Loading ToolBench
Lightweight alternatives to MCP servers for AI coding agents - provides web search, content extraction, and browser automation tools
This is a STDIO-only toolkit with 15 tools that lack a formal MCP server registration structure. While tool definitions are present in source files with descriptions and input schemas, they are NOT registered via the MCP protocol, they are bare Node.js scripts. Tools have basic descriptions (50-150 chars typically), but most lack depth about WHEN to use them, prerequisites, dependencies, or side effects. Parameter descriptions exist but are terse (avg 40-60 chars). No output schemas are documented anywhere. Error handling is minimal, most tools just exit with generic messages. Security concerns are present: browser-eval executes arbitrary code; browser tools assume Chrome is available and controllable; no validation on selectors or inputs. Composition is weak: tools are granular (click, type, scroll) but lack the context-rich chaining patterns of production tools (e.g., no structured output to enable downstream tool calls). The toolkit is functional for direct invocation but not optimized for LLM reasoning or multi-step planning.
Click an element on the page using CSS selector with support for double-click and right-click
Close the current or specified browser tab
Extract readable text content from a page loaded in the browser
Retrieve all cookies from the current browser tab
Execute arbitrary JavaScript code in the current browser tab and return result
Navigate to a URL in the active browser tab or open in a new tab
Interactive element picker - highlights elements on hover and allows selection via click or Cmd/Ctrl+click
Take a screenshot of the current browser tab and save to a file
No output schemas documented for any tool. LLMs cannot infer what fields to expect or how to chain tool results. E.g., web-search returns results but no structure is defined; browser-screenshot returns a file but no schema states the file path, format, or dimensions.
browser-eval accepts arbitrary JavaScript code with no sanitization, validation, or capability restrictions. This is a critical security vulnerability. An LLM could be tricked into executing malicious code (data exfiltration, DOM manipulation, form hijacking, keylogging). No guard rails or sandboxing documented.
No error handling guidance. Tools exit with generic error messages (e.g., 'HTTP 404: Not Found') instead of actionable recovery hints. LLMs receive no signal about whether an error is retryable, requires user input, or is fatal. E.g., browser-wait timeout could suggest retrying with a longer timeout or checking the selector.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | F | 39 | 2026-07-28+ | v2 |
| 2026-03-09 | F | 33 | - | v1 |
Scroll the page in specified directions or to specific positions
Starts a Chrome browser instance with remote debugging port 9222 for agent control
List, switch, or create browser tabs
Type text into an input element with support for clear, append, and simulated typing modes
Wait for an element to appear or disappear on the page with timeout support
Extracts readable content from a webpage as markdown using Readability and Turndown
Performs web search via Brave Search API with optional result filtering and content extraction
Descriptions lack WHEN and WHY guidance. E.g., 'browser-start: Starts a Chrome browser instance' does not explain when to call it (first time only?), what happens if called twice, or what useProfile=true means. Descriptions average 40-70 chars, below the 50-200 char sweet spot for LLM reasoning.
No composition support. Tools are highly granular (click, type, scroll, wait) but lack structured output to enable chaining. E.g., browser-click returns nothing; LLM has no way to verify click succeeded or extract IDs from newly rendered elements. This forces sequential screenshots to check state, wasting tokens.
Parameter descriptions are sparse. E.g., browser-click 'selector' param just says 'CSS selector for the element to click', no guidance on error handling (element not found?), timing (wait for it to appear?), or what happens if multiple elements match. LLMs cannot reason about failure modes.
No idempotency guarantees or retry safety. Tools like browser-click or browser-type will have side effects on retry (duplicate clicks, repeated typing). No documentation of which tools are safe to retry and which are not.
No validation or constraint documentation on CSS selectors, JavaScript code, URLs, or query strings. LLMs can pass invalid selectors (e.g., malformed CSS) or dangerous payloads without feedback. E.g., browser-type accepts 'text' as free-form string with no length/character limits or escaping guidance.
STDIO transport only. This toolkit is not remotely accessible, it cannot be used by hosted MCP clients, cloud-based LLM agents, or multi-tenant deployments. Limited to local/direct invocation only.
Missing dependency documentation. browser-tools require puppeteer-core and Chrome/Chromium to be available; no tool checks for this or provides setup instructions. Failure to start Chrome produces opaque errors. web-search requires BRAVE_API_KEY environment variable, not documented in tool descriptions.
No permission gates or access controls. browser-eval can execute arbitrary code; no scoping, sandboxing, or rate limits. web-search hits external API without quota checks. No audit trail of which tools were called, when, or by whom.