Loading ToolBench
MCP Server: Claude Desktop ↔ Kali Linux SSH Bridge. Exposes a run_command tool via the Model Context Protocol (MCP) stdio transport, allowing Claude Desktop to execute commands on a remote Kali Linux host over SSH.
Single tool 'run_command' has a basic description (97 chars) and minimal input schema. The description lacks WHEN to use it, prerequisites, or recovery guidance. Parameter 'command' has a description but no constraints (no length limits, no validation hints). No output schema documented, LLMs cannot predict the structure of stdout/stderr fields. No error handling guidance: what happens on timeout? SSH auth failure? Command not found? The tool is destructive (marked DESTRUCTIVE risk) but has no confirmation pattern, dry-run option, or permission gate. No tool annotations (readOnlyHint, destructiveHint, idempotentHint). Naming is generic ('run_command' could apply to any system); 'execute_remote_command' or 'run_kali_command' would be clearer.
Execute a shell command on the remote Kali Linux host via SSH. Returns stdout and stderr. Use for network recon, log analysis, and firewall inspection tasks.
No output schema documented. LLMs cannot predict response structure (stdout, stderr fields, error format). Breaks downstream tool chaining and forces LLMs to guess field names.
Destructive tool lacks confirmation or dry-run pattern. Agents can execute irreversible commands (rm -rf, iptables rules) without safeguards. No permission gate or audit trail.
Parameter 'command' has no constraints: no length limit, no validation hints, no examples of valid commands. LLMs may pass arbitrarily long or malformed input.
Error handling is silent. SSH failures, timeouts, and auth errors return generic stderr text with no recovery guidance. LLMs cannot distinguish retryable from fatal errors.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 41 | <=2025-11-25 | v2 |
SSH credentials hardcoded in source (SSH_PASS = 'kali'). Violates secret-injection pattern. Credentials must be injected via environment variables or vault, never in code.