Loading ToolBench

Reading the current corpus…

hardened-terminal-mcp MCP server · C · ToolBench

hardened-terminal-mcp

github.com/Asaad-Suliman/hardened-terminal-mcp

A security-hardened MCP server for running allowlisted terminal commands: no shell, cwd jail, timeouts, output caps, env scrub, audit trail, and secret redaction.

2026-07-28+STDIO2 tools

68/100

Definition Quality81

Protocol Readiness35

SupportabilityNot measured-

Spec posture

Inferred effective spec 2026-07-28+·current baseline 2026-07-28

Static source inference · medium confidence

Current-spec patterns detected

Summary

Two tools with clear security focus and reasonable descriptions (both 100+ chars). Schemas present with typed parameters and descriptions. However, output schema for CommandResult is documented in code but not formally exposed to MCP clients. Error handling is comprehensive (8 result codes) but descriptions lack actionable recovery guidance. Tool names are verb-based and clear. Missing: parameter constraints (enums for ResultCode), pagination support, and explicit documentation of which fields downstream tools should use.

Tools (2)

explain_commandread onlysource verified80/100

Dry-run evaluation of a command against the policy without executing it. Returns the policy decision and reason.

run_commandwritesource verified82/100

Execute a policy-approved command in a sandboxed environment with timeout, output caps, environment scrubbing, and secret redaction.

Issues (5)

HIGHtool ↗

Output schema (CommandResult) not formally declared in tool registration. LLMs cannot see that ok, code, stdout, stderr, exit_code, duration_ms, policy_reason fields exist. Clients must infer structure from examples.

run_commandexplain_command

MEDIUMconstrained-input ↗

ResultCode enum values not exposed as parameter constraints. Tool accepts 'command' as free-form string; no enum for result codes. LLMs cannot validate or predict valid outcomes.

run_commandexplain_command

MEDIUMrecovery-guide ↗

Error descriptions lack recovery guidance. 'POLICY_DENIED' and 'EXECUTOR_ERROR' are returned but tool description does not explain what the LLM should do next (e.g., 'Call explain_command to see why it was denied').

run_command

MEDIUMtool-description ↗

cwd parameter lacks format/constraint documentation. Description says 'optional, defaults to jail root' but does not explain valid paths, symlink handling, or escape detection behavior.

Recommendations

Formally document CommandResult schema in tool output_schema field: {ok: boolean, code: enum(OK|POLICY_DENIED|...), stdout: string, stderr: string, exit_code: int|null, duration_ms: int, policy_reason: string|null}.
Add actionable error recovery hints to run_command description: 'If POLICY_DENIED, call explain_command to see the policy reason. If EXECUTOR_ERROR, verify the command exists and is executable.'
Constrain cwd parameter: 'Relative path within jail root (e.g., subdir/work). Absolute paths and symlink traversals are rejected with CWD_ESCAPE.'
Add tool annotations: mark run_command as destructiveHint=true (modifies system state), explain_command as readOnlyHint=true (dry-run only).
Migrate from STDIO to HTTP+SSE or Streamable HTTP transport to enable remote client access and hosted MCP deployments.

Score history

Overall score trend

First recorded score · v2 rubric

68/100

Scored	Grade	Overall	Spec posture	Rubric
2026-09-23	C	68	2026-07-28+	v2