Loading ToolBench
A .NET-based agent system with tools for file operations, system control, clipboard management, communication (email/SMS), system information monitoring, and read-only workspace operations
This MCP server has 35 tools with inconsistent quality. Most tools have basic descriptions and parameter schemas, but lack depth expected for production use. Naming is generally good (verb_noun style), but many descriptions are generic and under the ideal 50-200 character range. Parameter schemas are present but many lack detailed constraints, enums, or format specifications. Error handling guidance is absent. The server appears to be primarily a desktop automation toolkit with significant security risks (file system access, process termination, email/SMS sending) but minimal safeguards documented. No evidence of tool annotations, pagination support, or idempotent operation markers. Composition is reasonable (each tool does one thing), but critical security parameters like credentials are not addressed. Code samples show basic C# implementation with FluentValidation, but MCP-specific patterns are not evident in the provided snippets.
Checks if an application is installed and returns diagnostic info.
Checks if SMS service is connected and working.
Clears the clipboard content.
Closes a running desktop application safely.
Controls system devices and hardware components.
Copies a file to a new location.
Creates a new file with optional initial content and can optionally open it.
CRITICAL: No evidence of input validation or sanitization. File path parameters accept arbitrary strings without path traversal checks. LLMs can be tricked into passing malicious payloads like '../../../etc/passwd' or command injection sequences.
CRITICAL: Destructive tools (delete_file, kill_process) lack confirmation/dry-run pattern. No recovery guidance in descriptions. Agents making mistakes could permanently delete files or terminate critical processes without safeguards.
HIGH: Email and SMS tools accept no authentication credentials as parameters. Security model unclear, are credentials injected server-side? If stored in environment variables, this is good, but it's not documented. If agents are expected to provide tokens, they could leak in logs.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 56 | 2026-07-28+ | v2 |
Deletes a file from the file system.
Checks if a file exists at the specified path.
Retrieves the full installation path for an application.
Gets battery status including charge level and power source.
Gets the current text content from the clipboard.
Gets CPU usage percentage and core information.
Gets disk space usage for all drives.
Gets detailed information about a file.
Gets RAM usage and availability.
Gets comprehensive system information including CPU, memory, and disk usage.
Checks if an application is currently running.
Terminates a process by name or ID.
Lists files in a directory with optional filter and can open the folder.
Lists all installed applications on the system.
Lists the top running processes by CPU or memory usage.
Moves a file to a new location.
Opens a desktop application by name.
Opens a folder in File Explorer.
Opens a file with its default application (Notepad, Word, etc.).
Plays music using available media players.
Reads the content of a file from the file system.
Sends an email to a specified recipient. Use when user wants to send an email message.
Sends a templated email. Available templates: welcome, notification, password-reset.
Sends an SMS message to a phone number. Phone number must include country code (e.g., +90 for Turkey, +1 for USA).
Sets the clipboard text content.
Validates an email address format.
Validates a phone number format (E.164).
Writes content to a file. Creates the file if it doesn't exist.
HIGH: 'control_device' tool has vague description ('Controls system devices') and ambiguous parameters ('deviceName': 'volume, wifi, etc'). LLMs cannot reliably infer what devices are available or what 'action' values are valid. No enum constraint on 'action' parameter (increase, toggle, on, off are suggested but not enforced).
MEDIUM: Email template tool ('send_email_template_async') accepts templateDataJson as a free-form string. No schema provided for what fields each template expects. LLMs must guess or hallucinate valid JSON structure for 'welcome', 'notification', and 'password-reset' templates.
MEDIUM: No pagination support on list_files and list_installed_applications. If results exceed a threshold, token bloat risks context window exhaustion. Descriptions do not state result limits or pagination strategy.
MEDIUM: Error handling is minimal. Descriptions do not guide agents on what to do if a file is not found, if an email fails to send, or if a process cannot be killed. No recovery hints provided.
MEDIUM: 'kill_process' accepts free-form processNameOrId without validation. No enum or format guidance. LLMs may pass invalid process names, and the tool description does not clarify whether by-name matching is case-sensitive or partial.
MEDIUM: Several tool descriptions are under 50 characters and lack actionable context. 'Plays music using available media players' does not explain when to use this tool or what parameters trackName should receive (song name? playlist name? URI?).
MEDIUM: No documentation of tool output schemas. Agents cannot predict what fields are returned by 'list_processes', 'get_system_info', or 'send_email_async'. Without documented return types, LLMs risk hallucinating field access.
LOW: Phone validation tool expects E.164 format but description does not provide an example pattern. LLMs may send invalid formats like '905551234567' (missing +) without explicit guidance.