Loading ToolBench
Computer use for Linux. Let Claude Code, OpenAI Codex or any MCP client drive a real browser on your Linux machine, with a live view, human takeover and guardrails.
21 tools with complete input schemas and descriptions. Naming follows verb_noun convention (open, goto, click, fill, press, type, etc.). Descriptions are concise (avg ~80 chars) and action-oriented. However, many parameter descriptions are minimal or missing entirely. Output schemas are not documented, LLMs cannot predict return structure. Error handling guidance is absent. Desktop tools (desktop_click, desktop_type, desktop_key) lack parameter constraints (e.g., button enum, key format). No security annotations or permission declarations. Composition is reasonable (single responsibility per tool), but some tools like 'mouse' and 'click' overlap in capability without clear delineation.
Click an element by its ref from snapshot. Blocked when the element looks irreversible unless confirm is true.
Move the pointer of the agent desktop and click. Coordinates come from desktop_screenshot.
Bring a window of the agent desktop to the front. Keyboard input goes to the focused window.
Press a key or combination on the agent desktop, for example Return, ctrl+c or alt+Tab.
Start an application on the agent desktop, found by name in the desktop catalog. Applications outside the allowed list need confirm.
Capture the agent desktop, or a single window of it. Use it to find coordinates before clicking.
No output schemas documented. LLMs cannot predict return structure (fields, types, pagination). Snapshot and screenshot responses are opaque.
Parameter descriptions are minimal or absent. 'key' in press/desktop_key lacks format guidance (e.g., 'Enter', 'ctrl+c'). 'action' in mouse lacks explanation of when to use each enum value.
No error handling guidance. Tools do not explain what to do on failure (e.g., 'Element not found, try snapshot() first', 'Browser crashed, call open() again'). Agents cannot recover from errors.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 59 | 2026-07-28+ | v2 |
Start the agent desktop, a nested X display in a resizable window. Required before any other desktop tool. Pass stop: true to shut it down.
Type text into the focused window of the agent desktop. Typing into a terminal needs confirm, because a shell runs whatever it receives.
List the visible windows on the agent desktop, with id, title, class and geometry.
Fill a field identified by its ref. Refused on credential fields.
Navigate the current tab to a URL.
Go back, go forward or reload.
Coordinate based mouse control for canvas, maps and custom widgets that have no accessible element. Take a screenshot first to read the coordinates.
Open a browser session, or attach to a browser already running with a CDP endpoint. Call this first.
Press a key, for example Enter, Tab or ArrowDown.
Image of the page. Use it to read visual content, verify a result, or work out coordinates for the mouse tool.
normal asks before sensitive actions. auto runs a complete objective end to end, stopping only for an empty login, an account choice, or an irreversible action.
Accessibility tree of the page with a ref for each element. Use these refs with click and fill. Prefer this over screenshot for acting: it is exact and cheap.
Report the session, the mode and who holds the control lease. Pass takeover: true to hand control to the human before they act in the dashboard. Control comes back only when the human releases it on their machine, never through this tool.
List, open, select or close tabs.
Type text into the focused element. Refused when a password field has focus.
Overlapping tool responsibilities. 'click' and 'mouse' both perform clicks; 'type' and 'fill' both enter text. No clear guidance on when to use each. Agents may choose wrong tool.
No security annotations. Tools like 'desktop_launch' and 'desktop_type' can execute arbitrary commands but lack permission gates, confirmation patterns, or audit trail guidance.