Loading ToolBench
Sandboxed computer-use MCP — drive a real browser + desktop apps in a nested X11 window. Each instance is its own Xephyr display running one app, rendered as a window on the host desktop and controlled independently. Multiple agents can drive different instances in parallel.
Glovebox provides 16 tools with complete input schemas and descriptions. Naming is verb-first and clear (screenshot, click, type, key, drag, scroll, launch_app, list_instances, kill_instance, parse_screen, click_element, list_files, write_file, read_file, upload_file, navigate). All tools have descriptions (avg ~120 chars, within 10-1024 range). Input parameters are typed and described. However, output schemas are not documented, responses are JSON but structure is inferred from code comments rather than explicit schema declarations. Error handling includes structured JSON responses with 'ok', 'error', and 'fix' fields, guiding recovery. No tool annotations (readOnlyHint, destructiveHint, idempotentHint) are present. Risk classifications (READ_ONLY, WRITE, DESTRUCTIVE) are noted in metadata but not exposed to the MCP client. Parameter descriptions lack format constraints (e.g., 'size' accepts 'WxH' but no regex/pattern is enforced). Some tools accept instance numbers with defaults, reducing required params, good UX. Overall: solid definitions with room for output schema documentation and tool annotations.
Click at coordinates (x, y) on an instance's screen using xdotool. Coordinates are in pixels relative to the instance's display.
Click on a parsed UI element by its id (from parse_screen). Uses cached element coordinates from the last parse.
Drag from (x1, y1) to (x2, y2) on an instance's screen using xdotool.
Press keyboard keys on an instance using xdotool. Supports single keys, key combinations (e.g. 'ctrl+c'), and key sequences.
Terminate a sandboxed instance (Xephyr display and its running app). Waits for the display to go down.
Launch a new sandboxed instance (Xephyr display) running a specified command. Returns the instance number and display name.
List files in the per-instance staging folder (files/<instance>/). Returns up to FILES_MAX entries; truncated flag indicates overflow.
Output schemas not documented. Tools return JSON (e.g., {ok, action, instance, display, ...}) but structure is inferred from code comments, not explicit schema declarations. LLMs cannot reliably plan downstream calls without knowing response field types and presence.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint). Risk classifications (READ_ONLY, WRITE, DESTRUCTIVE) exist in metadata but are not exposed via MCP tool definitions. Clients cannot distinguish safe vs. destructive operations without parsing descriptions.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 63 | 2026-07-28+ | v2 |
List all running sandboxed instances (Xephyr displays). Probes up to :12 for already-running sandboxes.
Navigate the browser on an instance to a URL. Sends the URL to the focused Chromium window via xdotool.
Parse the current screen of an instance and return grounded UI elements (text, icons, interactive regions) using the configured vision backend. Returns up to PARSE_MAX elements; truncated flag indicates overflow.
Read a file from the per-instance staging folder (files/<instance>/).
Capture the screen of an instance and return as an image. Optionally parse/ground the screen with the configured vision backend (none/basic/local) and return structured elements.
Scroll on an instance's screen. Positive dy scrolls down, negative scrolls up.
Type text into the focused window on an instance using xdotool. Input is unicode-safe.
Upload a file to a web form's <input type=file> element via Chrome DevTools Protocol (CDP). Bypasses the native GTK file picker dialog.
Write a file to the per-instance staging folder (files/<instance>/). Creates the folder if needed.
Parameter format constraints not enforced. 'size' parameter in launch_app accepts 'WxH' format but no regex pattern or validation is documented. 'encoding' in write_file has enum but 'path' and 'content' lack length/character constraints. LLMs may pass invalid formats.
Error responses lack actionable recovery guidance in some cases. While _fail() includes a 'fix' field, not all error paths populate it. E.g., xdotool failures may return raw stderr without suggesting next steps.
Pagination not implemented for list_files and parse_screen. Both cap results (FILES_MAX=200, PARSE_MAX=300) and flag overflow with 'truncated', but no offset/limit parameters allow the agent to fetch remaining items. Large result sets may be silently truncated.