Loading ToolBench
MCP server that drives a Windows PowerShell session inside a Citrix/RDP window over the synced clipboard — run commands, control the desktop, transfer files, no SSH/WinRM needed.
Strong tool definitions with clear naming (verb_noun pattern), comprehensive descriptions (avg 180 chars), and well-structured Zod schemas. All 11 tools have explicit registrations with inputSchema, descriptions, and titles. Parameters are typed and described. However, output schemas are not formally documented, responses are inferred from code (text/image content types visible but not declared in schema). Error handling is present but generic. No tool annotations (readOnlyHint/destructiveHint) despite clear risk levels. Missing pagination for list tools. Descriptions are good but could be more prescriptive about when to use each tool vs. alternatives.
Read a file out of the Windows session and save it to a local Mac path. Binary-safe, streamed straight to disk (safe for multi-GB files), gzip-compressed in transit by default.
Bring a window to the foreground by PID (preferred) or title substring. Useful before sending keystrokes.
Start a program in the Windows session (e.g. 'powershell.exe', 'notepad.exe', 'explorer.exe', a full path, or a document). Returns the launched process name and PID.
List visible top-level windows on the Windows desktop as a JSON array of {pid, process, title}. Useful for finding a window to focus or send keys to.
Move the cursor and optionally click. Supports left/right/middle buttons and single/double clicks. Uses P/Invoke to the Windows API.
Check that the Windows helper is running and the clipboard link is alive. Returns server/helper versions, host, user, PowerShell version, and gzip support. Run this first.
Output schemas not formally documented. Responses are inferred from code (TextResult type visible in tools.ts) but not declared in tool registration. LLMs cannot plan downstream operations without knowing return structure.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint) despite clear risk levels. rdt_run, rdt_launch, rdt_send_keys, rdt_upload, rdt_focus, rdt_mouse are WRITE operations; rdt_ping, rdt_screenshot, rdt_download, rdt_list_windows, rdt_processes are READ_ONLY. Annotations enable safer agent planning.
Inferred effective spec: <=2025-11-25.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | C | 64 | <=2025-11-25 | v2 |
List the top N processes by working set memory, as a JSON array of {pid, name, ws_mb, cpu}. Useful for monitoring or finding a process to kill.
Run a PowerShell command or script in the persistent remote session and return its merged output (stdout + errors). Session state (current directory, variables, imported modules) persists between calls. This is the universal control tool — anything PowerShell can do on the box, you can do here.
Capture the Windows session desktop as a PNG and return it as an image so you can see the current state of the remote instance. Optionally also saves the PNG to a local file on the Mac.
Send keystrokes to the Windows session using .NET SendKeys syntax (e.g. 'hello{ENTER}', '^c' for Ctrl+C, '%{F4}' for Alt+F4). Optionally activate a window by title first. Use this to drive GUI apps or a foreground console.
Send data from the Mac into a file in the Windows session. Provide either a local Mac file path (binary-safe, streamed from disk, gzip-compressed by default) or inline text content. For large files prefer localPath.
rdt_list_windows and rdt_processes return unbounded lists. No pagination (limit/offset/cursor), no documented max result count. Large result sets waste tokens and degrade LLM reasoning. Should cap at 20-50 items and document the limit.
Error handling is generic (guarded() wrapper returns text with isError flag). No recovery guidance. When rdt_run fails, LLM gets 'Error: <message>' but no hint about retryability, prerequisites, or next steps. Should categorize errors and suggest recovery actions.
Parameter descriptions lack format/constraint details. E.g., rdt_send_keys 'keys' param says 'Keys in SendKeys syntax' but does not explain valid syntax (e.g., {ENTER}, ^c, %{F4}). rdt_mouse 'button' and 'action' are enums but not declared as such in Zod schema, only documented in description text.