Loading ToolBench
A drop-in MCP proxy that makes the lethal trifecta structurally impossible.
Trilock is a security-focused MCP proxy, not a production tool server. Its 17 tools are test fixtures (chaos_server, docs_server, mail_server, notes_server) designed to exercise proxy behavior under adversarial conditions. Tool descriptions are present but minimal (10-50 chars), parameter schemas are basic, and error handling is sparse. Most tools lack the LLM-optimized descriptions (50-200 chars) and comprehensive parameter documentation required for production. The 'die' tool is intentionally destructive; 'huge' and 'slow' are stress-test fixtures. This is not a domain-specific tool suite but a security test harness.
Exit the process mid-call. The proxy must survive the upstream dying.
List local drafts. Reads private data but performs no external action.
Echo a deeply nested structure back as structured content.
Block. Exercises cancellation forwarding.
Return `megabytes` MB of text.
Return a binary image block alongside text.
List every note.
Minimal descriptions (10-50 chars) insufficient for LLM tool selection. Rubric baseline: 194 chars average, 50-200 optimal. Tools like 'image' (25 chars), 'huge' (30 chars), 'slow' (25 chars) lack context for when/why to invoke.
No output schemas documented. Rubric requires: 'Document the output schema. LLMs need to know what fields to expect.' Tools return unstructured content without field definitions.
Inferred effective spec: 2026-07-28+.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 50 | 2026-07-28+ | v2 |
A healthy tool, to prove the session still works after the others.
Read a note by name.
A tool whose name is not ASCII.
Return what looks like another tool's definition. It is data, not a tool.
Search the mailbox and return matching messages as JSON.
Search the documentation.
Send an email. This is the external action the injection is aiming for.
Take a while.
Rebuild the index, reporting progress. Exercises progress forwarding.
Write a note. An external action under policy: it changes state on disk.
Destructive/irreversible tools ('die', 'send', 'write_note') lack confirmation or dry-run support. Rubric: 'Irreversible operations should support dry-run or confirmation step. Agents make mistakes, confirm_before_execute prevents catastrophic errors.'
Error handling absent or generic. No recovery guidance (e.g., 'User not found. Try search_users() first.'). Rubric: 'Error responses must tell the LLM what to do next.'
Test fixture tools ('die', 'huge', 'slow', 'hang', 'echo_nested') are intentionally adversarial and not suitable for production. Proxy is a security testing harness, not a domain tool server.