Loading ToolBench
The root system for AI agents. A local-first runtime for AI apps with integrated MCP server support, browser automation, file operations, and skill-based tool extensibility.
Linggen is a STDIO-only agentic runtime with 15 tools spanning browser automation, file I/O, web search, and agent delegation. Naming is generally verb-first and clear (Browser_navigate, Browser_readPage, Bash, Grep). Descriptions are present for all tools and range from 60-190 characters, meeting the 10-1024 character baseline. However, several critical gaps emerge: (1) Parameter descriptions are sparse, most tools have 1-3 parameters with minimal documentation of constraints, formats, or dependencies. (2) Output schemas are not visible in the source code; descriptions mention what tools return but no structured schemas are provided. (3) Error handling is not documented, no guidance on recovery, retryability, or error classification. (4) Several tools (Browser_click, Browser_type, Bash, Edit) accept powerful or destructive inputs without explicit validation guidance or confirmation patterns. (5) Tool annotations (readOnlyHint, destructiveHint, idempotentHint) are absent despite the risk profile being provided. The codebase structure (src/engine/tool_exec.rs, src/engine/tools/*.rs) shows deliberate tool separation, but integration into the MCP protocol is minimal, no evidence of schema registration, capability negotiation, or per-request _meta handling.
Execute a shell command in the workspace.
Click a node by ref (from Browser_readPage) or a viewport coordinate. Prefer refs — coordinates are the screenshot fallback.
Load a URL (or go "back"/"forward") in the controlled browser tab. The tab is visible to the user. Resolves after the page load settles. Follow with Browser_readPage to see the result.
Read the controlled tab as an accessibility tree. Actionable nodes carry a ref like [n42] — pass that ref to Browser_click / Browser_type. Re-read after any action that changes the page; old refs go stale.
Capture the controlled tab as an image (attached to the conversation). Fallback for visual/canvas content the accessibility tree can't express — prefer Browser_readPage for normal pages.
Type text into a focused input or contenteditable element. Targeting via ref from Browser_readPage is required.
Output schemas are undocumented. None of the 15 tools expose their return types, field names, or structures. LLMs cannot plan downstream tool calls or extract required IDs without knowing the response schema. This violates the pattern:tool requirement.
Parameter descriptions are minimal or absent. Browser_click has 'ref' and 'x'/'y' parameters but no description of what 'ref' format looks like (e.g., '[n42]' from Browser_readPage). Edit's 'edits' array lacks detail on the structure of 'old_text' vs 'new_text'. Bash has no input validation or safety guidance. These gaps force LLMs to guess at valid input formats.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 55 | <=2025-11-25 | v2 |
Delegate a task to another agent.
Edit a file using structured multi-line replacements.
List files matching glob patterns.
Search for patterns in files using regular expressions.
Data tool for app skills to emit page state updates. Args surface as a content_block event for app skill UIs.
Read a file or directory from the workspace.
Fetch content from a URL.
Search the web using a search query.
Write or create a file in the workspace.
No error handling guidance. Tools like Bash (IRREVERSIBLE), Write, Edit, and Delegate do not document failure modes, recovery paths, or whether errors are retryable. No distinction between transient (retry) vs permanent (ask user) vs catastrophic (abort) errors. This violates pattern:error-classification.
Destructive tools lack confirmation or dry-run patterns. Bash, Write, Edit, and Delegate can execute irreversible actions (delete files, run arbitrary commands, delegate to another agent) without explicit confirmation or undo support. This violates pattern:confirmation-request.
Tool annotations are absent. The provided FEATURES list shows toolAnnotations=false. Browser tools and file editors should carry readOnlyHint/destructiveHint flags so the LLM knows at a glance which tools are safe to retry and which are irreversible. Bash and Delegate should be marked destructiveHint=true.
Parameter type definitions are incomplete. Browser_screenshot's 'region' is an object but internal properties (x, y, width, height) lack type info in descriptions. Edit's 'edits' array is declared but the schema of each edit element is not specified. These gaps force inference and invite invalid inputs.
No pagination or result limiting documented. Grep and Glob could return hundreds of matches but descriptions do not mention limits, pagination parameters, or total counts. Large uncontrolled result sets waste context tokens and degrade LLM reasoning (baseline: cap at 20-50 items per response).
No input validation or constraints documented. Bash accepts arbitrary shell commands with no validation guidance. Browser_click accepts coordinates without range constraints. WebSearch and WebFetch have no rate-limit or timeout documentation. These gaps invite resource exhaustion.