Multi-language REPL MCP server supporting Python, Shell, and JavaScript execution in isolated sandboxes with resource limits and network policies
RAGClaw Lite exposes 7 tools with basic descriptions and input schemas, but falls short of production quality. Tool names follow verb_noun convention (run_python, list_files, delete_file), which is good. However, descriptions are minimal (10-50 chars), parameter descriptions lack depth, and output schemas are not documented. No error handling guidance, no recovery paths, and no tool annotations (readOnlyHint/destructiveHint). The timezone parameter appears on execution tools but lacks validation constraints. File operation tools (list_files, read_file, write_file, delete_file) have identical 1-param schemas with minimal context. No pagination support on list_files despite potential for large directory listings. Security-critical tools (run_shell, delete_file) lack confirmation/dry-run patterns.
Delete a file from the allowed workspace directory
List files in the allowed workspace directory
Read file contents from the allowed workspace directory
Execute JavaScript code in Node.js sandbox with resource limits (requires --enable-javascript flag)
Execute Python code in an isolated sandbox with resource limits
Execute shell commands in an isolated sandbox with resource limits (requires --enable-shell flag)
Write file contents to the allowed workspace directory
Descriptions are too brief (10-50 chars). Rubric baseline is 194 chars; descriptions under 20 chars score 0-20. Most tools lack context on WHEN to use them, prerequisites, or what they return.
No output schemas documented. LLMs cannot infer what fields list_files returns (file names? sizes? timestamps?), forcing guesswork and downstream failures.
Destructive tools (run_shell, delete_file) lack confirmation/dry-run patterns. Agents can delete files or execute arbitrary shell commands without a safety gate.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 45 | <=2025-11-25 | v2 |
No tool annotations (readOnlyHint, destructiveHint, idempotentHint). Clients cannot distinguish safe reads from destructive writes without parsing descriptions.
Timezone parameter on execution tools lacks validation. No enum, pattern, or format constraint. LLMs may pass invalid IANA names (e.g. 'UTC+5' instead of 'Asia/Karachi').