MCP Server for safe tool execution with filesystem, network, and command containment. Guards agent tool invocations against unauthorized operations including path traversal, unauthorized egress, and dangerous command execution.
Three tools present with basic descriptions and minimal input schemas. All tools have descriptions (10-60 chars), but descriptions lack depth on WHEN to use them, prerequisites, and consequences. Input schemas are present but sparse: only 1-2 parameters per tool with minimal type info. No output schemas documented. No error handling guidance. Tools are read-only (low risk) but lack the structure and detail expected of production tools. Naming is clear (validate_*) but descriptions are too terse to guide LLM selection effectively.
Blocks prohibited command binaries.
Checks domain against allowlist.
Ensures path does not escape allowed_root_dir via traversal.
Tool descriptions are under 50 characters and lack context on WHEN to use each tool, what it returns, and how it fits into a containment workflow.
Output schemas are not documented. LLMs cannot plan downstream calls or extract required fields (e.g., is_safe, violation, target_path) without explicit schema documentation.
Input parameter descriptions are minimal. 'target_path' and 'domain' lack format/constraint guidance. 'command_args' description does not explain expected structure (array of strings, first element is binary name).
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 43 | 2026-07-28+ | v2 |
No error handling guidance. Tools return violation codes (PATH_TRAVERSAL_DETECTED, UNAUTHORIZED_EGRESS_DOMAIN) but do not explain what the LLM should do next or how to recover.
Tool composition unclear. No documentation on how these three validation tools are meant to be orchestrated by an agent. Are they called in sequence? In parallel? What is the expected workflow?