Loading ToolBench
Drive the user's real signed-in Chrome/Brave/Safari via Interceptor (DOM, network, tabs, editors, screenshots). Six router tools (browser / macos / ios / read / local / raw) whose verb menus are generated from the binary's own manifest, plus discovery resources for the long tail. All execution flows through the subprocess adapter; every call is classified and gated by the operator allowlist; content-bearing output is fenced.
Interceptor defines 6 tools with substantial complexity, but has critical gaps in parameter descriptions, output schema documentation, and error handling guidance. While tool names follow verb patterns (interceptor_browser, interceptor_macos, interceptor_ios, interceptor_read, interceptor_local, interceptor_raw), the descriptions are extremely dense and assume domain expertise. Critical issue: input schemas are visible for all tools, but output schemas are completely undocumented, LLMs cannot understand what these tools return, preventing effective chaining and planning. The descriptions attempt to enumerate 50+ sub-verbs per tool but lack structure, making it impossible for LLMs to parse actionable parameters. Parameter descriptions are minimal or absent. No error handling guidance is documented. The tools are defined in cli/mcp/server.ts but the actual tool registration code is not visible in the provided excerpt.
Drive the user's real signed-in Chrome/Brave/Safari via Interceptor (DOM, network, tabs, editors, screenshots). verb menu: state — DOM state; tree — element tree; diff — tree diff; find — search tree; text — read element text; html — read element HTML; click — click element; type — type; select — select option; focus — focus element; blur — blur element; hover — hover element; drag — drag; upload — upload file; dblclick — double-click; rightclick — right-click; check — check checkbox; keys — key combo; click-at — click at coords; what-at — element at coords; regions — find regions; navigate — navigate; back — back; forward — forward; scroll — scroll; wait — wait for; wait-stable — wait for stability; wait_for — wait for condition; tabs — list tabs; tab — switch/close tab; window — window mgmt; frames — list frames; session — session mgmt; network — network log; net — net alias; headers — request headers; screenshot — capture screen; canvas — canvas snapshot; capture — capture frame; ocr — OCR; cookies — read cookies; storage — read storage; history — read history; bookmarks — read bookmarks; downloads — read downloads; clear — clear storage; clipboard — read/write pasteboard; status — page status; reload — reload; meta — page metadata; links — list links; images — list images; forms — list forms; info — page info; page_info — page info; query — query selector; exists — element exists; count — count elements; table — read table; attr — read attributes; style — read computed style; events — read event listeners; notify — send notification; sessions — list sessions; capabilities — available capabilities; modals — dialog state; panels — sidebar state; eval — eval JS; save — save page. Put sub-args/flags in `args` (see the interceptor://manifest resource for exact flags/returns). eval/save run page code and require operator opt-in + confirm.
iOS automation: device discovery, element tree, screen capture, app control, filesystem, logs, on-device JS evaluation. verb menu: setup — build/sign/install runner (destructive); refresh — re-sign (destructive); login — Apple-services sign-in; logout — drop token; install — push runner (destructive); devices — list devices; name — rename device; discover — discover devices; enable — connect device; disable — disconnect device; status — connection status; fgdebug — foreground debug; tree — element tree; find — find elements; inspect — element details; click — tap; type — type; keys — type into focused; scroll — scroll; drag — drag; press — hardware button; screenshot — screenshot; apps — installed apps; app — launch/activate/terminate; eval — on-device JS brain (exec); proc — process list; ps — process list; top — CPU/mem samples; spawn — launch w/ env (exec); kill — kill pid (destructive); location — simulate GPS (set is destructive); gpu — GPU samples; shot — screenshot (runner-free); backup — mobilebackup2; screen — live frames; axtree — AX audit; diag — diagnostics; logs — syslog; fs — AFC filesystem (push is destructive); crash — crash reports; profiles — config profiles; notify — Darwin notifications; springboard — SpringBoard state; web — WebKit inspection (eval/call are exec); stream — continuous JPEG frames from the runner (start|stop|status, --out rewritten per frame); frame — save the newest streamed frame (read); gesture — multi-touch: x,y[@ms][>x,y@ms...] per finger, --hold ms. Put sub-args/flags in `args` (see the interceptor://help/ios resource for exact flags/returns).
Output schemas completely undocumented. No field descriptions, types, or return examples provided for any tool. LLMs cannot understand what these tools return, breaking tool composition and chaining.
Verb enumeration in descriptions is unstructured prose (50+ verbs per tool listed inline). Impossible to parse programmatically. Should be a structured enum in the schema or separate verb-discovery tools.
Parameter 'args' on all tools is a raw array of strings with zero validation guidance. No format constraints, length limits, or value ranges provided. LLMs cannot reliably construct valid invocations.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 43 | 2026-07-28+ | v2 |
Local daemon and extension queries: status — daemon/bridge/extension health; manifest — machine-readable capability manifest; diagnose — post-failure snapshot; init — bootstrap the daemon; skills — list/link skill packs; research — deep-research playbook + ledger; upgrade — promote to full computer-use mode; extensions — list installed extensions; contexts — list connected browser contexts; capabilities — available domains + verbs. Put sub-args/flags in `args`.
MacOS automation: AX tree, app control, vision, file access, Notifications, TCC prompts, Apple Events. verb menu: tree — AX tree; find — search AX tree; inspect — element details; value — get/set AX value (mutate); action — invoke AX action; focused — focused element; windows — window list; text — read element text; menu — menu navigation; apps — running apps; app — app activate/launch/quit/terminate; frontmost — frontmost app; click — background click; type — background type; keys — key combo; scroll — scroll; resize — resize window; move — move window; drag — drag; screenshot — capture screen/window/element; capture — capture frame/stream; listen — speech recognition; vad — voice activity detection; sounds — sound classification; vision — OCR/faces/objects/barcode; nlp — entities/sentiment/embed; ai — on-device LLM; sensitive — sensitive-content detection; health — system health; files — recent/search files; notifications — post/list/tail notifications; clipboard — read/write pasteboard; display — list/set displays; audio — audio I/O; stream — screen streaming; monitor — multi-modal recording; open — activate+read (compound); read — read AX tree (compound); act — click/type+read (compound); fs — read/write/search files; url — HTTPS fetch; log — unified log query; script — run AppleScript/OSA (exec); intent — structured Apple Events (exec); vm — VirtualBuddy VM lifecycle; container — run OCI container (exec); overlay — HUD/panel overlays; pdf — PDF read/annotate/merge; detect — file-type detection; translate — translation; thumbnail — thumbnails; auth — LocalAuthentication; calendar — Calendar read/CRUD; reminders — Reminders read/CRUD; contacts — Contacts read/CRUD; appintent — App Intent donations; photos — Photos read/CRUD; maps — Maps search/directions; location — location services; music — Music library/playback; share — share menu (exfil); update — Sparkle updates; trust — TCC prompts; tcc — TCC status/profile; runtime — in-process app runtime (exec); cdp — Electron/Chromium CDP. Put sub-args/flags in `args` (see the interceptor://help/macos resource for exact flags/returns).
Raw Interceptor CLI dispatch: pass any binary verb/args directly. Bypasses MCP tier restrictions and is subject only to the operator's global allowlist (INTERCEPTOR_MCP_ALLOW env). Intended for power users and complex compositions. Every call is still classified and gated by the allowlist.
Read-only access: state queries, discovery, passive observation across browser, macos, ios surfaces. Verbs restricted to read-only operations: state, tree, diff, find, text, html (browser); tree, find, inspect, focused, windows, text, apps, frontmost, screenshot, vision, nlp, health, files, clipboard, display, audio, read, fs, url, log, pdf, detect, translate, thumbnail, auth, calendar, reminders, contacts, photos, maps, location, music, tcc, cdp (macos); devices, discover, tree, find, inspect, screenshot, apps, proc, ps, top, shot, backup, screen, axtree, diag, logs, fs, crash, profiles, notify, springboard, web, frame (ios). Put sub-args/flags in `args`.
No error handling documentation. Tools return results via a CLI layer but expected error responses, retryability, and recovery steps are not documented for the LLM.
Descriptions exceed 1024 character soft limit and are dense prose assuming deep CLI knowledge. 'interceptor_browser' description is 2000+ characters. Should be split into discovery tools + verb-scoped tools.
Dangerous 'interceptor_raw' tool bypasses MCP restrictions and accepts arbitrary CLI arguments. No schema validation, no enumeration of safe verbs, no guidance on allowlist behavior. Extreme blast radius.
'confirm' parameter present on several tools but no explanation of what confirmation triggers, what the LLM should display to user, or what happens if absent. Breaks multi-round-trip request pattern.
Parameter descriptions are extremely minimal. 'args' described only as 'verb arguments + flags, verbatim' with no guidance on what constitutes valid input. 'context', 'tab', 'device', 'session' parameters lack detail on expected values or discovery mechanism.