Loading ToolBench
Windows Agent Sandbox MCP Server - provides sandboxed file operations, process execution, and task graph management for agent workloads
Mixed quality across 14 tools. Core file/process tools (file_search, file_read, file_edit, process_run, dir) have complete JSON schemas with proper type constraints and enums, but descriptions are terse (10-80 chars, below the 194-char baseline). Task/agent tools (task_update, agent_run, agent_status) have better descriptions but lack parameter-level documentation. Six conformance-only test tools are minimally specified and should not be in production. No tool annotations (readOnlyHint/destructiveHint) despite clear risk classifications. Error handling is absent from all tool definitions.
Queue a natural-language request for asynchronous execution.
Get the current state and result of a queued agent task.
Conformance-only elicitation task fixture.
Create, remove, or list directories under an approved root. Only empty directories can be removed.
Edit an approved file transactionally. For patch, pass a JSON string containing old_text and new_text; unified diff is unsupported.
Read an approved file.
Search files under an approved root.
Six test/conformance tools (test_missing_capability, test_streaming_elicitation, test_logging_tool, multi_input, test_tool_with_task, confirm_delete) are production-exposed but lack proper descriptions (<20 chars) and minimal schemas. These should be removed or gated behind a test-only flag.
Tool descriptions are uniformly terse (10 - 80 chars vs. 194-char baseline). file_search='Search files under an approved root.' lacks WHEN to use it, what it returns, and prerequisites. Descriptions should explain the action, use case, and output structure.
No parameter-level descriptions in any tool. LLMs cannot infer what 'mode' means in file_search (glob vs. name vs. text vs. regex vs. tail) without explicit guidance. Every parameter must have a description explaining its purpose and valid values.
Inferred effective spec: 2026-07-28+.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 45 | 2026-07-28+ | v2 |
Conformance-only multiple elicitation task fixture.
Run one approved executable with separated arguments.
Update the deterministic task graph structure or estimates.
Conformance-only request log-level probe.
Conformance-only sampling capability probe.
Conformance-only response-stream framing probe.
Conformance-only MRTR and Tasks composition fixture.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint) despite clear risk classifications in source (READ_ONLY, DESTRUCTIVE, WRITE). file_edit and process_run are destructive but unmarked. Agents cannot reason about safety without annotations.
No error handling guidance in any tool definition. Tools return success/failure but do not tell LLMs what to do on error (retry, ask user, abort). file_edit and process_run need recovery paths for common failures (permission denied, timeout, file not found).