Loading ToolBench

Reading the current corpus…

mcp-server-graph-api MCP server · F · ToolBench

← Browse

mcp-server-graph-api

github.com/GeeksikhSecurity/mcp-server-graph-api

MCP server for Microsoft Graph API (Entra) interaction with support for Anthropic and Azure OpenAI clients

2026-07-28+STDIO1 tools

35/100

Definition Quality31

Protocol Readiness50

Supportability33

Spec posture

Inferred effective spec 2026-07-28+·current baseline 2026-07-28

Static source inference · medium confidence · detected: Dynamic Client Registration

Deprecated protocol patterns detected

Summary

Single tool 'my-tenant' has a reasonable schema with 5 parameters (path, queryParameters, method, body, graphVersion), all with type definitions and descriptions. However, the tool name violates verb-noun convention (should be 'call_graph_api' or 'query_graph_api'), lacks clarity on what 'my-tenant' does, and the description is generic ('Tool to interact with Microsoft Graph'). Parameters lack constraints: 'method' accepts free-form strings instead of an enum (GET|POST|PUT|PATCH|DELETE); 'path' has no format guidance or examples; 'queryParameters' is an untyped object. No output schema is documented. No error handling guidance. The tool exposes a generic pass-through to Microsoft Graph without safety guardrails, validation, or recovery hints. This is a low-quality definition that would confuse LLMs about when/how to use it.

Tools (1)

my-tenantwriteauthsource verified31/100

Tool to interact with Microsoft Graph (Entra)

Issues (5)

CRITICALtool ↗

Tool name 'my-tenant' does not follow verb_noun convention. Should start with action verb (e.g., 'call_graph_api', 'query_graph_api', 'execute_graph_request'). Current name is opaque and does not convey what the tool does.

my-tenant

HIGHconstrained-input ↗

Parameter 'method' accepts free-form strings instead of an enum. Should constrain to [GET, POST, PUT, PATCH, DELETE] to prevent invalid HTTP methods and guide LLM selection.

my-tenant

HIGHtool ↗

No output schema documented. LLMs cannot predict response structure, plan downstream calls, or extract relevant fields. Must document what fields are returned (e.g., value[], @odata.nextLink, error details).

my-tenant

HIGHtool-description ↗

Parameter 'queryParameters' is typed as untyped object with no schema. LLMs cannot validate OData filter syntax, $select fields, or $orderby constraints. Should document expected keys and value types.

my-tenant

Recommendations

Rename tool to 'call_graph_api' or 'query_graph_api' to signal the action clearly and follow verb_noun convention.
Expand description to 100-200 chars explaining: what it does (calls Microsoft Graph endpoints), when to use it (querying users, groups, subscriptions), and what it returns (JSON response with value array and pagination). Example: 'Call Microsoft Graph API endpoints to query or modify Entra resources (users, groups, subscriptions). Returns JSON with results and @odata.nextLink for pagination. Requires valid path (e.g., /users, /groups) and method (GET/POST/PUT/PATCH/DELETE).'
Constrain 'method' parameter to enum: [GET, POST, PUT, PATCH, DELETE]. Add description: 'HTTP method. GET for queries, POST/PUT/PATCH for modifications, DELETE for removal.'
Document 'path' parameter format: 'Microsoft Graph API path (e.g., /users, /groups, /me/messages). Must start with /. See https://learn.microsoft.com/en-us/graph/api/overview for valid paths.'
Add output schema documentation in tool description or as a separate field: 'Returns JSON object with: value (array of results), @odata.nextLink (pagination cursor), error (if request failed with code and message). On error, includes HTTP status and Graph error details.'

Score history

Overall score trend

First recorded score · v2 rubric

35/100

Scored	Grade	Overall	Spec posture	Rubric
2026-09-23	F	35	2026-07-28+	v2