Loading ToolBench
Agent-native shell as an MCP server — quiet-by-default, addressable detail, effects-as-data, opt-in sandbox/trace. Built for LLM agents (Claude Code), not humans at a terminal.
veil-mcp demonstrates strong naming conventions (verb_noun: sh_run, sh_detail, sh_snapshot, sh_rollback, sh_logs, sh_kill) and comprehensive parameter schemas with type definitions and descriptions. Tool descriptions are detailed and action-oriented. However, output schemas are not explicitly documented in the source code, responses are inferred from implementation rather than formally declared. Error handling guidance is minimal. The server targets a specialized domain (shell execution for agents) with well-thought-out design (effects-as-data, addressable output store, sandbox/trace options), but lacks formal output schema documentation and recovery guidance patterns.
Retrieve full addressable output from a stored run by id and selector (stdout/stderr/trace), with optional regex matching and line range selection.
Stop a background run by id, sending SIGTERM and escalating to SIGKILL if needed.
Poll the output of a background run by id, with optional byte-cursor for incremental streaming.
Restore the working directory to a previously created checkpoint by id.
Execute a shell command with structured output, effects-as-data rendering, addressable output store, optional assertions/expectations, retries, background spawning, and optional sandbox confinement.
Create a checkpoint of the current working directory state (copy-on-write clone on macOS, rsync mirror elsewhere) for later rollback.
Output schemas not formally documented. Tool descriptions explain inputs but do not declare what fields/structure responses contain. LLMs cannot plan downstream tool calls without knowing response structure.
Error handling lacks recovery guidance. Tool descriptions do not explain what to do on failure (e.g., 'If command times out, increase timeout_ms or break into smaller steps'). Errors are implementation-driven, not LLM-optimized.
sh_rollback description is minimal (75 chars). Does not explain prerequisites (must call sh_snapshot first), failure modes, or when to use it. Lacks LLM-optimized guidance.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 56 | 2026-07-28+ | v2 |
sh_kill and sh_logs descriptions do not explain signal escalation behavior (SIGTERM → SIGKILL) or polling semantics (byte-cursor incremental streaming). Implementation details matter for agent planning.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint) declared. sh_run with background:true is idempotent; sh_snapshot/sh_rollback are destructive. Annotations help agents reason about side effects.