Loading ToolBench
Run Linux-style commands on Windows via deterministic PowerShell translation. No VM, no WSL. MCP server + CLI for AI agents.
Fauxnix exposes two shell execution tools with minimal schema and documentation. Both tools have weak descriptions (under 50 chars), missing output schemas, no error guidance, and no input validation hints. The 'bash' tool is a dangerous write operation with virtually no safeguards documented at the tool definition level. The 'bash_batch' tool lacks proper composition guidance. No tool annotations, no parameter constraints, no recovery guidance. This server would not pass a production tool review.
Execute a bash-style command translated to PowerShell
Execute multiple bash-style commands in a batch with step tracking
Tool descriptions critically underdeveloped. 'bash' description is 56 chars ('Execute a bash-style command translated to PowerShell'); 'bash_batch' is 85 chars. Both lack context on WHEN to use, WHAT the tool returns, prerequisites, and consequences of execution. Descriptions should be 50-200 chars and guide LLM tool selection. Currently they are bare imperatives.
No output schemas documented. Tools return unstructured command output (stdout/stderr), but LLMs need to know the structure of responses to chain operations and extract data. Return format is not specified, is it a string? An object with stdout/stderr fields? Does it include exit code? Return type must be formally documented.
Input schema for 'bash' lacks detail. 'command' parameter has a description but no constraints (length limits, forbidden patterns, validation rules). Input schema should include: min/max length, regex pattern for dangerous operations (e.g., block network access, file deletion patterns), or explicit guidance on validation. Currently there is no signal to LLM that certain commands are unsafe.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-22 | F | 41 | 2025-06-18+ | v2 |
Missing tool annotations for dangerous operations. Both tools are WRITE-class operations (can modify system state, delete files, execute code), but lack destructiveHint, idempotentHint, or readOnlyHint annotations. The 'bash' tool especially needs destructiveHint=true to warn LLMs that repeated calls are not safe.
No error recovery guidance. If a bash command fails (exit code != 0), what should the LLM do? Retry? Ask user? The tool returns raw command output but provides no structured error classification (retryable vs fatal). E.g., 'No such file or directory' (from demo) is user-fixable, but 'Permission denied' is not. Tools must categorize errors and suggest next steps.
No confirmation or dry-run pattern for destructive operations. The 'bash' and 'bash_batch' tools can delete files, modify system state, or execute irreversible commands (see demo: 'rm -rf', 'find ... -delete'). There is no mention of --confirm or dry-run modes, nor any pattern to prevent LLM accidents.
Missing composition and chaining guidance. 'bash_batch' accepts an array of steps with 'id' and 'command' fields, but there is no documentation on: (a) what the response looks like for each step, (b) whether partial failures halt the batch or continue, (c) how to reference step outputs in subsequent steps. Tools must enable agent composition.
Parameters lack descriptions in schema. 'bash_batch' input has an array of step objects with 'id' and 'command' properties, but the schema items do not include property descriptions. JSON Schema shows type: 'object', properties: {id, command}, but descriptions for each property are missing or not visible in the provided code.
No guidance on encoding/character handling. The demo (demo-commands.sh) shows GBK file handling is a feature ('逐文件嗅探编码'), but the tool descriptions do not mention encoding behavior, supported character sets, or how encoding mismatches are reported. LLMs need to know: 'If a file is GBK, tool will auto-detect and handle it' or 'Tool output is always UTF-8'.
No idempotency documentation. Shell commands are inherently non-idempotent (e.g., 'mkdir dir' fails on second call, 'rm file' fails if file is gone). The tool must declare idempotent=false or provide guidance on which commands are safe to retry. Agents rely on this to decide whether to retry on transient failures.