Pushary

Propose Run Scope

propose_scope

Destructive

Propose what this run will touch and block until the user ratifies it. Call ONCE at the start of a multi-step run, before doing work. The user sees the paths you intend to change, the areas you promise to leave alone, and your definition of done, and approves the whole thing in one tap. After that, editing a file outside the agreed scope stops being auto-approvable: it becomes a separate "wants to widen scope" question instead of a silent approval, so you are asked once about the boundary rather than repeatedly about each file. Use glob syntax ("src/", "/*.test.ts"). Shell commands are NOT scoped here, they stay governed by the permission policy. Scope lives for this session only and is never inherited by another run. Returns { correlationId, ratified, answered, value }; only ratified:true means the contract is enforced. If the first wait times out, poll its correlationId once; a late phone yes ratifies the stored proposal. If that poll is also pending, cancel it before asking in the current chat whether to continue without an enforced scope. If cancellation loses a race, honor the phone answer instead. Never describe a client-only agreement as ratification. SIDE EFFECT: sends a real push notification.

Input Schema

TableJSON Schema

Name	Required	Description
`doneWhen`	Yes	What "finished" means for this run, one or two lines. Carried for the human to judge against; never enforced automatically.
`agentName`	No	Name of the agent asking, format "{Agent} - {project}".
`machineId`	No	Stable machine id, so two machines never collapse into one session.
`sessionId`	Yes	Your per-session id. Required: a scope with no session cannot be enforced, and must never leak into another run.
`timeoutMs`	No	How long this call blocks, in milliseconds (max 55000).
`allowedPaths`	No	Globs you intend to change, e.g. ["src/*", "docs/.md"]. Omit or leave empty to propose no path restriction, which the user is told plainly.
`offLimitsPaths`	No	Globs you promise not to touch, e.g. ["*/.env", "infra/**"]. These win wherever they overlap allowedPaths.

Output Schema

TableJSON Schema

Name	Required	Description
`note`	No	Present only when the scope is not in force, saying what to do instead of proceeding.
`value`	No	The raw answer behind ratified, "yes" or "no".
`status`	No	The underlying scope-question state.
`answered`	Yes	True when the user responded at all. Answered but not ratified means they declined, so ask what scope they want rather than proceeding.
`contract`	Yes	The scope exactly as it was put to the user, echoed back so the agent and the human are holding the same contract.
`ratified`	Yes	True only on an explicit yes. The contract is in force for this session only when this is true; anything else means proceed as if no scope was agreed.
`nextAction`	No	Poll one live question once; otherwise ask in the current chat whether to continue without an enforced scope.
`correlationId`	Yes	Id of the scope question. Pass it to wait_for_answer once when the first wait times out.
`handoffAction`	No	Race-safe directive for updated clients. Takes precedence over nextAction.

TDQS

A4.4/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes well beyond what the annotations already declare by disclosing the blocking behavior, the timeout/poll/retry flow, late ratification, cancellation race handling, and the exact retry semantics. It also surfaces a real side effect: "SIDE EFFECT: sends a real push notification." The caveat "Never describe a client-only agreement as ratification" and the session-only contract both add a strong trust boundary. No contradiction with annotations; in fact, the detail explains why destructiveHint=true.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the purpose and then each subsequent sentence carries nonzero behavioral content, covering call timing, scope contract, enforcement, exclusions, session lifetime, return semantics, and runtime edge cases. Sentences are not redundant with the parameters. It is a long single paragraph and the race-condition logic could be tightened into structured subpoints, but no sentence is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex tool with 7 parameters, an output schema, 4 annotations, and 4 siblings, this description covers the full agent lifecycle: call site, the blocking wait behavior, what the return object means, how to recover on timeout, when to cancel, how to handle a racing late answer, and what is explicitly out of scope (shell commands). An agent given this description would be able to use the tool correctly without accessing any other documentation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3 per the rubric. The description adds a glob syntax hint ("src/**", "**/*.test.ts") that the schema doesn't spell out, and it maps the narrative terms (paths you intend to change, areas you promise to leave alone, definition of done) to allowedPaths, offLimitsPaths, and doneWhen. However, the schema already carries the full per-parameter meaning, so the description only marginally adds semantic value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening line states a specific verb-resource behavior: "Propose what this run will touch and block until the user ratifies it." This identifies the tool as a human-ratification contract for work boundaries, clearly distinct from sibling tools like ask_user, send_notification, or wait_for_answer. The first sentence and the "Call ONCE at the start of a multi-step run" instruction make the purpose impossible to miss.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

When to use is explicit: "Call ONCE at the start of a multi-step run, before doing work." When-not logic is also specified: "Shell commands are NOT scoped here, they stay governed by the permission policy" and "Scope lives for this session only and is never inherited by another run." It never names an alternative sibling tool (e.g., ask_user or wait_for_answer) as the substitute to use instead, so it stops just short of full alternative routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Pushary tools Inspect

Try in Browser

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4.7/5.0

Disambiguation5/5

Each tool has a clearly distinct role: ask_user blocks for a decision, send_notification is one-way, wait_for_answer polls an existing question, cancel_question retracts a pending one, and propose_scope is a specialized ratification flow. The only potential overlap is ask_user versus propose_scope, but the scope-specific contract and 'call ONCE at the start' guidance make the boundary clear.

Naming Consistency5/5

All five tools follow the same imperative verb_noun snake_case pattern: ask_user, cancel_question, propose_scope, send_notification, wait_for_answer. Even though the verbs differ, the structure is uniform and predictable.

Tool Count5/5

Five tools is well-scoped for a push-notification and human-in-the-loop interaction server. There is no redundancy or padding; every tool maps to a distinct stage in the question/notification lifecycle.

Completeness5/5

The server covers the full interaction lifecycle: create a question (ask_user), wait for its answer (wait_for_answer), cancel it if obsolete (cancel_question), send one-way alerts (send_notification), and ratify scope before multi-step work (propose_scope). No obvious dead ends or missing critical operations exist for the stated purpose.

Resources

Need Help?