Loading ToolBench
MCP server that bridges remote SSH sessions and browser automation tools from a remote daemon to local AI agents. Provides SSH command execution, remote browser control (Firefox/Chrome), and system introspection.
16 tools with mostly complete schemas and descriptions, but significant gaps in parameter documentation and error handling guidance. Tool names follow verb_noun convention well (ssh_start, remote_browser_navigate). Descriptions range 50-400+ chars, meeting baseline length (p10=34, p90=392). However, many parameter descriptions are minimal or missing entirely. remote_browser_start has an exceptionally detailed description (400+ chars) explaining session sharing, auth refresh, and headless modes, this is exemplary. Most other tools lack comparable depth. No visible error handling patterns, recovery guidance, or permission gates. Output schemas are not documented. Tools are well-composed (single responsibility), but lack chaining metadata (e.g., session IDs returned by ssh_start should be documented as required by ssh_exec).
Navigate the remote browser back one history entry.
Click an element by CSS selector on the remote page. May return permission_required if the action would submit to a non-allowlisted host; re-issue with confirm=true to proceed.
Get the visible text content of the current remote page (paginated).
List browsers (Firefox/Chrome), versions, and display/headless capability available on a remote server. Use to decide which engine to start.
List interactive elements (links, buttons, inputs) with selectors on the current remote page.
Evaluate a JavaScript expression in the remote page, out of page context (CSP-immune). Returns the JSON result value.
Output schemas not documented. Tools return data but LLMs cannot plan downstream calls without knowing response structure (e.g., what fields does ssh_exec return? Is it {stdout, stderr, exit_code} or {output, status}?). This forces agents to guess and wastes tokens on clarification.
Parameter descriptions are minimal or absent. 'offset' and 'limit' in remote_browser_content lack descriptions explaining pagination semantics. 'form_action_host' in remote_browser_click is underdocumented. LLMs cannot infer parameter meaning from names alone.
No error handling guidance. Tools like remote_browser_click mention 'permission_required' but do not explain what triggers it, how to recover, or whether to retry. Agents lack actionable next steps on failure.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 61 | 2026-07-28+ | v2 |
Fill an input by CSS selector on the remote page. May return permission_required for non-allowlisted submit targets; re-issue with confirm=true to proceed.
Navigate the remote browser to a URL.
Capture a JPEG screenshot of the remote page. Returns base64-encoded image data.
Scroll the remote page up or down by a pixel amount.
Start a browser on a remote server for automation. engine 'firefox' or 'chrome' — the two engines are 1:1 (identical tools and flags). By DEFAULT the browser is HEADED (visible, attaches to the server's active graphical session, auto-falls-back to HEADLESS when no display exists) and SHARES the user's real logged-in session — it drives a persistent AIOPE profile SEEDED from the user's real profile so cookies/auth/tokens carry over (the real profile is never driven or modified). Pass share_session=false for a clean throwaway profile (no auth), or mode='headless' to force headless. refresh=true pulls in fresh auth from the user's real profile (auth-only, keeps the agent's accumulated session data); reseed=true fully resets the AIOPE profile from the user's real profile (recovery; closes any running browser on the source first). Relay the user's explicit mode/session choice when they state one. Requires an active ssh session.
Get the current URL and title of the remote browser.
Stop the remote browser automation session.
Execute a shell command on an active remote SSH session. Returns stdout, stderr, and exit code.
Close an active SSH session and clean up remote processes.
Open persistent SSH session to a remote server. Returns session status.
Tool chaining metadata missing. ssh_exec requires a 'server' parameter that ssh_start returns, but the response schema for ssh_start is not documented. Agents cannot reliably chain ssh_start → ssh_exec without guessing field names.
No permission or scope declarations. Tools like ssh_exec and remote_browser_fill are destructive (WRITE risk) but lack permission gates or scope documentation. No audit trail guidance for compliance.