Loading ToolBench
Stateless MCP server to connect to a VPS over SSH and run commands.
Four well-named tools with clear, action-oriented names (ssh_exec, ssh_test_connection, ssh_read_file, ssh_upload_file). All tools have descriptions (100-200 chars, within baseline). Input schemas are fully visible with proper Zod types and descriptions for all parameters. Shared override shape (host, port, username, password, privateKeyPath, passphrase, timeoutMs) is well-documented. Error handling returns structured responses with isError flag and actionable messages. Main gaps: no output schema documentation (what fields are returned?), no pagination/limits guidance for file reads, no explicit idempotency markers, and tool annotations (readOnlyHint/destructiveHint) are absent from the MCP registration.
Open a fresh SSH connection to the configured VPS, run a single shell command, and return stdout, stderr and the exit code. Stateless — the connection is closed after each call.
Read the contents of a remote file via SSH. Refuses files larger than maxBytes (default 1 MiB) to avoid flooding the context.
Verify SSH connectivity and authentication to the configured VPS by running a lightweight identity command. Returns the resolved hostname and current user.
Upload a local file to a remote path on the VPS over SFTP. Useful for deployments and shipping artifacts. Creates the remote parent directory if needed. Stateless — connection closed after the transfer.
Output schemas not documented. Tools return structured objects (code, signal, stdout, stderr, host) but LLMs cannot see the schema. Agents must infer field names from examples, risking misuse.
ssh_read_file lacks explicit size limit guidance in description. While maxBytes defaults to 1 MiB, the description should state 'Refuses files larger than maxBytes (default 1 MiB) to avoid flooding context', which it does, but no guidance on what happens if limit is exceeded (error message format).
Tool annotations missing. ssh_exec and ssh_upload_file are destructive (WRITE risk), ssh_test_connection and ssh_read_file are read-only. MCP registerTool() should include readOnlyHint and destructiveHint in tool metadata for agent safety.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 63 | 2026-07-28+ | v2 |
No idempotency guarantees documented. ssh_exec and ssh_upload_file are stateless but agents need to know: if I retry with identical params, will I get the same result or duplicate side effects? Stateless design implies idempotency but it's not explicit.
Error messages are generic. 'SSH error: <message>' and 'Connection failed: <message>' do not guide recovery. Should include: is this retryable? Should the user check credentials? Is the host unreachable?