Loading ToolBench
A Python adaptation of the Code Mode MCP pattern for local agent stacks. Exposes a single `compose` tool that lets an LLM write async Python to orchestrate multiple tool calls in one round-trip.
Server exposes 7 tools with significant definition gaps. The compose tool has a reasonable description but lacks output schema documentation. iTerm2 and osascript tools have basic descriptions but missing parameter details (e.g., no description for 'tab' parameter across 5 tools, no enum constraints for 'character' in iterm2_send_control). No tools document return types or error recovery guidance. Naming is verb-noun compliant but descriptions average ~80 chars (below 194-char baseline). No tool declares permissions, audit requirements, or idempotency guarantees. Security concerns: compose accepts arbitrary Python code with only AST-level dunder blocking, insufficient for untrusted input. osascript_run accepts arbitrary AppleScript with no validation.
Execute a Python script with all MCP tool stubs injected as callable functions. Enables an LLM to compose multiple tool calls in one round-trip instead of sequential ping-pong.
Get the current working directory of an iTerm2 session. Tries three methods in order: 1. iTerm2 Shell Integration variable, 2. lsof PID-based CWD lookup, 3. Returns error.
Read the last N lines from an iTerm2 session.
Send a control character to an iTerm2 session.
Send text to an iTerm2 session WITHOUT pressing Enter. Useful for interactive prompts (y/n, passwords, etc.).
Write text or a command to an iTerm2 session. Sends text followed by Enter, then waits for output to settle (3 consecutive stable readings 0.3s apart).
Output schemas undocumented. No tool declares what fields it returns, forcing LLMs to infer structure. compose returns stdout/stderr but no schema; iterm2_read returns text but no field spec; osascript_run returns output but no type.
Parameter descriptions missing or incomplete. 'tab' parameter appears in 5 tools with identical description but no guidance on default behavior when None. 'character' in iterm2_send_control lacks enum constraint (should be C, D, Z, etc.). 'timeout' parameters lack min/max bounds.
No error recovery guidance. Tools lack descriptions of failure modes and recovery steps. E.g., iterm2_cwd says 'Returns error' but does not explain what error or how to recover. osascript_run timeout behavior undocumented.
Inferred effective spec: 2026-07-28+.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 55 | 2026-07-28+ | v2 |
Execute arbitrary AppleScript code. Use for macOS automation: controlling apps, reading system info, showing dialogs, file operations, etc.
Arbitrary code execution without sufficient guardrails. compose accepts Python code with only AST-level dunder blocking. Threat model acknowledges this is not a security boundary but relies on 'trusted-user environment', risky if code ever comes from untrusted sources. osascript_run has no validation whatsoever.
No permission declarations or audit trail. Tools do not declare required scopes (e.g., 'read:iterm2', 'write:iterm2'). No logging of who called what, when, or with what parameters, required for compliance and incident response.