Loading ToolBench
Local MCP server for snapWONDERS — lets an AI assistant hide, reveal, analyse and convert files that live on your own machine.
Four tools with complete schemas and descriptions, but significant gaps in error handling, parameter validation, and composition patterns. Tool names are clear action verbs (analyse_, hide_, reveal_, convert_), and descriptions are detailed (150-250 chars). However, descriptions lack actionable error recovery guidance, parameter constraints are minimal, and output schemas are not formally documented. The server handles secrets correctly (API key via environment), but lacks permission gates and audit trails. No tool annotations (readOnlyHint/destructiveHint) despite clear risk profiles.
Run forensic analysis on a local image or video and return the per-file verdicts. Reports the A–F grade, what the metadata reveals (GPS, device fingerprint, encoder signatures), manipulation evidence, and any hidden content detected. **A null verdict means no answer, not a negative one.** Fields such as ``steganography_suspected`` come back ``null`` when that check produced no result — because it was skipped, or could not run on this file. Do not report a file as clean, unmodified or free of hidden content on the strength of a null; say the check did not return a verdict.
Convert an image or video to a different format and save the result to disk. Supported image formats: JPEG, PNG, WebP, AVIF, HEIC, JXL. Supported video formats: MP4 (H.264), MP4 (H.265), WebM, Matroska, MOV.
Hide a file inside a cover image or video, and save the result to disk. The output looks like an ordinary photo or video. Recovering the hidden file needs this exact password — it is not stored anywhere and cannot be reset, so make sure the user knows what it is before running this.
Recover a file hidden inside a cover image or video, and save it to disk. The password must match exactly — there is no recovery mechanism, and a wrong password produces garbage, not an error.
No output schema documentation. Tools return dict[str, Any] with no formal schema describing fields, types, or structure. LLMs cannot plan downstream calls or extract specific data reliably.
Error handling lacks recovery guidance. Exceptions are caught and described (e.g., 'ValueError: ...') but do not tell the LLM what to do next or whether the error is retryable. No error classification (retryable vs. user-fixable vs. fatal).
Missing tool annotations. hide_file and convert_file are destructive (WRITE risk) but lack destructiveHint annotation. analyse_file and reveal_file are read-only but lack readOnlyHint. Agents cannot distinguish safe from risky tools.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 60 | 2026-07-28+ | v2 |
Parameter validation is incomplete. convert_file validates output_format against hardcoded lists, but analyse_file and reveal_file accept file_path as free-form string with only existence check. No regex patterns, length limits, or format constraints in schema.
No permission gates or audit logging. Tools execute immediately without verifying caller authority or logging who called what. Destructive operations (hide_file, convert_file) lack confirmation or dry-run support.