tfbash-mcp
tfbash-mcp
Eine grundlegende MCP-Toolsammlung für Agent-Systeme. Das Projekt möchte verschiedenen Agents eine Reihe stabiler, komponierbarer und kognitiv leichter allgemeiner Fähigkeiten bieten, z. B. Befehlsausführung, Datei-Lesen/-Schreiben und Suche; für konkrete Fähigkeiten werden bevorzugt ausgereifte Implementierungen wiederverwendet, und nur wenn bestehende Lösungen die Kernanforderungen nicht erfüllen, werden Anpassung oder Eigenentwicklung in Betracht gezogen.
Aktueller Status: Python-Projektskelett und Anforderungs-/Architektur-RFC. Das Repository kann einen leeren stdio-MCP-Server starten, bietet aber noch keine der im RFC definierten Shell-Tools.
Warum dieses Projekt?
Agents müssen häufig über reine Textlogik hinausgehen, echte Arbeitsbereiche manipulieren oder lokale Programme aufrufen. Programmierer nutzen die Shell als primäre Arbeitsoberfläche; auch allgemeine Rollen wie Produkt, Betrieb und Forschung rufen über die Shell Skripte auf, konvertieren Dateien, verarbeiten Daten in Stapeln oder diagnostizieren Umgebungen.
Bestehende MCP-Tools unterscheiden sich stark in Fähigkeitsumfang und Ausführungsmodell: Manche unterstützen nur Einmal-Befehle, manche hängen von PTY oder residenten Daemons ab, manche haben integrierte Genehmigungen und Sandboxen, manchen fehlen zuverlässige lange Befehle, inkrementelle Ausgaben und verwaltete Prozessbereinigung. tfbash-mcp definiert zuerst reale Szenarien und überprüfbare Fähigkeitsverträge und entscheidet dann, ob direkt übernommen, angepasst oder selbst entwickelt wird.
Related MCP server: MCP Terminal Tool Server
Designprinzipien
Erst Szenario, dann Auswahl: Anforderungen werden nicht rückwärts aus der Vertrautheit mit einer Sprache, einem Framework oder einem bestehenden Projekt abgeleitet.
Wiederverwendung bevorzugen: Die Auswahlreihenfolge ist Adopt → Wrap → Build; Wiederverwendung setzt voraus, dass das Kernverhalten erfüllt wird.
Klein und orthogonal: Basistools behalten klare Grenzen; Agent-Orchestrierung, Geschäftsworkflows oder UI werden nicht in die Tool-Schicht gepackt.
Expliziter Zustand: Lange Aufgaben, persistente Shells, Ausgabecursor, Exit-Status und Ressourcenlebenszyklen müssen beobachtbar sein; Shells, die cwd/env beibehalten müssen, werden explizit erstellt und adressiert.
Protokoll und Implementierungssprache unabhängig: Der Tool-Vertrag legt keine internen Konzepte von Python, pexpect, Computer oder Client offen; V1 verwendet Python + pexpect und stdio-Transport.
Vertrauen in die Bereitstellungsumgebung: In der ersten Phase gibt es keine integrierte Genehmigung, Sandbox, Befehlsrichtlinie oder Verzeichnisgrenzen.
Kontrollierbare Ressourcen: Speicher, Festplatte, Sitzungen, Prozesse und temporäre Dateien müssen klare Obergrenzen, Eigentümerschaft und Bereinigungsregeln haben.
Erste Phase: Bash-Tools
Die erste Phase konzentriert sich auf einen eigenständigen, allgemeinen Bash-MCP-Server in Unix-Umgebungen (Linux, macOS). Die Ziele umfassen gleichzeitig:
Build, Tests, Codesuche, Dienststart und Logbeobachtung für Programmierer;
Dateiverarbeitung, Datenkonvertierung und Umgebungsdiagnose für allgemeine Rollen über installierte CLIs oder Skripte;
Mehrere adressierbare persistente Command Shells, die jeweils cwd, Umgebung und Aktivierungsstatus beibehalten und für jeden Befehl einen genauen Exit-Status zurückgeben;
stdout/stderr des pexpect-PTY wird als kombinierte Ausgabe zurückgegeben, und für jede Ausführung wird eine begrenzte inkrementelle Ausgabe gepflegt;
Kurze Befehle werden von
shell_execin einem Schritt zurückgegeben; lange Befehle geben nach Überschreiten vonyield_msrunningzurück und werden in derselben Shell weiter ausgeführt;Lange Befehle lesen Ausgaben inkrementell über
shell_read, schreiben übershell_writein stdin und werden übershell_signalunterbrochen oder beendet;Persistente Command Shells unterstützen Erstellung, Ausführung, inkrementelles Lesen, Schreiben, Signale, Auflistung und Schließen; separate Hintergrund-Job- und Terminal-Toolgruppen werden nicht mehr bereitgestellt;
Shells und Executions gehören zum MCP-Serviceprozess und bleiben über Tool-Aufrufe hinweg erhalten, aber eine Wiederherstellung über Service-Neustarts hinweg wird nicht zugesagt;
Ein tfrobot-client Computer entspricht einem vom SDK verwalteten MCP-Prozess; der Client behält nur den Aktivierungsschalter und den Laufzeitstatus.
Die persistente Shell der ersten Phase verwendet PTY, bietet aber nur eine befehlsorientierte Textausgabe, kein Vollbild-TUI-Bildschirmmodell, keine rohe Terminal-Sitzung und kein resize. Sollten später klare Integrationspartner für xterm.js, REPL oder Vollbild-TUI auftauchen, wird im selben Shell-Ressourcenmodell ein Terminal-Modus hinzugefügt. Ebenfalls nicht enthalten sind Befehlsgenehmigung, Prozess-Sandbox, Wiederherstellung über Service-Neustarts und eine starke Bindung an MCP Tasks.
Verwandte Dokumentation:
Anforderungen und Architektur des allgemeinen Bash-MCP-Servers: definiert die unabhängige MCP-Grenze, den Tool-Vertrag, den ide4ai-Wiederverwendungsumfang, die SDK-/Client-Verantwortlichkeiten und die Abnahmekriterien.
Geplante Basisfähigkeiten
Die aktuelle Roadmap drückt nur die Erkundungsreihenfolge aus, nicht eine Entscheidung für Eigenentwicklung:
Persistente Shell und Ausführung langer Befehle;
Datei-Lesen, -Schreiben und patchartige Änderungen;
Dateierkennung und Textsuche;
Weitere kleine Basistools, die auf Basis realer Agent-Workflows ergänzt werden.
Jede Fähigkeit sollte zuerst eigenständige Anforderungen und Kandidatenrecherchen bilden und die Entscheidungsgrundlage für Adopt, Wrap oder Build dokumentieren. Verschiedene Fähigkeiten können aus verschiedenen Quellen stammen, solange das Fehlermodell, der Lebenszyklus und die Ergebnisstruktur, die dem Agent ausgesetzt werden, konsistent bleiben.
Repository-Struktur
.
├── .github/workflows/tests.yml # Python 3.10–3.12 CI
├── pyproject.toml # 包元数据、依赖与工具配置
├── src/tfbash_mcp/ # MCP Server 包与入口
├── tests/ # 自动化测试
├── README.md
├── docs/
│ └── bash-tool-requirements.md
└── reference/
├── ide4ai/ # pexpect 持久 Shell 基线
├── codex/ # 进程生命周期参考
├── pi/ # Agent Shell 参考
└── deepseek-harness/ # Agent Runtime 参考reference/ ist ein lokales Recherche-Checkout-Verzeichnis, das relativ groß ist und mehrere Git-Repositories von Drittanbietern enthält; es wird daher nicht in die Versionskontrolle oder das Verteilpaket von tfbash-mcp aufgenommen.
Lokale Entwicklung
Das Projekt unterstützt Python 3.10–3.12 und verwendet uv zur Umgebungsverwaltung:
uv sync --all-groups
uv run ruff check .
uv run ruff format --check .
uv run mypy
uv run pytest --covStarten des aktuellen stdio-Server-Skeletts:
uv run tfbash-mcpDieser Prozess registriert derzeit keine Shell-Tools; er dient nur zur Verifizierung des Pakets, des Einstiegspunkts und des MCP-stdio-Lebenszyklus.
Entscheidungsbeteiligung
Das Anforderungsdokument hat bereits das V1-Modell mit mehreren Shells + Execution-Tools und die Python/pexpect-Implementierungsbasis festgelegt, ist aber noch ein zu implementierender, zu akzeptierender RFC. Vor Beginn der Entwicklung sind mindestens folgende Punkte erforderlich:
Abgleich der harten Schwellenwerte und offenen Punkte im Dokument;
Durchführung eines minimalen Machbarkeitsexperiments mit der gewählten pexpect-Basis;
Bestätigung der Lizenzbeibehaltung, Anpassungskosten, langfristigen Wartungsfläche und Ausstiegsstrategie für die ide4ai-Codeextraktion;
Rückschreiben der Experimentergebnisse und endgültigen Implementierungsabweichungen in den RFC, bevor Codierung und Abnahme beginnen.
Available Tools
7 toolsshell_closeA
Close a persistent shell and its managed process tree.
| Name | Required | Description | Default |
|---|---|---|---|
| shell_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| status | Yes | |
| shell_id | Yes | |
| cleanup_complete | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of disclosing behavior. It transparently communicates a critical side effect: closing the shell also closes its managed process tree, which is substantive context beyond the schema. It does not address idempotency or whether the operation is reversible, but the core destructive behavior is clear.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single efficient sentence that front-loads the verb and resource, then states the important side-effect scope. There is no wasted text or repetition of schema content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple and has an output schema, so the description need not explain return values. However, it omits practical context such as the relationship to shell_open, how shell_close differs from shell_signal, and what happens when an invalid or already-closed shell_id is provided. It is adequate but not fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description does not explain shell_id, where it comes from, or how it should be obtained. The parameter name is self-explanatory to a degree, but the description adds no semantic value beyond the schema's property name and constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Close') and a clear resource ('persistent shell') while also naming the scope of the side effect ('managed process tree'). This clearly distinguishes it from sibling tools such as shell_open, shell_exec, and shell_signal, which have different actions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to invoke this tool versus alternatives like shell_signal, nor does it mention prerequisites such as first opening a shell with shell_open. The usage context is only implied by the resource name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
shell_execC
Execute one bash command in a persistent shell.
| Name | Required | Description | Default |
|---|---|---|---|
| command | Yes | ||
| shell_id | Yes | ||
| yield_ms | No | ||
| timeout_ms | No | ||
| max_output_bytes | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It does not disclose that commands may mutate state, that the shell persists between calls, how output is returned, or that errors can occur mid-command. 'Execute one bash command' only states the action, not the behavioral consequences.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence with no fluff or redundant detail, and it is front-loaded with the core action. It is under-specified overall, but as far as conciseness alone it earns high marks.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given that this is a shell execution tool with potentially destructive side effects, no annotations, and five parameters, the description is too thin. It omits prerequisites (an existing shell), behavioral guarantees, and guidance around the timeout/output parameters. The presence of an output schema reduces the need to describe return values, but not these other aspects.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description adds no parameter-level meaning beyond the raw property names. It does not clarify shell_id's relationship to an existing session, or the meaning of yield_ms, timeout_ms, or max_output_bytes. With zero schema coverage, this is insufficient.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Execute' and names both the resource ('one bash command') and the context ('persistent shell'). This clearly distinguishes it from sibling tools like shell_open, shell_write, and shell_read, which have different purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance on when to use this tool versus shell_write or shell_read, and no mention that shell_id must already exist (e.g., from shell_open). Usage context is only implied by the word 'Execute.'
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
shell_listA
List shells with authoritative runtime and redacted host context.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| host | Yes | |
| shells | Yes | |
| runtime | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description must disclose behavior itself. It adds useful context by saying the runtime is authoritative and host context is redacted, but it does not explicitly state that the operation is read-only or describe side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence with no filler, front-loading the action and resource before qualifiers. Every word earns its place and the structure is immediately scannable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple parameterless list tool with an output schema, the description conveys the key behavioral nuance (authoritative, redacted). It could add a hint about what 'host context' includes, but the output schema likely defines the return shape, so the description is largely complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters, so the schema already fully covers this dimension. Per the baseline for parameterless tools, a 4 is appropriate; the description needs no parameter-specific details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'List' and identifies the resource 'shells', adding qualifiers 'authoritative runtime' and 'redacted host context' that clarify the tool's scope. It is easily distinguished from siblings like shell_read, shell_write, or shell_exec, which imply different actions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied through the verb 'List' – an agent will know to call it for enumeration before operating on a shell – but the description does not explicitly state when to prefer it over siblings or mention any exclusions or alternative tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
shell_openC
Open a persistent bash command shell.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | /app | |
| env | No | ||
| startup_command | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| cwd | Yes | |
| status | Yes | |
| dialect | Yes | |
| shell_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It states persistence but does not disclose that opening a shell creates a stateful resource, starts a process, may need to be closed via shell_close, or how startup_command and env affect the session.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with no redundancy, so it is concise. However, it is so terse that it omits important context about lifecycle and usage; it is under-specified rather than efficiently complete.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return-value details are likely covered elsewhere, but that does not compensate for missing lifecycle, parameter, and sibling-relationship context. With zero annotations and 0% schema description coverage, the description is inadequate for an agent to use this tool confidently.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description should compensate for the undocumented cwd, env, and startup_command parameters. It does not: the parameter meanings are left entirely to inference from their names and schema titles.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Open') and resource ('persistent bash command shell'), making the core action clear. The 'persistent' qualifier helps distinguish it from one-off command execution, though it does not explicitly name a sibling alternative.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use shell_open versus shell_exec or the other sibling tools. It does not mention that a persistent shell should be opened before shell_read/shell_write, or that shell_exec is for non-persistent commands.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
shell_readC
Read incremental output from an execution cursor.
| Name | Required | Description | Default |
|---|---|---|---|
| cursor | Yes | ||
| exec_id | Yes | ||
| wait_ms | No | ||
| shell_id | Yes | ||
| max_bytes | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of explaining behavior. It discloses that output is incremental and tied to a cursor, but does not state whether reading advances the cursor, whether reads are idempotent, how wait_ms affects blocking, or what happens when output exceeds max_bytes.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The single sentence is terse and free of filler, and it front-loads the core operation. However, at one sentence with no parameter or behavioral context, it is under-sized relative to the tool's complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With five parameters, no annotations, and only this description, the definition lacks important operational context—how a cursor is obtained, how incremental advancement works, and how wait_ms/max_bytes shape the read. The presence of an output schema may define the return shape, but it does not fill the input/usage gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, yet the description names none of the five parameters and does not explain cursor, shell_id, exec_id, wait_ms, or max_bytes beyond their raw schema constraints. This leaves the agent without semantic guidance for the parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Read') and a precise resource ('incremental output from an execution cursor'), clearly distinguishing this from sibling tools like shell_exec, shell_write, or shell_signal. It tells an agent exactly what operation this tool performs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'execution cursor' implies this tool is used after an execution has been started, but there is no explicit 'use this when...' guidance or mention of alternatives. No exclusions or conditions are given, so an agent must infer the context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
shell_signalC
Send a portable control intent to the active execution.
| Name | Required | Description | Default |
|---|---|---|---|
| signal | Yes | ||
| exec_id | Yes | ||
| shell_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| signal | Yes | |
| status | Yes | |
| exec_id | Yes | |
| shell_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are available, so the description carries the full burden of behavioral disclosure. It merely says 'Send a portable control intent' and does not explain the effects of interrupt, terminate, or kill, nor the impact on the shell/exec, reversibility, or any side effects. The schema enum hints at behavior, but the description itself adds little.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is appropriately short with no wasted words, but its brevity sacrifices precision. 'Portable control intent' is unclear terminology, so the single sentence does not earn its place as effectively as it could.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no annotations and only a one-sentence description, the tool lacks the operational context needed to safely signal an execution: what each signal does, whether shell_id and exec_id must reference existing handles, and any preconditions. The schema enum provides structure but not the behavioral semantics, and the output schema does not compensate for missing input and context guidance.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description provides essentially no per-parameter meaning. It does not define shell_id, exec_id, or signal; only 'active execution' loosely suggests exec_id and 'control intent' loosely maps to signal, leaving shell_id entirely unexplained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a clear verb ('Send') and resource ('control intent to the active execution'), and the action is distinct from sibling tools like shell_open, shell_exec, shell_read, and shell_close. However, 'portable control intent' is vague jargon and does not explicitly name the signals that the schema enum lists (interrupt, terminate, kill).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided about when to use this tool versus siblings such as shell_exec or shell_read, no conditions, prerequisites, or exclusions are mentioned. The agent is left to infer the intended use case from the name and the signal enum.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
shell_writeC
Write UTF-8 text to the active execution.
| Name | Required | Description | Default |
|---|---|---|---|
| text | Yes | ||
| exec_id | Yes | ||
| shell_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| status | Yes | |
| exec_id | Yes | |
| shell_id | Yes | |
| accepted_bytes | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description bears the full behavioral-disclosure burden, but it only adds an unspecified 'active' qualifier and UTF-8 encoding. It does not disclose whether the write blocks, whether it appends to the process stdin, whether newline termination is required, what happens if the execution is not active, or any buffering semantics.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence ('Write...') with zero filler; every word earns its place. The imprecision of 'active' is a substance problem, not an organization problem.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Although an output schema exists (relieving the return-value burden), the input side is underserved: 3 required parameters at 0% schema coverage, an undefined lifecycle state ('active'), and no guidance on where this fits among 6 sibling tools. An agent cannot confidently invoke or route to this tool based on the description alone.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate, but it only loosely maps 'text' as the UTF-8 content to write. It never explains the distinct roles of shell_id vs exec_id, how they relate (execution belongs to shell), or any constraints on which combinations are valid, so the agent must guess at the IDs' semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Write'), a resource ('the active execution'), and a scope ('UTF-8 text'), and the write verb clearly distinguishes it from siblings like shell_read and shell_signal. However, 'active execution' is ambiguous: it reads like a singleton selection, while the schema requires an explicit shell_id and exec_id, leaving the execution-lifecycle meaning unexplained.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no when-to-use guidance, prerequisites, or exclusions. Among 6 siblings (shell_open, shell_exec, shell_read, shell_signal, shell_list, shell_close), an agent gets no help deciding that this tool is for sending input after shell_exec, nor why it is preferable to shell_signal for process interaction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
2 tool updates
v0.2.0- Changed
shell_list5 fields changed- changed
Output schema / $defs / DialectName / enumPrevious value: -[ - "bash", - "pwsh" -]New value: +[ + "bash", + "zsh", + "pwsh" +] - removed
Output schema / $defs / EnvironmentKindRemoved value: -{ - "enum": [ - "none", - "python-venv", - "conda", - "custom" - ], - "title": "EnvironmentKind", - "type": "string", - "x-validUtf8": true -} - removed
Output schema / $defs / EnvironmentSummaryRemoved value: -{ - "additionalProperties": false, - "properties": { - "kind": { - "$ref": "#/$defs/EnvironmentKind" - }, - "name": { - "pattern": "^[^\\x00]*$", - "title": "Name", - "type": "string", - "x-validUtf8": true - } - }, - "required": [ - "kind" - ], - "title": "EnvironmentSummary", - "type": "object" -} - removed
Output schema / $defs / HostContext / properties / environmentRemoved value: -{ - "$ref": "#/$defs/EnvironmentSummary" -} - changed
Output schema / $defs / HostContext / requiredPrevious value: -[ - "mode", - "workspace_root", - "environment" -]New value: +[ + "mode", + "workspace_root" +]
- Changed
shell_open2 fields changed- removed
Input schema / properties / shellRemoved value: -{ - "pattern": "(?=^/)^[^\\x00]*$", - "title": "Shell", - "type": "string", - "x-nativeAbsolutePath": "linux", - "x-platform": "linux", - "x-validUtf8": true -} - changed
Output schema / $defs / DialectName / enumPrevious value: -[ - "bash", - "pwsh" -]New value: +[ + "bash", + "zsh", + "pwsh" +]
7 tool updates
v0.1.0- First observed
shell_close - First observed
shell_exec - First observed
shell_list - First observed
shell_open - First observed
shell_read - First observed
shell_signal - First observed
shell_write
TDQS
Scored across 7 tools
Each tool maps to a distinct operation in the shell lifecycle: creating, executing, reading, writing, signaling, listing, and closing. There is no meaningful overlap between the tool purposes, and the descriptions make the boundaries clear.
All tool names follow the exact same shell_verb pattern, making the API highly predictable. The verb choice is consistent and matches the corresponding action with no style mixing.
Seven tools is well-scoped for a persistent bash shell server. Each tool covers a necessary aspect of shell interaction without redundancy or bloat.
The toolset covers the full lifecycle of a persistent shell: open, execute, read output, write input, send signals, list shells, and close. There are no obvious dead ends or missing operations for the stated domain.
Maintenance
Related MCP Connectors
Nifty's MCP server — exposes tasks, projects, messages, and files as tools for AI agents.
Remote MCP server exposing your Node Command fleet (files, shell, processes, browser) to AI hosts.
1MCP server for building and testing AI agents with multi-model experimentation and insights.
MCP server for your apps' tools and custom tools, plus hosted AI agents and approval-gated workflows
Related MCP Servers
- AlicenseAqualityDmaintenanceAn MCP server that enables coding agents to execute and manage long-running shell commands asynchronously with capabilities for process monitoring, interaction, and lifecycle management.720 PyPI13MIT
- FlicenseBqualityDmaintenanceAn MCP server that enables users to execute arbitrary shell commands on their local machine and receive the output. It provides a terminal tool for running system commands through MCP-compatible clients using the Python SDK.1-
- AlicenseBqualityAmaintenanceA secure MCP server for shell operations, terminal management, and process control, enabling AI assistants to safely execute commands and manage interactive sessions.13172 npm6MIT
- AlicenseNot gradedqualityBmaintenanceA PTY-based MCP server providing persistent, interactive shell sessions with strong Windows support, enabling AI agents to run commands, handle interactive tools, and manage large output across MCP-compatible clients.99 npm12MIT