Loading ToolBench
A read-only analysis layer over unifi-siem-sink that provides security findings, heuristic analysis, and MCP tools for AI-assisted security review of UniFi network events
Three tools with clear verb-noun naming and basic schemas. All tools have descriptions (10 - 100 chars, below ideal 50 - 200 baseline). Input schemas present and typed via Zod, but parameter descriptions are minimal or absent. Output structure documented via toolResult/toolError helpers, but no explicit schema documentation for response fields. Error handling returns structured text but lacks recovery guidance or error classification. No tool annotations (readOnlyHint/destructiveHint) despite clear risk profiles.
Get full context for one analysis request: the request, its finding, and finding history.
List pending analysis requests awaiting a recommendation.
Submit a recommendation for a pending analysis request, marking it answered.
Parameter descriptions missing or minimal. 'id' param in get_analysis_context has description 'Analysis request ID' (18 chars), below 50-char baseline. No descriptions for enum values (low/medium/high) or constraints on 'recommendation' string length.
No tool annotations (readOnlyHint/destructiveHint/idempotentHint). submit_analysis is marked Risk:WRITE but tool definition lacks destructiveHint annotation. get_pending_analyses and get_analysis_context lack readOnlyHint. Current MCP spec (2026-07-28) supports these annotations.
Error handling returns generic text-wrapped errors without recovery guidance. 'Error: Analysis request 123 not found' does not suggest next steps (e.g., 'Call get_pending_analyses to list valid IDs'). No error classification (retryable vs. user-fixable vs. fatal).
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 64 | <=2025-11-25 | v2 |
Output schema not explicitly documented. toolResult() wraps responses in JSON text, but no schema definition for pending analyses list structure, analysis context object fields, or submit_analysis result. LLMs cannot infer field names or types.
Tool descriptions are brief (10 - 100 chars) vs. production baseline of 50 - 200 chars. 'List pending analysis requests awaiting a recommendation' (54 chars) is acceptable, but lacks context on when to call it vs. get_analysis_context, or what structure is returned.