Loading ToolBench
MCP server for file operations including finding, reading, writing, appending, and deleting files with workspace isolation
FileHandling server has critical definition gaps. All 7 tools have basic descriptions (10-50 chars), but most lack depth on WHEN to use them or what they return. Input schemas are present with type info, but parameter descriptions are minimal (e.g., 'Pattern to search for' vs. 'Regex or substring pattern; case-sensitive; max 256 chars'). Output schemas are entirely undocumented, tools return strings or lists with no structure guidance. Error handling is generic ('Error: {e}') with no recovery hints. Security is weak: read_file and write_file accept arbitrary paths without safe_path validation (only find_by_name, find_by_content, list_directory use it). No tool annotations (readOnlyHint, destructiveHint). Naming is acceptable (verb_noun pattern) but descriptions fail the 50-200 char LLM-optimized baseline.
Append content to a file.
Delete a file.
Find files containing text (grep style).
Find files whose name contains pattern.
List files and directories in a given path.
Read and return the content of a file.
Write content to a file.
Output schemas completely undocumented. Tools return raw strings or lists with no field definitions. LLMs cannot plan downstream calls or extract structured data.
Path traversal vulnerability: read_file, write_file, append_file do NOT use safe_path() validation. Agents can access files outside WORKSPACE directory.
Error responses are generic ('Error: {e}') with no recovery guidance. LLMs cannot self-correct or know whether to retry.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 43 | 2026-07-28+ | v2 |
Descriptions are too short (10-50 chars) and lack context. Missing WHEN to use each tool, prerequisites, and what data is returned.
No tool annotations. delete_file is destructive but lacks destructiveHint. read_file is read-only but lacks readOnlyHint. Agents cannot infer safety properties.