Loading ToolBench
A security-first MCP server for operating a Whatbox slot.
Strong foundation with 37 well-named tools following verb_noun convention (upload_path, download_path, move_path, etc.). All tools have descriptions (avg ~120 chars, within 10-1024 baseline). Input schemas present and properly typed with Zod validation. Tool annotations (destructiveHint, readOnlyHint) correctly applied. Key gaps: output schemas not documented in source; some parameter descriptions lack format/constraint details; error handling guidance minimal in descriptions; no pagination documented for list tools despite bounded outputs.
The account's own disk quota and usage, not the shared filesystem.
Curated SHA-256-pinned app templates: installed/running/responding, installed vs pinned version, upgrade availability.
Download a pinned artifact, verify its SHA-256 checksum, and install it. Never overwrites an existing install. Requires explicit human approval.
Kill and relaunch a template-installed service app. Requires explicit human approval.
Stop, de-cron, and quarantine a template-installed app. Reversible via restore from quarantine. Requires explicit human approval.
Verify and re-extract the manifest's pinned version, preserving config and data. Requires explicit human approval.
Output schemas not documented in source code. While tools return structured JSON via textResult(), the response field structure and types are not formally declared. LLMs cannot plan downstream calls without knowing what fields to expect.
Pagination not explicitly documented for list tools (whatbox_list_directory, whatbox_list_quarantine, whatbox_torrents_status). While limit parameters exist, no mention of total count, next_cursor, or pagination strategy in descriptions. Agents cannot reliably iterate large result sets.
Error handling guidance minimal. Tool descriptions state what they do but rarely explain what to do if they fail. E.g., whatbox_upload_path checks free space but description doesn't say 'if insufficient space, try deleting old files' or similar recovery hints.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 61 | 2026-07-28+ | v2 |
Back up Whatbox configuration files to a local directory. Reversible; skips sensitive files and symlinks.
Conservative advisory findings.
Local configuration completeness without values.
Pinned SSH connectivity check.
Per-subdirectory disk usage (largest first) — what is using the quota.
Download a remote file or directory into the configured local download directory. Skips symlinks; checks local free space first.
Bounded entries below an allowed root.
List items currently in the quarantine directory, so a human can choose what to restore (move) or purge.
List all available tools with their categories, risk levels, and mutation state.
Create a directory (and missing parents) below an allowed root. Reversible.
Move or rename a path between allowed roots without overwriting an existing destination. Reversible.
Consolidated storage, services, website, and safety state.
Top-level data no loaded torrent references (rTorrent). Wasted quota.
Permanently delete a quarantined path. Requires a second explicit human approval after quarantine. Irreversible.
Move a path into a dated quarantine directory instead of deleting it. Requires explicit human approval. Reversible; reports storage headroom (quarantine does not free space).
Run an approved shell command on Whatbox. Off by default; requires exact-text human approval per command. Enforces a destructive-shape denylist, bounded output, and timeout.
Start, stop, or restart an allowlisted Whatbox service. Requires explicit human approval.
Configured/running state of allowlisted services.
Filesystem capacity by allowed root.
Directory-only map and Mermaid diagram.
Add a torrent to the configured torrent client. Accepts magnet links or .torrent files. Requires explicit human approval.
Running state of supported torrent clients.
Start, stop, or remove a torrent. Requires explicit human approval.
Remove a torrent and optionally delete its data. Requires explicit human approval.
List torrents from the configured torrent client via loopback RPC. Bounded output; no raw metadata.
Upload an allowlisted local file or directory into an allowed remote root without overwriting. Reversible; checks remote free space first.
Execute a signed website deployment plan. Requires prior plan creation and explicit human approval.
Validate a local site and sign a plan; no execution.
nginx syntax test, loopback probe, redacted error counts.
Fixed nginx/website hosting readiness facts.
Rollback a website deployment to a previous release. Requires explicit human approval.
Parameter format constraints not always explicit in descriptions. E.g., 'remoteRelativePath' accepts strings up to 1024 chars but no guidance on path separators, forbidden characters, or symlink handling (mentioned in code but not in param description).
Status/diagnostic tools (whatbox_configuration_status, whatbox_connection_status, whatbox_configuration_review) have generic descriptions under 70 chars. 'Local configuration completeness without values' and 'Pinned SSH connectivity check' lack context on when to call them or what they reveal.