X-Ways MCP
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@X-Ways MCPvalidate XWFIM cache at C:\xwfim\Temp"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
X-Ways MCP Server
An MCP server for X-Ways Forensics triage, installation validation, and controlled automation.
This repo follows the same general idea as bethington/ghidra-mcp: put a
specialist desktop analysis tool behind a structured MCP surface so agents can
inspect state, run repeatable workflows, and keep a useful audit trail. The first
version is intentionally a safe control plane. When command-line or scripting
coverage is not enough, runners should generate a small X-Tension bridge for the
specific in-process gap and document the API provenance for future runs.
Current Capabilities
Discover X-Ways Forensics, WinHex, X-Ways Imager, and XWFIM executables.
Validate XWFIM
Tempdownloads and detect truncated ZIPs such as a badviewer.zip.Hash evidence and downloaded packages with MD5/SHA-1/SHA-256.
Create repeatable case workspace folders.
Build read-only triage inventories for mounted folders or exports.
Run a forensic harness that writes case manifests, report stubs, status JSON, and audit logs compatible with
Donovoi/forensic-copilot.Create disposable synthetic test environments for Windows, Linux, macOS, and generic evidence fixtures.
Build X-Ways launch commands without executing them.
Optionally launch X-Ways when explicitly enabled.
Fetch public X-Ways release information for quick version checks.
Cache and search the X-Ways manual locally for command-line, scripting, and headless workflow syntax.
Plan X-Ways operations with a headless-first, native-distributed-RVS, X-Tension-next, UI-last policy.
Generate local X-Tension bridge scaffolds with API notes and build hooks.
Inventory X-Ways executable imports, delay imports,
XWF_*exports, andXWF_*/XT_*string clues with documented PowerShell cmdlets.Expose the 77 verified
XWF_*exports as agent-facing PowerShell cmdlets that create validated JSONL requests for an in-process X-Tension bridge.Plan parallel X-Ways processing from the local manual: native distributed volume snapshot refinement first, isolated worker cases only as fallback.
Provide a reusable PowerShell guardrail module for container-first exports, manual/action gates, and contemporaneous notes.
Prefer query-first X-Ways analysis through command-line/script, Export List metadata, X-Tensions, reports, or bounded UI before materializing file contents.
Run read-only X-Ways case database usage-pattern triage from metadata strings, with sanitized reports and local-only alias maps.
Provide a loose case-run manifest contract so examiner harnesses such as
Donovoi/forensic-copilotcan consume sanitized X-Ways outputs without becoming tightly coupled to this repo.Maintain a generic best-practice catalog so notes can record which jurisdiction/SOP guidance was followed and why.
Related MCP server: Systems Manager
Safety Model
Read-only and dry-run behavior is the default.
launch_xways will not execute unless both conditions are true:
XWAYS_MCP_ALLOW_EXECUTE=1the tool call passes
confirm=true
This avoids accidentally starting analysis, imaging, or script workflows while an agent is still planning.
Automation preference is:
Manual first: check the newest available X-Ways manual, official docs, or approved local docs cache before deciding command syntax, API behavior, distributed processing, X-Tension work, or UI fallback.
X-Ways command-line, scripts, saved dialog selections,
Cfg:,XT:, andXTParam:*.X-Ways native distributed RVS for different evidence objects in the same case when the manual supports it.
A generated X-Tension bridge when the task needs in-process X-Ways access or the API covers something the headless surface cannot.
UI automation only as a bounded last resort.
If a runner uses documented or undocumented X-Tensions API behavior, it must record the symbols, X-Ways version constraints, and provenance in local bridge notes before using the bridge on real evidence.
X-Ways analysis is query-first. Use command-line/script routes, Export List metadata, reports, X-Tensions, or bounded UI queries when they can answer the question without materializing file contents. File-content exports are container-first only when bytes must leave X-Ways for external tooling. Metadata-only lists can be exported for planning, but copied/recovered file contents must first go into an X-Ways evidence file container.
Requirements
Python 3.10+
X-Ways Forensics, WinHex, X-Ways Imager, or XWFIM installed separately
Windows for real X-Ways launching and executable version inspection
The server itself can run on other platforms for archive validation, hashing, and folder inventory work.
Quick Start
python -m venv .venv
.\.venv\Scripts\Activate.ps1
python -m pip install -e ".[dev]"
pytest
python -m xways_mcp --transport stdioCache the current X-Ways manual locally for offline model lookup:
python -m pip install -e ".[dev]"
python -c "from xways_mcp.manual import cache_xways_manual; print(cache_xways_manual(source=r'<XWAYS_ROOT>\manual.pdf'))"To refresh from the public X-Ways manual and official scripting/setup pages:
python -c "from xways_mcp.manual import cache_xways_manual; print(cache_xways_manual(download_latest=True, fetch_official_docs=True, refresh=True))"Run the MCP stdio smoke test:
python scripts\smoke_mcp.py --search-root "<XWFIM_ROOT>" --public-releaseRun a forensic-copilot-compatible harness preflight:
python -m xways_mcp.harness xwfim-preflight `
--case-name CASE-001 `
--xwfim-root "<XWFIM_ROOT>" `
--staging-root artifacts `
--output-root reports `
--evidence-os Windows `
--evidence-mode portable-toolingRun a local query-first usage-pattern triage over an existing X-Ways case database without exporting file contents:
.\scripts\Invoke-XwfCaseDbPathStringTriage.ps1The script writes a sanitized report, structured JSON, and a sensitive local-only alias map under the local case workspace reports folder.
Compare a local X-Ways executable surface against the committed XWF/XT reference baseline:
Import-Module .\powershell\XWaysForensicWorkflow\XWaysForensicWorkflow.psd1 -Force
Compare-XwfExternalSurface `
-XwfRoot "<XWF_ROOT>" `
-OutputDirectory ".\reports\xwf-external-surface"The comparison writes Markdown, JSON, and CSV artifacts for imports, delay imports, exports, API-like strings, and undocumented-looking string candidates.
Create validated XWF API bridge requests with the generated PowerShell cmdlets:
Import-Module .\powershell\XWaysForensicWorkflow\XWaysForensicWorkflow.psd1 -Force
Get-XwfItemName -Argument @{ nItemID = 42 }
Add-XwfComment `
-Argument @{ nItemID = 42; lpComment = 'Reviewed'; nFlagsHowToAdd = 0 } `
-OutboxPath ".\case-workspaces\CASE-001\xwf-api-requests.jsonl" `
-AllowMutatingThese cmdlets do not call X-Ways exports directly from PowerShell. They produce
xwf-api-bridge-request/v1 objects for an in-process X-Tension bridge.
Build disposable synthetic fixtures for every supported evidence OS:
python -m xways_mcp.testenv build --name CASE-001 --evidence-os all --root test-envs --force
python -m xways_mcp.testenv destroy --name CASE-001 --evidence-os all --root test-envs --missing-okConfigure your MCP client with:
{
"mcpServers": {
"xways-mcp": {
"command": "python",
"args": ["-m", "xways_mcp", "--transport", "stdio"],
"env": {
"XWAYS_HOME": "C:\\xwf",
"XWAYS_MCP_SEARCH_ROOTS": "<XWAYS_ROOT>;<XWFIM_ROOT>",
"XWAYS_MCP_ALLOW_EXECUTE": "0",
"PYTHONIOENCODING": "utf-8"
}
}
}
}Useful Tools
environmentpublic_xways_releasemanual_statuscache_xways_manualsearch_xways_manualheadless_xways_referenceplan_xways_operationplan_parallel_xways_jobscreate_xtension_scaffolddiscover_installationsinspect_xwfim_cachevalidate_archivehash_filecreate_workspacetriage_inventorybuild_launch_commandlaunch_xwaysharness_init_caseharness_xwfim_preflightharness_folder_triagetestenv_createtestenv_buildtestenv_runtestenv_destroytestenv_list
See docs/TOOLS.md for details.
See docs/FORENSIC_COPILOT.md for integration with
Donovoi/forensic-copilot.
See docs/INTEGRATION_CONTRACT.md for the loose
adapter contract and shared case-run manifest.
See docs/TEST_ENVIRONMENTS.md for disposable
synthetic fixture testing.
See docs/MANUAL_FIRST.md for the manual-first tooling
policy.
See docs/HEADLESS_XWAYS.md for local manual indexing
and headless command lookup.
See docs/PARALLEL_PROCESSING.md for the
manual-backed distributed processing policy.
See docs/XTENSION_BRIDGE.md for the generated
X-Tension bridge workflow.
See docs/EXTERNAL_SURFACE_ANALYSIS.md for
PE import/export/string analysis and the XWF 21.8 x64 baseline.
See docs/XWF_API_CMDLETS.md for the generated
PowerShell wrappers over the verified XWF_* exports.
See docs/FORENSIC_SOUNDNESS.md for the
container-first export policy and reusable PowerShell module.
See docs/BEST_PRACTICES.md for the public
best-practice catalog and selection workflow.
XWFIM Validation Example
inspect_xwfim_cache(path="<XWFIM_ROOT>")This reports each ZIP in Temp, whether it can be opened, and whether the ZIP
end-of-central-directory record is missing. That is the signal for a truncated
download.
Roadmap
Stabilize the Python MCP control plane.
Add stronger X-Ways script templates for repeatable triage.
Add native distributed RVS orchestration for multi-instance same-case runs.
Generate operation-specific X-Tension DLL bridges for in-process gaps.
Dynamically register X-Tension-backed tools when X-Ways is open.
Add reporting workflows for timeline, search hit, and tagged-file exports.
References
X-Ways X-Tensions API: https://www.x-ways.net/forensics/x-tensions/api.html
X-Ways manual: https://www.x-ways.net/winhex/manual.pdf
X-Ways scripting: https://www.x-ways.net/winhex/scripting.html
X-Ways command-line setup notes: https://www.x-ways.net/winhex/setup.html
X-Ways release mailing list: https://www.x-ways.net/winhex/mailings/
Available Tools
32 toolsbuild_case_db_path_string_triage_commandB
Build, but do not run, the local X-Ways case-DB path-string triage PowerShell command.
| Name | Required | Description | Default |
|---|---|---|---|
| search_root | No | ||
| output_root | No | ||
| throttle_limit | No | ||
| max_matches_per_file | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must carry the burden of behavioral disclosure. It only states 'build, but do not run' but does not describe the output, side effects, or permissions needed. The existence of an output schema is not leveraged in the description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is front-loaded and concise. Every word is meaningful and avoids redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 4 parameters and an output schema, the description is too minimal. It does not explain the output (what the built command looks like) or parameter roles, which is essential for an AI agent to use it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description provides no explanation for any of the 4 parameters (search_root, output_root, throttle_limit, max_matches_per_file). The description adds zero value beyond the schema names.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Build' and the specific resource 'local X-Ways case-DB path-string triage PowerShell command'. It distinguishes from sibling tools like 'run_case_db_path_string_triage' by noting 'but do not run'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implicitly tells when to use this tool (build without running) and contrasts with the run counterpart. However, it does not explicitly list alternatives or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
build_launch_commandC
Build the X-Ways launch command without executing it.
| Name | Required | Description | Default |
|---|---|---|---|
| executable | Yes | ||
| case_path | No | ||
| evidence_path | No | ||
| script_path | No | ||
| extra_args | No | ||
| xt_params_json | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries full burden; it only adds that the tool does not execute, but fails to disclose return format, side effects, or authorization needs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that is efficient, front-loaded, and contains no extraneous information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having an output schema, the description does not mention return values, and with 6 parameters and many siblings, the description is insufficient for complete understanding.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage across 6 parameters, the description provides no parameter information whatsoever, leaving the agent to guess parameter meanings.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Build', the resource 'X-Ways launch command', and explicitly distinguishes that it does not execute, differentiating from sibling 'launch_xways'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like 'launch_xways' or other sibling tools, leaving the agent without context for selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
build_path_usage_pattern_triage_commandA
Build, but do not run, the local sanitizer command for XwfPathExport JSONL output.
| Name | Required | Description | Default |
|---|---|---|---|
| jsonl_path | Yes | ||
| report_directory | Yes | ||
| run_id | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, and the description only states the tool builds a command. It does not disclose side effects, permissions, or what the command does beyond being a 'sanitizer'. Minimal behavioral insight.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that front-loads the key action ('Build, but do not run'). No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having an output schema (not provided), the description is too brief for a tool with 3 parameters and low schema coverage. It lacks details on parameter meanings, command output, and typical use cases.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description does not explain any parameters. Schema description coverage is 0%, so the description should compensate but fails to. It only hints that 'jsonl_path' relates to XwfPathExport output, but leaves 'report_directory' and 'run_id' unexplained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Build') and the resource ('local sanitizer command for XwfPathExport JSONL output'). It distinguishes from siblings like 'run_path_usage_pattern_triage' by specifying 'but do not run'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says 'but do not run', providing a clear usage guideline. It implies that running is done elsewhere (sibling tool), but does not explicitly list alternatives or when-not conditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cache_xways_manualC
Cache and index the X-Ways manual locally for offline model lookup.
| Name | Required | Description | Default |
|---|---|---|---|
| source | No | ||
| cache_dir | No | ||
| refresh | No | ||
| download_latest | No | ||
| fetch_official_docs | No | ||
| timeout | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must disclose behaviors but only states the high-level purpose. It omits details about downloading, refreshing, side effects, permissions, or potential downtime.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence is concise to a fault. It efficiently states purpose but underspecifies all other aspects, making it minimally adequate without being wasteful.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 6 parameters with no schema descriptions, no annotation context, and an output schema, the description fails to provide sufficient detail for correct invocation. Lacks explanation of parameters, return value, and tool effects.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description provides no explanation for any of the 6 parameters (source, cache_dir, refresh, etc.). It adds zero value beyond parameter names.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Cache and index') and the resource ('X-Ways manual'), with the benefit ('for offline model lookup'). It sufficiently distinguishes from sibling tools like 'search_xways_manual' or 'manual_status'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like 'manual_status' or 'search_xways_manual'. Lacks cues for prerequisites, sequencing, or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
case_run_manifest_templateC
Return a generic forensic case-run manifest template for loose tool-adapter integration.
| Name | Required | Description | Default |
|---|---|---|---|
| case_id | No | CASE-001 | |
| question | No | Summarize the forensic tasking here. | |
| evidence_os | No | unknown | |
| evidence_mode | No | unknown | |
| adapter_name | No | xways-mcp | |
| include_schema | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full burden for behavioral disclosure. It only says 'Return', implying a read operation, but does not explicitly state that it is safe, stateless, or what side effects exist. No mention of authentication, rate limits, or scope.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, very concise and front-loaded. However, it is arguably too brief, sacrificing necessary detail for brevity. Every word earns its place but could be expanded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 6 parameters with no description coverage and no usage guidance, the description is insufficient for full understanding. The presence of an output schema helps but does not compensate for missing parameter semantics and behavioral context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the description adds no information about any of the 6 parameters. The defaults and titles provide minimal context, but the description fails to explain their meaning or relationships.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it returns a generic forensic case-run manifest template for loose tool-adapter integration. The verb 'return' and the resource 'manifest template' are specific, but it does not differentiate from sibling tools like create_xtension_scaffold or harness_folder_triage.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool vs alternatives. It does not mention prerequisites, when not to use it, or any context for selection among siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_workspaceB
Create a case workspace with evidence, export, report, log, and script folders.
| Name | Required | Description | Default |
|---|---|---|---|
| case_name | Yes | ||
| base_dir | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description carries full burden. It only states it creates folders but provides no information on side effects, failure modes, permissions needed, or whether it is destructive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One sentence, no wasted words. Front-loaded with verb and key outcome.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Simple tool with 2 parameters and output schema; description gives basic idea but lacks usage guidelines and parameter details. Barely adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so description must add parameter meaning. It does not explain 'case_name' or 'base_dir' beyond mentioning folder types. No additional semantics provided.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool creates a case workspace with specific folders (evidence, export, report, log, script). It uses a specific verb and resource, and distinguishes it from sibling tools that focus on building commands or triage.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. It does not mention prerequisites, context of use, or when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_xtension_scaffoldC
Generate a local X-Tension bridge scaffold with API provenance notes.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | ||
| output_root | No | xtensions | |
| purpose | No | ||
| api_reference | No | ||
| documented_symbols | No | ||
| undocumented_symbols | No | ||
| force | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full behavioral disclosure burden. It only states that a scaffold is generated but does not mention side effects (e.g., file creation, overwriting), required permissions, or whether the operation is safe or destructive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
While the description is a single short sentence, it is too brief for a tool with 7 parameters. It lacks essential information and feels under-specified rather than efficiently concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (7 parameters, no annotations, 0% schema coverage), the description is incomplete. It does not explain parameter semantics, usage context, or behavioral traits, even though an output schema may exist.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. However, the description adds no parameter-level details. Users must infer meanings from names like 'documented_symbols' or 'force' without any explanation of their roles or formats.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's main action: 'Generate a local X-Tension bridge scaffold with API provenance notes.' It specifies a unique verb-resource combination that distinguishes it from all sibling tools, which focus on different operations like building commands or caching manuals.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. There is no mention of prerequisites, when-not-to-use, or suggested alternative tools for related tasks.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
discover_installationsC
Discover X-Ways, WinHex, X-Ways Imager, and XWFIM executables.
| Name | Required | Description | Default |
|---|---|---|---|
| search_roots | No | ||
| max_depth | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It only states that the tool discovers executables but does not mention if it reads files, modifies anything, or has side effects. It does not disclose resource usage or error conditions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no fluff. It is front-loaded with the action and purpose. Every word is necessary.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is too brief given the tool has two parameters and an output schema. It does not explain what 'discover' entails (e.g., scanning directories, returning paths) or how the parameters affect behavior. While the output schema covers return format, the lack of behavioral context leaves the tool under-specified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description does not mention the parameters 'search_roots' or 'max_depth' at all. With 0% schema coverage, the lack of parameter explanation severely hampers correct usage. The schema provides only default values and types, leaving the agent to guess their meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description specifies exactly what the tool does: discovering executables of X-Ways, WinHex, X-Ways Imager, and XWFIM. The verb 'discover' and the resource 'executables' are clear. No sibling tool has a similar purpose, so it is well-differentiated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool, when not to, or any alternatives. It lacks context on prerequisites, typical use cases, or comparison to sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
environmentA
Return server configuration, platform, and execution safety status.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries burden. It implies read-only by saying 'return', but does not explicitly state safety, side effects, or permissions required.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, 10 words, no filler. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool has 0 parameters and an output schema. Description covers main purpose; could mention it's a safe read operation, but output schema handles return details.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters, baseline is 4 per rules. Description adds no parameter info as none exist.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states it returns server configuration, platform, and execution safety status. It distinguishes from siblings like 'discover_installations' which focuses on installation paths.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use or when-not-to-use guidance. While it's a general query tool, alternatives like 'discover_installations' exist for similar queries, but no differentiation provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
harness_folder_triageC
Run read-only folder triage and write forensic-copilot-compatible artifacts.
| Name | Required | Description | Default |
|---|---|---|---|
| case_name | Yes | ||
| input_root | Yes | ||
| staging_root | No | artifacts | |
| output_root | No | reports | |
| depth | No | triage | |
| evidence_os | No | unknown | |
| evidence_mode | No | mounted-folder | |
| max_files | No | ||
| hash_small_files | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must fully disclose behavioral traits. It mentions 'read-only' to indicate non-destructive intent, but does not discuss side effects of writing artifacts, required permissions, rate limits, or error handling. The description is insufficient for a tool with 9 parameters.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no wordiness. It is concise but at the expense of completeness. The structure is clean, but the brevity reduces its usefulness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (9 parameters, 2 required, no schema descriptions) and the presence of many sibling tools, the description is too brief to provide adequate context. It does not explain return values, parameter roles, or how this tool fits into the larger workflow, despite an output schema existing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must explain parameter meanings. The description provides no information about the 9 parameters (case_name, input_root, staging_root, etc.), leaving the agent to guess what each parameter does without any added semantic value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool runs read-only folder triage and writes forensic-copilot-compatible artifacts, specifying the verb 'run' and the resource 'folder triage'. However, it does not explicitly differentiate from sibling tools like 'triage_inventory' or 'run_case_db_path_string_triage', which may have overlapping purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives, such as when to choose 'harness_folder_triage' over 'run_case_db_path_string_triage' or 'triage_inventory'. There are no explicit exclusions or context indicators.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
harness_init_caseC
Create a forensic-copilot-compatible manifest, report stub, and audit log.
| Name | Required | Description | Default |
|---|---|---|---|
| case_name | Yes | ||
| input_roots | No | ||
| staging_root | No | artifacts | |
| output_root | No | reports | |
| depth | No | triage | |
| evidence_os | No | unknown | |
| evidence_mode | No | unknown | |
| runner_boundary | No | local |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must disclose behavioral traits. It only states what is created but not side effects, idempotency, required permissions, or whether existing files are overwritten. Incomplete disclosure for a setup tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The single sentence is concise but under-specified for an 8-parameter tool. It lacks structure or additional context, wasting the opportunity to convey important details briefly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 8 parameters, zero schema descriptions, no annotations, and a large sibling set, the description fails to provide enough context for correct agent invocation. Missing return value info despite output schema existing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 0% description coverage and the description does not explain any of the 8 parameters (e.g., case_name, depth, evidence_os). Without linking parameters to the three created items, an AI cannot infer correct parameter usage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool creates three specific items (manifest, report stub, audit log) with a 'forensic-copilot-compatible' qualifier. However, it does not differentiate from sibling tools like 'case_run_manifest_template' which may also create manifests.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives like 'create_workspace' or 'harness_folder_triage'. Missing prerequisites or context for invocation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
harness_xwfim_preflightC
Run XWFIM preflight and write artifacts, status JSON, report stub, and audit log.
| Name | Required | Description | Default |
|---|---|---|---|
| case_name | Yes | ||
| xwfim_root | Yes | ||
| staging_root | No | artifacts | |
| output_root | No | reports | |
| evidence_os | No | Windows | |
| evidence_mode | No | portable-tooling | |
| depth | No | triage | |
| public_release | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description mentions the tool writes multiple outputs (artifacts, status JSON, report stub, audit log), which implies side effects. However, it does not disclose potential impacts like required permissions, idempotency, or whether it is a safe read operation. Without annotations, the description carries full burden but only partially addresses behavioral traits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that efficiently states the action and outputs. It is concise without being too sparse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 8 parameters with 0% schema description coverage and no annotations, the description is incomplete. It does not explain the preflight process, parameter roles, or how the tool fits into a workflow. The output schema exists but is not referenced; the description should provide more context for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description does not explain any parameter meaning. Although parameter names like 'case_name' and 'xwfim_root' are somewhat self-explanatory, the description adds no value beyond the schema. For 8 parameters, this is insufficient.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Run' and resource 'XWFIM preflight', and lists the outputs (artifacts, status JSON, report stub, audit log). While it does not explicitly differentiate from sibling tools like 'inspect_xwfim_cache', the name and description give a clear sense of the action.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives, prerequisites, or context. The description only states what the tool does without any usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
hash_fileB
Hash a file using comma-separated algorithms such as md5,sha1,sha256.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| algorithms | No | sha256 |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description must fully inform. It does not disclose any behavioral traits such as whether the operation is read-only (likely read-only but not stated), permission requirements, or error conditions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is concise and front-loaded, containing no extraneous information. Every part is necessary and directly conveys the tool's function.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with only two parameters and an output schema, the description is minimally adequate. However, it lacks details on expected input formats, error handling, or return values, which an output schema may partially cover but is not referenced.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds meaning by explaining that algorithms are comma-separated and listing examples, but it does not elaborate on the path parameter. With 0% schema description coverage, the description provides some additional context but not enough to fully compensate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool hashes a file and specifies the input as comma-separated algorithms. The verb 'hash' and resource 'file' are precise, and it uniquely identifies its function among sibling tools, which do not include other hashing tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives or when not to use it. There is no mention of prerequisites, typical scenarios, or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
headless_xways_referenceC
Retrieve local manual snippets relevant to X-Ways command-line and scripting automation.
| Name | Required | Description | Default |
|---|---|---|---|
| topic | No | ||
| cache_dir | No | ||
| limit | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description should disclose behavioral traits. It mentions 'local' and 'snippets' implying cached content, but does not state whether it triggers caching, requires prior caching, or any side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence, but it sacrifices essential detail. It is not overly long, but could be more informative without losing conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given three parameters, no annotations, and no schema descriptions, the description fails to provide sufficient context for an agent to understand how to use the tool effectively. The output schema exists but is not referenced.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description does not explain any of the three parameters (topic, cache_dir, limit). The description adds no value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves local manual snippets relevant to X-Ways automation, with a clear verb and resource. However, it does not distinguish from the sibling tool 'search_xways_manual' which likely searches the manual.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives like 'search_xways_manual' or 'cache_xways_manual'. The description lacks any context for selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
inspect_xwfim_cacheC
Validate XWFIM Temp ZIP downloads, including truncated viewer archives.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It mentions handling truncated archives but does not disclose whether the tool is read-only, what side effects exist, error behaviors, or required permissions. The behavioral profile is under-specified.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no extraneous content, but it could benefit from additional structure or detail without becoming verbose. It is minimally concise but not optimally informative.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has one optional parameter and no annotations, the description should provide more context about validation criteria, output format (though output schema exists but is not shown), and usage scenarios. It is incomplete for an agent to use reliably.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema coverage for the 'path' parameter is 0% and the description does not explain what the parameter is, its expected format, or default behavior. The agent has no semantic understanding of the parameter beyond its name.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool validates XWFIM Temp ZIP downloads and explicitly mentions handling truncated viewer archives, which distinguishes it from sibling tools like 'validate_archive'. It uses a specific verb and resource, but could be more precise about what validation entails.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It does not mention prerequisites, context, or exclusions. Agents have no basis to choose this over 'validate_archive' or other validation tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
launch_xwaysC
Launch X-Ways only when XWAYS_MCP_ALLOW_EXECUTE=1 and confirm=true.
| Name | Required | Description | Default |
|---|---|---|---|
| executable | Yes | ||
| case_path | No | ||
| evidence_path | No | ||
| script_path | No | ||
| extra_args | No | ||
| xt_params_json | No | ||
| confirm | No | ||
| wait | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description bears full responsibility. It only mentions launch conditions, not potential side effects like process blocking, resource consumption, or error handling. Critical behavioral traits are omitted.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, which is concise, but it lacks structure and critical details. It could be expanded with parameter summaries and usage context without losing conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 8 parameters (1 required), no parameter descriptions, and no annotation, the description is too minimal. It fails to explain output or how parameters interact. A more complete description is needed for an 8-param tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description adds no information about any of the 8 parameters. Parameters like xt_params_json are unclear. The description does nothing to clarify parameter meaning, leaving the agent to rely solely on names.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool launches X-Ways, which is a specific action. However, it does not differentiate from sibling tools like headless_xways_reference or run_* commands, which could also involve launching. A more explicit distinction would improve clarity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides two prerequisites (env variable and confirm flag) but offers no guidance on when to use this tool versus alternatives. It implies usage only when these conditions are met, but missing comparative context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
manual_statusC
Report local X-Ways manual candidates and the offline manual index status.
| Name | Required | Description | Default |
|---|---|---|---|
| search_roots | No | ||
| cache_dir | No | ||
| check_online | No | ||
| timeout | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. It only says 'report', implying read-only, but discloses no side effects, return format, or behavior like whether it modifies state. Minimal behavioral insight.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence, front-loaded with the action. However, given the tool's complexity (4 parameters, no schema descriptions), it is too brief and leaves critical questions unanswered.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is an output schema, so return values may be documented, but the description fails to explain how parameters affect output or what 'candidates' means. With 4 parameters and 0% schema coverage, the description is incomplete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% and description does not explain any of the 4 parameters. Without parameter descriptions or contextual hints, the agent cannot understand how to use search_roots, cache_dir, check_online, or timeout.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('report') on specific resources ('local X-Ways manual candidates' and 'offline manual index status'). It distinguishes from siblings like 'cache_xways_manual' and 'search_xways_manual', though 'candidates' is slightly vague.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use or not use this tool vs alternatives. The description does not mention prerequisites, typical scenarios, or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
plan_parallel_xways_jobsC
Plan manual-backed parallel X-Ways workers without launching them.
| Name | Required | Description | Default |
|---|---|---|---|
| case_name | Yes | ||
| evidence_paths | Yes | ||
| workspace_root | No | artifacts | |
| case_path | No | ||
| operation | No | xways_analysis | |
| requested_workers | No | ||
| max_workers | No | ||
| xways_extra_threads_per_worker | No | ||
| execution_mode | No | auto | |
| gpu_mode | No | auto | |
| executable | No | ||
| script_path | No | ||
| allow_shared_case | No | ||
| include_sensitive_paths | No | ||
| write_plan | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of disclosure. It only states 'plan' and 'manual-backed', but does not explain what planning entails (e.g., output, side effects, permissions). Behavioral traits such as destructiveness or rate limits are absent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very concise (one sentence), which is efficient but sacrifices necessary detail. It front-loads the core action but omits parameter and behavioral context.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (15 parameters, no annotations, output schema exists), the description is severely incomplete. It does not explain return values, prerequisites, or parameter usage, leaving the agent underinformed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description provides no information about the 15 parameters. The agent must rely solely on parameter names, which may be ambiguous (e.g., 'execution_mode', 'write_plan'). The description adds no value here.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action 'plan' and the resource 'parallel X-Ways workers', and distinguishes from similar tools by specifying 'without launching them'. This differentiates it from sibling tools like 'launch_xways'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like 'plan_xways_operation' or 'launch_xways'. The description lacks context about prerequisites or suitable scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
plan_xways_operationC
Choose the preferred X-Ways route: headless, native distributed RVS, X-Tension, then UI.
| Name | Required | Description | Default |
|---|---|---|---|
| operation | Yes | ||
| known_headless | No | ||
| known_xtension_api | No | ||
| requires_in_process | No | ||
| allow_ui_fallback | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided. The description only says 'choose the preferred route', but does not disclose what happens when called (e.g., returns a decision, modifies state). No behavioral traits beyond the vague choice.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very short (one sentence), achieving conciseness but at the expense of completeness. It is not well-structured; it lists options without clear flow.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 5 parameters, 1 required, no schema descriptions, and an output schema present, the description is severely incomplete. It fails to explain inputs, outputs, or the decision-making process.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% and the description does not explain any of the 5 parameters (operation, known_headless, etc.). No meaning is added beyond the schema field names.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'Choose the preferred X-Ways route: headless, native distributed RVS, X-Tension, then UI.' This gives a hint of selecting among options, but lacks a clear verb+resource statement like 'plans the optimal execution method for an X-Ways operation'. The purpose is vague.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like directly launching or using other planning tools. The description does not mention context or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
public_xways_releaseC
Fetch the public X-Ways release version from X-Ways web pages.
| Name | Required | Description | Default |
|---|---|---|---|
| timeout | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden for behavioral disclosure. It mentions fetching from web pages but does not disclose network behavior, rate limits, caching, or potential side effects. The behavioral transparency is insufficient for an unannotated tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single short sentence that efficiently conveys the core purpose. However, it omits critical details about parameters and behavior, which prevents a higher score. It is concise but not optimally informative.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given that the tool has an output schema (not shown) and a single optional parameter, the description still lacks essential context about return values, network dependencies, and expected usage patterns. The complexity is low, but the description fails to provide a complete picture for an agent to use the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has only one parameter (timeout) with no description in the schema (0% coverage) and no mention in the tool description. The agent receives no guidance on what the timeout controls or its significance, leaving the parameter's semantics entirely ambiguous.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Fetch') and the specific resource ('public X-Ways release version') from a source ('X-Ways web pages'). It is a specific verb+resource combination that distinguishes it from sibling tools, which involve building commands, launching, caching, etc.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No usage guidelines are provided. The description does not indicate when to use this tool versus alternatives, nor does it mention prerequisites or limitations. The agent is left to infer context from the tool name and siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
redaction_statusC
Report whether a local file appears to contain common case-sensitive patterns.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description should disclose behavior like read-only nature, permissions, or output format. It only says 'report' without describing the response or side effects, leaving significant gaps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence with no redundant information, perfectly front-loaded and efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given there is an output schema (not shown), the description doesn't need to detail return values. However, it lacks context about common patterns and usage, making it minimally adequate for a simple tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must compensate. It mentions 'local file' for the path parameter but doesn't clarify format, constraints, or meaning beyond the basic purpose.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool reports on whether a file contains common case-sensitive patterns, using a specific verb and resource. However, it doesn't specify what the patterns are, leaving some ambiguity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus siblings like 'redact_local_file' or prerequisites. The description lacks context for appropriate usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
redact_local_fileC
Redact a local file to another local file without passing case text through MCP.
| Name | Required | Description | Default |
|---|---|---|---|
| input_path | Yes | ||
| output_path | No | ||
| alias_map_path | No | ||
| include_alias_map | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations are absent, so description must disclose behaviors. It only mentions that case text is not passed through MCP, but omits other important traits like file mutation, required permissions, supported formats, or reversibility.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, 14 words, efficient and front-loaded. Every word adds value, no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having 4 parameters and an output schema, the description lacks essential context about redaction behavior, output format, and parameter usage. It is insufficient for reliable tool selection and invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the description provides no explanation for any of the 4 parameters (input_path, output_path, alias_map_path, include_alias_map). The meaning of 'alias_map_path' and 'include_alias_map' remains completely unclear.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool redacts a local file to another local file and highlights a key distinguishing feature (not passing case text through MCP). It uses a specific verb and resource, and differentiates from sibling like 'redaction_status'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives, prerequisites, or when not to use it. The description only states what it does, not when to invoke it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
run_case_db_path_string_triageC
Run local case-DB path-string triage only when XWAYS_MCP_ALLOW_CASE_READ=1 and confirm=true.
| Name | Required | Description | Default |
|---|---|---|---|
| search_root | No | ||
| output_root | No | ||
| throttle_limit | No | ||
| max_matches_per_file | No | ||
| confirm | No | ||
| timeout | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the full burden. It only mentions a usage condition but fails to disclose behavioral traits such as whether the operation is read-only or destructive, side effects, authentication requirements, or output format. This is insufficient for safe invocation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very short (one sentence) and front-loaded with the condition. While concise, it sacrifices essential detail. It is not structured to highlight key aspects like parameters or output.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (6 parameters, no schema descriptions, and an output schema that is not described), the description is woefully incomplete. It does not explain what the tool does in sufficient detail, what the inputs control, or what the output represents.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 6 parameters with 0% schema description coverage, yet the description does not explain any parameter's meaning, default behavior, or relationship to the tool's operation. The description adds zero value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Run local case-DB path-string triage') and includes a condition for usage. However, it does not differentiate from sibling tool 'run_path_usage_pattern_triage' which also performs triage, and the phrase 'path-string triage' is somewhat jargon.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit conditions ('only when XWAYS_MCP_ALLOW_CASE_READ=1 and confirm=true'), which is helpful. But it provides no guidance on when to use this tool versus alternatives like 'run_path_usage_pattern_triage' or 'build_case_db_path_string_triage_command'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
run_path_usage_pattern_triageC
Run local X-Tension JSONL usage-pattern sanitizer only when case-read gate is enabled.
| Name | Required | Description | Default |
|---|---|---|---|
| jsonl_path | Yes | ||
| report_directory | Yes | ||
| run_id | No | ||
| confirm | No | ||
| timeout | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must fully disclose behavioral traits. It only states that the tool 'runs' a sanitizer, but does not mention side effects, authorization requirements, rate limits, or whether the operation is destructive. The term 'sanitizer' is vague and could imply data modification, but this is not clarified.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that conveys the core purpose and a key condition. It is front-loaded and avoids unnecessary words. However, it may be too brief, as it omits critical details about parameters and behavior. Still, it earns its place by being non-redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 5 parameters, no annotations, and an output schema that is not described, the description is insufficient. It does not explain the tool's role among many similar siblings, does not describe output or side effects, and leaves agents without enough information to invoke it correctly in context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, meaning parameters have no descriptions. The tool's description does not explain any of the five parameters (jsonl_path, report_directory, run_id, confirm, timeout). Without this, an agent cannot determine what values to provide beyond their names and types. The description fails to compensate for the lack of schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Run' and the resource 'local X-Tension JSONL usage-pattern sanitizer'. It adds a condition 'only when case-read gate is enabled', which clarifies scope. However, it does not differentiate from a very similar sibling tool 'run_case_db_path_string_triage' with a nearly identical name, leading to potential confusion.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description includes a usage condition ('only when case-read gate is enabled'), which provides some context. However, it lacks explicit when-not-to-use guidance and does not mention alternative tools (e.g., 'run_case_db_path_string_triage') that might be more appropriate in other scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_xways_manualC
Search the local X-Ways manual/docs index for command syntax and workflow details.
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | ||
| cache_dir | No | ||
| limit | No | ||
| max_chars | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden but only mentions the search action. It does not disclose whether the tool modifies data, requires permissions, or has side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The single 12-word sentence is efficient but lacks detail. It is concise at the expense of completeness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 0% parameter coverage and no annotations, the description is insufficient. The existence of an output schema is not hinted, and parameter semantics are missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description does not explain any of the four parameters (query, cache_dir, limit, max_chars). The names alone are insufficient for correct usage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool searches a local index for command syntax and workflow details, using a specific verb and resource, and distinguishes from siblings like cache_xways_manual and manual_status.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. The description lacks context about prerequisites or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
testenv_buildC
Create a disposable fixture environment and immediately run harness checks.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | CASE-001 | |
| evidence_os | No | windows | |
| root | No | test-envs | |
| cache | No | truncated | |
| force | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full behavioral disclosure burden. It mentions 'immediately run harness checks' but does not describe what happens after checks (e.g., environment teardown, error behavior, side effects). The term 'disposable' is vague.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very concise (one sentence) but lacks structure and detail. It states the action but omits important context. Conciseness traded off against completeness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having an output schema and 5 parameters, the description provides no context on return values, parameter meanings, or operational flow. It is insufficient for an agent to use correctly without additional knowledge.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the description adds no information about any of the 5 parameters (name, evidence_os, root, cache, force). The description fails to explain how parameters affect the tool's behavior.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool creates a disposable fixture environment and runs harness checks. It uses specific verbs and resources, and differentiates from siblings like testenv_create (which likely only creates without running checks) and testenv_run (which may run checks in existing environments).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives such as testenv_create or testenv_run. The description does not mention prerequisites, when not to use, or context for decision-making.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
testenv_createC
Create a synthetic disposable fixture environment for windows/linux/macos/generic evidence.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | CASE-001 | |
| evidence_os | No | windows | |
| root | No | test-envs | |
| cache | No | truncated | |
| force | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must disclose side effects. It states 'create' and 'disposable' but doesn't clarify what exactly is created (e.g., files, directories), permissions required, or whether cleanup is automatic.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that is efficient and front-loaded. However, it could include a bit more detail without losing conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no annotations, no parameter descriptions, and no information about what the output schema contains, the description is incomplete. A creation tool should mention return values (e.g., environment ID) and the lifecycle.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description adds only a hint about 'evidence_os' (windows/linux/macos/generic). It does not explain the other parameters: name, root, cache, force. The description fails to compensate for the lack of schema parameter descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Create' and the resource 'synthetic disposable fixture environment' for multiple OS types. It distinguishes itself from sibling tools like testenv_destroy or testenv_list, which have different actions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like testenv_build or testenv_run. No prerequisites or exclusions are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
testenv_destroyB
Delete a managed disposable fixture environment only when confirm=true.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | CASE-001 | |
| evidence_os | No | windows | |
| root | No | test-envs | |
| confirm | No | ||
| missing_ok | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description indicates a destructive operation ('Delete'), but with no annotations, it lacks detail on side effects, reversibility, or safety nets. The condition on confirm is noted, but overall behavioral disclosure is minimal.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, front-loaded with the verb, and no extraneous text. Every word contributes to understanding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having 5 parameters and no schema descriptions, the description fails to explain parameter roles or output. For a destructive tool, more context on behavior and result format is needed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description adds minimal parameter info—only referencing confirm for the deletion condition. Other four parameters (name, evidence_os, root, missing_ok) are left unexplained, requiring agent inference.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's action ('Delete') and target ('a managed disposable fixture environment'), with the key condition ('only when confirm=true'). This distinguishes it from sibling tools like testenv_create or testenv_list.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives (e.g., testenv_build, testenv_create). The description only specifies a condition for execution but omits context about prerequisites or scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
testenv_listC
List managed disposable fixture environments.
| Name | Required | Description | Default |
|---|---|---|---|
| root | No | test-envs |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, and the description does not disclose behavioral traits such as read-only nature, authorization requirements, or side effects. For a listing tool, it likely safe, but this is not explicitly stated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, clear sentence with no superfluous words. It is appropriately concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With only one parameter and an output schema, the description is too sparse. It fails to explain the parameter's role or the tool's output, leaving the agent with insufficient context despite the tool's simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description provides no explanation for the single parameter 'root' (default 'test-envs'). Schema coverage is 0%, so the agent gets no additional context beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'List' and the resource 'managed disposable fixture environments', making the tool's purpose clear. However, it lacks differentiation from sibling tools like testenv_create or testenv_destroy, which could be improved.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No usage guidance is provided. The description does not indicate when to use this tool over alternatives, nor does it mention prerequisites or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
testenv_runC
Run harness checks against an existing disposable fixture environment.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | CASE-001 | |
| evidence_os | No | windows | |
| root | No | test-envs |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description should disclose behavioral traits like safety, side effects, or permissions. It only states the action without mentioning whether it is destructive, idempotent, or requires specific privileges.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The single sentence is concise and front-loaded, but it lacks necessary detail. It earns its place but could be expanded to include parameter context or behavioral notes without becoming verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of 3 parameters and no annotations or output schema explanation (although output schema exists), the description fails to provide adequate context for correct invocation. The agent is left guessing about valid values or return behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds no meaning to any of the three parameters (name, evidence_os, root). Schema description coverage is 0%, and defaults are present but unexplained. The agent has no context for what these parameters represent.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Run' and the resource 'harness checks' against an existing disposable fixture environment. It effectively distinguishes this tool from siblings like testenv_create and testenv_destroy, which manage the environment lifecycle.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives, nor any prerequisites or exclusions. The agent must infer usage from the name and siblings alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
triage_inventoryC
Create a read-only filesystem triage inventory for a folder or mounted evidence tree.
| Name | Required | Description | Default |
|---|---|---|---|
| root | Yes | ||
| max_files | No | ||
| hash_small_files | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden for behavioral disclosure. It only states 'read-only' but does not explain what the inventory entails, what side effects exist, or if it requires special permissions. The behavioral implications of 'triage inventory' are unclear.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, which is concise but lacking necessary detail. It earns its place by stating the core purpose, but could be expanded to cover parameters and usage.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (3 parameters, output schema exists), the description is incomplete. It does not explain the output, parameter meanings, or usage context. The output schema may help, but the description should still provide high-level context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, yet the description adds no explanation for any of the three parameters ('root', 'max_files', 'hash_small_files'). The agent cannot infer what these parameters mean or how to use them correctly.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool creates a read-only filesystem triage inventory for a folder or mounted evidence tree. The verb 'Create' and resource 'read-only filesystem triage inventory' are specific, and the scope ('folder or mounted evidence tree') is clear. This distinguishes it from sibling tools that focus on building commands or hashing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It does not mention prerequisites, scenarios, or exclusions. The agent is left to infer usage from the name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
validate_archiveC
Validate a ZIP archive and report truncation or bad entries.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the full burden. It only states the validation and reporting behavior but omits details like side effects, mutation, permission needs, or output format. The description is too minimal for full transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that conveys the core functionality without extraneous words. It is front-loaded with the verb and resource.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one parameter, no annotations, output schema exists), the description provides the essential purpose but lacks detail on parameter semantics and behavioral traits. It is minimally adequate but leaves gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description does not mention the 'path' parameter at all. It adds no meaning beyond what the schema provides (just a type and required flag).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'validate' and the resource 'ZIP archive', and specifies what it reports ('truncation or bad entries'). It is specific and distinguishes the tool's purpose, though it does not differentiate from sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. No conditions, prerequisites, or exclusions are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
32 tool updates
v0.1.0- First observed
build_case_db_path_string_triage_command - First observed
build_launch_command - First observed
build_path_usage_pattern_triage_command - First observed
cache_xways_manual - First observed
case_run_manifest_template - First observed
create_workspace - First observed
create_xtension_scaffold - First observed
discover_installations - First observed
environment - First observed
harness_folder_triage - First observed
harness_init_case - First observed
harness_xwfim_preflight - First observed
hash_file - First observed
headless_xways_reference - First observed
inspect_xwfim_cache - First observed
launch_xways - First observed
manual_status - First observed
plan_parallel_xways_jobs - First observed
plan_xways_operation - First observed
public_xways_release - First observed
redact_local_file - First observed
redaction_status - First observed
run_case_db_path_string_triage - First observed
run_path_usage_pattern_triage - First observed
search_xways_manual - First observed
testenv_build - First observed
testenv_create - First observed
testenv_destroy - First observed
testenv_list - First observed
testenv_run - First observed
triage_inventory - First observed
validate_archive
TDQS
Scored across 32 tools
Each tool serves a distinct purpose, such as building commands, running triage, managing test environments, or accessing the manual. No two tools have ambiguous or overlapping functionality.
Tool names follow snake_case and mostly adhere to a verb_noun pattern (e.g., build_, run_, create_). Minor inconsistencies exist, such as 'harness_folder_triage' versus 'harness_init_case' and 'triage_inventory' using a noun_verb structure.
With 32 tools, the server is on the higher end of the typical range. While each tool has a clear role, the count feels heavy for a focused forensic tool adapter, though not excessive.
The tool set covers essential tasks like launching X-Ways, building commands, running triage, and managing test environments. However, gaps remain in direct evidence analysis and case database interaction beyond path-string triage.
Maintenance
Related MCP Connectors
Remote MCP for Android CLI agent build gate, structured receipts, audit logs, and reviewer-ready evi
Run and manage H Company's Computer-Use Agents from any MCP client.
Workflow diagnostics, capability routing, and x402 settlement for MCP-compatible agents.
Enrich, search, assess, and manage threat intelligence through 80+ typed MCP tools.
Related MCP Servers
- FlicenseNot gradedqualityDmaintenanceExposes Sysinternals and NirSoft Windows diagnostic binaries as MCP tools with safe subprocess execution. Dynamically registers tools from a binaries directory with built-in security filters for destructive operations.-
- AlicenseNot gradedqualityAmaintenanceEnables AI agents to manage system updates, application installations, and remote host orchestration through MCP tools.3MIT
- FlicenseNot gradedqualityDmaintenanceEnables digital forensics investigation by exposing SANS SIFT tools (The Sleuth Kit, Volatility 3, Plaso, etc.) as callable MCP tools, running in a self-contained Docker container with safe, allowlisted commands.-
- AlicenseNot gradedqualityBmaintenanceEnables autonomous digital forensics and incident response by wrapping SIFT Workstation tools as MCP tools and orchestrating a multi-agent AI pipeline for evidence analysis and remediation planning.2MIT