Loading ToolBench
An MCP server that provides tools and resources for interacting with OpenAPI specifications. Enables searching, retrieving details, listing endpoints, and executing API calls based on OpenAPI specs.
Server has 5 tools with explicit schemas and descriptions. Naming follows verb_noun convention (search, get, list, execute). Descriptions are present but generic (avg ~80 chars, below 194-char baseline). Schemas use proper JSON Schema with types. Critical gaps: no output schemas documented, no error recovery guidance, no parameter constraints (enums, ranges), and executeApiCall accepts untyped 'auth' and 'requestBody' objects. Parameter descriptions lack format/constraint details (e.g., 'apiId' just says 'unique ID' without format). No pagination support despite list tools. Missing idempotency and destructive operation warnings.
Executes a specific API call based on an OpenAPI specification. Requires API ID, path, method, and necessary parameters/body.
Retrieve detailed information about a specific OpenAPI specification from the registry using its ID.
Retrieve details for a specific endpoint (operation) within an OpenAPI specification, including summary, parameters, request body, and responses.
List all available endpoints (path and method) for a specific OpenAPI specification.
Search the registry for OpenAPI specifications by keyword.
executeApiCall accepts untyped 'auth' and 'requestBody' parameters. 'auth' is described as 'object containing authentication details' with no schema, allowing arbitrary keys. 'requestBody' has no type constraint. This invites hallucinated auth schemes and malformed payloads.
No output schemas documented for any tool. LLMs cannot plan downstream calls or extract required fields (e.g., does getApiDetails return a 'servers' array? What fields does executeApiCall return?). Violates pattern:tool requirement.
Parameter descriptions lack actionable constraints. 'apiId' described as 'unique ID' without format. 'query' has no length/character limits. 'method' says 'case-insensitive' but no enum of valid HTTP methods. Descriptions should state format, range, and allowed values per pattern:tool-description.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 52 | 2026-07-28+ | v2 |
executeApiCall is destructive (WRITE risk) but has no confirmation step, dry-run option, or warning in description. Agents can invoke arbitrary API calls without safeguards. Violates pattern:confirmation-request.
listApiEndpoints and searchOpenApiSpecs return lists but lack pagination (no limit, offset, page_size, or next_cursor parameters). Large result sets will blow context window. Violates pattern:paginated-result.