Skip to main content
Glama

Muster

license

Launch coding agents on your machine, under containment you chose, and get back an address you can actually reach.

Muster starts Claude Code, Codex and OpenCode sessions on your behalf. You say what the agent may do; Muster arranges it, verifies the session is genuinely alive, and hands you a durable address for it. If a session never becomes reachable, you get a diagnosis naming what stopped it — not a process that looks fine and isn't.

It is the launching half of a small family: Muster starts agents, tincan lets them message each other, birddog watches what they do.

What it's for

Running more than one agent, deliberately. One session reviewing while another builds; a task that runs once and captures its output; an agent launched under a separate account so its work never touches your own configuration. Muster is the part that makes those launches repeatable, contained and addressable instead of a terminal tab you have to remember.

A session returns an address only after its runtime is reachable. A task runs once, captures output, and never advertises a peer address.

Related MCP server: LightsOut

What makes it different

  • Containment is two separate questions, and both are answered. Whether the agent stops to ask you, and what it may touch — the second enforced by the OS, not by asking nicely. Every launch records which of the two it actually got.

  • A session is only reported ready when it is reachable. Muster asks each runtime in its own language — a session record, an RPC call, an HTTP endpoint — and does not confuse "the process started" with "the agent is listening".

  • It refuses instead of guessing. An unrecognised flag, a contradictory pair of options, an identity belonging to a different runtime: all errors, before anything is started. Nothing half-launched is left behind.

  • Other machines can ask, within limits you set. An enrolled caller launches inside a profile's ceiling — the directories it may use, the strongest containment it may request. Configuration is the grant; the request never widens it.

  • Every claim here was measured. Runtime behaviour is established by driving the real programs and recording what they did — see Verification. Where a finding later proved wrong, the correction is in the release notes rather than quietly edited away.

Claude requires a directory already trusted by the operator, or --options auto-approve-path. The automated suite uses fake runtimes, not real models; behaviour against real ones is verified by hand and recorded in RELEASE_NOTES.md.

Quick start

# Allow the install scripts: muster's postinstall builds node-pty, and npm
# skips install scripts by default — silently, so the pty host fails later.
npm install -g --allow-scripts=@brutalsystems/muster,node-pty @brutalsystems/muster

# A session: an agent you can reach, addressed once it is genuinely alive.
muster run claude --prompt 'Review this project' --cwd . --level work

# A task: runs once, captures output, advertises nothing.
muster run codex --kind task --prompt 'Summarise the failing tests' --level read
muster output <id>

# What is running, and stopping it.
muster list --format human
muster stop <id>

--level names a containment pair. read can look but not change; work can edit its working directory, except muster's own home (~/.muster); open removes the sandbox and needs allow_dangerous_flags in config.

Level

The agent asks before acting

What it may touch

read

always

nothing on disk

work

no

its cwd, except ~/.muster

open

no

everything

Claude asks to trust a directory the first time. That is a one-time review you do yourself — or --options auto-approve-path, which records it for you after checking the directory ships no hooks. See Claude workspace trust.

Requirements

Node 22.12+ (tested on 24.16), and a POSIX host with ps and lsof. Terminals use tmux or node-pty. The OS sandbox is seatbelt, so kernel-enforced containment is macOS only; everywhere else enforcement reports what was actually applied rather than pretending.

Then whichever agents you mean to launch, installed and logged in. Verified against Claude Code 2.1.274, Codex 0.155.1 and OpenCode 1.18.31 or newer — a newer OpenCode must keep the CLI and loopback HTTP API Muster uses. What that verification covers is in Verification.

Documentation

How a launch runs

hosts, terminals, lifetimes, repeated requests

Configuration and permissions

containment, config file, remote callers

Agent identities

running as a named account

Claude workspace trust

the one-time dialog, and the two gates behind it

Command-line reference

output formats, runtime pass-through

MCP servers and plugins

tools for launched agents, and Muster's own MCP server

Verification

what is tested, what is checked by hand

Keeping it up to date

Publishing a release does not touch an installed copy: muster --version keeps reporting the old version until you update it.

npm update -g @brutalsystems/muster

If which muster resolves to a version-manager shim (for example ~/.asdf/shims/muster), run that update under the Node the shim resolves to and reshim afterwards — asdf reshim nodejs — or the shim keeps pointing at the old binary.

An MCP server starts once at session startup, so an agent session that already has Muster loaded keeps running the old binary until that session restarts. Updating on disk is not enough; restart the session too.

Build and run locally

npm run check is the local gate: it builds, runs the suite, then packs and verifies the tarball — the same scripts/check-tarball.mjs the CI packing job runs, so the two cannot disagree about what "verified" means. npm test alone does not pack anything, so tarball drift is green locally and red on push.

It is not everything CI does: CI additionally runs the suite across the Node version matrix, and the contract suite runs only on release. Passing check is necessary rather than sufficient.

Beyond the runtime requirements above, building needs TypeScript 5. The terminal interface itself is platform-neutral; the macOS Terminal driver is an unavailable v1 stub.

npm ci
npm run build
node dist/muster.js run codex --prompt 'Review the authentication flow'
node dist/muster.js run claude --prompt 'Summarize the project' --host tmux
node dist/muster.js run opencode --prompt 'Review this project'
node dist/muster.js run opencode --prompt 'Build a plan' -- --model local-provider/qwen3-30b
node dist/muster.js run codex --kind task --prompt 'Explain the test layout'
node dist/muster.js run opencode --kind task --prompt 'Summarize the tests'
node dist/muster.js list
node dist/muster.js list --format human
node dist/muster.js list --kind task
node dist/muster.js output RUN_ID
node dist/muster.js stop THREAD_OR_SESSION_OR_RUN_ID

--prompt is required and cannot be blank. --cwd defaults to the current working directory. --kind defaults to session. All commands except output emit JSON; output prints the captured task output. stop also accepts an unambiguous peer name or canonical address, refusing ambiguity with candidates. Use the durable ID to stop a session whose runtime has renamed it.

License and releases

MIT © 2026 BrutalSystems. See LICENSE. Vendored Tin Can code retains source attribution and its MIT notice.

Publishing is tag-driven and runs in GitHub Actions over OIDC trusted publishing, with no stored npm token. A bare git push publishes nothing; a version tag is what triggers publish.yml. That workflow validates a RELEASE_NOTES.md section for the version being published, so write the notes under ## Unreleased as you do the work and commit them normally. Cutting the release is then one command:

git commit -am "<the change, including its notes under ## Unreleased>"
npm version patch -m "%s — <what changed>"

npm version runs the version hook, which stamps ## Unreleased into ## <version> — <date> and stages it, then bumps, commits and tags; the postversion hook pushes the commit and tag together. If there is no ## Unreleased section, or it is empty, the stamp refuses — before a tag exists, rather than in CI after one has been pushed.

RELEASING.md covers versioning, package inspection, publication, and release notes in full. Changes to the shared address format require an explicit contract update; Muster never independently fixes the frozen naming behavior.

Available Tools

5 tools
listA

List Muster-owned sessions and tasks, including host capabilities.

ParametersJSON Schema
NameRequiredDescriptionDefault
kindNo

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must disclose behavioral traits. It describes the action as non-mutating ('List'), which implies a read-only operation, but it does not explicitly state there are no side effects, nor does it mention authentication requirements, pagination, or output format. 'Including host capabilities' hints at extra data, but no details are given. This is adequate for a simple list tool but not richly transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence that front-loads the primary purpose ('List Muster-owned sessions and tasks') before adding the secondary detail about host capabilities. It contains no filler or repetition, and its brevity is appropriate for a tool with only one optional parameter.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's low complexity (one optional enum parameter, no output schema, no annotations), the description covers the main purpose but leaves gaps: it does not explain the 'kind' parameter's effect, nor does it describe the return structure. The phrase 'including host capabilities' suggests extra output but is undefined. For a simple list tool, this is moderately complete but not fully self-sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description does not explain the 'kind' parameter at all. The schema provides an optional enum of 'session' or 'task', but with 0% schema description coverage, the description should clarify how this parameter filters results. The overview says 'sessions and tasks' but not that 'kind' selects between them. This is a meaningful gap, as the parameter's role is left entirely to inference from the schema's enum values.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the operation: 'List Muster-owned sessions and tasks'. It uses a specific verb ('List') and names the resource, which distinguishes it from siblings like 'run', 'stop', and 'output'. The additional 'including host capabilities' makes the scope more specific without confusing the core purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage: the agent should call this when it needs to enumerate existing sessions/tasks. However, it does not explicitly state when to use it over alternatives (e.g., before running or stopping), nor does it describe when not to use it. There is no mention of prerequisites or routing to siblings, leaving the agent to infer the use case.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

outputC

Read captured output from a task run.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYes

TDQS

C2.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. It only says 'Read', implying a non-mutating operation, but does not state whether the task must be finished, whether it blocks, what happens if the id is invalid, or what the output format is. The description is too sparse to convey essential behavioral traits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single short sentence, which is concise, but it is under-specified. It lacks essential context that should be present given the absence of annotations and parameter descriptions. The brevity works against the agent rather than aiding it, so it is not appropriately sized for the tool's needs.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with one parameter, no annotations, and no output schema, the description is severely incomplete. It does not explain what the 'id' is, what 'captured output' means, how to obtain the output, or what the response will look like. An agent cannot reliably invoke this tool correctly based on the provided definition.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has a single required parameter 'id' with no description, and schema coverage is 0%. The description does not explain what 'id' refers to (presumably a task run ID) or how to obtain it. The agent has no information about the parameter's meaning, format, or constraints beyond a minLength of 1.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Read' and the resource 'captured output from a task run', which distinguishes it from sibling tools like run, list, and stop. However, it is slightly vague about what 'captured output' includes (e.g., stdout, stderr, logs), so it does not fully specify the resource.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives such as list or run. It does not mention prerequisites like the task needing to be completed, nor does it contrast with siblings. The agent is left to infer usage context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

runB

Launch an instructed agent. Sessions return only when reachable; tasks return a non-messageable run handle.

ParametersJSON Schema
NameRequiredDescriptionDefault
cwdNo
mcpNoConfigured MCP server names. Omit for session defaults; [] disables all. Tasks have no defaults.
ttlNoStop this tmux session the given duration after launch regardless of activity, as 90s/30m/4h, or 'off'. Off by default.
argsNo
hostNo
kindNosession
openNoOpen the tmux session in a terminal viewer (macOS only).
levelNoA spelling of a legal permissions/sandbox pair: read is deny + read-only, work is auto + workspace-write, open is bypass + full-access. Naming a level and either flag is an error.
modelNoModel for the launch. A bare model id for claude and codex; PROVIDER/MODEL for opencode, where it overrides the configured [opencode] model. Recorded on the run and reported by `list`.
titleNoTerminal title for this tmux session, shown by any terminal attached to it. Defaults to the session's name and runtime once it is reachable; the agent's own title is shown instead only with [session] title_from_agent. Control characters are stripped and it is capped at 100 characters. Refused for tasks and for pty or macos-terminal hosts.
pluginNoConfigured OpenCode plugin names. Omit for session defaults; [] disables all. OpenCode only.
promptYes
optionsNoMuster-side launch options. auto-approve-path records the launch directory as trusted in the profile the agent will use, so its one-time dialog does not block the launch; refused for a runtime with no trust gate, and refused if the directory ships hooks or MCP servers. accept-bypass-warning accepts Claude's one-time Bypass Permissions warning for a bypass launch (level open); refused for other runtimes and without bypass permissions. Not expressible remotely.
projectNoA project named in config.toml, used instead of cwd. Naming both is an error.
runtimeYes
sandboxNoDefaults to config (read-only). Full access requires config authorization.
identityNoA named identity created by `muster setup-identity`; the agent runs as that account instead of inheriting the ambient environment. A non-local requester is bounded by its profile's identities.
terminalNoViewer app; requires open. Auto uses Terminal.app.
requestKeyNoCaller-owned identity for this launch. Repeating it returns the launch it already produced instead of starting another; repeating it with different parameters is refused.
idleTimeoutNoStop this tmux session after the given inactivity, as 90s/30m/4h, or 'off'. Off by default. Refused for tasks and for pty or macos-terminal hosts, which do not outlive their parent.
permissionsNoDefaults to config (deny). Auto requires workspace-write; bypass requires authorized full-access.

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden, and it does disclose one important trait: sessions only return when reachable and tasks yield a non-messageable handle. That is genuinely useful blocking/return semantics, but it says nothing about permissions, sandbox bypass, or refusal conditions that dominate this tool's risk profile.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences, front-loaded with the action and followed by the mode-dependent outcome. Every sentence earns its place, though the brevity is stark against a 21-parameter tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 21-parameter launch tool with no annotations and no output schema, the description is far too thin. It omits auth/prerequisite context, safety-relevant launch semantics, and any return-structure detail beyond the single task-handle note.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 71%, so the schema documents most parameters in detail. The description adds meaning only for the session/task outcome, not for any named parameter, so it neither compensates heavily nor repeats the schema. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ("Launch an instructed agent") and clarifies the two operating modes it produces. It is clearly the launching tool versus siblings like list/output/stop, though it does not explicitly name or contrast against them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit when-to-use or when-not guidance for the 21 parameters. The session-vs-task return distinction implies how the kind choice behaves, but prerequisites and exclusions are left to the schema.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

stopA

Stop a Muster-owned run by durable id or unambiguous peer name.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYes

TDQS

A3.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full responsibility for behavioral disclosure. It only says 'Stop,' implying a mutating action, but does not disclose whether stopping is irreversible, what happens to the run's output, permission requirements, or idempotency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler. Every part contributes: the action, the resource scope, and the accepted identifier forms.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple and the description covers the action and parameter semantics, so an agent can likely invoke it correctly. However, with no annotations and no output schema, it omits behavioral consequences and does not mention how to obtain the id or name, despite the sibling list tool existing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has one required string id with no description (0% coverage). The description adds crucial meaning by explaining that id can be a durable id or an unambiguous peer name, which is not derivable from the schema. It does not define the formats, but it compensates well for the schema gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description uses a specific verb ('Stop') and names the exact resource ('Muster-owned run'), plus the identifier forms accepted. It is clearly distinct from siblings run, list, and output.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies this tool is for stopping an existing Muster-owned run and even states how to identify it, but it does not explicitly mention when not to use it or direct the agent to list for finding ids. Usage context is clear but alternatives are left implicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

titleB

Retitle a running tmux session by durable id or unambiguous peer name, from outside its agent.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYes
titleYes

TDQS

B3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It conveys that this mutates a running session's title, but says nothing about failure behavior, ambiguity resolution, whether the title must be unique, or what response to expect.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no wasted words; the resource and accepted identifier forms come first.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a mutation tool with no annotations and no output schema, the description is thin. It omits error/ambiguity behavior, session-existence requirements, and confirmation of the applied title, which an agent needs before invoking.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must compensate. It does add one useful fact: id may be a durable id or an unambiguous peer name. But it gives no format, length, or validity guidance for either id or title, leaving half the parameter meaning unexplained.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (retitle) and resource (a running tmux session), and identifies the identifiers accepted. It does not explicitly contrast with siblings like run or stop, but the mutation of session metadata is distinct enough to identify.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'from outside its agent' implies the calling context (an external caller, not the session's own agent), which is useful guidance. However, it never states when to retitle versus other operations, or prerequisites such as the session needing to exist.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 2 tool updatesv1.2.0
    • Changedrun3 fields changed
      • changedInput schema / properties / idleTimeout / description
        Previous value: -"Stop this tmux session after the given inactivity, as 90s/30m/4h, or 'off'. Defaults to 30m. Refused for tasks and for pty or macos-terminal hosts, which do not outlive their parent."New value: +"Stop this tmux session after the given inactivity, as 90s/30m/4h, or 'off'. Off by default. Refused for tasks and for pty or macos-terminal hosts, which do not outlive their parent."
      • addedInput schema / properties / options
        Added value: +{
        +  "description": "Muster-side launch options. auto-approve-path records the launch directory as trusted in the profile the agent will use, so its one-time dialog does not block the launch; refused for a runtime with no trust gate, and refused if the directory ships hooks or MCP servers. accept-bypass-warning accepts Claude's one-time Bypass Permissions warning for a bypass launch (level open); refused for other runtimes and without bypass permissions. Not expressible remotely.",
        +  "items": {
        +    "enum": [
        +      "auto-approve-path",
        +      "accept-bypass-warning"
        +    ],
        +    "type": "string"
        +  },
        +  "type": "array"
        +}
      • addedInput schema / properties / title
        Added value: +{
        +  "description": "Terminal title for this tmux session, shown by any terminal attached to it. Defaults to the session's name and runtime once it is reachable; the agent's own title is shown instead only with [session] title_from_agent. Control characters are stripped and it is capped at 100 characters. Refused for tasks and for pty or macos-terminal hosts.",
        +  "type": "string"
        +}
    • Addedtitle
  2. 1 tool updatev0.9.1
    • Changedrun2 fields changed
      • addedInput schema / properties / idleTimeout
        Added value: +{
        +  "description": "Stop this tmux session after the given inactivity, as 90s/30m/4h, or 'off'. Defaults to 30m. Refused for tasks and for pty or macos-terminal hosts, which do not outlive their parent.",
        +  "type": "string"
        +}
      • addedInput schema / properties / ttl
        Added value: +{
        +  "description": "Stop this tmux session the given duration after launch regardless of activity, as 90s/30m/4h, or 'off'. Off by default.",
        +  "type": "string"
        +}
  3. 1 tool updatev0.7.21
    • Changedrun1 field changed
      • changedInput schema / properties / model / description
        Previous value: -"PROVIDER/MODEL, overriding the configured [opencode] model. OpenCode only."New value: +"Model for the launch. A bare model id for claude and codex; PROVIDER/MODEL for opencode, where it overrides the configured [opencode] model. Recorded on the run and reported by `list`."
  4. 1 tool updatev0.7.14
    • Changedrun6 fields changed
      • addedInput schema / properties / identity
        Added value: +{
        +  "description": "A named identity created by `muster setup-identity`; the agent runs as that account instead of inheriting the ambient environment. A non-local requester is bounded by its profile's identities.",
        +  "pattern": "^[a-zA-Z0-9_-]+$",
        +  "type": "string"
        +}
      • addedInput schema / properties / level
        Added value: +{
        +  "description": "A spelling of a legal permissions/sandbox pair: read is deny + read-only, work is auto + workspace-write, open is bypass + full-access. Naming a level and either flag is an error.",
        +  "enum": [
        +    "read",
        +    "work",
        +    "open"
        +  ],
        +  "type": "string"
        +}
      • addedInput schema / properties / model
        Added value: +{
        +  "description": "PROVIDER/MODEL, overriding the configured [opencode] model. OpenCode only.",
        +  "minLength": 1,
        +  "type": "string"
        +}
      • addedInput schema / properties / plugin
        Added value: +{
        +  "description": "Configured OpenCode plugin names. Omit for session defaults; [] disables all. OpenCode only.",
        +  "items": {
        +    "pattern": "^[a-zA-Z0-9_-]+$",
        +    "type": "string"
        +  },
        +  "type": "array"
        +}
      • addedInput schema / properties / project
        Added value: +{
        +  "description": "A project named in config.toml, used instead of cwd. Naming both is an error.",
        +  "pattern": "^[a-zA-Z0-9_-]+$",
        +  "type": "string"
        +}
      • addedInput schema / properties / requestKey
        Added value: +{
        +  "description": "Caller-owned identity for this launch. Repeating it returns the launch it already produced instead of starting another; repeating it with different parameters is refused.",
        +  "maxLength": 200,
        +  "minLength": 1,
        +  "type": "string"
        +}
  5. 1 tool updatev0.7.8
    • Changedrun4 fields changed
      • addedInput schema / properties / mcp
        Added value: +{
        +  "description": "Configured MCP server names. Omit for session defaults; [] disables all. Tasks have no defaults.",
        +  "items": {
        +    "pattern": "^[a-zA-Z0-9_-]+$",
        +    "type": "string"
        +  },
        +  "type": "array"
        +}
      • addedInput schema / properties / open
        Added value: +{
        +  "description": "Open the tmux session in a terminal viewer (macOS only).",
        +  "type": "boolean"
        +}
      • changedInput schema / properties / runtime / enum
        Previous value: -[
        -  "codex",
        -  "claude"
        -]New value: +[
        +  "codex",
        +  "claude",
        +  "opencode"
        +]
      • addedInput schema / properties / terminal
        Added value: +{
        +  "description": "Viewer app; requires open. Auto uses Terminal.app.",
        +  "enum": [
        +    "auto",
        +    "terminal",
        +    "iterm2",
        +    "ghostty"
        +  ],
        +  "type": "string"
        +}
  6. 4 tool updatesv0.3.0
    • First observedlist
    • First observedoutput
    • First observedrun
    • First observedstop

TDQS

B3.4/5.0

Scored across 5 tools

Disambiguation5/5

Each tool targets a distinct lifecycle action: run launches, list enumerates, output reads, title renames, and stop terminates. Overlap is minimal, with output and list only differing by scope.

Naming Consistency5/5

All tool names are lowercase single-word commands (run, title, list, output, stop), giving a consistent imperative style. No mixed conventions or prefixes/suffixes are present.

Tool Count5/5

Five tools is compact and appropriate for a session/task orchestration server, covering launch, inspection, output retrieval, naming, and termination without redundancy. No obvious over- or under-scoping.

Completeness4/5

The surface covers the core lifecycle: launch (run), list/inspect (list), read output (output), rename (title), and stop. It may lack a direct message/send tool for interacting with reachable sessions, but core operations are present.

Maintenance

ActivityMaintained
ResponsivenessUnresponsive

Related MCP Connectors

Related MCP Servers