Loading ToolBench
MCP server exposing the full YouTube Analytics, Data v3 and Reporting API surface for one or many channels you own.
Server has 6 tools with clear naming (verb_noun pattern) and reasonable descriptions (avg ~150 chars). All tools have input schemas with type definitions. However, parameter descriptions are sparse or missing in several tools (youtube_authorize_status, youtube_authorize_cancel, youtube_set_default_account, youtube_forget_account have empty input objects with no descriptions). Output schemas are not documented, responses are JSON blobs without field-level documentation. Error handling is minimal; no recovery guidance or actionable error messages visible. Security is reasonable (no secrets in params, OAuth flow is server-side), but no audit logging or permission gates documented.
List authorized channels, which one is the default, and where configuration lives. Start here when unsure what this server can see.
Start authorizing a channel. Returns the consent URL immediately — give it to the owner to open in a browser, then poll youtube_authorize_status. Run it again, picking a different Google account in the browser, to add another channel.
Abandon an in-flight consent flow so a new one can be started.
Check an in-flight consent flow started by youtube_authorize: still waiting, finished, or failed. Also re-prints the consent URL.
Remove a stored refresh token. This does not revoke the grant — do that at https://myaccount.google.com/permissions.
Choose which authorized channel calls use when none is named.
Output schemas not documented. Tools return JSON via json() helper but no field-level schema is visible. LLMs cannot plan downstream calls or extract specific fields reliably.
youtube_authorize_status and youtube_authorize_cancel have empty input schemas (z.object({})) with no parameter descriptions. Even though no params are required, the schema should document what the tool returns and when to call it.
No error handling guidance. Tools do not return actionable error messages (e.g., 'Authorization failed: consent URL expired. Call youtube_authorize again.'). LLMs receive raw errors with no recovery path.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 56 | 2026-07-28+ | v2 |
No tool annotations (readOnlyHint, destructiveHint). youtube_forget_account is marked DESTRUCTIVE in metadata but the tool definition lacks destructiveHint annotation. Agents cannot infer which tools are safe to retry.
No audit logging or permission gates visible. Tools modify state (authorize, forget account) but no logging of who called what, when, or with what result. Compliance and debugging are at risk.