Loading ToolBench
A .NET-based ASP.NET Core API server with user authentication, JWT token management, and visitor tracking functionality. This is a standard REST API application, not an MCP (Model Context Protocol) server.
Server has 4 tools with basic schemas and descriptions, but significant gaps prevent production use. Tool names lack clear action verbs (CreateVisitante vs create_visitante). Descriptions are present but generic (avg ~80 chars, below 194-char baseline). Parameter descriptions exist but lack constraints, ranges, or format details. No output schemas documented. Error handling is minimal, no recovery guidance or actionable error messages. Security concern: JWT token handling visible in code but no documentation of token injection/validation patterns. Overall structure suggests early-stage implementation.
Create a new visitor record with name, visit date, and optional observation. Requires JWT authentication.
Retrieve all visitor records. Requires JWT authentication.
Authenticate a user with email and password. Returns a JWT token on successful authentication.
Register a new user with username, email, and password. Returns the created user object or error if email or username already exists.
Tool names violate verb_noun convention. 'CreateVisitante' and 'GetVisitantes' use PascalCase; should be 'create_visitante' and 'get_visitantes'. LLMs parse intent from lowercase verb_noun patterns, inconsistent casing increases selection errors.
No output schemas documented. Callers cannot predict response structure. E.g., register returns 'User object' but no field list. GetVisitantes returns 'all visitor records' but no pagination, count, or field details. LLMs cannot chain tools without knowing what fields to extract.
Parameter descriptions lack constraints. 'Password' has no length/complexity rules. 'DataVisita' is datetime but no timezone or range guidance. 'Observacao' is optional but no max length. LLMs cannot validate inputs, will pass invalid values, causing silent failures.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 44 | 2026-07-28+ | v2 |
GetVisitantes has no pagination. Returns 'all visitor records' with no limit, offset, or cursor. If database has 10k visitors, response will exhaust context window. No total_count or next_cursor field documented.
Error handling is minimal. AuthController catches KeyNotFoundException and returns generic 'Email already exists' or 'Invalid credentials'. No recovery guidance (e.g., 'Try search_users() with partial name'). No error classification (retryable vs fatal). LLMs cannot plan recovery.