Loading ToolBench
Approve your AI coding agent's risky commands from your phone — MCP server (request_approval / notify).
Two tools with clear, action-oriented names (request_approval, notify) and well-structured schemas. Descriptions are detailed (150 - 200 chars) and explain WHEN to use each tool. However, parameter descriptions lack specificity about formats, constraints, and error recovery. Output schemas are not documented, LLMs cannot predict what fields to expect. Error handling is present but generic ('no_response', 'error') without actionable recovery guidance. Security redaction is implemented server-side (good), but no permission gates or audit trail declarations.
Send a one-way push notification to the human's phone (no response awaited). Use for 'task done', 'I'm blocked', or status pings. Returns immediately.
Ask the human to Approve or Deny an action from their phone, and BLOCK until they respond. Call this before any destructive, irreversible, or sensitive action (force-push, rm -rf, production deploy, payment, sending email/DM, deleting data) so a human can sign off remotely. Returns 'approved', 'denied', or 'no_response' (deferred). On 'denied' or 'no_response', do NOT proceed.
Output schemas not documented. LLMs cannot predict return structure (e.g., is 'approved' a string, object, or enum?). Agents must guess downstream field names.
Parameter descriptions lack format/constraint details. 'summary' and 'command' have no length limits, format hints, or examples of what NOT to pass. 'message' is similarly bare.
Error responses are generic strings ('no_response', 'error: ...') without recovery guidance. LLMs cannot distinguish retryable from fatal errors or know what to do next.
No permission gates or scope declarations. Tools should declare required permissions (e.g., 'requires: user.approval_authority') for audit and least-privilege configuration.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | B | 70 | 2026-07-28+ | v2 |
request_approval blocks for up to 280 seconds with no timeout parameter exposed to LLM. Agents cannot control wait duration or set context-aware timeouts.