Loading ToolBench
LLM-powered system administration daemon for Linux with risk-aware action planning and execution. Exposes tools for querying system state and executing privileged operations with formal risk levels and audit logging.
SysKnife defines 28 tools with consistent naming (verb_noun pattern: query_*, sysknife_*) and complete JSON schemas. Descriptions are present but vary in quality, most are 30-80 chars, below the 194-char baseline for A+ tools. Critical gaps: (1) No parameter descriptions for most query_* tools (e.g., query_services, query_firewall have empty properties). (2) Output schemas are not documented, LLMs cannot predict response structure. (3) Error handling is absent, no guidance on retryability or recovery. (4) sysknife_execute accepts a generic 'params' object with no schema, forcing LLMs to guess parameter names. (5) No tool annotations (readOnlyHint, destructiveHint) despite clear risk levels. Strengths: consistent naming, all tools have descriptions, input schemas present with types, risk levels declared.
Show SSH authorized keys for a user account.
Show detailed info for a specific container.
List all running containers (podman) with name and status.
Return the Linux username of the user who launched sysknife. Call this before any action that requires a `username` param when the username is not already known from context.
Show the deployment history of rpm-ostree upgrades and rollbacks.
List all rpm-ostree deployments with their index, version, and pinned status.
Collect system diagnostics including recent errors and resource usage.
18 query_* tools have empty parameter schemas (no properties defined). LLMs cannot infer what parameters these tools accept or what they return.
No output schemas documented for any tool. LLMs cannot predict response structure, forcing them to guess what fields are available for downstream tool calls. Violates pattern:tool and pattern:response-shaper.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 53 | 2026-07-28+ | v2 |
Show disk usage for all mounted filesystems.
Show current firewall rules and allowed services.
Show detailed info for an installed Flatpak application.
List configured Flatpak remotes.
List all local groups on the system.
Show recent SysKnife transaction history. Use this to check what actions SysKnife has executed (or attempted) recently. Returns action names, statuses, and summaries.
Show the current kernel boot arguments.
Show recent systemd journal logs for a specific service unit.
Show system memory usage (total, used, free, swap).
Show network interface addresses and status.
List configured package repositories.
List all layered packages installed via rpm-ostree.
List running processes sorted by memory usage.
List all running systemd services. Returns one service name per line.
List all toolbox containers.
List local user accounts (uid >= 1000) with username and groups.
Verify the audit-log hash chain (read-only). Validates cryptographic integrity of the audit log and returns verification status with details.
Daemon connectivity + config diagnostics (read-only). Returns snapshot of daemon reachability, brain provider configuration, Linux distribution, audit database path, and audit chain integrity status.
Execute a plan returned by sysknife_plan. Daemon runs each step and streams output back as collected lines. Returns execution results with status, summary, output, warnings, and transaction IDs.
List past audit-log entries (read-only). Returns transaction history with action names, statuses, summaries, and optional timestamps and risk levels.
Turn a natural-language intent into a risk-labelled plan. Returns ordered steps with action names, summaries, risk levels, and parameters.
sysknife_execute accepts a generic 'params' object with no schema. LLMs cannot determine what parameters each action_name requires. Requires per-action parameter documentation or a schema map.
No error handling guidance. Tools do not document retryability, user-fixable errors, or recovery steps. LLMs cannot determine whether to retry, ask the user, or abort.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint). Risk levels are declared but not exposed via MCP annotations. LLMs cannot reason about side effects or safety without explicit hints.