Loading ToolBench
MCP server for API discovery and code execution across multiple data sources (REST APIs, GraphQL, SPARQL). Provides search tools, execute tools with sandboxed V8 isolate execution, and data staging capabilities.
This server exposes 14 tools with significant definition gaps. Public tools (search, execute variants) have descriptions but lack structured output schemas and parameter validation guidance. Internal proxy tools (__api_proxy, __graphql_proxy, etc.) have minimal descriptions and no visible input validation. Most tools lack error handling guidance, recovery paths, and actionable error messages. Parameter descriptions exist but are often vague (e.g., 'JavaScript code' without constraints on size, complexity, or safety). No tool annotations (readOnlyHint, destructiveHint, idempotentHint) despite clear risk profiles. The server prioritizes code execution flexibility over safety guardrails and LLM-friendly structure.
Internal proxy handler for REST API calls routed through the host. Handles api.get() and api.post() calls from user code in the isolate. Auto-stages large responses (>threshold) into SQLite and returns staging metadata.
Internal proxy handler for GraphQL queries routed through the host. Handles gql.query() calls from user code in the isolate. Auto-stages large responses (>threshold) into SQLite and returns staging metadata.
Internal proxy handler for exhaustive pagination. Backs api.getAll() calls from user code. Fetches all pages of a paginated endpoint and returns combined results, with auto-staging for large datasets.
Internal proxy handler for SQL queries against staged data. Backs db.queryStaged() and api.query() calls from user code. Executes SQL against the DO-SQLite database containing auto-staged datasets.
Internal proxy handler for SPARQL queries routed through the host. Handles sparql.query(), sparql.ask(), and sparql.raw() calls from user code in the isolate. Auto-stages large responses (>threshold) into SQLite and returns staging metadata.
Internal proxy handler for explicit data staging. Backs db.stage() calls from user code. Stages arbitrary data into SQLite and returns a data_access_id for subsequent SQL queries.
No output schemas documented for any tool. LLMs cannot predict response structure, forcing them to guess at field names and types for downstream tool chaining. This violates pattern:tool and pattern:response-shaper.
Internal proxy tools (__api_proxy, __graphql_proxy, __sparql_proxy, __stage_proxy, __query_proxy, __paginate_proxy) lack meaningful descriptions. Descriptions are 35-40 chars, below the 50-char minimum for LLM comprehension. These tools are implementation details exposed to the LLM, creating confusion about when to call them vs public tools.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 38 | 2026-07-28+ | v2 |
List files matching a glob pattern in the virtual filesystem. Available in isolates when fsDoNamespace is configured.
Read a file from the virtual filesystem. Available in isolates when fsDoNamespace is configured.
Write a file to the virtual filesystem. Available in isolates when fsDoNamespace is configured.
Execute JavaScript code against the API in a sandboxed V8 isolate. Code runs with: searchSpec(query) / searchPaths(query) — search the API catalog or OpenAPI spec; listCategories() / listTags() — inspect tags/categories; getEndpoint(path) / getOperation(idOrPath) — get endpoint docs; api.get(path, params) for GET, api.post(path, body, params) for POST; console.log() capture; optional fs.* for virtual filesystem; optional db.stage() / db.queryStaged() for data staging. Large responses (>100KB) are auto-staged into SQLite. The last expression or return value is the result.
Execute JavaScript code against a GraphQL endpoint in a sandboxed V8 isolate. Code runs with: gql.query(queryString, variables?) — execute GraphQL queries; schema.types() / schema.type() / schema.search() — introspection helpers; db.stage() / db.queryStaged() — data staging; optional api.get/api.post for hybrid REST capability; optional fs.* for virtual filesystem; console.log() capture. Large responses (>30KB) are auto-staged into SQLite. The last expression or return value is the result.
Execute JavaScript code against a SPARQL endpoint in a sandboxed V8 isolate. Code runs with: sparql.query(queryString, opts?) — run SELECT/CONSTRUCT/DESCRIBE; returns array of plain { variable: value } rows; sparql.ask(queryString) — run ASK; returns boolean; sparql.raw(queryString, opts?) — return unparsed { head, results } envelope; prefixes — object of common ontology prefixes (rdfs, owl, xsd, skos, dcterms, void, obo, uberon, go, ncbigene, efo, obi, sio, up, ensembl, bgee); prefixHeader — pre-built PREFIX block; optional fs.* for virtual filesystem; console logging capture. Large SPARQL responses (>30KB) are auto-staged into SQLite. The last expression or return value is the result.
Search the API catalog (catalog mode). Returns matching endpoints with full parameter docs. Use this to discover API capabilities before calling {prefix}_execute. Categories are dynamically populated from the catalog. USAGE IN {prefix}_execute: api.get(path, params) for GET, api.post(path, body, params) for POST. Path params like /lookup/{id} are auto-interpolated from params. Remaining params become query string. Large responses (>100KB) are auto-staged: check result.__staged, return the staging info, use {prefix}_query_data to explore. Use limit/pagination params to control response size.
Search the GraphQL schema. Write JavaScript code to search the schema using helper functions: searchTypes(query) — keyword search across type names and descriptions; listTypes() — list all types; getType(name) — get full type definition; describeType(name) — formatted documentation for a type; schema — the full frozen introspection result. Use {prefix}_search to discover schema, then write code in {prefix}_execute to call queries.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint) despite clear risk profiles. __stage_proxy and fs.writeFile are marked WRITE but lack destructiveHint. __api_proxy and __graphql_proxy are READ_ONLY but lack readOnlyHint. This prevents agents from reasoning about safety and retry semantics.
Code execution tools ({prefix}_execute variants) accept arbitrary JavaScript with no size limits, complexity constraints, or safety documentation. Descriptions mention 'sandboxed V8 isolate' but provide no guidance on what is/isn't allowed, timeout behavior, or memory limits. LLMs cannot reason about safety or failure modes.
No error handling guidance. Tools lack recovery hints, categorization of errors as retryable/user-fixable/fatal, or actionable error messages. An LLM receiving a timeout or 404 has no guidance on what to do next. Violates pattern:recovery-guide.