Loading ToolBench
Small MCP server for GNOME Wayland desktop automation via AT-SPI and Mutter.
Server has 10 tools with explicit schemas and descriptions, but quality is inconsistent. Naming follows verb_noun convention (session_start, launch_app, kill_app). Descriptions are present but often lack actionable context, e.g., session_start describes WHAT it does but not WHEN to use it or what prerequisites exist. Parameters have types and descriptions, but several lack constraints (enums, ranges). Critical gap: no output schemas documented, LLMs cannot predict what fields to expect from responses. Error handling is minimal; no recovery guidance. Security concerns: launch_with_logging accepts arbitrary shell commands (IRREVERSIBLE risk) with no sanitization or warning in description. Tool composition is reasonable (single responsibility), but file_dialog_set_path and close_app/kill_app rely on fragile UI automation (Alt+F4, Ctrl+L) without fallback or validation.
Gracefully close all windows of an application by sending Alt+F4.
Set a file path in a GTK file dialog by sending Ctrl+L to activate the location entry, typing the path, and pressing Return.
Forcefully kill an application by PID. Sends SIGTERM first, then SIGKILL if still alive.
Launch an application by desktop ID.
Launch an application with stdout/stderr capture. Warning: executes the specified command on the host system.
List installed desktop applications.
Read stdout/stderr of a launched application by PID.
launch_with_logging accepts arbitrary shell commands with no input validation, sanitization, or injection guards. Description warns 'executes the specified command on the host system' but provides no guidance on safe usage or constraints. This is a critical command-injection vector.
No output schemas documented for any tool. LLMs cannot predict response structure (fields, types, nesting). session_start returns pid, bus_address, width, height, already_running but this is inferred from code, not declared in tool metadata. Agents must guess what to extract.
UI automation tools (file_dialog_set_path, close_app) rely on fragile keyboard shortcuts (Ctrl+L, Alt+F4) without validation that the UI is in the expected state. No error handling if the shortcut fails or the dialog is not open. Descriptions do not warn of brittleness.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 53 | 2026-07-28+ | v2 |
Get information about the current isolated session.
Start an isolated GNOME Shell session via gnome-shell --headless. Creates a private D-Bus session with its own display and input.
Stop the isolated GNOME Shell session.
Descriptions lack actionable context. session_start says WHAT it does but not WHEN to use it, what prerequisites exist (GNOME/Wayland only?), or what happens if already running. launch_app description omits whether it blocks until the app exits or returns immediately.
Parameters lack constraints. list_desktop_apps max_results has no min/max bounds (could LLM pass 1000000?). file_dialog_set_path path parameter has no validation hint (absolute vs relative? must exist?). launch_with_logging command has no length limit or character restrictions documented.