Loading ToolBench
A Model Context Protocol server providing safe, read-only and narrowly-scoped mutating Git operations on explicitly allowlisted repositories with deterministic safety checks, secret redaction, and audit logging.
Codex Safe Git demonstrates strong naming conventions (verb_noun pattern: git_status, list_local_branches, commit_files) and comprehensive parameter descriptions. All 21 tools have explicit schemas with typed inputs and clear descriptions (avg ~80 chars per tool). Security-focused design with READ_ONLY vs WRITE risk annotations. However, output schemas are not documented in the visible code, only input schemas are defined. Error handling is present but lacks recovery guidance (e.g., 'try search_users' patterns). Tool descriptions average ~120 chars, which is good but could be more prescriptive about WHEN to use each tool vs alternatives.
Return bounded changed-file names and counts between two safe local refs without patch text.
Create a local commit from exactly listed files after deterministic safety checks.
Return recent bounded commit metadata without patch text.
Summarise merge-base, ahead/behind counts, and changed-file counts for two safe local refs.
Create or switch to a safe local non-default branch at current HEAD.
Create a linked local worktree on a new safe non-protected branch under an allowed root.
Attach a detached worktree to a safe local non-default branch at current HEAD.
Output schemas not documented. Tool descriptions specify what inputs are accepted but do not document return types, field names, or structure. LLMs cannot plan downstream tool calls or extract required data without knowing response shape.
Error handling lacks recovery guidance. Errors are raised (e.g., 'remote/ref path', 'limit exceeds maximum') but do not guide the LLM on next steps. Should include actionable suggestions like 'Use only local branch names' or 'Reduce limit to X'.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 62 | 2025-06-18+ | v2 |
Return redacted, bounded file-level diff counts for an explicitly allowed local Git repo.
Return a redacted, bounded, read-only status summary for an explicitly allowed local Git repo.
Return bounded local branch metadata without contacting remotes.
Return bounded local branch and tag refs with target metadata.
Return local worktrees visible under the configured allowlist, redacting unallowlisted paths.
Return the merge base for two safe local refs.
Fast-forward a clean non-default local target branch from another local branch.
Return bounded exact-path Git state for explicit paths without reading file contents.
Return recent bounded HEAD or local-branch reflog movements without expiry, deletion, or mutation.
Run a bounded read-only connectivity diagnostic without repair or lost-found writes.
Switch a clean worktree to an existing safe non-protected local branch.
Return bounded MCP version, tool-surface, checksum, audit, and redacted allowlist health metadata.
Return bounded metadata and changed-file names for one local commit without patch text.
Return bounded read-only submodule state without cloning, fetching, or updating.
Tool descriptions lack WHEN-to-use guidance. Descriptions state WHAT each tool does but not when to prefer it over similar tools. E.g., compare_refs vs changed_files_between_refs both show differences, when should an LLM pick one over the other?
Destructive operations (commit_files, merge_branch, create_worktree) lack confirmation or dry-run support. Agents can make mistakes, no pattern to preview changes before committing or merging.
Parameter descriptions do not specify constraints. E.g., 'branch_name' accepts 'safe local branch name' but does not define what 'safe' means (no special chars? no slashes? no reserved names?). LLMs cannot validate inputs without explicit constraints.