Loading ToolBench
MCP Server that exposes an `ask_claude` tool to delegate tasks to Claude Code running on a remote Mac via SSH over Tailscale. Enables persistent sessions and Mac filesystem access.
Single tool 'ask_claude' has a well-structured schema with all required and optional parameters properly typed and described. Description is comprehensive (280+ chars) and explains the tool's purpose, capabilities, and session persistence. However, the tool lacks critical error handling guidance, output schema documentation, and does not declare destructive/irreversible consequences in a machine-readable way (no toolAnnotations). The schema is complete and descriptions are present, placing this in the 'fair to good' range, but missing patterns for production-grade agent composition.
Delegate a task to Claude Code running on a remote Mac via SSH over Tailscale. Full Claude with persistent sessions and Mac filesystem access. Claude can write/review scripts, research topics, debug code, analyse data, draft text, and reason through complex problems. Returns Claude's response plus a session_id, pass session_id back as resume_session_id to continue the same conversation across multiple calls.
No output schema documented. LLM cannot predict response structure (result, session_id, cost fields) or plan downstream tool calls. Agents must infer output format from description alone.
No error handling guidance. Tool can timeout, SSH fail, or return malformed JSON, but description does not explain recovery steps or error categories (retryable vs fatal). LLM has no guidance on what to do if the call fails.
Destructive/irreversible operations not annotated. Tool description mentions 'Claude can write/review scripts' but does not use toolAnnotations (destructiveHint) to signal that code execution on a remote Mac is irreversible. Agents cannot reason about risk.
No confirmation or dry-run pattern for irreversible operations. A tool that executes arbitrary code on a remote system should support a dry-run mode or require explicit confirmation before execution. Current design allows accidental code execution.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 61 | 2026-07-28+ | v2 |
Session ID returned in response but not documented as a secret. The 'session_id' field is returned to the LLM context and could be logged or echoed to users. If session IDs are sensitive, they should not appear in tool responses.