tfbash-mcp
tfbash-mcp
Agent 시스템을 위한 기반 MCP 도구 모음입니다. 이 프로젝트는 다양한 Agent에 안정적이고, 조합 가능하며, 인지 부담이 낮은 범용 기능(예: 명령 실행, 파일 읽기/쓰기 및 검색)을 제공하는 것을 목표로 합니다. 구체적인 기능은 성숙한 구현을 우선 재사용하며, 기존方案이 핵심 제약을 충족하지 못할 때만适配하거나 자체 개발을 고려합니다.
현재 상태: Python 프로젝트 스켈레톤 및 요구사항/아키텍처 RFC. 저장소는 빈 stdio MCP Server를 시작할 수 있지만, RFC에 정의된 Shell 도구는 아직 제공되지 않습니다.
왜 이 프로젝트를 만드는가
Agent는 종종 순수 텍스트 추론을 벗어나 실제 작업 공간을 조작하거나 로컬 프로그램을 호출해야 합니다. 프로그래머는 Shell을 주요 작업 인터페이스로 사용합니다. 제품, 운영, 연구 등 일반 직무에서도 Shell을 통해 스크립트를 호출하고, 파일을 변환하며, 데이터를 일괄 처리하거나 환경을 진단합니다.
기존 MCP 도구는 기능 범위와 실행 모델에서 차이가 큽니다. 일부는 일회성 명령만 지원하고, 일부는 PTY 또는 상주 데몬에 의존하며, 일부는 승인 및 샌드박스를 내장하고, 일부는 안정적인 장기 명령, 증분 출력 및 관리되는 프로세스 정리를 제공하지 못합니다. tfbash-mcp는 먼저 실제 시나리오와 검증 가능한 기능 계약을 정의한 후, 직접 채택할지, 래핑하여适配할지, 아니면 자체 개발할지를 결정합니다.
Related MCP server: MCP Terminal Tool Server
설계 원칙
시나리오 우선, 기술 선택은 그 다음: 특정 언어, 프레임워크 또는 기존 구현에 익숙하다는 이유로 요구사항을 역산출하지 않습니다.
재사용 우선: 선택 순서는 Adopt → Wrap → Build입니다. 재사용은 핵심 동작을 충족하는 것을 전제로 합니다.
작고 직교적: 기본 도구는 명확한 경계를 유지하며, Agent 오케스트레이션, 업무 워크플로 또는 UI를 도구 계층에 넣지 않습니다.
명시적 상태: 장기 작업, 영구 Shell, 출력 커서, 종료 상태 및 리소스 수명 주기는 모두 관찰 가능해야 합니다. cwd/env를 유지해야 하는 Shell은 명시적으로 생성되고 주소 지정이 가능해야 합니다.
프로토콜과 구현 언어는 무관: 도구 계약은 Python, pexpect 또는 클라이언트 내부 개념을 노출하지 않습니다. V1은 Python + pexpect 및 stdio 전송을 사용합니다.
배포 환경 신뢰: 1단계에서는 approval, sandbox, 명령 정책 또는 디렉터리 경계를 내장하지 않습니다.
리소스 제어: 메모리, 디스크, 세션, 프로세스 및 임시 파일에는 명확한 상한, 소유권 및 정리 규칙이 있어야 합니다.
1단계: Bash 도구
1단계는 Unix(Linux, macOS) 환경의 독립형 범용 Bash MCP Server에 집중합니다. 목표는 다음을 동시에 다룹니다:
프로그래머의 빌드, 테스트, 코드 검색, 서비스 시작 및 로그 관찰;
일반 직무에서 설치된 CLI 또는 스크립트를 통한 파일 처리, 데이터 변환 및 환경 진단;
여러 개의 주소 지정 가능한 영구 Command Shell이 각각 cwd, 환경 및 활성화 상태를 유지하고, 각 명령에 대해 정확한 종료 상태를 반환;
pexpect PTY의 stdout/stderr를 combined output으로 반환하고, 각 실행에 대해 유계 증분 출력을 유지;
짧은 명령은
shell_exec로 한 번에 반환하고, 긴 명령이yield_ms를 초과하면running을 반환하여 원래 Shell에서 계속 실행;긴 명령은
shell_read로 증분 출력을 읽고,shell_write로 stdin에 쓰며,shell_signal로 중단 또는 종료;영구 Command Shell은 생성, 실행, 증분 읽기, 쓰기, 시그널, 열거 및 종료를 지원하며, 더 이상 독립적인 백그라운드 Job 및 Terminal 도구 그룹을 노출하지 않습니다;
Shell과 Execution은 MCP 서비스 프로세스에 속하며, 도구 호출 간에 유지되지만 서비스 재시작 간에는 유지되지 않습니다;
하나의 tfrobot-client는 SDK가 관리하는 하나의 MCP 프로세스에 대응하며, 클라이언트는 활성화 스위치와 실행 상태만 유지합니다.
1단계의 영구 Shell은 PTY를 사용하지만, 명령 지향 텍스트 스트림만 제공하며 전체 화면 TUI 화면 모델, 원시 터미널 Session 또는 resize는 제공하지 않습니다. 이후 xterm.js, REPL 또는 전체 화면 TUI의 명확한 통합 요구가 나타나면 동일한 Shell 리소스 모델 위에 Terminal 모드를 추가합니다. 또한 명령 승인, 프로세스 샌드박스, 서비스 재시작 간 복구 및 MCP Tasks와의 강한 결합은 포함하지 않습니다.
관련 문서:
범용 Bash MCP Server 요구사항 및 아키텍처 설명: 독립형 MCP 경계, 도구 계약, ide4ai 재사용 범위, SDK/클라이언트 책임 및 승인 기준을 정의합니다.
계획 중인 기반 기능
현재 로드맵은 탐색 순서를 표현할 뿐, 자체 개발을 결정한 것은 아닙니다:
영구 Shell 및 장기 명령 Execution;
파일 읽기, 쓰기 및 패치 방식 수정;
파일 검색 및 텍스트 검색;
실제 Agent 워크플로를 기반으로 보완되는 기타 소형 기본 도구.
각 기능은 먼저 독립적인 요구사항과 후보 구현 조사를 구성하고, Adopt, Wrap 또는 Build 결정의 근거를 기록해야 합니다. 서로 다른 기능은 서로 다른 출처를 사용할 수 있지만, Agent에 노출되는 오류 모델, 수명 주기 및 결과 구조는 일관성을 유지해야 합니다.
저장소 구조
.
├── .github/workflows/tests.yml # Python 3.10–3.12 CI
├── pyproject.toml # 包元数据、依赖与工具配置
├── src/tfbash_mcp/ # MCP Server 包与入口
├── tests/ # 自动化测试
├── README.md
├── docs/
│ └── bash-tool-requirements.md
└── reference/
├── ide4ai/ # pexpect 持久 Shell 基线
├── codex/ # 进程生命周期参考
├── pi/ # Agent Shell 参考
└── deepseek-harness/ # Agent Runtime 参考reference/는 로컬 조사 및 체크아웃 디렉터리로, 규모가 크고 여러 서드파티 Git 저장소를 포함하므로 tfbash-mcp의 버전 관리나 배포 패키지에는 포함되지 않습니다.
로컬 개발
프로젝트는 Python 3.10–3.12을 지원하며 uv로 환경을 관리합니다:
uv sync --all-groups
uv run ruff check .
uv run ruff format --check .
uv run mypy
uv run pytest --cov현재 stdio Server 스켈레톤을 시작합니다:
uv run tfbash-mcp이 프로세스는 현재 Shell 도구를 등록하지 않으며, 패키지, 진입점 및 MCP stdio 수명 주기 검증에만 사용됩니다.
의사 결정 참여
요구사항 문서는 현재 V1의 다중 Shell + Execution 도구 모델과 Python/pexpect 구현 베이스라인을 확정했지만, 여전히 구현 및 승인 대기 중인 RFC입니다. 개발에 들어가기 전에 최소한 다음이 필요합니다:
문서의 하드 요구사항과 미결 항목을 정렬;
선택된 pexpect 베이스라인에 대해 최소 실행 가능 실험을 수행;
ide4ai 코드 추출의 라이선스 보존 방식,适配 비용, 장기 유지 관리 부담 및 종료 전략을 확인;
실험 결과와 최종 구현 편차를 RFC에 다시 반영한 후, 코딩 및 승인 단계로 진행합니다.
Available Tools
7 toolsshell_closeA
Close a persistent shell and its managed process tree.
| Name | Required | Description | Default |
|---|---|---|---|
| shell_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| status | Yes | |
| shell_id | Yes | |
| cleanup_complete | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of disclosing behavior. It transparently communicates a critical side effect: closing the shell also closes its managed process tree, which is substantive context beyond the schema. It does not address idempotency or whether the operation is reversible, but the core destructive behavior is clear.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single efficient sentence that front-loads the verb and resource, then states the important side-effect scope. There is no wasted text or repetition of schema content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple and has an output schema, so the description need not explain return values. However, it omits practical context such as the relationship to shell_open, how shell_close differs from shell_signal, and what happens when an invalid or already-closed shell_id is provided. It is adequate but not fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description does not explain shell_id, where it comes from, or how it should be obtained. The parameter name is self-explanatory to a degree, but the description adds no semantic value beyond the schema's property name and constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Close') and a clear resource ('persistent shell') while also naming the scope of the side effect ('managed process tree'). This clearly distinguishes it from sibling tools such as shell_open, shell_exec, and shell_signal, which have different actions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to invoke this tool versus alternatives like shell_signal, nor does it mention prerequisites such as first opening a shell with shell_open. The usage context is only implied by the resource name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
shell_execC
Execute one bash command in a persistent shell.
| Name | Required | Description | Default |
|---|---|---|---|
| command | Yes | ||
| shell_id | Yes | ||
| yield_ms | No | ||
| timeout_ms | No | ||
| max_output_bytes | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It does not disclose that commands may mutate state, that the shell persists between calls, how output is returned, or that errors can occur mid-command. 'Execute one bash command' only states the action, not the behavioral consequences.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence with no fluff or redundant detail, and it is front-loaded with the core action. It is under-specified overall, but as far as conciseness alone it earns high marks.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given that this is a shell execution tool with potentially destructive side effects, no annotations, and five parameters, the description is too thin. It omits prerequisites (an existing shell), behavioral guarantees, and guidance around the timeout/output parameters. The presence of an output schema reduces the need to describe return values, but not these other aspects.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description adds no parameter-level meaning beyond the raw property names. It does not clarify shell_id's relationship to an existing session, or the meaning of yield_ms, timeout_ms, or max_output_bytes. With zero schema coverage, this is insufficient.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Execute' and names both the resource ('one bash command') and the context ('persistent shell'). This clearly distinguishes it from sibling tools like shell_open, shell_write, and shell_read, which have different purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance on when to use this tool versus shell_write or shell_read, and no mention that shell_id must already exist (e.g., from shell_open). Usage context is only implied by the word 'Execute.'
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
shell_listA
List shells with authoritative runtime and redacted host context.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| host | Yes | |
| shells | Yes | |
| runtime | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description must disclose behavior itself. It adds useful context by saying the runtime is authoritative and host context is redacted, but it does not explicitly state that the operation is read-only or describe side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence with no filler, front-loading the action and resource before qualifiers. Every word earns its place and the structure is immediately scannable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple parameterless list tool with an output schema, the description conveys the key behavioral nuance (authoritative, redacted). It could add a hint about what 'host context' includes, but the output schema likely defines the return shape, so the description is largely complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters, so the schema already fully covers this dimension. Per the baseline for parameterless tools, a 4 is appropriate; the description needs no parameter-specific details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'List' and identifies the resource 'shells', adding qualifiers 'authoritative runtime' and 'redacted host context' that clarify the tool's scope. It is easily distinguished from siblings like shell_read, shell_write, or shell_exec, which imply different actions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied through the verb 'List' – an agent will know to call it for enumeration before operating on a shell – but the description does not explicitly state when to prefer it over siblings or mention any exclusions or alternative tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
shell_openC
Open a persistent bash command shell.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | /app | |
| env | No | ||
| startup_command | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| cwd | Yes | |
| status | Yes | |
| dialect | Yes | |
| shell_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It states persistence but does not disclose that opening a shell creates a stateful resource, starts a process, may need to be closed via shell_close, or how startup_command and env affect the session.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with no redundancy, so it is concise. However, it is so terse that it omits important context about lifecycle and usage; it is under-specified rather than efficiently complete.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return-value details are likely covered elsewhere, but that does not compensate for missing lifecycle, parameter, and sibling-relationship context. With zero annotations and 0% schema description coverage, the description is inadequate for an agent to use this tool confidently.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description should compensate for the undocumented cwd, env, and startup_command parameters. It does not: the parameter meanings are left entirely to inference from their names and schema titles.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Open') and resource ('persistent bash command shell'), making the core action clear. The 'persistent' qualifier helps distinguish it from one-off command execution, though it does not explicitly name a sibling alternative.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use shell_open versus shell_exec or the other sibling tools. It does not mention that a persistent shell should be opened before shell_read/shell_write, or that shell_exec is for non-persistent commands.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
shell_readC
Read incremental output from an execution cursor.
| Name | Required | Description | Default |
|---|---|---|---|
| cursor | Yes | ||
| exec_id | Yes | ||
| wait_ms | No | ||
| shell_id | Yes | ||
| max_bytes | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of explaining behavior. It discloses that output is incremental and tied to a cursor, but does not state whether reading advances the cursor, whether reads are idempotent, how wait_ms affects blocking, or what happens when output exceeds max_bytes.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The single sentence is terse and free of filler, and it front-loads the core operation. However, at one sentence with no parameter or behavioral context, it is under-sized relative to the tool's complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With five parameters, no annotations, and only this description, the definition lacks important operational context—how a cursor is obtained, how incremental advancement works, and how wait_ms/max_bytes shape the read. The presence of an output schema may define the return shape, but it does not fill the input/usage gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, yet the description names none of the five parameters and does not explain cursor, shell_id, exec_id, wait_ms, or max_bytes beyond their raw schema constraints. This leaves the agent without semantic guidance for the parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Read') and a precise resource ('incremental output from an execution cursor'), clearly distinguishing this from sibling tools like shell_exec, shell_write, or shell_signal. It tells an agent exactly what operation this tool performs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'execution cursor' implies this tool is used after an execution has been started, but there is no explicit 'use this when...' guidance or mention of alternatives. No exclusions or conditions are given, so an agent must infer the context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
shell_signalC
Send a portable control intent to the active execution.
| Name | Required | Description | Default |
|---|---|---|---|
| signal | Yes | ||
| exec_id | Yes | ||
| shell_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| signal | Yes | |
| status | Yes | |
| exec_id | Yes | |
| shell_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are available, so the description carries the full burden of behavioral disclosure. It merely says 'Send a portable control intent' and does not explain the effects of interrupt, terminate, or kill, nor the impact on the shell/exec, reversibility, or any side effects. The schema enum hints at behavior, but the description itself adds little.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is appropriately short with no wasted words, but its brevity sacrifices precision. 'Portable control intent' is unclear terminology, so the single sentence does not earn its place as effectively as it could.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no annotations and only a one-sentence description, the tool lacks the operational context needed to safely signal an execution: what each signal does, whether shell_id and exec_id must reference existing handles, and any preconditions. The schema enum provides structure but not the behavioral semantics, and the output schema does not compensate for missing input and context guidance.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description provides essentially no per-parameter meaning. It does not define shell_id, exec_id, or signal; only 'active execution' loosely suggests exec_id and 'control intent' loosely maps to signal, leaving shell_id entirely unexplained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a clear verb ('Send') and resource ('control intent to the active execution'), and the action is distinct from sibling tools like shell_open, shell_exec, shell_read, and shell_close. However, 'portable control intent' is vague jargon and does not explicitly name the signals that the schema enum lists (interrupt, terminate, kill).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided about when to use this tool versus siblings such as shell_exec or shell_read, no conditions, prerequisites, or exclusions are mentioned. The agent is left to infer the intended use case from the name and the signal enum.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
shell_writeC
Write UTF-8 text to the active execution.
| Name | Required | Description | Default |
|---|---|---|---|
| text | Yes | ||
| exec_id | Yes | ||
| shell_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| status | Yes | |
| exec_id | Yes | |
| shell_id | Yes | |
| accepted_bytes | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description bears the full behavioral-disclosure burden, but it only adds an unspecified 'active' qualifier and UTF-8 encoding. It does not disclose whether the write blocks, whether it appends to the process stdin, whether newline termination is required, what happens if the execution is not active, or any buffering semantics.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence ('Write...') with zero filler; every word earns its place. The imprecision of 'active' is a substance problem, not an organization problem.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Although an output schema exists (relieving the return-value burden), the input side is underserved: 3 required parameters at 0% schema coverage, an undefined lifecycle state ('active'), and no guidance on where this fits among 6 sibling tools. An agent cannot confidently invoke or route to this tool based on the description alone.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate, but it only loosely maps 'text' as the UTF-8 content to write. It never explains the distinct roles of shell_id vs exec_id, how they relate (execution belongs to shell), or any constraints on which combinations are valid, so the agent must guess at the IDs' semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Write'), a resource ('the active execution'), and a scope ('UTF-8 text'), and the write verb clearly distinguishes it from siblings like shell_read and shell_signal. However, 'active execution' is ambiguous: it reads like a singleton selection, while the schema requires an explicit shell_id and exec_id, leaving the execution-lifecycle meaning unexplained.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no when-to-use guidance, prerequisites, or exclusions. Among 6 siblings (shell_open, shell_exec, shell_read, shell_signal, shell_list, shell_close), an agent gets no help deciding that this tool is for sending input after shell_exec, nor why it is preferable to shell_signal for process interaction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
2 tool updates
v0.2.0- Changed
shell_list5 fields changed- changed
Output schema / $defs / DialectName / enumPrevious value: -[ - "bash", - "pwsh" -]New value: +[ + "bash", + "zsh", + "pwsh" +] - removed
Output schema / $defs / EnvironmentKindRemoved value: -{ - "enum": [ - "none", - "python-venv", - "conda", - "custom" - ], - "title": "EnvironmentKind", - "type": "string", - "x-validUtf8": true -} - removed
Output schema / $defs / EnvironmentSummaryRemoved value: -{ - "additionalProperties": false, - "properties": { - "kind": { - "$ref": "#/$defs/EnvironmentKind" - }, - "name": { - "pattern": "^[^\\x00]*$", - "title": "Name", - "type": "string", - "x-validUtf8": true - } - }, - "required": [ - "kind" - ], - "title": "EnvironmentSummary", - "type": "object" -} - removed
Output schema / $defs / HostContext / properties / environmentRemoved value: -{ - "$ref": "#/$defs/EnvironmentSummary" -} - changed
Output schema / $defs / HostContext / requiredPrevious value: -[ - "mode", - "workspace_root", - "environment" -]New value: +[ + "mode", + "workspace_root" +]
- Changed
shell_open2 fields changed- removed
Input schema / properties / shellRemoved value: -{ - "pattern": "(?=^/)^[^\\x00]*$", - "title": "Shell", - "type": "string", - "x-nativeAbsolutePath": "linux", - "x-platform": "linux", - "x-validUtf8": true -} - changed
Output schema / $defs / DialectName / enumPrevious value: -[ - "bash", - "pwsh" -]New value: +[ + "bash", + "zsh", + "pwsh" +]
7 tool updates
v0.1.0- First observed
shell_close - First observed
shell_exec - First observed
shell_list - First observed
shell_open - First observed
shell_read - First observed
shell_signal - First observed
shell_write
TDQS
Scored across 7 tools
Each tool maps to a distinct operation in the shell lifecycle: creating, executing, reading, writing, signaling, listing, and closing. There is no meaningful overlap between the tool purposes, and the descriptions make the boundaries clear.
All tool names follow the exact same shell_verb pattern, making the API highly predictable. The verb choice is consistent and matches the corresponding action with no style mixing.
Seven tools is well-scoped for a persistent bash shell server. Each tool covers a necessary aspect of shell interaction without redundancy or bloat.
The toolset covers the full lifecycle of a persistent shell: open, execute, read output, write input, send signals, list shells, and close. There are no obvious dead ends or missing operations for the stated domain.
Maintenance
Related MCP Connectors
Nifty's MCP server — exposes tasks, projects, messages, and files as tools for AI agents.
Remote MCP server exposing your Node Command fleet (files, shell, processes, browser) to AI hosts.
1MCP server for building and testing AI agents with multi-model experimentation and insights.
MCP server for your apps' tools and custom tools, plus hosted AI agents and approval-gated workflows
Related MCP Servers
- AlicenseAqualityDmaintenanceAn MCP server that enables coding agents to execute and manage long-running shell commands asynchronously with capabilities for process monitoring, interaction, and lifecycle management.720 PyPI13MIT
- FlicenseBqualityDmaintenanceAn MCP server that enables users to execute arbitrary shell commands on their local machine and receive the output. It provides a terminal tool for running system commands through MCP-compatible clients using the Python SDK.1-
- AlicenseBqualityAmaintenanceA secure MCP server for shell operations, terminal management, and process control, enabling AI assistants to safely execute commands and manage interactive sessions.13172 npm6MIT
- AlicenseNot gradedqualityBmaintenanceA PTY-based MCP server providing persistent, interactive shell sessions with strong Windows support, enabling AI agents to run commands, handle interactive tools, and manage large output across MCP-compatible clients.99 npm12MIT