Loading ToolBench
MCP server providing a Python REPL with persistent session
The server defines 3 tools with basic schemas and descriptions, but critical gaps limit quality. Tool names follow verb_noun pattern (execute_python, list_variables, install_package) which is good. However, descriptions are minimal (10-50 chars for most), parameter descriptions are missing entirely for some parameters, and output schemas are completely undocumented. The execute_python tool has a HARD constraint issue: the 'reset' parameter lacks a type specification in the JSON schema (boolean is declared in description text but schema only shows 'default' without explicit type in the visible schema definition). The install_package tool's regex validation is present but not documented in the parameter description, forcing LLMs to guess about what package names are valid. Error handling exists but is generic, errors from subprocess calls return raw stderr without actionable recovery guidance. No output schema documentation for any tool, preventing LLMs from planning downstream calls.
Execute Python code and return the output. Variables persist between executions.
Install a Python package using uv
List all variables in the current session
No output schema documentation for any tool. LLMs cannot know what fields to expect from execute_python (does it return stdout, stderr, both?), list_variables (what is the structure of the variable list?), or install_package (what does success look like?). This blocks LLM planning and chaining.
Parameter descriptions are missing or vague. 'code' parameter for execute_python lacks guidance on language, constraints, or expected execution environment. 'package' parameter for install_package has no description of format, validation rules, or what happens if the package doesn't exist. 'reset' parameter has no description at all in the schema.
Error handling is not actionable. When subprocess.run fails (install_package), the error returns raw stderr without recovery guidance. When code execution throws an exception, the traceback is returned as-is instead of 'Invalid syntax. Check your code and try again' or 'NameError: variable X not found. Define it first or use list_variables to see what's available.'
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | F | 49 | 2026-07-28+ | v2 |
| 2026-03-09 | D | 55 | - | v1 |
No documented output structure for execute_python. The tool returns different text formats based on condition (Output:, Errors:, Result:, or 'Code executed successfully'), but there's no schema declaring this. Returning a Result: field when eval() succeeds is inconsistent with the Output:/Errors: pattern and risks confusing LLMs about what the output represents.
The 'reset' parameter for execute_python lacks description and should warn about data loss. The description must explicitly state: 'If true, clears all variables and resets the session. This is irreversible.' Without this, LLMs may not understand the consequence.
Package name validation via regex is hidden in implementation code, not documented in parameter description. The parameter 'package' should explicitly state: 'Package name (2-255 characters, alphanumeric + . - _). Examples: pandas, scikit-learn, numpy[extra]'
No confirmation or dry-run for irreversible operations. execute_python with destructive code (e.g., file deletion, database drop) executes immediately. For a REPL tool, this is expected, but the description should clarify: 'Executes Python code immediately, no confirmation. Be careful with destructive operations (delete, drop, remove).'
list_variables has no output documentation. Does it return a dict, a list, a formatted string? How should the LLM parse it? What fields are included (name, type, value, size)?
No security documentation for execute_python. This tool can run arbitrary Python, including importing libraries, reading files, making network calls, and accessing environment variables. The description should warn: 'Executes Python code without sandboxing. Do not use with untrusted input. The code runs with the privileges of the MCP server process.'