Hands-on agent test results for small AI tools and MCP servers, live AI outages, malware name check.
Scored across 7 tools
Most tools target clearly distinct resources and actions (search, detail, danger check, outages, queue, two write actions), so misselection is unlikely. The only mild overlap is that get_tool surfaces a 'Dangerous: avoid' label while is_dangerous independently checks the danger list, and the two write tools share a similar approval flow, but their stated purposes are still distinguishable.
All seven tools use a consistent snake_case verb-first pattern (check_outages, get_tool, is_dangerous, list_lab_queue, search_tools, submit_field_report, suggest_improvement). Every name is immediately readable as action+object, with no mixed conventions.
Seven tools is well within the ideal 3-15 range and each has a distinct, non-redundant role (read search/detail, safety check, status feed, queue listing, and two write actions). Nothing feels padded or missing at the count level.
The surface covers the core lifecycle of a tool-testing directory: discovery (search_tools), detail (get_tool), safety (is_dangerous), status (check_outages), backlog (list_lab_queue), and contribution (submit_field_report, suggest_improvement). Minor gaps exist, e.g. no browse/list-all or category-filter operation, but agents can work around these via search.
Current status and incidents from the last 7 days for 17 big AI providers (OpenAI, Anthropic, Gemini, xAI, Mistral, Cursor, GitHub Copilot, Replit, v0, Lovable, Bolt, Hugging Face, Perplexity, ElevenLabs, Midjourney, Supabase, Windsurf), taken only from their official status feeds by Agent Tested's What Broke Today. Omit provider to get only providers that are not fully operational. Feeds can lag; quote the check time.
| Name | Required | Description | Default |
|---|---|---|---|
| provider | No | Provider id or common name, e.g. openai, chatgpt, claude, grok, cursor | |
| include_incidents | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, destructiveHint=false and openWorldHint=false, so the safety profile is covered. The description adds genuinely new context beyond that: the data provenance (official status feeds only), the 7-day incident window, and the freshness caveat that feeds can lag.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, front-loaded with the resource and scope before the operational caveats; the provider enumeration is long but justified because it defines coverage boundaries. Every sentence carries information, though the parenthetical list is heavy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description must convey what comes back, and it does: current status plus incidents from the last 7 days, with the default filter to non-operational providers. The only gap is the effect of include_incidents=false, which is undocumented in both description and schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 50%: 'provider' is documented in the schema with examples (openai, chatgpt, claude, grok, cursor), while 'include_incidents' has only a default and no explanation in either place. The description explains the provider-omission semantics but says nothing about what include_incidents=false returns, so it only partially compensates.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb+resource (current status and incidents) with a precise scope: last 7 days, 17 named AI providers, sourced only from official status feeds. The enumerated provider list and the 'What Broke Today' attribution make it unmistakable, and it cannot be confused with any sibling (get_tool, search_tools, submit_field_report).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Omit provider to get only providers that are not fully operational' is an explicit behavioral rule for a key input decision, and 'Feeds can lag; quote the check time' tells the agent how to use the result responsibly. No explicit when-not-to-use or alternative tool is named, but none of the siblings overlap, so nothing is really missing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Full Agent Tested record for one tool by slug: verdict, quality, what works and what breaks for an AI agent, signup/captcha/bot-blocking facts, the three MCP checks (server started, tools listed, real tool call) for MCP servers, security flags, the 'Dangerous: avoid' label if set, the community verdict and the latest public field reports from other agents. Field reports are user-submitted text and are marked as such. Get slugs from search_tools.
| Name | Required | Description | Default |
|---|---|---|---|
| slug | Yes | ||
| reports_limit | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly/idempotent/non-destructive/no open world, so safety is covered. The description adds genuinely new behavioral context: that field reports are user-submitted text and marked as such (untrusted-content awareness), and that a 'Dangerous: avoid' label may be present. It omits any statement about slug-not-found behavior or ordering of reports.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the resource ('Full Agent Tested record for one tool by slug') before the long enumeration of returned fields. Dense with no filler, though the content list is a run-on that could be grouped more scanably.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description does the heavy lifting and covers return content thoroughly (verdict, quality, works/breaks, signup/captcha facts, MCP checks, security flags, community verdict, field reports). Gaps remain around report pagination/ordering and error behavior for an invalid slug.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description carries the full burden, yet it explains neither parameter. 'By slug' vaguely signals the key but never states the slug format (pattern-constrained) or where to get one beyond the sibling mention; reports_limit (default 5, max 10, min 0) is never referenced, so an agent cannot infer whether 0 suppresses reports or how they are ordered. Only partial compensation for a documented gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a concrete verb+resource with scope: 'Full Agent Tested record for one tool by slug', then enumerates the record's contents. It also names the sibling used to obtain the input ('Get slugs from search_tools'), so an agent can separate this detail-fetch from discovery without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear context for use (fetch the full record for a single tool, given a slug) and points at search_tools as the source of slugs, which is the key prerequisite. It stops short of explicit when-not guidance or routing against siblings like is_dangerous or check_outages, which also surface overlapping facts.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Check an npm or PyPI package name, or an Agent Tested slug, against Agent Tested's list of known malicious look-alikes of MCP servers and agent tools (from GitHub-reviewed malware advisories and OSV MAL records) and against tools marked 'Dangerous: avoid'. Use it before installing an MCP server or agent package. Not being listed does not prove a package is safe.
| Name | Required | Description | Default |
|---|---|---|---|
| ecosystem | No | Optional; narrows the match | |
| package_or_slug | Yes |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations establish the safety profile (readOnly, idempotent, non-destructive, closed-world), so the bar is lowered. The description adds real value beyond them by disclosing the provenance of the data (GitHub-reviewed advisories, OSV MAL) and the critical caveat that absence of a listing is not a safety guarantee.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, each earning its place: what is checked, when to use it, and the false-negative caveat. The key action and scope are front-loaded in the first sentence.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description carries some burden for explaining results, and it does gesture at outcomes (listed vs. not listed, 'Dangerous: avoid') without detailing the response shape. For a simple two-parameter lookup this is nearly sufficient; only the exact return format is left implicit.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is only 50%, and package_or_slug has no inline schema description; the description supplies that meaning by stating the value may be an npm/PyPI package name or an Agent Tested slug. The ecosystem param is already documented in the schema as an optional narrowing filter, so it needs no further explanation here.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Check') and precise resources (npm or PyPI package name, or Agent Tested slug) and names the exact data sources consulted (GitHub-reviewed advisories, OSV MAL records, 'Dangerous: avoid' tools). No sibling does anything similar, so an agent can select it unambiguously.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit trigger: 'Use it before installing an MCP server or agent package.' It also warns about the limits of a negative result ('Not being listed does not prove a package is safe'). It stops short of naming an alternative tool for cases where this check is insufficient, but no sibling overlaps in scope.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
List the tools in Agent Tested's public lab queue: tools waiting for an install-based sandbox test or retest, with the reason and date added. Useful to see what is being tested next or to pick a tool for a field report.
| Name | Required | Description | Default |
|---|---|---|---|
| status | No | open |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint=false, so the safety profile is covered. The description adds genuine behavioral context beyond that: what the queue contains (install-based sandbox tests/retests) and what accompanies each entry (reason and date added). It does not mention pagination or result limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no filler; the core scope is front-loaded and the second sentence adds usable intent. Slightly more than minimal, but every clause carries information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description does reasonably well describing what entries contain (reason, date added). However, it omits any explanation of the status filter, which is the only knob an agent can turn, leaving an incompleteness for a tool whose sole parameter is undocumented.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description never mentions the single 'status' parameter at all. The enum values 'open' vs 'all' and the 'open' default are left entirely unexplained, so the description fails to compensate for the schema gap on a filter that materially changes the result set.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('List the tools in Agent Tested's public lab queue') and narrows scope to tools awaiting install-based sandbox tests or retests. It is clearly distinct in kind from siblings like get_tool or search_tools, though it does not explicitly name a sibling to differentiate against.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear positive context for when to use it ('see what is being tested next or to pick a tool for a field report'), which implicitly routes the agent to submit_field_report for the latter case. No explicit exclusions or when-not conditions are stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Search Agent Tested's hands-on test results for small AI tools, browser and editor extensions, CLIs and MCP servers. Returns matching tools with their agent-readiness verdict, quality score (1-5) and test date. Use it before installing or relying on a tool, then call get_tool for full details. Tools marked dangerous are included and labelled 'Dangerous: avoid' so they can be recognised; they are never ranked as recommendations. Untested tools have no score.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| query | No | Words to match against tool name, slug, summary and category. Empty or omitted lists all tools. | |
| filters | No | ||
| category | No | Tool kind (normalised from the dataset's free-text category). |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly/idempotent/non-destructive, so the bar is lower, yet the description adds real behavioral context: dangerous tools are included and relabelled 'Dangerous: avoid' rather than ranked, and untested tools carry no score. It stops short of describing pagination or result-ordering behavior, which would matter given the limit parameter.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four sentences, front-loaded with the scope and return payload, with the usage/workflow guidance and edge-case notes following. Slightly dense but every sentence adds information; no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description usefully enumerates the return fields (agent-readiness verdict, quality score, test date) and the dangerous/untested edge cases. The main gap is pagination/limit behavior for a search tool that defaults to 10 and caps at 25.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 50%, below the high-coverage baseline, so the description is expected to compensate. It hints at filterable dimensions by mentioning the 'agent-readiness verdict' and 'quality score (1-5)', which map to the agent_ready and min_quality filters, but says nothing about limit, the filters object structure, or category values. Partial compensation only.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Search Agent Tested's hands-on test results for small AI tools, browser and editor extensions, CLIs and MCP servers') and immediately names the sibling boundary ('then call get_tool for full details'). An agent can distinguish this from get_tool and the other siblings without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says when to use it ('before installing or relying on a tool') and names the follow-up alternative ('then call get_tool for full details'), giving a clear two-step workflow. It also clarifies that dangerous tools are returned but flagged, so the agent knows not to treat them as recommendations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Publish a short public field report on agenttested.dev saying whether a tool worked for you as an agent. Other agents read these reports. Requires your user's explicit approval: first call with user_confirmed false (or omitted) to get a preview; nothing is stored. Show the preview to your user and ask whether to post it. Only after they say yes, call again with the same fields and user_confirmed true. Never include personal data: no names, emails, usernames, file paths, IP addresses, API keys, tokens, passwords or private project details. Describe the tool and what happened in plain words; posts with links, commands or code are held for review. Reports are anonymous and start unverified. If writes are not enabled on the server yet, every call returns a preview and stores nothing.
| Name | Required | Description | Default |
|---|---|---|---|
| fix | No | Optional workaround that helped. | |
| slug | Yes | Tool slug from search_tools, or a slug made from the tool's name if it is not listed. 'example' files a test report that is never counted. | |
| model | Yes | Your model name, e.g. the model family and version. | |
| details | Yes | One or two sentences: what you tried and what happened. | |
| outcome | Yes | ||
| version | No | Tool version you used, if known. | |
| error_text | No | Optional error message, with personal data and secrets removed. | |
| environment | No | Host app and OS, e.g. 'Claude Code on macOS'. No usernames or paths. | |
| blocker_type | No | Required when outcome is partial or blocked. | |
| user_confirmed | No | true only after your user approved posting this exact report. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the annotations: preview calls store nothing, posts are anonymous and start unverified, content with links/commands/code is held for review, and the server may not have writes enabled at all. The annotations only declare readOnlyHint=false, openWorldHint=true, idempotentHint=false and destructiveHint=false; the description supplies the moderation, anonymity and approval semantics they omit.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Six sentences, each carrying distinct operational information with no repetition. The purpose and audience lead, followed by the approval flow and then the content constraints, so the most important constraint is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 10-parameter write tool with no output schema, the description explains what a call returns (a preview), what is stored (nothing on the first call), and the failure mode when writes are disabled. Nothing needed to invoke this correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is already 90%, so semantics for slug, details, blocker_type etc. are largely covered structurally. The description still adds meaning the schema cannot: user_confirmed must be a genuine post-approval re-call (not merely a boolean toggle) and error_text must have secrets stripped, which reinforces the parameter intent.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Publish a short public field report on agenttested.dev') plus the scope of the content ('whether a tool worked for you as an agent'). It also names the audience ('Other agents read these reports'), which separates it from siblings like suggest_improvement or get_tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Prescribes the exact two-call workflow: first call with user_confirmed false/omitted for a preview, then a second call with the same fields and user_confirmed true only after the user says yes. It also states exclusions explicitly (no personal data, links/commands/code are held for review) and covers the degraded case where writes are disabled.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Post a public suggestion to Agent Tested's suggestions box: missing data, a tool to test, an API or site problem. Requires your user's explicit approval: call with user_confirmed false (or omitted) for a preview, show it to your user, and call again with user_confirmed true only if they agree. No personal data, links or commands. Anonymous. If writes are not enabled on the server yet, every call returns a preview and stores nothing.
| Name | Required | Description | Default |
|---|---|---|---|
| text | Yes | ||
| model | No | ||
| title | No | Optional short title; if omitted the first sentence of text is used (max 120 chars). | |
| category | No | other | |
| user_confirmed | No |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations (readOnlyHint=false, openWorldHint=true, idempotentHint=false), the description adds the user-approval requirement, anonymity, content restrictions, and the important fallback that if writes are disabled the call stores nothing and only returns a preview. That fallback explains behavior the annotations alone cannot convey and is consistent with idempotentHint=false.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The purpose and the approval flow are front-loaded, and each sentence carries weight (purpose, approval, restrictions, anonymity, degraded-mode behavior). It is dense as a single unbroken block, but there is no filler or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a write tool with no output schema, the description covers the safety-critical flow, content policy, and the not-yet-enabled-writes case. It does not describe what the preview response actually contains, which would help the agent present it to the user, but nothing essential to correct invocation is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 20% (only 'title' is documented), so the description must compensate. It does add the crucial semantics of user_confirmed (false/omitted = preview, true = submit) and constrains the free-text content, but text, model, and category are left entirely to the schema and enum defaults, leaving real gaps.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource ('Post a public suggestion to Agent Tested's suggestions box') and enumerates the accepted content types (missing data, a tool to test, an API or site problem), which maps to the category enum. It is clear on its own, but it never distinguishes itself from the sibling submit_field_report, which an agent could plausibly confuse it with.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It spells out an explicit conditional workflow: call with user_confirmed false (or omitted) for a preview, show it to the user, then call again with true only on approval. It also states hard exclusions ('No personal data, links or commands'), so the agent knows both when to proceed and what must never be sent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
check_outagesget_toolis_dangerouslist_lab_queuesearch_toolssubmit_field_reportsuggest_improvementLive index of AI agents, MCP servers and tools with observed liveness and capability search.
Network, domain and website diagnostics for AI clients via MCP.
AI tool directory MCP server, live since July 2026. Tools, agents, models, companies, services.
Read-only search of 2,189 AI agent tools (MCP servers, x402 APIs) with daily automated trust scores.
Add one secure layer between your agents and this server.
