Loading ToolBench
A policy-controlled local SSH gateway for AI agents with MCP (Model Context Protocol) support
18 tools with consistent naming (ssh_* prefix) and action verbs. Descriptions present but vary in quality, some are detailed (ssh_run_operation: 234 chars), others minimal (ssh_ping: 56 chars). All tools have input schemas with type definitions and parameter descriptions. However, output schemas are not documented in the provided code, and several parameter descriptions lack format/constraint details. Error handling guidance is absent. Risk annotations (READ_ONLY, DESTRUCTIVE, WRITE) are present but not integrated into descriptions. No evidence of pagination support despite tools like ssh_list_allowed_operations and ssh_list_targets that could return large result sets.
Cancel a daemon-owned SSH task.
Check one configured SSH target with the Gateway's fixed hostname probe. Known AccessClient failures are returned as a closed, non-sensitive failureReason; remote stderr is never returned. No command or timeout can be supplied by the caller.
Check Docker prerequisites on an SSH target.
Download a file from an SSH target.
Run a command synchronously on an SSH target. Accepts the compatible single command form or a full-access structured shell/script/cwd/env form. Prefer ssh_start for builds, downloads, and other long work.
Report whether the local SSH management service and Gateway are ready, plus configured target summaries. In each target, maxTimeoutMs is the command limit and maxTransferTimeoutMs is the independent upload/download/sync limit.
Output schemas not documented. Tools like ssh_list_allowed_operations, ssh_gateway_status, and ssh_list_targets return structured data but no schema is visible in source. LLMs cannot plan downstream calls without knowing response field names and types.
File transfer tools (ssh_upload, ssh_download, ssh_sync) have minimal descriptions (50 chars each). Missing details on file size limits, supported protocols, timeout behavior, and error recovery. Parameter 'remotePath' lacks format guidance (absolute vs relative, allowed characters).
No pagination support declared. ssh_list_allowed_operations and ssh_list_targets could return large result sets but lack limit/offset/cursor parameters. Risk of context window exhaustion if results are unbounded.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 53 | 2025-06-18+ | v2 |
Inspect detailed information about an SSH target.
Discover the fixed read-only operations permitted by a target's selected permission presets, including parameter schemas and permitted log resources. Empty operations means none are granted by presets; full-access and legacy targets continue to use ssh_exec.
List immutable SSH target IDs, current display aliases, remote platforms, and effective command and file-transfer policy status. maxTimeoutMs applies to commands; maxTransferTimeoutMs independently applies to upload/download/sync. Tools accept either the targetId or a current/retained alias.
Open the local SSH management center in the Windows default browser without exposing its administrator token to the MCP caller.
Check whether the local Agent SSH Gateway daemon is ready.
Read output from a completed SSH execution.
Run one permitted fixed read-only inspection operation. Call ssh_list_allowed_operations first for operation IDs and allowed parameters. No arbitrary shell, script, environment, file writes or Docker changes. Timeout is capped at 15 seconds and the target limit. Results retain stdout/stderr and outputRef pagination.
Start a daemon-owned SSH execution and return a runId immediately. The task continues across MCP client disconnects; use ssh_status and ssh_tail to follow it.
Read the current state and progress counters of a daemon-owned SSH task.
Synchronize files between local and remote systems.
Stream the latest output from a daemon-owned SSH task, with automatic reconnection and backpressure handling.
Upload a file to an SSH target.
Error handling guidance absent. Descriptions do not explain what errors are retryable, what user actions are needed, or how to recover. E.g., ssh_check_connection mentions 'failureReason' but does not guide LLM on next steps.
Risk annotations (READ_ONLY, DESTRUCTIVE, WRITE) are metadata but not integrated into tool descriptions. LLMs cannot infer from names alone which tools are safe to retry or have side effects. Descriptions should explicitly state 'This tool modifies state' for destructive operations.