Loading ToolBench
MCP server with multiple database backends including MongoDB, Pinecone, and Supabase
This server has 7 tools with significant quality gaps. Tool naming is inconsistent (add, mongodb_find, pinecone_search vs read_table_rows, create_table_records). Most tools lack proper input schema validation in code. Descriptions vary widely: add/mongodb_find/pinecone_search are minimal (10-30 chars), while Supabase tools have detailed docstrings (200+ chars). Parameter descriptions are present in Supabase tools but missing or minimal in others. No output schemas documented. Error handling is absent, no recovery guidance, no validation messages. Security concerns: mongodb_server.py and pinecone_server.py expose credentials via environment variables without validation. Supabase tools accept dict/object parameters (filters, updates, records) without type constraints, inviting injection attacks. No tool annotations (readOnlyHint, destructiveHint) despite clear risk levels (DESTRUCTIVE delete_table_records). Overall, Supabase subset is B-grade; add/mongodb_find/pinecone_search are D-grade.
Add two numbers
Create one or multiple records in a Supabase table. Use this tool to insert new data into a specific table in the Supabase database. You can insert a single record or multiple records at once.
Delete records from a Supabase table that match the specified filters. Use this tool to remove data from a specific table in the Supabase database. You provide filter conditions to identify which records to delete.
Find MongoDB documents
Search Pinecone vectors
Read rows from a Supabase table with optional filtering, ordering, and limiting. Use this tool to query data from a specific table in the Supabase database. You can select specific columns, filter rows based on conditions, limit the number of results, and order the results.
Minimal descriptions for 3 tools (add, mongodb_find, pinecone_search). 'Add two numbers', 'Find MongoDB documents', 'Search Pinecone vectors' are under 30 chars and lack context for LLM selection. No guidance on when to use vs alternatives.
No output schemas documented for any tool. LLMs cannot plan downstream calls or extract required fields. E.g., mongodb_find returns {documents: [...]}, but structure of each document is undocumented.
Destructive operations (delete_table_records) lack confirmation/dry-run support and tool annotations. No readOnlyHint/destructiveHint metadata. Agents cannot distinguish safe from dangerous tools.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 49 | 2026-07-28+ | v2 |
Update records in a Supabase table that match the specified filters. Use this tool to modify existing data in a specific table in the Supabase database. You provide the new values and filter conditions to identify which records to update.
Supabase tools accept untyped dict/object parameters (filters, updates, records) without validation. No enum constraints, no format specs. Invites SQL injection via filter payloads. E.g., filters={"name": "'; DROP TABLE users; --"} is not validated.
No error handling or recovery guidance. Tools fail silently or return raw API errors. E.g., if mongodb_find hits a connection error, no guidance on retry or fallback.