Loading ToolBench
A collection of bash scripts providing MCP tools for intelligence gathering, data verification, and research automation including BIN lookup, email verification, breach checking, CAPTCHA solving, blockchain analysis, and corporate intelligence.
Agent-reach is a bash-based tool collection with 38 tools, but exhibits critical definition quality gaps. Tool names lack consistent verb-noun structure (e.g., 'bin-lookup' vs 'bounceban-verify' vs 'brief'). Descriptions vary wildly in quality: some are detailed (bounceban-verify: 150+ chars), others are vague ('brief': generic research deliverable). Input schemas are present but inconsistent, many parameters lack type definitions or descriptions. For example, 'brief' has parameters 'n', 'pdf', 'lang', 'o' with minimal context. No output schemas documented. Error handling is implicit (curl failures, Python exceptions) with no recovery guidance. Security concerns: tools expose API keys via environment variables (BOUNCEBAN_API_KEY, etc.) but do not validate or sanitize inputs. No tool annotations (readOnlyHint, destructiveHint). Composition is poor: multiple tools operate on the same resource (e.g., bounceban-verify, bounceban-check, bounceban-bulk) with overlapping responsibilities. No pagination or result limits documented.
BIN (Bank Identification Number) lookup using binlist.net API. Looks up card scheme, type, brand, country, currency, and bank information for a given BIN.
Check BounceBan account credits balance.
Bulk verify list of email addresses from a file using BounceBan. Returns task ID for tracking progress.
Fetch bulk verification results as JSON from BounceBan.
Get CSV export download link for bulk verification results from BounceBan.
Check the status of a bulk email verification task on BounceBan.
Fast syntax/domain/role check for email addresses using BounceBan. No SMTP verification, uses separate Check Plan credits.
No output schemas documented for any tool. LLMs cannot predict response structure, forcing them to parse unstructured output and plan downstream calls blindly.
Inconsistent naming convention. Tools use hyphenated names (bin-lookup, bounceban-verify) but lack consistent verb-noun structure. 'brief' and 'captcha-auto' are vague; 'bounceban-bulk-dump' is compound. LLMs struggle to infer intent from inconsistent names.
Many parameters lack descriptions or have minimal context. 'brief' tool has parameters 'n', 'pdf', 'lang', 'o' with only 1-2 word descriptions. 'bounceban-bulk-status' and 'bounceban-bulk-dump' have no parameter descriptions visible.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 40 | 2026-07-28+ | v2 |
Show BounceBan configuration and API key status.
Verify single email address using BounceBan waterfall API. Detects deliverability, catch-all status, and risky emails. Supports standard and deep verification modes.
List all known data breaches in HaveIBeenPwned database (free, no key needed).
Check domain for data breaches using HaveIBeenPwned API (free, no key needed).
Check email address for data breaches using LeakCheck (free) and HaveIBeenPwned (if API key set).
Check IP address fraud score using Scamalytics and ip-api.com (free APIs).
Check if password has been compromised using PwnedPasswords API with k-anonymity (free, password never sent in full).
Check phone number for data breaches using LeakCheck API (free).
Check username availability and presence across 10 social media platforms (GitHub, GitLab, Twitter, Reddit, Instagram, TikTok, YouTube, Twitch, Pinterest, Medium).
One-verb research deliverable: Exa search → fetch → summarize → DOCX/PDF. Generates a formatted research brief with executive summary and source compilation.
Automatically detect and solve CAPTCHA on a URL.
Check balance/credits for all configured CAPTCHA solving providers.
Solve CAPTCHA inside a real browser using Playwright. Supports manual solving mode.
Show CAPTCHA solver configuration and active providers.
Detect CAPTCHA type and extract sitekey from a URL.
Solve CAPTCHA using best available provider with automatic fallback. Supports reCAPTCHA, hCaptcha, Turnstile, and Cloudflare challenges.
Analyze cookies for session markers and security attributes (HttpOnly, Secure, SameSite).
Extract interesting values from cookies including tokens, JWTs, session IDs, and secrets.
Fetch and display Set-Cookie headers from a URL.
Parse Netscape format cookie jar file.
Parse and display cookie string with name-value pairs.
Map ownership network showing company → directors → other companies → shareholders → UBO (Ultimate Beneficial Owner).
Get list of officers/directors for a company by jurisdiction and company number.
Search for company ownership and shareholder information.
Search for company information using OpenCorporates API.
Search UK Companies House registry for company information.
Check Bitcoin address balance and transaction history using Blockstream API.
Get current Bitcoin price in USD and 24-hour trading volume.
Check Ethereum address balance and token holdings using Ethplorer API.
Get current Bitcoin transaction fee estimates in sat/vB for various confirmation times.
Get Bitcoin network statistics including block height, mempool size, and current price.
No error handling guidance. Tools fail silently (curl timeouts, API errors) with no recovery hints. E.g., bounceban-verify retries on 408 but does not document this behavior or guide LLMs on what to do if verification hangs.
Overlapping tool responsibilities. bounceban-verify, bounceban-check, and bounceban-bulk all verify emails but with different modes/APIs. No clear guidance on when to use each. LLMs will waste reasoning cycles choosing between them.