Loading ToolBench
An MCP server that enables remote command execution with operator approval, combining web-based approval interface, terminal UI, and SSH support.
The server implements a single tool (execute_command) with comprehensive schema definition and structured error handling. The tool demonstrates strong naming conventions, detailed parameter descriptions, and well-documented output structure. However, there are moderate gaps in parameter constraint clarity and insufficient guidance on destructive operation safeguards. The tool is properly registered with full JSON Schema including types and descriptions for all parameters. Error responses use structured format (CallToolResult::structured_error), but lack actionable recovery hints. The description adequately explains WHAT the tool does and WHEN to use it, meeting baseline expectations for tool descriptions (baseline: 194 chars avg; this tool: ~180 chars).
Execute a command on a remote host with optional confirmation, returning structured output including execution status, exit code, and command output.
Destructive tool (execute_command) lacks explicit confirmation/dry-run pattern despite risk=DESTRUCTIVE flag. Code shows optional confirmation flow via operator_console, but confirmation logic is not mandatory and can be bypassed if no confirmation_request exists.
Parameter constraint documentation incomplete. 'timeout_ms', 'head_lines', 'tail_lines', 'max_chars' lack explicit ranges/bounds. LLMs may pass unlimited values (e.g. timeout_ms=999999999 or max_chars=1000000) causing resource exhaustion.
Error responses return structured format but lack actionable recovery guidance. Errors like 'command confirmation timed out' or 'Failed to persist rejected execution history' do not indicate whether to retry, how to debug, or what the user should do next.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | C | 60 | <=2025-11-25 | v2 |
| 2026-03-09 | D | 56 | - | v1 |
Output structure (exit.code, exit.success, exit.timedOut) returns multiple exit state indicators simultaneously. No guidance on precedence if exit.timedOut=true but exit.code is also set. Ambiguous for LLM parsing.
Parameter 'server' (server identifier where command executes) has minimal description ('The server identifier where the command will be executed'). Does not clarify whether this accepts hostnames, IP addresses, registered server names, or system IDs, nor how to discover valid values.
Tool accepts 'env' (environment variables) as arbitrary object but does not validate against secret injection risk. LLMs may pass sensitive values (API keys, passwords) as env var values. No guidance that secrets should use server-side injection.