Loading ToolBench
MCP server wrapping Anthropic Claude Code CLI as tools
Two tools with comprehensive schemas and detailed descriptions. Both tools have well-structured Zod schemas with type definitions and descriptions for all parameters. Descriptions are substantive (200+ chars) and explain WHAT the tool does, WHEN to use it, and key prerequisites. Parameter naming follows verb_noun convention (claude, claude-reply). However, output schemas are not documented, the code shows formatResult() is called but the actual response structure is not specified in the tool definitions. Error handling is present but generic. No tool annotations (readOnlyHint/destructiveHint) despite both tools being WRITE operations. Security guidance is embedded in descriptions (permission mode warnings) but not formalized.
Run a Claude Code CLI session. Executes `claude -p --output-format stream-json` as a subprocess and returns the result. Use this tool to start a new coding task with Claude Code. The response includes a Session ID that can be used with the claude-reply tool to continue the conversation. WARNING: defaults to permission mode `bypassPermissions` (parity with codex --full-auto). Use a safer mode (e.g. `acceptEdits` or `auto`) for sensitive workspaces.
Continue a Claude Code CLI conversation by providing the session ID from a previous claude call and a follow-up prompt. Uses `claude --resume <session-id>` to load the previous session and continue. NOTE: Sessions are tied to the directory they were started in (Claude Code issue #5768). The MCP server cannot change the resumed session's working directory — make sure the host process runs from the original cwd, otherwise the session may not be found.
Output schemas not documented. Code calls formatResult() but the response structure (fields, types, pagination) is not specified in tool definitions. LLMs cannot plan downstream operations or extract required data.
No tool annotations despite WRITE risk classification. Both tools modify state (execute Claude sessions, resume sessions) but lack destructiveHint or idempotentHint annotations. Agents cannot reason about retry safety.
Error handling is generic. Catch blocks return 'Error: {message}' with isError=true but do not categorize errors as retryable, user-fixable, or fatal. No recovery guidance (e.g., 'Session not found, check session ID or start a new claude session').
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 56 | <=2025-11-25 | v2 |
Parameter 'permissionMode' defaults to 'bypassPermissions', a dangerous default that could cause unintended side effects. Description warns users but does not prevent the LLM from omitting the parameter and triggering full auto-execution.
Session ID dependency not enforced. claude-reply requires sessionId from a prior claude call, but the schema does not validate that the session exists or was created by the same MCP server instance. No guidance on session lifecycle or expiration.