Loading ToolBench
AI-native alternative to SSH for remote server management via MCP. Provides secure HTTPS-based command execution, file operations, and system monitoring with built-in safety checks.
Reach provides 8 tools with complete input schemas and descriptions. Tool names follow verb_noun convention (reach_bash, reach_read, reach_write, reach_upload, reach_stats, reach_dryrun). Descriptions are present and actionable (avg ~120 chars), explaining WHAT each tool does and WHEN to use it. However, descriptions lack dependency hints and recovery guidance. Parameter descriptions are adequate but generic. Output schemas are not documented, LLMs cannot predict response structure for chaining. Error handling is absent from tool definitions; no guidance on retryability or user-fixable vs fatal errors. Security risk annotations (IRREVERSIBLE, READ_ONLY, WRITE) are present but not formalized as tool annotations per MCP spec. reach_dryrun is a good safety pattern but lacks integration with reach_bash (no confirmation flow documented).
Execute a shell command on a remote server via reach
Check if a command is dangerous before executing it. Returns risk level (low/medium/high/blocked), score 0-100, and reasons. Use this before reach_bash for destructive commands.
Get system information from a remote server
List all servers configured in ~/.reach/config.yaml
Read a file from a remote server
Get detailed system stats from a remote server: CPU usage %, memory, disk, network IO, top processes. Returns structured JSON — no shell parsing needed.
Output schemas not documented. LLMs cannot predict response structure (fields, types, pagination) for reach_bash, reach_read, reach_stats, reach_info, reach_list. This breaks tool chaining and forces agents to guess field names.
No error handling guidance in tool definitions. Descriptions do not indicate which errors are retryable, user-fixable, or fatal. reach_bash with timeout=30 may hang, no timeout error recovery documented.
Security risk annotations (IRREVERSIBLE, READ_ONLY, WRITE) are informal comments, not formalized as MCP tool annotations (readOnlyHint, destructiveHint, idempotentHint). Agents cannot programmatically detect which tools are safe to retry.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 59 | 2026-07-28+ | v2 |
Upload a local file to a remote server
Write content to a file on a remote server (atomic)
reach_dryrun exists as a safety tool but is not integrated into reach_bash flow. No confirmation pattern documented, agents may still call reach_bash directly without dryrun check. Confirmation-request pattern not implemented.
Parameter descriptions lack format constraints and ranges. reach_bash timeout is 'number' with no min/max (could be 0 or 999999). reach_stats top_n says 'default 5, max 20' in description but not enforced in schema. Enums not used where applicable (e.g., reach_info could return structured fields but no enum for field selection).