Loading ToolBench
Agentic (AI Agent) safe code execution with network and filesystem restrictions
This MCP server has severe structural issues that make it unsuitable for production agentic use. Tool naming violates fundamental conventions (camelCase instead of snake_case, no clear action verbs), descriptions are extremely sparse or absent, parameter schemas are incomplete or use non-standard types (AbortSignal, function), and error handling is invisible in the provided code. The 15 tools span infrastructure concerns (proxy servers, platform-specific sandboxing) that are atypical for LLM-friendly tool definitions. Most critically, tools like 'initialize' and 'reset' expose procedural lifecycle management rather than declarative operations, agents cannot reason about when to call these. Output schemas are undocumented, and there is no evidence of pagination, structured results, or error recovery guidance. This appears to be a systems library adapted as an MCP server, not a tools-first design.
Annotates stderr output with sandbox violation information by retrieving recorded violations for a given command
Closes all active HTTP and SOCKS proxy servers
Detects if a path pattern contains glob wildcards
Decodes a base64-encoded command string back to plaintext
Encodes a sandboxed command string (truncated to 100 chars) as base64
Initializes the sandbox manager with runtime configuration, sets up network proxies, filesystem restrictions, and platform-specific infrastructure
Detects if a symlink resolves outside its intended boundary, preventing escape attempts
Normalizes file paths for sandbox use, resolving symlinks and handling glob patterns while detecting symlink escape attempts
Inconsistent tool naming convention: tools use camelCase (wrapWithSandbox, annotateStderrWithSandboxFailures) instead of snake_case (wrap_with_sandbox, annotate_stderr_with_sandbox_failures). MCP and agentic tool conventions expect snake_case. LLMs trained on standard MCP servers will struggle to parse camelCase tool names.
Parameter types include non-standard JSON Schema types: AbortSignal (JavaScript runtime type, not serializable), function (callback functions). These cannot be passed over MCP protocol which requires JSON-serializable inputs. Tools like wrapWithSandbox, startHttpProxyServer, startSocksProxyServer have unfixable schema violations.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 33 | 2026-07-28+ | v2 |
Removes trailing /** glob suffix from path patterns
Cleans up and resets all sandbox manager state, closing proxy servers and killing bridge processes
Starts an HTTP proxy server that filters network requests based on sandbox configuration
Starts a SOCKS5 proxy server that filters network requests based on sandbox configuration
Wraps a shell command with Linux-specific sandbox restrictions using bubblewrap and seccomp
Wraps a shell command with macOS-specific sandbox restrictions using sandbox-exec and profile rules
Wraps a shell command with sandbox restrictions based on platform (macOS or Linux), applying filesystem and network restrictions
Procedural lifecycle tools (initialize, reset) expose internal state management rather than declarative operations. Agents cannot reason about when to call these without external coordination. Pattern:tool requires each tool to be independently callable and composable. initialize() modifying global state violates stateless request handling (MCP spec 2026-07-28).
Output schemas completely undocumented. No response formats visible for any tool. Rubric requires 100% of A-grade tools to document return types. LLMs cannot plan chained calls or extract data when output structure is unknown.
Parameter descriptions are minimal (35 - 60 chars) and lack actionable constraint information. Rubric baseline for param descriptions is 72 chars average; many here are half that. E.g., 'customConfig' described as 'Optional runtime configuration overrides' provides no hint of valid keys, structure, or when to use it.
No error handling documentation visible. Rubric pattern:recovery-guide requires error responses to tell the LLM what to do next. No evidence of error categorization (retryable/user-fixable/fatal) or recovery guidance in any tool definition.
Tools with destructive or security-sensitive operations (wrapWithSandbox, initialize, reset) lack permission gates, audit trail declarations, or scope annotations. Rubric pattern:scope-declaration requires permission and audit metadata for any write operation.
No evidence of idempotency guarantees. wrapWithSandbox and command-wrapping tools have WRITE risk but no documentation of whether repeated calls with the same input are safe or cause duplicate effects. Agents will retry on ambiguous failures.
Platform-specific tools (wrapCommandWithSandboxLinux, wrapCommandWithSandboxMacOS) should be abstracted behind a single canonical interface (wrap_command_with_sandbox). Parallel implementations force agents to reason about platform selection, increasing errors and token waste.