Loading ToolBench
Let Codewhale see and operate your apps. Background control, permission setup and human safety controls over MCP.
This server defines 12 tools with explicit schemas and descriptions. Naming follows verb_noun patterns (preview, computer, consent). Descriptions are present and substantive (avg ~150 chars), explaining WHAT each tool does and WHEN to use it. However, several critical gaps reduce the score: (1) Many parameters lack descriptions, e.g., 'computer' param is well-described, but nested properties in 'computer' tool (host, port, user, target, installAgent) have minimal or no guidance on format/constraints. (2) Output schemas are NOT documented, tools return results but the response structure is not specified, forcing LLMs to infer field names and types. (3) Error handling is absent, no guidance on retryability, user-fixable vs fatal errors, or recovery paths. (4) No tool annotations (readOnlyHint, destructiveHint, idempotentHint) despite clear risk levels (READ_ONLY, WRITE, DESTRUCTIVE). (5) Parameter relationships undocumented, e.g., 'computer' tool's action enum determines which other params apply, but this dependency is not stated in param descriptions.
The computer registry. action list | switch | register | spawn | remove. switch/register/spawn/remove take `id`; register also takes transport (local|ssh|hdc) plus host/port/user/target/installAgent; spawn takes transport (docker) plus optional image/label and creates a task-owned disposable desktop that remove or session end destroys. Prefer a spawned computer for work that does not need the user's own session. Every other tool also accepts `computer` to switch stickily on use.
List registered computers (local, ssh, docker, harmony/hdc) and which one is active. Every other tool acts on the active computer unless given `computer`.
Register or update a computer. transport=local (this machine), ssh (runs the bundled remote agent over ssh; agent is pushed automatically), hdc (HarmonyOS device via hdc).
Remove a registered computer. 'local' cannot be removed.
Spawn a task-owned disposable computer. transport=docker provisions an isolated Linux desktop container registered under `computer`; every other tool works on it unchanged. The spawned computer is destroyed by computer_remove or when the session ends. Prefer it over local when the task does not need the user's own session.
Output schemas not documented. Tools return results but response structure (fields, types, pagination) is not specified. LLMs cannot plan downstream calls or extract required data reliably.
Parameter descriptions incomplete. Nested properties (host, port, user, target, installAgent) lack format constraints, valid ranges, or usage guidance. E.g., 'port' has no default or range; 'image' has no format spec.
No error handling guidance. Tools do not document retryability, user-fixable errors, or recovery paths. E.g., computer_remove fails silently if 'local' is passed; no error message guides the LLM.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 58 | 2026-07-28+ | v2 |
Switch the active computer. Subsequent tools act on it by default.
Per-app consent on the local computer. Any call that targets an app — open_application, an app_ref, an element, or an action on the bound app — refuses consent_required until the user decides; record their answer here. action status | allow | deny | revoke. app is a name or bundle id (or pid:/number for a pid); scope 'foreground' is the separate darwin decision for foreground control (open_application activate:true). Decisions apply to this session; remember:true persists them.
Record an allow decision: app (name/bundle_id/pid/app string) or scope:'foreground'. remember:true persists it.
Record a deny decision: app (name/bundle_id/pid/app string) or scope:'foreground'. remember:true persists it.
Remove recorded decisions for an app or scope:'foreground' (session and persisted).
List recorded app-consent decisions for a computer (persisted and this session's) plus the foreground decision.
macOS: show or hide the nonactivating app preview with the drawn agent cursor. On by default while an app is bound — each action updates the captured window and cursor without moving the real pointer. Set enabled:false to mute it for the session.
No tool annotations. Risk levels are declared (READ_ONLY, WRITE, DESTRUCTIVE) but not exposed via readOnlyHint, destructiveHint, or idempotentHint. LLMs cannot infer safety constraints from schema alone.
Parameter dependencies undocumented. 'computer' tool's action enum determines which params apply (e.g., action=spawn requires transport=docker, image, label; action=register requires transport, host, port, user). No description states these constraints.