Loading ToolBench
MCP server for simple ordering app with Permit.io integration
26 tools with explicit schemas and descriptions, but significant quality gaps. All tools have basic descriptions (10-200 chars) and input schemas with type definitions. However, descriptions are often generic and lack actionable context for LLM selection. Parameter descriptions are minimal (e.g., 'Session code for authentication' repeated 25 times). No output schemas documented. Error handling is absent, no recovery guidance, no categorization of retryable vs fatal errors. Tool naming is inconsistent: verb_noun pattern mostly followed, but 'epic-detail' and 'task-detail' lack clarity vs 'get-epic' and 'get-task'. No enum constraints on status fields (e.g., log-work-on-task accepts 'status' as enum but others don't). Composition is reasonable, tools are single-purpose, but missing critical chaining IDs in responses (e.g., create-task likely returns taskId but not epicId for downstream calls). Security concern: sessionCode passed as parameter in every call instead of server-side injection.
Assign task to a user. Only manager and admin can assign task to users.
Create new comment for specific task.
Create new epic.
Create new task for a specific epic.
Delete comment from a task.
Delete existing epic based on its ID.
Delete the specified task.
sessionCode passed as parameter in every tool instead of server-side secret injection. Credentials in parameters leak into agent logs and traces.
No output schemas documented. LLMs cannot plan downstream tool calls or extract required fields (e.g., taskId, epicId) for chaining.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 53 | 2026-07-28+ | v2 |
Get a detailed epic information, contains the epic title, creator, and creation date.
List all epics along with its task progression statistics.
List comments for a specific task.
List all epics in the system
List available tasks.
List available tasks filtered by epic.
List all registered user in the system, returning the user profile information.
Update task status and optionally increase the time spent for a specified task.
Authenticate a user by providing an email address. The email will contains a unique session code which will be used for subsequent MCP calls.
Invalidate the provided session code so it will be unusable for subsequent MCP calls, effectively revoking the user access and requiring the user to login again.
Get a detailed profile of the user based on its session code, the data includes the user's email, name, and role.
Rename existing epic title.
Get a detailed info of a specific task.
Count the number of comments per task
Count the number of tasks per user.
Unassign user from a specific task. Only manager and admin can unassign task to users.
Update existing comment content.
Updates task title and content.
Get a detailed profile of the used based on the provided email.
Generic parameter descriptions repeated 25+ times ('Session code for authentication'). LLMs cannot distinguish when to use each tool or what context they require.
No error handling or recovery guidance. Tools return success/failure with no actionable next steps for LLM (e.g., 'User not found. Try search_users() first.').
Inconsistent naming: 'epic-detail' and 'task-detail' lack verb clarity vs 'get-epic' and 'get-task'. 'list-tasks-by-epic' is verbose; 'list-tasks' with optional epicId filter is clearer.