Loading ToolBench
File reader server with MCP integration
Single tool 'read_file' has a basic description but critical security and schema gaps. Description is present (95 chars) but focuses on vulnerability rather than usage guidance. Input schema exists but lacks proper type constraints and validation guidance. No output schema documented. Tool is intentionally vulnerable to command injection, making it unsuitable for production. Parameter 'file_name' has minimal description (22 chars) and no format constraints despite accepting arbitrary paths.
Read the file from the operating system This implementation is vulnerable to command injection as it doesn't properly sanitize the file_name parameter before using it in a shell command.
Critical command injection vulnerability: subprocess.check_output(f'cat {file_name}', shell=True) executes unsanitized user input. Superficial path check ('SAFE_DIRECTORY in file_name') is bypassable via '/tmp/safe/test.txt; whoami'. This violates pattern:tool-gateway (treat agent input as untrusted).
No output schema documented. Tool returns unstructured string ('Error: ...' or raw file content). LLMs cannot parse or chain results reliably. Violates pattern:response-shaper.
Parameter 'file_name' description is 22 characters ('The name/path of the file to read'), below 20-char threshold. No format constraints, length limits, or allowed-path guidance. Violates pattern:constrained-input.
Tool description (95 chars) emphasizes the vulnerability rather than usage intent. Does not answer WHEN to use it, WHAT it returns, or HOW to call it safely. Violates pattern:tool-description guidance.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 41 | 2026-07-28+ | v2 |
No error handling guidance. Exceptions return raw error strings ('Error: ...') without actionable recovery steps. LLM cannot determine if error is retryable or user-fixable. Violates pattern:recovery-guide.