Loading ToolBench
Governed context plane for AI agents - permissioned, purpose-bound, auditable retrieval over MCP
Aperture demonstrates strong naming conventions (verb_noun pattern: context_search, action_propose, access_explain) and comprehensive descriptions (avg 180 chars, well above 34-char baseline). All 8 tools have explicit input schemas with typed properties. However, parameter descriptions are sparse, most lack guidance on format, constraints, or dependencies. Output schemas are undocumented; LLMs cannot predict response structure. Error handling is absent from visible code; no recovery guidance or categorization. Security posture is excellent (no credentials in params, permission gates, audit trails mentioned in descriptions), but composition could be tighter, action_propose and action_execute are tightly coupled, forcing multi-step workflows.
Return the audit record for an earlier trace_id: identity, purpose, sources consulted, records returned, and everything withheld with reasons.
Execute a proposal that is in the 'ready' state. Proposals awaiting approval cannot be executed until a human approves them out of band; poll action_status rather than retrying.
List the actions this caller may take under a purpose, with whether each one can be undone and whether it needs human approval. Check here before promising a user that something can be done.
Propose an action. This does NOT perform it. The gateway measures the real blast radius, applies policy, and returns either a proposal you may execute, a proposal awaiting human approval, or a refusal with a reason. Always show the blast radius to the user before executing.
Check a proposal: its state, blast radius, and any human decision. Use this to tell the user whether their request is waiting on an approver.
Output schemas completely undocumented. LLMs cannot predict response structure (fields, types, pagination). Breaks downstream tool chaining and forces agents to guess field names.
Parameter descriptions lack format/constraint guidance. 'purpose' appears in 5 tools with identical vague description; no enum of valid purposes (e.g., customer_support, billing, security). 'max_records' has no range (1 - 100? 1 - 1000?). LLMs will hallucinate invalid values.
No error handling guidance in visible code. Tools return success/failure but do not guide LLM on recovery (retry vs ask user vs fatal). 'Proposal awaiting human approval' mentioned in action_execute description but no structured error response shown.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 58 | 2026-07-28+ | v2 |
List the data sources this caller may read under a given purpose, with what each one covers. Use it to decide whether the question can be answered from governed context at all.
Fetch one record by id from a registered source. Permissions are re-evaluated on every fetch; a record id from an earlier result is not a durable capability.
Search governed enterprise context. Returns records the caller is permitted to see, with provenance, plus an explicit account of anything withheld. If records were withheld, say so in your answer instead of answering as though the context were complete.
action_propose and action_execute are tightly coupled (proposal_id from propose → execute). No dry-run or confirmation step visible. Agents cannot preview blast radius before committing destructive actions.
Pagination not visible in context_search schema. 'max_records' default=8 suggests truncation, but no next_cursor, offset, or total_count documented. Large result sets will blow context window.