Loading ToolBench
A comprehensive project management and AI integration platform with MCP (Model Context Protocol) support for tool delegation, connection management, and grant administration
Server defines 12 tools with clear verb-noun naming (propose_, reject_, revoke_, confirm_, create_, acknowledge_, submit_, get_). All tools have descriptions (avg 156 chars, within 10-1024 range). Input schemas present with typed parameters and descriptions. However, output schemas are NOT documented, critical gap for LLM planning. Parameter descriptions lack actionable constraints (e.g., no enum values shown for 'conclusion' or 'riskLevel' in submit_mcp_tool_review, though enums exist in schema). Error handling guidance absent, tools do not explain recovery paths. Composition is sound: tools chain logically (delegation → grant → review). Security concern: no visible permission gates or audit logging in tool definitions.
Acknowledge an MCP tool grant after creation. Required before the grant becomes effective.
Connection owner confirmation of an MCP delegation. Confirms that the project is allowed to use this connection. After confirmation, the project owner must independently confirm the project scope.
Project owner confirmation of an MCP delegation. Confirms project scope and data egress. After confirmation, current V2 review tools can enter read-only grant candidates; remote action invocation remains frozen.
Create a read-only MCP tool grant for a project. Requires a valid delegation, tool definition, and V2 attestation. The grant must be acknowledged by the project owner.
Retrieve paginated history of MCP tool reviews. Can filter by tool definition or connection. Requires admin access.
Retrieve MCP connection delegations for a project. Returns available connections and current delegation status.
Output schemas not documented. LLMs cannot plan downstream calls or extract required fields (e.g., what does get_project_mcp_delegations return? Does it include delegation status, expiry, owner info?). This forces agents to guess or make extra discovery calls.
Enum constraints (conclusion, riskLevel, riskReasonCode in submit_mcp_tool_review) are in schema but NOT explained in parameter descriptions. LLMs cannot read JSON Schema enums, they rely on description text. Parameter descriptions should state: 'Must be one of: read_only_verified, read_only_rejected, needs_research'.
No error handling guidance. Tools do not explain what to do on failure (e.g., if delegation confirmation fails due to permission denied, should the agent retry, ask the user, or escalate?). Error responses must guide recovery.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 52 | 2025-06-18+ | v2 |
Retrieve MCP tool grants for a project. Returns active grants and eligible grant candidates.
Submit a read-only MCP delegation proposal for a project connection. The proposal enters the control plane confirmation queue and requires confirmation from both the connection owner and project owner before becoming active.
Reject a pending MCP delegation proposal. This prevents the delegation from proceeding through confirmation. Requires a reason to be provided.
Revoke an active MCP delegation. This stops subsequent project usage of the connection. Already-issued external requests cannot be recalled. Requires a reason to be provided.
Revoke an active MCP tool grant. Prevents further tool invocations through this grant.
Submit a V2 attestation review for an MCP tool. Requires admin access and includes conclusion, risk level, and evidence notes. Supports read-only verification, rejection, or research-needed conclusions.
Destructive operations (revoke_mcp_delegation, revoke_mcp_tool_grant) lack confirmation or dry-run support. Agents make mistakes, these tools should support a confirmation step before irreversible revocation.
No visible permission gates or scope declarations in tool definitions. Tools like submit_mcp_tool_review require 'admin access' (stated in description) but no mechanism shown to enforce or declare this. Audit logging not visible.