Loading ToolBench
A personal AI agent operating environment you self-host on Cloudflare.
8 tools with complete input schemas and descriptions. Naming follows verb_noun pattern (browser_open, desk_upsert, ask_user). Descriptions are detailed (100-250 chars) and explain WHEN to use each tool. Parameters have types and descriptions. However, output schemas are not documented in the source code provided, and some tools lack error handling guidance. Tool composition is strong, each tool has a single responsibility. Security considerations are present (e.g., desk_promote_artifact requires confirmation). No tool annotations (readOnlyHint/destructiveHint) visible in schema definitions.
Ask the owner a single multiple-choice question and pause for their answer. Creates an interactive decision widget, sends a push notification deep-linking to it, and records the decision. Use this when you genuinely need a human choice (approval, selection, direction) before continuing — especially if the user may be away. After calling this, stop and wait; the user's choice arrives as a new message in this conversation.
Open a public web page in Cloudflare Browser Run, capture a rendered text preview, and create an inline visual replay with a short observation window so playback is inspectable. Use for public web browsing and visible UI checks; do not claim authenticated access.
Replace the owner's durable desk board with an empty artifact. Use when the owner asks to clear the desk.
Read the owner's durable desk board.
Put an existing artifact on the owner's desk at /?action=desk, where it becomes the live app every open client sees. The desk holds exactly ONE app, so this replaces whatever is there now. Call it first with confirm omitted to get a summary naming the app you would take down, tell the owner that sentence, and only call again with confirm true after they agree. Use search_artifacts or the id returned by create_svelte_artifact to find the id.
Output schemas not documented. Tool descriptions explain inputs but not return types. LLMs cannot plan downstream calls or extract required fields without knowing what each tool returns.
Tool annotations (readOnlyHint, destructiveHint, idempotentHint) not visible in schema definitions. Risk metadata is provided in the FEATURES section but not in the actual tool schemas where MCP clients can read them.
desk_clear is destructive with no confirmation step. Unlike desk_promote_artifact which requires confirm=true, desk_clear has no dry-run or confirmation mechanism to prevent accidental board wipes.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 63 | 2026-07-28+ | v2 |
Remove one card by id from the owner's durable desk board at /?action=desk, without changing the other cards.
Upsert one card on the owner's durable desk board at /?action=desk. Use this instead of flattening Approve/Reject into notify_owner body text. Pair with notify_owner href /?action=desk to wake the owner. If the PWA tab is open and page.listArtifactTools has setBoard, also invoke that tool.
Render a read-only code review diff from two owner-authorized real-file reads. Supply old and new as {source: workspace|machine, path}; My AX reads both values server-side through Workspace or the connected Machine shell. Do not supply file text, source claims, URLs, browser paths, write/apply actions, or generated content. path and title are display-only relative labels.
Error handling guidance absent. Tool descriptions do not explain what errors can occur, how to recover, or what the LLM should do if a call fails (retry, ask user, abort).
show_diff parameter descriptions lack format details. 'path' and 'title' are marked display-only but no guidance on max length, character restrictions, or what constitutes a valid relative path.