Loading ToolBench
Expose the TrustShell toolkit (static engine, autonomous attacker, red-team skills) as tools any MCP agent can call. Lets Claude Code / Claude Desktop / Cursor invoke static analysis, autonomous red-teaming, and red-team skills as native tools.
TrustShell defines 5 tools with clear security-focused purposes and reasonable descriptions (avg 180 chars). All tools have input schemas with type definitions. However, parameter descriptions are sparse or missing context; error handling guidance is absent; and output schemas are not documented. The red_team tool's 'authorized' parameter shows good safety gating, but lacks recovery guidance when authorization fails. Tool composition is sound (each does one thing), but descriptions could better explain when to call each tool vs. alternatives.
List the available red-team skills (RT-1..RT-9 + methodology) with their descriptions.
Return the full SKILL.md for a skill id (e.g. 'rt6-memory-poisoning'). Load it into your agent to run that red-team test.
Autonomously red-team a RUNNING agent and return an exploit-validated report (JSON). A finding is CONFIRMED only when the exploit's proof marker actually comes back. Harmless markers only; no destruction. For authorized, defensive testing only.
Run the attacker against its built-in MOCK target (no real target, no keys) to see the exploit-validated output shape. hardened=False → RT-1+RT-6 confirmed; True → all refuted.
Read an AI agent's SOURCE and flag CANDIDATE vulnerable paths (triage; candidate != vuln), mapped to the RT-1..RT-9 attack classes. Returns JSON. Confirm candidates dynamically with red_team.
Output schemas not documented. Tools return JSON but LLMs cannot infer field structure (e.g., what fields does static_scan return? Is it {candidates: [...], metadata: ...}?). Forces LLMs to guess or fail on parsing.
Error handling lacks recovery guidance. red_team refuses if authorized=false, but description does not explain what to do next or how to obtain authorization. No guidance for network timeouts, target unreachable, or malformed target_cmd.
Parameter descriptions incomplete. 'source_dir' in static_scan lacks format guidance (absolute vs relative path? must exist?). 'target_cmd' in red_team does not explain shell escaping rules or what happens if {msg} is missing. 'skill_id' in read_skill lacks enum or examples of valid IDs.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 58 | 2026-07-28+ | v2 |
Tool selection ambiguity. static_scan and red_team both analyze agents; descriptions do not clearly explain when to call static_scan alone vs. red_team (which includes static triage). LLMs may waste calls on both when one suffices.
No pagination or result limits documented. red_team and list_skills may return large result sets (e.g., many confirmed exploits, many skills). No mention of limits, pagination, or how to handle large responses.