Loading ToolBench
MCP server for controlling QEMU virtual machines with GDB debugging, QMP monitoring, and screen capture capabilities
14 tools with complete schemas and descriptions, but quality is uneven. Naming is strong (verb_noun pattern, clear intent). Descriptions are adequate (100-200 chars typical) but lack dependency hints and recovery guidance. Parameters are well-typed with good constraints (enums for machine_type, numeric bounds for ports/memory). Critical gap: no output schemas documented, LLMs cannot predict response structure for chaining. Error handling is minimal; tools lack actionable recovery guidance. Security is reasonable (no secrets in params), but no permission gates or audit trail hints. Composition is good, each tool has one responsibility, but no batch variants for common loops.
Captures the current QEMU framebuffer as a PNG image, via QMP screendump. Requires a running instance from launch_qemu.
Resumes execution of the paused QEMU instance via the GDB stub. Blocks until the next breakpoint or exception.
Retrieves QMP events (machine state changes, device hotplug, etc.) from the background event listener.
Reads the current CPU general-purpose registers via the GDB stub (rax-r15, rip, eflags, segment registers). Requires a running instance.
Reads the serial console output log from the running QEMU instance.
Launches QEMU booting an ISO image with the GDB stub, QMP socket, serial logging, and a background QMP event listener all pre-wired. Fails if an instance is already running.
No output schemas documented. LLMs cannot predict response structure (fields, types, pagination) for downstream tool chaining. E.g., launch_qemu succeeds but what does it return? Instance ID? Port numbers? Required for agents to compose multi-step workflows.
Descriptions lack dependency hints and recovery guidance. E.g., 'Requires a running instance' is stated but no guidance on what to do if instance is not running. Missing: 'If no instance is running, call launch_qemu first.' This forces agents to discover error paths via trial-and-error.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 59 | 2026-07-28+ | v2 |
Health check - returns pong. Placeholder until QEMU tools are wired up.
Reads raw memory at a given address via the GDB stub. Returns hex-encoded bytes.
Removes a previously set software breakpoint at the given address.
Sends a raw QMP command to the running QEMU instance and returns the response.
Sets a software breakpoint at the given address via the GDB stub.
Steps a single CPU instruction via the GDB stub.
Terminates the running QEMU instance (SIGTERM, then SIGKILL if it doesn't exit) and releases the GDB/QMP connections. Safe to call even if nothing is running.
Writes raw hex-encoded bytes to memory at a given address via the GDB stub.
No error handling guidance. Tools lack actionable recovery messages. E.g., if launch_qemu fails because an instance is already running, the error should suggest 'Call terminate_qemu first.' Raw error codes or stack traces give agents nothing to act on.
No permission gates or audit trail hints. Destructive tools (terminate_qemu, write_memory, set_breakpoint) lack confirmation steps or permission checks. Agents can accidentally destroy state without safeguards.
Parameter descriptions lack format/constraint details. E.g., 'address' accepts 'hex (e.g. 0x1000) or decimal string' but no validation rules stated. 'data_hex' expects hex-encoded bytes but no length limits or validation guidance. LLMs may pass invalid formats.