxValue). LLMs may pass invalid values.