Loading ToolBench
MCP server for filesystem access with security controls
Solid foundation with all 10 tools having names, descriptions, and input schemas. Tool names follow verb_noun convention (read_file, write_file, etc.). Descriptions are present and contextual (avg ~120 chars), meeting the 10-1024 char baseline. However, parameter descriptions are minimal, most lack detail on constraints, formats, or valid ranges. Output schemas are not documented. Error handling is basic with no recovery guidance. Security validation is strong (path traversal checks, symlink resolution), but error messages could guide LLM recovery better. No tool annotations (readOnlyHint, destructiveHint) despite clear risk categories.
Create a new directory or ensure it exists. Creates parent directories as needed.
Get a recursive tree view of a directory's contents.
Edit a file by specifying a series of find-and-replace operations. Each operation finds exact text matches and replaces them. Supports a dry-run mode to preview changes.
Get detailed information about a file or directory.
List the contents of a directory, including file names, types, and sizes.
Move or rename a file or directory.
Read the complete contents of a file from the file system. Handles various text encodings and provides detailed error messages if the file cannot be read.
Output schemas not documented. Tools return FileInfo objects and search results, but LLMs cannot see the structure of returned fields (size, created, modified, permissions, etc.). This forces LLMs to guess what data is available and risks incorrect downstream tool chaining.
Parameter descriptions lack constraint details. 'path' parameters have no guidance on format, length limits, or allowed characters. 'pattern' in search_files lacks explanation of case-sensitivity or glob syntax. 'excludePatterns' mentions glob but does not explain minimatch behavior.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 57 | 2026-07-28+ | v2 |
Read the complete contents of multiple files from the file system.
Search for files and directories by name in a directory tree.
Create a new file or completely overwrite an existing file with new contents.
No tool annotations despite clear risk categories. write_file, edit_file, create_directory, and move_file are marked WRITE but lack destructiveHint annotations. read_* tools lack readOnlyHint. This prevents LLMs from reasoning about safety and retry logic.
Error messages lack recovery guidance. validatePath() throws generic 'Access denied' errors without suggesting valid directories or next steps. LLMs cannot self-correct from permission failures.
edit_file dryRun parameter lacks clear explanation of what 'git-style diff format' means and how the LLM should interpret the response. No guidance on when to use dryRun vs live execution.