Sandboxed file management for Claude with secure read/write/delete/search operations
AdvancedFileSystem has clear verb-based naming (list_, read_, write_, delete_, search_) and all tools include descriptions. However, parameter descriptions are minimal (1-2 sentences), output schemas are not documented, and error handling lacks recovery guidance. The safe_path() validation is solid, but tools return unstructured strings rather than typed objects. No tool annotations (readOnlyHint, destructiveHint) despite clear risk levels. Descriptions average ~60 chars, below the 194-char baseline for A+ tools. Parameters lack constraints (e.g., no max file size for write_file, no limit on search results).
Delete a file from the sandbox.
List all files and folders in the sandbox directory.
Read the text content of a file.
Search for a keyword in all text files in the sandbox.
Write (or overwrite) content to a file.
Output schemas not documented. Tools return unstructured strings (e.g., 'File not found: {file_path}') instead of typed objects with fields. LLMs cannot reliably parse or chain results.
No tool annotations despite clear risk levels. write_file and delete_file are destructive; list_files and read_file are read-only. Missing destructiveHint and readOnlyHint annotations prevent clients from applying appropriate safeguards.
Error responses lack recovery guidance. 'File not found: {file_path}' tells the LLM nothing about next steps. Should suggest 'Try list_files() to see available files' or return available alternatives.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 54 | 2026-07-28+ | v2 |
No parameter constraints. write_file accepts unlimited content; search_files returns unbounded results. Missing max_size, max_results, and format constraints. LLMs may pass absurd values.
Destructive operations lack confirmation step. delete_file executes immediately with no dry-run or confirmation. Agents make mistakes, should support confirm_before_execute pattern.