Loading ToolBench
A browser-based MCP server for testing refund comparison workflows, external target staging canaries, and workbench assurance scenarios with isolated sandbox execution and proof verification.
Server defines 10 tools with explicit schemas and descriptions. Most tools have clear, domain-specific names (run_external_target_canary, issue_refund, prove_refund_comparison) that convey intent. Descriptions are detailed and contextual (avg ~120 chars), explaining prerequisites and constraints. However, 6 of 10 tools accept empty input schemas with no parameters, limiting composability. Parameter descriptions are present but some lack actionable constraints (e.g., findingId pattern is documented but no guidance on discovery). Error handling is minimal, no recovery guidance or categorization. Output schemas are not documented. Tool composition is weak: many tools require prior state setup (stage_refund_comparison before issue_refund) but this dependency is only implicit in descriptions, not enforced via schema or error messages.
Explain one existing finding by ID, including its redacted evidence, failed invariant, and smallest permitted sandbox correction.
Invoke one approved refund attempt against the selected staging lane. The first attempt commits with an uncertain acknowledgement; retry once with the identical request ID.
Return the bounded redacted proof receipt after assurance replay. A passed receipt can truthfully record that the requested business goal was not achieved.
Read the staging ledger through the separate observation endpoint after both lanes receive two attempts, require the known-bad target to fail and the protected target to pass, then bind observed effect IDs to the approved trial.
Read the current redacted synthetic action case, workflow phase, staged-guardrail status, and allowed next actions. Use this before choosing another workbench action.
Replay the synthetic action using the exact currently approved guardrail, then check its authoritative post-condition. Human confirmation in the page is required.
Six tools (run_external_target_canary, stage_refund_comparison, prove_refund_comparison, read_case, run_diagnostics, replay_flow, prepare_report) accept empty input schemas with no parameters. This severely limits composability and forces agents to rely on implicit state management. Empty schemas should be replaced with explicit parameters (e.g., caseId, trialId) to enable chaining.
No output schemas documented for any tool. LLMs cannot plan downstream calls or extract required fields (e.g., what does read_case return? What fields enable the next action?). Add explicit return type documentation for all tools.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 58 | 2026-07-28+ | v2 |
Evaluate the current synthetic action against its deterministic safety invariant. This updates visible judgment and returns compact finding identifiers.
Run the fixed isolated External Target staging publish canary. It cannot choose accounts, content, providers, credentials, or production targets.
Reset one isolated external staging trial with known-bad and protected lanes. This changes no real payment and requires visible human approval before issue_refund can run.
Stage the permitted guardrail for one finding in browser-local state. This never grants approval or changes production.
Tool dependencies are implicit in descriptions but not enforced. E.g., issue_refund requires stage_refund_comparison to run first, but this is only mentioned in prose. No error handling guides recovery if called out of order. Add explicit dependency checks and actionable error messages.
Parameter descriptions lack actionable constraints. E.g., findingId has a regex pattern but no guidance on how to discover valid IDs or what happens if an invalid ID is passed. Add constraint descriptions and error recovery hints.
No error categorization or recovery guidance. Tools return blocked/failed states but do not tell the LLM whether to retry, ask the user, or abort. Add error classification (retryable, user-fixable, fatal) and next-step guidance.