Loading ToolBench
An MCP server that provides SSH connection management and remote command execution capabilities. Allows clients to discover available SSH machines, create persistent SSH sessions, execute commands, and manage connections.
SSH MCP Server has well-structured tool definitions with clear names and complete input schemas. All 6 tools follow verb_noun naming (get_*, create_*, execute_*, close_*). Descriptions are present and actionable (avg ~100 chars). However, critical gaps exist: (1) NO output schemas documented for any tool, LLMs cannot plan downstream calls or extract structured data; (2) parameter descriptions are minimal or missing (e.g., connection_id lacks any guidance on format or origin); (3) no error handling guidance, tools fail silently without recovery hints; (4) dangerous command execution (execute_command) lacks validation or confirmation patterns despite DESTRUCTIVE risk classification; (5) secure_execute_command's 'read-only' enforcement relies on regex patterns not visible in schema, creating false security assumptions. The server is functional but falls short of production-grade tool design.
Terminate an SSH session and remove it from global state.
Open an SSH session to the given machine and track it in global state so subsequent tool calls can reuse it.
Run a shell command in an existing SSH session and return stdout/stderr/exitCode.
List every SSH-capable machine this server knows about (but is NOT yet connected).
Return every STILL-OPEN SSH session in global state.
Run a **read‑only** shell command (i.e., one that does not mutate state) in an existing SSH session and return stdout/stderr/exitCode.
No output schemas documented. LLMs cannot infer what fields are returned (e.g., does get_available_connections return machine_id, label, ssh config?). This breaks tool chaining and forces agents to guess at response structure.
Parameter descriptions are missing or trivial. 'connection_id' appears in 4 tools with no description of format, origin, or how to obtain it. LLMs cannot reason about valid values.
execute_command (DESTRUCTIVE risk) lacks confirmation or dry-run pattern. Agents can invoke destructive commands (rm -rf /, kill -9) without safeguards. No error recovery guidance provided.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | F | 49 | 2026-07-28+ | v2 |
secure_execute_command's read-only enforcement relies on runtime regex validation (isCommandDangerous) not visible in the schema. LLMs cannot verify which commands are safe before calling. False sense of security.
No error handling guidance. Tools fail with raw errors (e.g., SSH connection timeout, command exit code 127) without recovery hints. LLMs cannot determine if errors are retryable or user-fixable.