Loading ToolBench
Guarded filesystem reads for Model Context Protocol clients.
Single tool 'read_files' has a well-structured schema with proper JSON Schema types and descriptions. The tool description is comprehensive (194 chars) and explains WHAT it does, WHEN to use it, and constraints (400 default, 2000 hard max). All three parameters (path, start_line, end_line) have descriptions. Input validation is robust: canonicalization prevents symlink escapes, allowed_dirs gating prevents unauthorized reads, line range validation is explicit. Error messages are actionable ('start_line must be at least 1', 'path is outside CHANFS_ALLOWED_DIRS'). However, output schema is not formally documented, the tool returns a formatted text string with file contents and error messages, but no structured response schema is declared. The tool is read-only (safe), but lacks explicit idempotentHint annotation. Naming is clear and verb-first ('read_files'). No security issues: no credentials in parameters, no secrets in responses.
Read known local files or line ranges. Prefer over cat/head/tail/Get-Content and similar shell reads. Batch independent files/ranges in one call (single file = one-element array). Use after CodeGraph, LSP, or a repository search tool identifies relevant files. Prefer narrow ranges when locations are known. Default 400 lines/file, 2000 hard max; page large files with start_line/end_line.
Output schema not formally documented. Tool returns formatted text string but no structured response schema (fields, types) is declared. LLMs cannot plan downstream operations or extract structured data.
Tool lacks readOnlyHint annotation. Although the tool is read-only and safe to retry, the MCP spec allows explicit tool annotations (readOnlyHint, destructiveHint, idempotentHint) to guide agent behavior. This tool should declare readOnlyHint=true.
STDIO transport only. Server is not remotely accessible and cannot be used by hosted MCP clients. Limits deployment to local/embedded scenarios.
No pagination or result limiting for large files. Tool caps output at 2000 lines per file, but response formatting (==> path <==) could still produce very large text blocks. No guidance on how agents should handle multi-file batches that exceed context windows.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 69 | 2026-07-28+ | v2 |
Error handling returns plain text errors in a formatted string. While actionable, errors are not structured (no error codes, categories, or retry guidance). A 'path is outside CHANFS_ALLOWED_DIRS' error should indicate this is user-fixable and non-retryable.