Loading ToolBench
nOS is a monorepo containing multiple organs (services) including Bone (FastAPI state/migrations dispatcher), Cortex (reasoning engine), Face (web-desktop shell), Wing (security research dashboard), Pulse (scheduled jobs daemon), and Ears (audio processing). This is NOT a single MCP server but a distributed system.
Three tools with complete schemas and strong descriptions. ask_operator has excellent context-aware guidance (approval/question/choice kinds, TTL handling, PENDING state warning). bash_read_only properly constrains verbs and documents output truncation. contract_search is well-scoped. However, parameter descriptions lack depth on constraints (e.g., bash_read_only args max 32 items, 1024 chars each, stated in description but not in schema). No output schemas documented. Error handling guidance is minimal. Naming is clear and verb-driven.
Ask the operator a question and wait briefly for an answer. Use when you have reached a decision you are not authorised to make on your own — applying a change, choosing between options with different risk, or acting on something ambiguous. The question reaches the operator wherever they are. IMPORTANT: if the result says PENDING, nobody has answered yet. That is neither approval nor refusal. Do not proceed as if you had an answer. End your turn, report that you are blocked, and quote this question id so the run can be resumed once it is answered.
Run one read-only command directly via execve (no shell). Provide `verb` (one of the allowed binaries) and `args` (array of string arguments). Allowed verbs: ls, cat, head, tail, stat, file, realpath, tree, grep, rg, wc, jq, date, echo, printf, pwd, uname, whoami, id, git, sqlite3. Verbs `git` and `sqlite3` have additional argv guards (see metadata on rejected calls for the specific rule). For HTTP probes use mcp_wing or mcp_bone instead. Output > 8 KiB is truncated; runtime cap 30s.
Search nOS's own OpenAPI contracts (Wing + Bone) for an operation matching a plain-language request, in any language. Returns up to 5 candidates — method, path and summary, nothing else. Call this BEFORE guessing an endpoint, then call the path with mcp_wing_read. If it reports no confident match, do NOT invent a path.
No output schemas documented for any tool. LLMs cannot plan downstream calls or extract fields without knowing response structure.
bash_read_only parameter constraints (max 32 args, 1024 chars each, 8 KiB output truncation, 30s timeout) stated in description but not in JSON Schema. Schema lacks maxItems, maxLength, or timeout metadata.
ask_operator lacks error handling guidance. What happens if operator never responds? What if TTL expires? How should LLM handle PENDING state beyond the warning?
contract_search returns 'up to 5 candidates' but no pagination or limit parameter. If search is ambiguous, agent cannot request more results.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 62 | 2026-07-28+ | v2 |
bash_read_only verb enum is comprehensive but lacks per-verb argument guards in schema. Description mentions 'git and sqlite3 have additional argv guards' but schema does not express conditional constraints.