Loading ToolBench
Causly MCP server — an open-source MCP server that gives AI agents the tools to build, ship, deploy, and operate real software end-to-end.
46 tools with consistent naming (verb_noun pattern) and descriptions present. However, parameter descriptions are sparse or missing for many tools. Input schemas use Zod but lack detailed type constraints, enums, and ranges. Output schemas are undocumented, LLMs cannot predict return structure. Error handling is generic ('Error: {message}') with no recovery guidance. Security concerns: connection_string parameters expose credentials in logs; no mention of secret injection. Destructive tools (delete_file, delete_directory, docker_remove) require confirm:true but lack dry-run alternatives. Composition is reasonable, tools are single-purpose, but many lack chaining IDs in responses.
Copy a single file to a new location.
Create a new directory, including any missing parent directories.
Create a brand-new file. Fails if the file already exists (use write_file to overwrite).
Delete a directory. Recursive by default so it removes nested contents too. DESTRUCTIVE — requires confirm: true.
Delete a single file. DESTRUCTIVE — requires confirm: true.
Recursively build a tree view of a directory's contents (skips node_modules and .git).
Build an image from a Dockerfile. HIGH risk — requires confirm: true.
Credentials exposed in parameters: postgres_query, mysql_query, and all database tools accept connection_string as a parameter. These strings contain passwords and will be logged in agent traces, violating secret-injection pattern.
Output schemas undocumented: No tool documents what fields it returns. LLMs cannot predict response structure, forcing them to guess field names for downstream tool calls. This breaks tool chaining.
Parameter descriptions missing or minimal: Many parameters lack descriptions explaining constraints, formats, or valid values. E.g., docker_run 'ports' parameter has no description of expected format (array of strings? objects?). Zod schemas present but not LLM-readable.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 58 | 2026-07-28+ | v2 |
Run docker compose down for a project directory. HIGH risk — requires confirm: true.
Run docker compose up for a project directory. HIGH risk — requires confirm: true.
Execute a command inside a running container.
List images.
Inspect a container or image — full JSON metadata.
Get logs from a container.
List containers. Set all=true to include stopped ones (defaults to running only).
Pull an image from a registry.
Push an image to a registry. HIGH risk — requires confirm: true.
Remove a container. DESTRUCTIVE — requires confirm: true.
Remove an image. DESTRUCTIVE — requires confirm: true.
Restart a container. HIGH risk — requires confirm: true.
Run a new container from an image. HIGH risk — requires confirm: true.
Start a stopped container.
Show live resource usage stats (CPU, memory) for running containers — one-shot snapshot, not streaming.
Stop a running container. HIGH risk — requires confirm: true.
Get Docker client/server version info — connectivity check.
Edit a file via exact string find-and-replace, without rewriting the whole file. old_str must match exactly and be unique unless replace_all is set.
Get metadata about a file or directory: size, type, created/modified timestamps.
List the immediate files and subfolders inside a directory.
Move or rename a file or directory.
Get column names, types, and nullability for a MySQL table.
List all tables in a MySQL database.
Run a read or write SQL query against a MySQL database.
Test a MySQL connection string — returns server version on success.
Get column names, types, and nullability for a Postgres table.
List all tables in a Postgres database (public schema by default).
Run a read or write SQL query against a Postgres database.
Test a Postgres connection string — returns server version on success.
Read the full text content of a single file.
Read multiple files in a single call. Failures on individual files do not stop the batch.
Run a shell command in a given working directory. Blocks a short list of catastrophic patterns; everything else is allowed since this server runs with full trusted access on the user's own machine.
Recursively search for files/folders whose name contains a given pattern (case-insensitive).
Delete a secret by name. DESTRUCTIVE — requires confirm: true.
Retrieve and decrypt a secret by name.
List secret names in the store (never returns values).
Re-encrypt every secret in the store under a new master key. Call this AFTER setting SECRETS_MASTER_KEY_NEW in your environment. HIGH risk — requires confirm: true.
Store an encrypted secret by name. HIGH risk — requires confirm: true.
Create or completely overwrite a file with new content. Creates parent directories if needed.
Error handling lacks recovery guidance: toolWrapper.js returns generic 'Error: {message}' with no actionable next steps. LLMs cannot determine if errors are retryable, user-fixable, or fatal.
Destructive operations lack dry-run: delete_file, delete_directory, docker_remove require confirm:true but offer no preview or dry-run. Agents cannot safely plan destructive operations.