Loading ToolBench
Local security fence and GitHub Action for AI coding agents — detect secrets, risky commands, and unsafe network actions before they run.
Single tool 'agentfence_check' has a clear, well-written description (168 chars) and complete input schema with all parameters typed and described. However, the tool violates the single-responsibility principle by accepting multiple action kinds (shell, filesystem, git, network) in one tool. Output schema is not documented, callers cannot predict the structure of the decision result. Parameter descriptions are adequate but lack format constraints (e.g., what constitutes a valid 'kind' value). No error handling guidance provided to help agents recover from deny/ask decisions.
Evaluate a proposed shell, filesystem, git, or network action before attempting it. Never executes the proposed action. A deny decision means do not proceed; an ask decision requires human approval.
Output schema not documented. Tool returns a 'decision' field (deny/ask/allow) and likely other fields, but callers cannot predict structure. LLMs cannot plan downstream actions without knowing what fields to expect.
Tool combines four distinct action types (shell, filesystem, git, network) into one 'kind' parameter. This violates single-responsibility principle. Consider splitting into check_shell_command, check_filesystem_action, check_git_command, check_network_request for clearer intent and better LLM routing.
No error handling guidance. When decision is 'deny' or 'ask', the tool provides no actionable next steps. Error responses should guide the agent: 'Denied: risky command detected. Review the policy or request human approval via ask_human_approval().'
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 64 | 2025-06-18+ | v2 |
'kind' parameter lacks enum constraint. Description says 'such as shell, filesystem, git, or network' but does not enforce these as the only valid values. LLMs may pass invalid kinds. Add enum: ['shell', 'filesystem', 'git', 'network'].
Parameters 'command', 'path', 'url', 'body' are all optional but their validity depends on 'kind'. E.g., if kind='shell', 'command' is required; if kind='filesystem', 'path' is required. These dependencies are not documented, forcing LLMs to guess which params apply to which kinds.