Loading ToolBench
MCP daemon that gives an agentic coding client a native offensive-security toolchain
The Box MCP has 15 tools with mixed quality. Naming is generally verb-forward (tool_describe, ask_operator, box_targets, cve_search, create_target, subagent_spawn). Descriptions are present for all tools and range from adequate to good (e.g., ask_operator at ~280 chars, cve_search at ~120 chars). However, schemas are inconsistently detailed: some tools like cve_search have proper typed parameters with descriptions; others like box_targets have empty objects with additionalProperties:false, offering no guidance. Parameter descriptions are sparse or missing in several tools (e.g., box_use_target's 'target' param lacks format/constraint details). Output schemas are not documented anywhere in the provided code. Error handling is minimal, no recovery guidance, no categorization of retryable vs fatal errors. Security concerns: ask_operator and subagent_spawn accept free-form strings without validation. No tool annotations (readOnlyHint/destructiveHint) despite clear risk levels declared in metadata. Composition is reasonable (each tool has one job), but chaining is unclear, e.g., box_targets returns active target, but box_use_target's resolution logic ('id, exact name, or substring') is underdocumented.
Emit an adversarial verdict from the adversarial review panel. Subagents can call this; parent agents cannot.
Halt the loop and surface a focused question to the operator. Use when blocked by auth walls, repeated scope violations on the same host, ambiguous next step, or budget running out. NOT for asking permission to run authorized work. The operator answers; the loop resumes with their answer as your tool_result. Call alone in a turn — do not batch with other tools.
List authorized targets (id, name, scope, status) and show which one is active for this MCP session. Call before offensive tools to pick a target.
Set the active target for subsequent tool calls. Resolves by target id, exact name, or substring of name/scope. Scope guard and per-target rate limit key off this.
Create a new target for offensive security testing. Sets initial status to draft.
Empty parameter schemas on discovery tools (box_targets, list_targets). Both declare properties:{} with additionalProperties:false, providing zero guidance to LLMs on what the tool returns or accepts.
No output schemas documented. Tools return structured data (CVE entries, target lists, findings) but LLMs have no schema to understand response structure, forcing them to infer field names and types.
Parameter constraints missing. box_use_target's 'target' param accepts 'id, exact name, or substring' but no regex, enum, or format constraint is declared. cve_search's 'limit' is untyped number with no min/max bounds.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | B | 70 | <=2025-11-25 | v2 |
Search CVE records by query, vendor, year, and limit. Returns matching CVE entries with severity, CVSS score, and CWE information.
Find similar HackerOne reports based on weakness type and program. Returns matching vulnerability reports with bounty information.
Simple greeting tool for testing. Returns a greeting message.
Spawn a JavaScript semantic fuzzing subagent. Blocked for recursive subagent spawning (depth cap = 1).
List all authorized targets with their status, scope, and metadata.
Spawn a mobile semantic fuzzing subagent. Blocked for recursive subagent spawning (depth cap = 1).
Match vulnerability patterns against endpoints. Returns matching patterns with CWE and severity information.
Emit a security finding from a subagent. Only callable by subagents, not parent agents.
Spawn a subagent with specific tools and instructions. Subagents operate with depth cap = 1 (no recursive spawning).
Get full input_schema for tool names. Call before invoking unfamiliar tools — manifest entries omit schema details for context budget.
No error handling guidance. Tools provide no recovery hints (e.g., 'target not found, call box_targets() to list available targets'). Agents cannot self-correct on failures.
No tool annotations despite clear risk levels. Metadata declares Risk:WRITE for box_use_target, create_target, subagent_spawn, but no destructiveHint or idempotentHint annotations in schema. LLMs cannot infer safety properties.