Loading ToolBench
A collection of bash scripts for auditing and hardening the security of AI agent installations on macOS, including permission tightening, port monitoring, and credential scanning.
This MCP server exposes three bash scripts as tools with minimal structured metadata. While the bash scripts themselves contain good inline documentation and clear descriptions of what they do, the MCP tool registration lacks critical elements: (1) No input schemas are visible for any tool beyond a trivial boolean for tool 1. (2) Parameter descriptions are minimal or absent. (3) Tools are inferred from bash scripts rather than explicitly registered with proper MCP tool definitions. (4) No output schemas are documented. (5) Error handling lacks recovery guidance. (6) Tool naming is descriptive but parameter naming is inconsistent with best practices (e.g., 'apply' boolean is not sufficiently constrained). The server essentially wraps shell scripts without translating them into production-grade MCP tools with proper schemas and metadata.
Checks whether anything is listening on or connecting to port 18789 (the default port used by OpenClaw). Audits macOS Application Firewall status and provides firewall blocking commands but does NOT modify the firewall.
Inventories installed AI agents, checks config directory permissions, scans for plaintext credential files, and lists MCP server connections. Reads-only audit tool that never modifies anything.
Tightens file permissions on AI agent config directories to prevent other processes or users from reading sensitive config and session files. Changes directory permissions to 700 (owner-only) and credential files to 600 (owner-read/write only).
No input schemas visible for tools 2 and 3; tool 1 has only a bare boolean with minimal parameter description.
Tool definitions appear inferred from bash scripts rather than explicitly registered with MCP metadata; no direct evidence of JSON Schema type definitions or structured parameter constraints.
No output schemas documented. Tools return unstructured bash output (plain text, command listings) with no structured response format, field definitions, or typing guidance for downstream agent use.
Error handling provides no recovery guidance. Bash script error states (e.g., 'lsof: command not found', permission denied) are not caught and translated into actionable LLM instructions.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | F | 33 | 2026-07-28+ | v2 |
Tool 1 (tighten_agent_permissions) accepts an 'apply' boolean but provides no clear description of what 'true' vs 'false' means in the schema. Parameter description exists but is minimal.
Tool 1 is destructive (chmod -R changes permissions) but has no destructive indicator, confirmation mechanism, or explicit state-modification warning in schema.
Tools 2 and 3 have empty input schemas ({}). This violates the requirement that every tool parameter must be described and typed.