Skip to main content
Glama

Sapper Bench

sapper_bench

Runs end-to-end TSecBench challenge workflows—list, start, solve, submit, and close each challenge—as the hosted-mode entrypoint; enable background mode for real runs.

Instructions

TSecBench end-to-end driver: list -> start -> solve -> submit -> close per challenge (like sapper bench). The hosted-mode entrypoint. Use background=True for real runs.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "cwd": "<cwd>"
    },
    "name": "sapper_bench"
  }
}

Input Schema

NameRequiredDescriptionDefault
cwdYes
rootNoruns
modelNo
verifyNo
minutesNo
deadlineNo
parallelNo
max_stepsNo
templatesNo
backgroundNo
exec_timeoutNo
poll_secondsNo
skip_permissionsNo
round_gap_secondsNo
minutes_per_challengeNo

Output Schema

NameRequiredDescriptionDefault
resultYes

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

B3.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are supplied, so the description carries the full burden. It does disclose meaningful behavior beyond the schema: the five-stage per-challenge lifecycle and the fact that real runs are long-lived and should be backgrounded. It says nothing about permissions requirements (despite a skip_permissions parameter), side effects on disk, failure handling, or what 'solve' entails, which matters for a 15-parameter orchestrator.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, front-loaded with the identity and pipeline, then the usage tip. Nothing is redundant. It is arguably under-specified rather than over-long, but on the conciseness axis it is efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, and that relieves part of the burden. However, for a complex orchestration tool with 15 undocumented parameters and zero annotations, the description leaves far too much unstated — no guidance on timeouts, parallelism, verification, or permission skipping.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across 15 parameters, so the description must compensate and it does not. Only background is explained; cwd, root, model, verify, minutes, deadline, parallel, max_steps, templates, exec_timeout, poll_seconds, skip_permissions, round_gap_seconds, and minutes_per_challenge are all left opaque. The distinction between minutes and minutes_per_challenge in particular goes unaddressed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names the specific driver (TSecBench end-to-end) and spells out the pipeline it runs: list -> start -> solve -> submit -> close per challenge. That verb sequence is far more informative than the bare name 'sapper_bench'. It only weakly differentiates from siblings like sapper_arena or sapper_auto, and only via the phrase 'The hosted-mode entrypoint'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is one concrete piece of usage guidance ('Use background=True for real runs'), which tells the agent something actionable about invocation mode. The 'hosted-mode entrypoint' clause implies a non-hosted alternative but never names it or states the condition for choosing one over the other. No prerequisites, no when-not-to-use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools