Loading ToolBench
Zero-config SSH/SFTP MCP server. All connection data is passed at runtime from chat, never persisted to disk or MCP config.
Strong foundation with 15 well-defined tools, comprehensive parameter schemas using Zod validation, and clear descriptions for most tools. All tools have explicit input schemas with type constraints and descriptions. Naming follows verb_noun convention (connect, disconnect, exec, upload_file, etc.). Error handling includes redaction and isError flags. Key gaps: no output schemas documented, no tool annotations (readOnlyHint/destructiveHint), limited guidance on error recovery, and some parameter descriptions could be more prescriptive about constraints. Average tool description ~180 chars (within baseline 194). All 15 tools have descriptions and typed parameters.
Open a temporary in-memory SSH connection. Requires host, username, and either password OR privateKey (PEM). All credentials are kept in RAM only and wiped on disconnect. WARNING: this connects to a real remote host and host-key checking is disabled — the calling user is responsible for trust.
Return explicit local diagnostics: MCP server alive, registered connections, known jobs, or a short SSH probe for a named connection. This helps distinguish server unavailable, SSH unavailable, dead connection, and MCP transport issues.
Close the named SSH connection and wipe its credentials from memory.
Download a remote file from the SSH host to the local filesystem via SFTP.
Execute a shell command over SSH on the named connection. WARNING: this runs real commands on a real remote machine — destructive operations are NOT blocked by this server. The MCP client / approval layer is responsible for confirming dangerous commands with the user.
Execute a command on the remote host as another Linux user via sudo, non-interactively. Requires a valid Linux username and optional sudo password.
No output schemas documented. Tools return JSON-stringified results without formal schema definitions. LLMs cannot predict response structure for downstream planning.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint). Risk levels are documented in descriptions but not machine-readable. Agents cannot automatically classify tools as safe/destructive.
Error recovery guidance incomplete. Descriptions warn of risks (host-key checking disabled, destructive operations) but do not guide LLM on recovery steps. E.g., 'exec' says 'destructive operations are NOT blocked' but does not suggest confirmation patterns.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 60 | 2026-07-28+ | v2 |
Start a long-running command as another Linux user via sudo and return immediately with a jobId. Use `exec_status` to read output later and `exec_cancel` to stop it.
Cancel a long-running job started by `exec_start` or `exec_as_start`. Sends SIGTERM to the remote process.
Start a command over SSH and return immediately with a jobId. Use `exec_status` to read stdout/stderr later and `exec_cancel` to stop it. This avoids MCP client tool-call timeouts for git clone, pip install, apt install, dkms builds, reboot waits, and similar long operations.
Poll the status and output of a long-running job started by `exec_start` or `exec_as_start`. Returns stdout/stderr chunks, exit code, and status.
List currently registered SSH connections. Returns only non-sensitive metadata (connectionName, host, port, username, connectedAt, status).
Read a remote file and return its contents as a string (with optional size limit). Useful for config files, logs, and small text files.
Recursively upload a local directory tree to the remote host via SFTP.
Upload a local file to the remote host via SFTP.
Write or overwrite a remote file with the given content via SFTP.
Parameter descriptions lack prescriptive constraints. E.g., 'command' param in exec has no guidance on shell escaping, injection risks, or format expectations. 'remotePath' in upload_file has no path traversal warning.
No pagination or result limits documented for list_connections and diagnose. If many connections exist, response could be large. No maxBytes or limit parameter offered.