Loading ToolBench
A modern web-based workbench for managing Claude Code CLI - configure MCP servers, custom commands, environment variables, and chat with Claude
Claude Workbench is a desktop/web management UI for Claude configuration, not an MCP server in the standard sense. However, it exposes 47 tools via an HTTP backend. Critical issues: (1) Most tools lack formal input schemas in the visible source code (backend/src/server.ts shows tool definitions but JSON schemas are not explicitly visible for parameter validation). (2) Descriptions exist but are extremely brief (average ~20-40 chars) and lack actionable guidance for LLM selection. (3) No output schemas documented anywhere. (4) No error handling patterns visible, no recovery guidance, no categorization of retryable vs fatal errors. (5) Many tools operate on files/config state without clear safety boundaries. (6) Parameter descriptions are minimal ('Name of the MCP server', 'ID of the profile') with no format constraints, ranges, or validation rules. (7) 9 tools handle secrets (API keys, auth tokens, environment variables) without clear secrets-injection patterns. (8) No tool annotations visible (readOnlyHint, destructiveHint, idempotentHint). The server is functionally a UI backend, not a composable agentic tool suite, tools are tightly coupled to file I/O and UI state management rather than being independently idempotent and chainable.
Send a message to Claude AI and get a response
Clear environment variables from shell configuration files
Clear environment variables from settings.json
Create a new AI assistant conversation
Create a new environment profile
Create a new workbench project
Delete an agent configuration
Delete a custom command
No output schemas documented for any of the 47 tools. LLMs cannot determine what fields to expect in responses, making downstream tool chaining unreliable and forcing wasteful discovery calls.
Destructive tools (delete_env_profile, delete_command, delete_skill, delete_agent, delete_project, uninstall_marketplace, uninstall_plugin) lack dry-run/confirmation patterns and no error recovery guidance. An agent deleting a critical resource has no safety net.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | F | 38 | 2026-07-28+ | v2 |
| 2026-03-09 | F | 18 | - | v1 |
Delete an AI assistant conversation
Delete an environment profile
Delete a workbench project
Delete a skill file
Expand a file path with environment variable and home directory substitution
Retrieve all agents
Retrieve available Claude AI models from active environment profile
Retrieve available tool definitions for Claude AI
Get the status of all configured MCP servers
Retrieve the Claude JSON configuration from ~/.claude.json
Retrieve all custom commands
Retrieve a specific AI assistant conversation
List all AI assistant conversations
Retrieve all environment profiles from env-profiles.json
Retrieve all installed plugin marketplaces
Retrieve logs for an MCP server
Get the current status of an MCP server
Retrieve all workbench projects
Retrieve all skills
Get list of available Windows drive letters (Windows only)
Install a plugin marketplace from a Git repository
Install a plugin from a marketplace
Update a conversation name or project path
Read environment variables from shell configuration files (.zshrc, .bashrc, or .claude-env)
Read environment variables from settings.json
Save an agent configuration
Save a custom command
Save a skill file
Set the active environment profile
Start an MCP server process by name
Stop a running MCP server process by name
Uninstall a plugin marketplace
Uninstall a plugin
Update the Claude JSON configuration and save to ~/.claude.json
Update an existing environment profile
Update a plugin marketplace from its repository
Update a workbench project
Write environment variables to shell configuration files
Write environment variables to settings.json
9 tools handle secrets (write_env_to_shell_config, write_settings_env, update_claude_config, create_env_profile, update_env_profile, ai_chat with apiKey) without documented secret-injection patterns. API keys and auth tokens should never be tool parameters.
Parameter descriptions are universally terse (15-30 chars) and lack format constraints, ranges, or validation rules. E.g., 'Name of the MCP server' does not specify valid characters, length limits, or examples. No enums documented for constrained inputs (e.g., model names in ai_chat).
No tool annotations visible (readOnlyHint, destructiveHint, idempotentHint). LLMs cannot infer which tools have side effects, are read-only, or are safe to retry. This is especially critical for destructive tools like delete_* and configuration writers.
Error handling is completely absent from the visible code. No error classification, recovery guidance, or actionable error messages. An LLM calling start_mcp_server() with an invalid name gets no guidance on what to try next.
Many tools expose opaque IDs (profileId, conversationId) without accepting human-friendly identifiers (profile name, conversation title). Agents must perform extra lookup calls instead of using names directly.
No pagination support visible in list tools (get_conversations, get_projects, get_commands, get_skills, get_agents, get_marketplaces). For systems with hundreds of items, responses will be incomplete or blow the context window.
Tool definitions are inferred from sparse source code references (e.g., 'frontend/src/App.tsx') without explicit input/output schema registration visible. Cannot confirm JSON Schema compliance or parameter types for many tools.
No audit logging or permission gates visible. A tool like delete_project or write_env_to_shell_config executes with no visibility into who called it, when, or with what parameters. No least-privilege scoping.