Loading ToolBench
Local MCP server exposing a run_bash tool to run shell commands.
Single tool 'run_bash' has a clear verb-noun name and reasonable description (89 chars). Input schema is present with three parameters (command, cwd, timeout), all with type definitions and descriptions. However, the tool is destructive and lacks critical safety patterns: no confirmation mechanism, no dry-run option, no permission gating, and no tool annotations (destructiveHint). Output is unstructured plain text rather than a typed object. Error messages are somewhat actionable but could be more specific. The allowlist feature (BASH_MCP_ALLOWED) provides some mitigation but is not enforced at the tool definition level.
Run a shell command on the local machine and return its output.
Destructive tool lacks confirmation or dry-run pattern. run_bash can delete files, modify systems, or cause irreversible damage with no confirmation step or preview capability.
No tool annotations. run_bash is marked as DESTRUCTIVE in the server metadata but lacks destructiveHint annotation in the tool definition itself. LLMs cannot see this risk classification.
Output is unstructured plain text. run_bash returns a concatenated string with exit code, stdout, and stderr. Should return a structured object with typed fields (exit_code: int, stdout: string, stderr: string, cwd: string) for reliable LLM parsing.
No permission gating. The tool respects BASH_MCP_ALLOWED environment variable but does not declare required permissions or scope in the tool definition. No audit trail of who executed what command.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 59 | 2026-07-28+ | v2 |
Timeout parameter lacks bounds documentation. Description says 'Capped by BASH_MCP_MAX_TIMEOUT' but does not state the actual cap value (default 300s) or minimum (1s). LLMs cannot infer valid ranges.