Skip to main content
Glama

tfbash-mcp

面向 Agent 系统的基础 MCP 工具集合。项目希望为不同 Agent 提供一组稳定、可组合、低心智负担的通用能力,例如命令执行、文件读写与检索;具体能力优先复用成熟实现,只有现有方案无法满足核心约束时才考虑适配或自研。

当前版本:0.2.1。macOS、Linux 与 Windows 11 x64 均提供七个持久 Shell 工具及 stdio MCP Server,并可作为 Python 运行时嵌入 IDE/SDK 宿主。两种入口共享同一套七工具 合同和 Shell Domain。运行时会发现并探测 Bash、Zsh 或 PowerShell,再与 POSIX PTY 或 Windows ConPTY/Job Object 原生后端组合。

为什么做这个项目

Agent 经常需要离开纯文本推理,操作真实工作区或调用本机程序。程序员会把 Shell 作为主要工作界面;产品、运营、研究等通用岗位也会通过 Shell 调用脚本、转换文件、批处理数据或诊断环境。

现有 MCP 工具在能力范围和运行模型上差异很大:有的只支持一次性命令,有的依赖 PTY 或常驻守护进程,有的内置审批和沙箱,有的缺少可靠的长命令、增量输出与受管进程清理。tfbash-mcp 先定义真实场景和可验收的能力合同,再决定直接采用、包装适配还是自研。

Related MCP server: MCP Terminal Tool Server

设计原则

  • 先场景,后选型:不因熟悉某种语言、框架或现有项目而倒推需求。

  • 优先复用:选型顺序是 Adopt → Wrap → Build;复用必须以满足关键行为为前提。

  • 小而正交:基础工具保持清晰边界,避免把 Agent 编排、业务工作流或 UI 塞进工具层。

  • 显式状态:长任务、持久 Shell、输出游标、退出状态和资源生命周期都应可观察;需要保留 cwd/env 的 Shell 必须显式创建和寻址。

  • 协议与实现语言无关:工具合同不暴露 Python、pexpect、Computer 或客户端内部概念;V1 使用 Python + pexpect,默认提供 stdio adapter,也支持 Python 宿主进程内注册。

  • 信任部署环境:第一阶段不内置 approval、sandbox、命令策略或目录边界。

  • 可控资源:内存、磁盘、会话、进程和临时文件必须有明确上限、所有权与清理规则。

持久 Shell 工具

当前实现覆盖 macOS、Linux 和 Windows 的共享 Shell Runtime,并提供独立 stdio MCP Server 与 Python 嵌入入口。目标同时覆盖:

  • 程序员的构建、测试、代码检索、服务启动和日志观察;

  • 通用岗位通过已安装 CLI 或脚本完成文件处理、数据转换和环境诊断;

  • 多个可寻址的持久 Command Shell 分别保留 cwd、环境和激活状态,并为每条命令返回准确退出状态;

  • pexpect PTY 的 stdout/stderr 作为 combined output 返回,并为每次执行维护有界增量输出;

  • 短命令由 shell_exec 一次返回;长命令超过 yield_ms 后返回 running,继续在原 Shell 中执行;

  • 长命令通过 shell_read 增量读取输出,通过 shell_write 写入 stdin,通过 shell_signal 中断或终止;

  • 持久 Command Shell 支持创建、执行、增量读取、写入、信号、列举和关闭,不再暴露独立的后台 Job 与 Terminal 工具组;

  • Shell 和 Execution 归属于具体 Runtime 实例,跨工具调用保持,但不承诺跨实例重建恢复;

  • 一个 tfrobot-client Computer 对应一个由 SDK 管理的 stdio 进程或嵌入运行时实例,客户端只保留启用开关和运行状态。

第一阶段的持久 Shell 会使用 PTY,但只提供命令导向的文本流,不提供全屏 TUI 屏幕模型、原始终端 Session 或 resize。后续若出现 xterm.js、REPL 或全屏 TUI 的明确集成方,再在同一 Shell 资源模型上增加 Terminal mode。同时不包含命令审批、进程沙箱、跨服务重启恢复,以及与 MCP Tasks 的强绑定。

相关文档:

规划中的基础能力

当前路线只表达探索顺序,不代表已经决定自研:

  1. 持久 Shell 与长命令 Execution;

  2. 文件读取、写入和补丁式修改;

  3. 文件发现与文本检索;

  4. 基于真实 Agent 工作流补充的其他小型基础工具。

每项能力都应先形成独立需求和候选调研,并记录 Adopt、Wrap 或 Build 的决策依据。不同能力可以采用不同来源,只要对 Agent 暴露的错误模型、生命周期和结果结构保持一致。

仓库结构

.
├── .github/workflows/tests.yml  # Python 3.10–3.12 CI
├── pyproject.toml               # 包元数据、依赖与工具配置
├── src/tfbash_mcp/              # MCP Server 包与入口
├── tests/                       # 自动化测试
├── README.md
├── docs/
│   └── bash-tool-requirements.md
└── reference/
    ├── ide4ai/                   # pexpect 持久 Shell 基线
    ├── codex/                    # 进程生命周期参考
    ├── pi/                       # Agent Shell 参考
    └── deepseek-harness/         # Agent Runtime 参考

reference/ 是本地调研检出目录,体量较大且包含多个第三方 Git 仓库,因此不会纳入 tfbash-mcp 的版本控制或发行包。

本地开发

项目支持 Python 3.10–3.12,并使用 uv 管理环境:

uv sync --all-groups
uv run ruff check .
uv run ruff format --check .
uv run mypy
uv run pytest --cov

CI、PR 合并与 PyPI 发布

Pull Request 和 main 分支使用同一套 Tests 质量门禁,在 Python 3.10、3.11、3.12 上执行 ruff check、ruff format --check、mypy 和完整测试。为确保检查失败时不能合并, 仓库管理员需要在 GitHub 的 main branch ruleset 中启用 Require a pull request before merging 和 Require status checks to pass,并把 Python 3.10、Python 3.11、 Python 3.12 三个检查设为 required。

PyPI 发布由 publish workflow 完成。它只在 GitHub Release 进入 published 状态时触发,并先复用上述完整质量门禁;全部通过后才校验 release tag、 构建并验证 wheel/sdist、安装 wheel 做 smoke test,最后通过 PyPI Trusted Publishing 上传。 发布 Job 使用 GitHub OIDC 短期凭证,仓库不保存 PyPI API Token。

首次发布前需要完成一次配置:

  1. 在 GitHub 仓库 Settings → Environments 创建名为 pypi 的 Environment;建议增加 required reviewers,并将 deployment branches/tags 限制为 release tags。

  2. tfbash-mcp 尚未存在于 PyPI 时,在 PyPI 的 Publishing 页面创建 pending Trusted Publisher;项目名填写 tfbash-mcp,Owner 填写 A2C-SMCP,Repository 填写 tfbash-mcp,Workflow name 填写 publish.yml,Environment 填写 pypi。首次成功发布 后 pending publisher 会自动成为该项目的正式 publisher。

  3. 按上一段配置 GitHub main branch ruleset,确保 PR 不能绕过质量门禁合并。

每次发布都必须先在 PR 中更新 pyproject.toml 的版本并通过 required checks。合并到 main 后创建与版本完全一致的 v<version> GitHub Release,例如:

gh release create v0.2.1 --target main --generate-notes

Release tag 与 pyproject.toml 版本不一致,或 tag 指向的提交不属于 main 时,发布会在 上传 PyPI 前失败。PyPI 上的版本文件不可覆盖,因此每次重发都必须使用新版本号。

启动 stdio Server:

uv run tfbash-mcp

使用 MCP Inspector 2.2 从当前本地源码启动并检查工具 discovery:

npx -y @modelcontextprotocol/inspector@2.2.0 --web \
  uv \
  --directory "$PWD" \
  run tfbash-mcp \
  --runtime-profile auto \
  --host-profile ide \
  --workspace-root "$PWD"

该命令必须在包含最终实现的分支或 worktree 中执行。连接后运行 Tools → List Tools,应恰好显示 shell_open、shell_exec、shell_read、shell_write、 shell_signal、shell_list 和 shell_close。Server 默认使用 stdio,无需再传一个 可能被 Inspector 当成自身选项的 --transport stdio。选择 shell_write 时,Inspector 应只显示必填的 shell_id、exec_id 和 text 三个输入字段。

Server 注册 shell_open、shell_exec、shell_read、shell_write、 shell_signal、shell_list 和 shell_close。默认使用当前目录作为 workspace root 和 default cwd,并按宿主系统自动选择 Runtime Profile。IDE 集成应显式传入工作区:

uv run tfbash-mcp \
  --host-profile ide \
  --workspace-root /absolute/path/to/workspace

IDE4AI 等 Python 宿主也可以不启动子进程,直接创建进程内运行时:

from tfbash_mcp import EmbeddedShellConfig, EmbeddedShellRuntime

config = EmbeddedShellConfig(
    workspace_root="/absolute/path/to/workspace",
    environment=project_environment,
)

async with await EmbeddedShellRuntime.create(config) as runtime:
    tools = runtime.list_tools()
    resources = runtime.list_resources()
    overview = runtime.read_resource(resources[0].uri)
    unsubscribe = runtime.subscribe_resource_updates(on_resource_updated)
    opened = await runtime.call_tool("shell_open")
    unsubscribe()

EmbeddedShellConfig 会复制环境映射;修改原字典不会改变已经创建的配置。初始化、工具调用 和关闭均通过异步 API 执行,不阻塞宿主事件循环。每个 EmbeddedShellRuntime 拥有独立的 Shell/Execution Registry;IDE4AI 负责先按项目选择对应实例,再注册 list_tools() 返回的 工具。宿主可将 list_resources() 返回的定义、read_resource() 的结果及 subscribe_resource_updates() 收到的 URI 桥接到自己的 MCP Server;嵌入 API 本身不创建 第二个 MCP Server,也不自行注册 Resource。更新回调同步运行在产生 Shell/Execution 变化的 Domain/worker 线程上,必须快速返回且线程安全;需要执行异步工作时,由宿主投递到自己的事件 循环。取消订阅函数可幂等调用,aclose() 会清理全部遗留订阅;Runtime 进入 closing 后不再 调用回调,Resource 枚举、读取和新增订阅与工具调用一样会被拒绝。需要跨实例 限制线程数时,宿主可以把同一个 ToolConcurrencyBudget 传给多个 create() 调用;这些 实例必须运行在同一个 AnyIO backend 和宿主事件循环中,budget 不支持跨线程、跨事件循环 或跨 asyncio/Trio backend 共享。

aclose() 可并发、幂等调用;清理失败会向调用方报错并允许重试。运行时进入关闭状态后拒绝 新工具调用。工具调用被取消时等待方立即返回,底层工作线程按既有 abandon_on_cancel=True 语义退出等待,并由 Shell 生命周期/关闭流程完成资源回收。

Server 同时暴露 window://io.github.a2c-smcp.tfbash/shell-overview Markdown Resource, 供 A2C-SMCP Desktop 展示当前所有 Shell 的 ID、状态、cwd、最近 Execution 状态和末尾 500 个 Unicode 字符输出。该 Resource 支持订阅,并在 Shell 生命周期、Execution 状态或 输出变化时通过事件驱动的 ResourceUpdatedNotification 刷新;它是上下文补充,不替代 shell_list。七个工具还通过 Tool._meta.a2c_tool_meta.tags 声明 BuildIn 和对应 CRUD 能力标签,Computer 的更高优先级配置仍可按 A2C-SMCP v0.4.0 合并规则覆盖。

运行参数可通过 uv run tfbash-mcp --help 查看。--runtime-profile 仅接受 auto|bash|zsh|pwsh。--shell 是 stdio Runtime 实例级严格覆盖:只探测该程序,不成功时不回退; shell_open 不再接受 shell 字段,因此一个 Runtime 实例内所有 Shell 始终使用同一版本。 继承的环境变量只用于启动 Shell; shell_list 仅返回 Runtime、Host 和 Shell 状态,不返回环境变量名、值、启动命令或其他密钥材料。

服务在 stdin EOF、客户端断开或取消时走同一个有界 shutdown 路径,关闭全部 Shell 及其 受管进程。auto 的候选顺序为:macOS 系统 zsh → 其他 zsh → 系统 Bash → 其他 Bash;Linux 系统 Bash → 其他 Bash → 系统 zsh → 其他 zsh;Windows 稳定版 PowerShell Core → Windows PowerShell 5.1 → Git Bash。显式 zsh 仅支持 POSIX;Windows 支持显式 bash|pwsh。Windows Git Bash 使用 MSYS 路径语义执行命令,但 MCP cwd 字段仍返回 C:/... Windows 路径。WSL 不在 0.2.0 范围内,传入 WSL 程序会得到明确错误。

Zsh 不引入新的 Python 包;Bash、Zsh、PowerShell 与 Git Bash 都是可选的系统 程序。使用 uvx 时仍只需满足项目声明的 Python/uv 与对应平台依赖;Windows 的 ConPTY 实现继续由条件依赖 pywinpty 提供。

参与决策

0.2.0 的多 Shell + Execution 工具模型和跨平台方言/后端组合已实现。后续协议或 Runtime 变更仍须:

  1. 对齐文档中的硬性门槛和未决项;

  2. 对受影响的真实 PTY/ConPTY 路径执行可复现实验;

  3. 确认 ide4ai 代码抽取的许可证保留方式、适配成本、长期维护面和退出策略;

  4. 把实验结果和最终实现偏差回写到 RFC,再进入编码与验收。

Available Tools

7 tools
shell_closeA

Close a persistent shell and its managed process tree.

ParametersJSON Schema
NameRequiredDescriptionDefault
shell_idYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
statusYes
shell_idYes
cleanup_completeYes

TDQS

A3.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of disclosing behavior. It transparently communicates a critical side effect: closing the shell also closes its managed process tree, which is substantive context beyond the schema. It does not address idempotency or whether the operation is reversible, but the core destructive behavior is clear.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single efficient sentence that front-loads the verb and resource, then states the important side-effect scope. There is no wasted text or repetition of schema content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple and has an output schema, so the description need not explain return values. However, it omits practical context such as the relationship to shell_open, how shell_close differs from shell_signal, and what happens when an invalid or already-closed shell_id is provided. It is adequate but not fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description does not explain shell_id, where it comes from, or how it should be obtained. The parameter name is self-explanatory to a degree, but the description adds no semantic value beyond the schema's property name and constraints.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Close') and a clear resource ('persistent shell') while also naming the scope of the side effect ('managed process tree'). This clearly distinguishes it from sibling tools such as shell_open, shell_exec, and shell_signal, which have different actions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to invoke this tool versus alternatives like shell_signal, nor does it mention prerequisites such as first opening a shell with shell_open. The usage context is only implied by the resource name.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

shell_execC

Execute one bash command in a persistent shell.

ParametersJSON Schema
NameRequiredDescriptionDefault
commandYes
shell_idYes
yield_msNo
timeout_msNo
max_output_bytesNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

C2.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It does not disclose that commands may mutate state, that the shell persists between calls, how output is returned, or that errors can occur mid-command. 'Execute one bash command' only states the action, not the behavioral consequences.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence with no fluff or redundant detail, and it is front-loaded with the core action. It is under-specified overall, but as far as conciseness alone it earns high marks.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given that this is a shell execution tool with potentially destructive side effects, no annotations, and five parameters, the description is too thin. It omits prerequisites (an existing shell), behavioral guarantees, and guidance around the timeout/output parameters. The presence of an output schema reduces the need to describe return values, but not these other aspects.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description adds no parameter-level meaning beyond the raw property names. It does not clarify shell_id's relationship to an existing session, or the meaning of yield_ms, timeout_ms, or max_output_bytes. With zero schema coverage, this is insufficient.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb 'Execute' and names both the resource ('one bash command') and the context ('persistent shell'). This clearly distinguishes it from sibling tools like shell_open, shell_write, and shell_read, which have different purposes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no guidance on when to use this tool versus shell_write or shell_read, and no mention that shell_id must already exist (e.g., from shell_open). Usage context is only implied by the word 'Execute.'

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

shell_listA

List shells with authoritative runtime and redacted host context.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
hostYes
shellsYes
runtimeYes

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are present, so the description must disclose behavior itself. It adds useful context by saying the runtime is authoritative and host context is redacted, but it does not explicitly state that the operation is read-only or describe side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence with no filler, front-loading the action and resource before qualifiers. Every word earns its place and the structure is immediately scannable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple parameterless list tool with an output schema, the description conveys the key behavioral nuance (authoritative, redacted). It could add a hint about what 'host context' includes, but the output schema likely defines the return shape, so the description is largely complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There are zero parameters, so the schema already fully covers this dimension. Per the baseline for parameterless tools, a 4 is appropriate; the description needs no parameter-specific details.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb 'List' and identifies the resource 'shells', adding qualifiers 'authoritative runtime' and 'redacted host context' that clarify the tool's scope. It is easily distinguished from siblings like shell_read, shell_write, or shell_exec, which imply different actions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied through the verb 'List' – an agent will know to call it for enumeration before operating on a shell – but the description does not explicitly state when to prefer it over siblings or mention any exclusions or alternative tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

shell_openC

Open a persistent bash command shell.

ParametersJSON Schema
NameRequiredDescriptionDefault
cwdNo/app
envNo
startup_commandNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
cwdYes
statusYes
dialectYes
shell_idYes

TDQS

C2.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. It states persistence but does not disclose that opening a shell creates a stateful resource, starts a process, may need to be closed via shell_close, or how startup_command and env affect the session.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single front-loaded sentence with no redundancy, so it is concise. However, it is so terse that it omits important context about lifecycle and usage; it is under-specified rather than efficiently complete.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return-value details are likely covered elsewhere, but that does not compensate for missing lifecycle, parameter, and sibling-relationship context. With zero annotations and 0% schema description coverage, the description is inadequate for an agent to use this tool confidently.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description should compensate for the undocumented cwd, env, and startup_command parameters. It does not: the parameter meanings are left entirely to inference from their names and schema titles.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Open') and resource ('persistent bash command shell'), making the core action clear. The 'persistent' qualifier helps distinguish it from one-off command execution, though it does not explicitly name a sibling alternative.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use shell_open versus shell_exec or the other sibling tools. It does not mention that a persistent shell should be opened before shell_read/shell_write, or that shell_exec is for non-persistent commands.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

shell_readC

Read incremental output from an execution cursor.

ParametersJSON Schema
NameRequiredDescriptionDefault
cursorYes
exec_idYes
wait_msNo
shell_idYes
max_bytesNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of explaining behavior. It discloses that output is incremental and tied to a cursor, but does not state whether reading advances the cursor, whether reads are idempotent, how wait_ms affects blocking, or what happens when output exceeds max_bytes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The single sentence is terse and free of filler, and it front-loads the core operation. However, at one sentence with no parameter or behavioral context, it is under-sized relative to the tool's complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With five parameters, no annotations, and only this description, the definition lacks important operational context—how a cursor is obtained, how incremental advancement works, and how wait_ms/max_bytes shape the read. The presence of an output schema may define the return shape, but it does not fill the input/usage gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, yet the description names none of the five parameters and does not explain cursor, shell_id, exec_id, wait_ms, or max_bytes beyond their raw schema constraints. This leaves the agent without semantic guidance for the parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Read') and a precise resource ('incremental output from an execution cursor'), clearly distinguishing this from sibling tools like shell_exec, shell_write, or shell_signal. It tells an agent exactly what operation this tool performs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'execution cursor' implies this tool is used after an execution has been started, but there is no explicit 'use this when...' guidance or mention of alternatives. No exclusions or conditions are given, so an agent must infer the context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

shell_signalC

Send a portable control intent to the active execution.

ParametersJSON Schema
NameRequiredDescriptionDefault
signalYes
exec_idYes
shell_idYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
signalYes
statusYes
exec_idYes
shell_idYes

TDQS

C2.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are available, so the description carries the full burden of behavioral disclosure. It merely says 'Send a portable control intent' and does not explain the effects of interrupt, terminate, or kill, nor the impact on the shell/exec, reversibility, or any side effects. The schema enum hints at behavior, but the description itself adds little.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is appropriately short with no wasted words, but its brevity sacrifices precision. 'Portable control intent' is unclear terminology, so the single sentence does not earn its place as effectively as it could.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no annotations and only a one-sentence description, the tool lacks the operational context needed to safely signal an execution: what each signal does, whether shell_id and exec_id must reference existing handles, and any preconditions. The schema enum provides structure but not the behavioral semantics, and the output schema does not compensate for missing input and context guidance.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description provides essentially no per-parameter meaning. It does not define shell_id, exec_id, or signal; only 'active execution' loosely suggests exec_id and 'control intent' loosely maps to signal, leaving shell_id entirely unexplained.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a clear verb ('Send') and resource ('control intent to the active execution'), and the action is distinct from sibling tools like shell_open, shell_exec, shell_read, and shell_close. However, 'portable control intent' is vague jargon and does not explicitly name the signals that the schema enum lists (interrupt, terminate, kill).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided about when to use this tool versus siblings such as shell_exec or shell_read, no conditions, prerequisites, or exclusions are mentioned. The agent is left to infer the intended use case from the name and the signal enum.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

shell_writeC

Write UTF-8 text to the active execution.

ParametersJSON Schema
NameRequiredDescriptionDefault
textYes
exec_idYes
shell_idYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
statusYes
exec_idYes
shell_idYes
accepted_bytesYes

TDQS

C2.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description bears the full behavioral-disclosure burden, but it only adds an unspecified 'active' qualifier and UTF-8 encoding. It does not disclose whether the write blocks, whether it appends to the process stdin, whether newline termination is required, what happens if the execution is not active, or any buffering semantics.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single front-loaded sentence ('Write...') with zero filler; every word earns its place. The imprecision of 'active' is a substance problem, not an organization problem.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Although an output schema exists (relieving the return-value burden), the input side is underserved: 3 required parameters at 0% schema coverage, an undefined lifecycle state ('active'), and no guidance on where this fits among 6 sibling tools. An agent cannot confidently invoke or route to this tool based on the description alone.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, but it only loosely maps 'text' as the UTF-8 content to write. It never explains the distinct roles of shell_id vs exec_id, how they relate (execution belongs to shell), or any constraints on which combinations are valid, so the agent must guess at the IDs' semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Write'), a resource ('the active execution'), and a scope ('UTF-8 text'), and the write verb clearly distinguishes it from siblings like shell_read and shell_signal. However, 'active execution' is ambiguous: it reads like a singleton selection, while the schema requires an explicit shell_id and exec_id, leaving the execution-lifecycle meaning unexplained.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no when-to-use guidance, prerequisites, or exclusions. Among 6 siblings (shell_open, shell_exec, shell_read, shell_signal, shell_list, shell_close), an agent gets no help deciding that this tool is for sending input after shell_exec, nor why it is preferable to shell_signal for process interaction.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 2 tool updatesv0.2.0
    • Changedshell_list5 fields changed
      • changedOutput schema / $defs / DialectName / enum
        Previous value: -[
        -  "bash",
        -  "pwsh"
        -]New value: +[
        +  "bash",
        +  "zsh",
        +  "pwsh"
        +]
      • removedOutput schema / $defs / EnvironmentKind
        Removed value: -{
        -  "enum": [
        -    "none",
        -    "python-venv",
        -    "conda",
        -    "custom"
        -  ],
        -  "title": "EnvironmentKind",
        -  "type": "string",
        -  "x-validUtf8": true
        -}
      • removedOutput schema / $defs / EnvironmentSummary
        Removed value: -{
        -  "additionalProperties": false,
        -  "properties": {
        -    "kind": {
        -      "$ref": "#/$defs/EnvironmentKind"
        -    },
        -    "name": {
        -      "pattern": "^[^\\x00]*$",
        -      "title": "Name",
        -      "type": "string",
        -      "x-validUtf8": true
        -    }
        -  },
        -  "required": [
        -    "kind"
        -  ],
        -  "title": "EnvironmentSummary",
        -  "type": "object"
        -}
      • removedOutput schema / $defs / HostContext / properties / environment
        Removed value: -{
        -  "$ref": "#/$defs/EnvironmentSummary"
        -}
      • changedOutput schema / $defs / HostContext / required
        Previous value: -[
        -  "mode",
        -  "workspace_root",
        -  "environment"
        -]New value: +[
        +  "mode",
        +  "workspace_root"
        +]
    • Changedshell_open2 fields changed
      • removedInput schema / properties / shell
        Removed value: -{
        -  "pattern": "(?=^/)^[^\\x00]*$",
        -  "title": "Shell",
        -  "type": "string",
        -  "x-nativeAbsolutePath": "linux",
        -  "x-platform": "linux",
        -  "x-validUtf8": true
        -}
      • changedOutput schema / $defs / DialectName / enum
        Previous value: -[
        -  "bash",
        -  "pwsh"
        -]New value: +[
        +  "bash",
        +  "zsh",
        +  "pwsh"
        +]
  2. 7 tool updatesv0.1.0
    • First observedshell_close
    • First observedshell_exec
    • First observedshell_list
    • First observedshell_open
    • First observedshell_read
    • First observedshell_signal
    • First observedshell_write

TDQS

A3.5/5.0

Scored across 7 tools

Disambiguation5/5

Each tool maps to a distinct operation in the shell lifecycle: creating, executing, reading, writing, signaling, listing, and closing. There is no meaningful overlap between the tool purposes, and the descriptions make the boundaries clear.

Naming Consistency5/5

All tool names follow the exact same shell_verb pattern, making the API highly predictable. The verb choice is consistent and matches the corresponding action with no style mixing.

Tool Count5/5

Seven tools is well-scoped for a persistent bash shell server. Each tool covers a necessary aspect of shell interaction without redundancy or bloat.

Completeness5/5

The toolset covers the full lifecycle of a persistent shell: open, execute, read output, write input, send signals, list shells, and close. There are no obvious dead ends or missing operations for the stated domain.

Maintenance

ActivitySlowing
ResponsivenessWithin a week

Related MCP Connectors

Related MCP Servers

  • F
    license
    B
    quality
    D
    maintenance
    An MCP server that enables users to execute arbitrary shell commands on their local machine and receive the output. It provides a terminal tool for running system commands through MCP-compatible clients using the Python SDK.
    1
    -
  • A
    license
    B
    quality
    A
    maintenance
    A secure MCP server for shell operations, terminal management, and process control, enabling AI assistants to safely execute commands and manage interactive sessions.
    13
    172 npm
    6
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    A PTY-based MCP server providing persistent, interactive shell sessions with strong Windows support, enabling AI agents to run commands, handle interactive tools, and manage large output across MCP-compatible clients.
    99 npm
    12
    MIT