kvm-pilot
kvm-pilot is a write-capable, gated MCP server that lets an agent see, decide, and act on physical machines through IP-KVMs, BMCs, Intel AMT, and SSH — with no agent on the target.
Sense the screen & boot phase —
snapshot(withframe_refstaleness guards),classify_screen,wait_for_state(bounded polling to a named boot phase), plus cheap gates like power/signal/OCR before invoking vision.Read device state —
info,healthcheck(readiness/recovery posture, CRITICAL findings),power_state,logs,events,boot_options,access_paths(independent recovery domains),list_virtual_media.Inspect the ecosystem —
capabilities(what the driver supports),support_matrix(per device+firmware+capability live evidence),firmware_check,doctrine(bundled playbooks),session(gates, approvals, act journal).Control power & boot —
power(on/off/off-hard/reset),set_boot_device,wake(Wake-on-LAN),ctrl_alt_delete, andamt_enablefor Intel AMT SOL/KVM listeners.Drive keyboard & mouse —
type_text,press_key,send_shortcut,mouse(click requires anobserved_frame_ref),calibrate_mouse.Manage virtual media —
mount_iso(local path or URL, CD or USB),eject.Act in-band over SSH —
ssh_reachable,ssh_exec,appliance_status,appliance_reboot(clear a wedged KVM encoder).Contribute evidence —
file_firmware_report(gated GitHub external write) andssh_discover(opted-in CIDR scan).Safety — every destructive effect is gated per class (READ_ONLY → DRY_RUN → per-effect
ALLOW_*) plus per-call approval with signed single-use receipts, dry-run short-circuits before prompting, and denials return typed outcomes.
Provides control of GL.iNet KVM devices (GLKVM, GL-RM1/GL-RM1PE) through the KVM plane, including screen snapshots, power management, keyboard/mouse input, and virtual media operations.
Provides out-of-band management of Intel AMT/vPro firmware, enabling power control, boot device selection, SOL console access, and screenshots of firmware screens (BIOS/POST/GRUB).
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@kvm-pilotTake a KVM screenshot and tell me which boot phase the machine is in"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
kvm-pilot
Smart hands for your AI agents. A write-capable, multi-plane (KVM + BMC + SSH) MCP server for controlling physical machines — gated, verified, audited.
kvm-pilot lets an agent drive a headless box through POST, firmware, the
bootloader, and an OS install with no agent on the target: it works at the
pixel level through an IP-KVM (PiKVM, the GL.iNet GLKVM fork GL-RM1 /
GL-RM1PE, BliKVM), at the structured-state level through a BMC (Redfish on
iDRAC/iLO/OpenBMC, IPMI on BMCs that predate Redfish), at the firmware level
through Intel AMT/vPro (a BIOS/POST/GRUB screenshot + power + SOL on a
business laptop an HDMI-capture KVM can't see boot on), and over SSH once an OS
is up. A pluggable vision subsystem reads a KVM screenshot and tells you what
boot phase the machine is in — bios_menu, grub_menu, installer_progress,
login_prompt, crash_screen, and so on — and a safety layer gates every
destructive operation behind operator opt-ins and per-call approvals.
Vision runs on Claude or any local OpenAI-compatible VLM (LM Studio, Ollama, vLLM, llama.cpp). Point it at a model on your own GPU and the screenshots never leave your network and cost nothing per frame.
How it works
kvm-pilot runs a see → decide → act loop, and the screen is its only sensor:
it pulls a screenshot from the KVM, a vision model classifies the boot phase, and
kvm-pilot acts back through the KVM's keyboard and power. Because it works at the
pixel level, there is no agent on the target — the same loop drives POST,
firmware, the bootloader, and an OS install.
A real, unedited run against a GLKVM on the home fleet — an honest preflight, a headless snapshot (watch it wake the on-demand encoder), a gated dry-run power-cycle, and the boot console the agent actually saw:

Related MCP server: qemu-mcp-server
Quickstart
One install gives you the whole product — the kvm-pilot CLI, the
kvm-pilot-mcp MCP server, and the bundled Claude skill — nothing to
clone.
pip install kvm-pilot # CLI + skill + MCP server + WebSocket events
pip install "kvm-pilot[totp]" # + 2FA / TOTP support (pyotp)
kvm-pilot install-skill # optional: put the bundled skill where Claude Code loads itDriving a KVM from an AI agent (MCP)
claude mcp add kvm-pilot -s user \
-e KVM_PILOT_PROFILE=mykvm -e KVM_PILOT_MCP_READ_ONLY=1 -- \
kvm-pilot-mcpKVM_PILOT_MCP_READ_ONLY=1 is the recommended first rung of the trust ladder
— the agent can see everything and touch nothing until your hardware is
verified. The Getting started guide
covers credentials, Claude Desktop JSON config, sample prompts, and climbing
the ladder. The server is published to the official
MCP registry
as io.github.DustinTrap/kvm-pilot, so registry-aware hosts can discover
and install it by name. Agents: the repo root carries an
llms.txt doc map.
Scripting from Python
from kvm_pilot import KVMClient
from kvm_pilot.vision import ScreenAnalyzer, make_backend
kvm = KVMClient("192.168.8.1", "admin", "secret")
# Classify the current screen with Claude (model auto-resolved at runtime)
analyzer = ScreenAnalyzer(kvm, make_backend("anthropic"))
print(analyzer.classify().phase)
# Or run entirely on a local VLM — nothing leaves your network
local = make_backend("local", base_url="http://127.0.0.1:1234/v1", model="qwen2.5-vl-7b")
analyzer = ScreenAnalyzer(kvm, local)
# Block until the box reaches the GRUB menu, then pick the first entry
analyzer.wait_for_state("grub_menu", timeout=120)
kvm.press_key("Enter")For the latest unreleased tree:
pip install "kvm-pilot[totp] @ git+https://github.com/DustinTrap/kvm-pilot"CLI
kvm-pilot info --host 192.168.8.1 --user admin --ask-passwd # prompt (no echo)
kvm-pilot capabilities --profile homelab # what this driver supports
kvm-pilot snapshot screen.jpg --profile homelab
kvm-pilot --timeout 60 power-cycle --profile homelab --dry-run # log, don't send
kvm-pilot eject --profile homelab # detach virtual media
kvm-pilot events --profile homelab --count 5 # stream device events
kvm-pilot watch grub_menu --profile homelab \
--backend local --vision-url http://127.0.0.1:1234/v1 --vision-model qwen2.5-vl-7bThe CLI prompts for confirmation before any destructive action (power, virtual
media — including uploads — keyboard/mouse injection, GPIO). Use --yes to
skip prompts in automation, or --dry-run to log intended actions without
sending them — dry-run short-circuits before the prompt, so it never blocks
waiting for input. --timeout (HTTP per-request timeout) is a global flag and
goes before the subcommand; watch keeps its own --timeout for the vision
wait deadline.
Profiles like homelab live in ~/.config/kvm-pilot/config.toml. See
docs/cli.md for the full command table (every subcommand, the
capability it needs, and its gating), and
docs/configuration.md for the config-file format,
every KVM_PILOT_* environment variable, and the precedence between flags,
env, and profiles.
GLKVM setup note: on GL.iNet firmware the PiKVM REST API is disabled by default and a firmware upgrade can re-disable it — enable it first, per Every
/api/*call returns 404.
The tool surface, by plane
The same capability protocols span three actuation planes, so one agent workflow can mix pixels, structured BMC state, and shell access — with every destructive effect gated per class:
Plane | Read | Act (operator-gated) |
KVM — pixels & HID (PiKVM · GLKVM · BliKVM) |
|
|
BMC — structured state (Redfish · IPMI) |
|
|
Firmware — Intel AMT/vPro (spans both planes) |
|
|
SSH — in-band & appliance |
|
|
Meta — evidence & intake |
|
|
A machine with no KVM and no BMC at all is itself a first-class target:
driver = "ssh" plus ssh_host (the machine's own address, #248) stands
kvm-pilot on the recovery ladder's in-band rung — every device capability
honestly absent, and the healthcheck saying plainly that there is no
out-of-band recovery path there.
The canonical per-tool reference — annotations, effect gates, approval lifecycle — is the MCP server README; the CLI covers the full surface in docs/cli.md.
Status & maturity
Status: 1.0, general availability — on the strength of the run ledger, not beyond it. Three device types have run live (GL-RM1PE, Dell R710 over iDRAC6/IPMI, Dell Latitude 5411 over Intel AMT); three of the seven device drivers (
redfish,pikvm,blikvm) have only ever run against emulators. See the Hardware-Compatibility list for what has actually been exercised — and please add to it. (The exact version lives in the CHANGELOG.) The core paths have graduated from mocked-only to live-verified: a fleet of GL-RM1PE units has exercisedsnapshot/healthcheck/logs/power_state/virtual_media/infoacross two firmware lines — on V1.9.1 the run ledger that ships in the wheel putsinfo/logs/healthcheck/power_stateat ga,snapshotat rc, andvirtual_mediaat beta — derived from real runs, never hand-edited — and a Dell iDRAC6 has exercised the IPMI driver live end-to-end (power, boot-device, sensors, event log, SOL serial console). The paths that can hurt are hardened: transports never re-fire a destructive request, MCP approvals are signed single-use receipts with an audit trail, and every destructive effect — power, HID, media, boot-config, appliance, SSH, external writes — has its own operator opt-in gate. Recent betas added remote boot-device control (Redfish, IPMI, and in-bandefibootmgr), Wake-on-LAN, an IPMI driver for BMCs that predate Redfish, a serial (SOL) console, mouse auto-calibration, and headless native-resolution GLKVM snapshots;kvm-pilot test-reportturns contributing evidence into one command, and the firmware registry feeds itself (firmware-checkauto-files registry updates). Now we need your hardware. PiKVM, BliKVM, other GLKVM models, and Redfish BMCs (iDRAC/iLO/OpenBMC) are the combos the matrix needs most — success or failure, a hardware report takes two minutes and the hourly ingest does the rest. Anything the Hardware-Compatibility list doesn't show as exercised is still unverified: the 1.x line keeps the public API stable, but a rating only moves when a live run moves it; note the remote firmware-flash no-op on GL-RM1PE (#94/#95), and don't point destructive ops at a machine you can't afford to have power-cycled unexpectedly. See Compatibility.
Boot-phase detection
The vision classifier maps each screenshot to a phase — bios_menu,
grub_menu, installer_progress, login_prompt, crash_screen, and so on.
wait_for_state() polls the screen and blocks until the phase you asked for
appears (or a timeout fires), so an unattended install becomes a few waits with
actions wired between them:
Sensing model
Vision is the most expensive way to read a screen — a model call per frame — and
most of what it infers (power state, boot phase, liveness, a crash) is also
available as a field, an event, or a line of text. The direction of
kvm-pilot is to treat classification as a hierarchy: answer from the cheapest
signal the device exposes, and fall through to OCR and finally a vision model
only when nothing cheaper can.
The PiKVM/GLKVM client already exposes the cheap end — ATX and HID LEDs,
video-signal and resolution, on-device OCR (?ocr=true), logs, Prometheus
metrics, and a WebSocket event stream. The capability protocols
add Logs, BootProgress, Sensors, SerialConsole, Watchdog, and
BootConfig as the seam for BMC drivers (Redfish/IPMI), where the boot phase
is a structured enum (BootProgress.LastState) and the console is a serial
text stream rather than pixels. Different device classes are nearly
complementary: capture devices are strong on pixels, BMCs on structured state
and serial text.
Safety model
Power-offs, hard resets, virtual-media connect/disconnect and image uploads,
keyboard/mouse injection (type_text, press_key, shortcuts, clicks), GPIO,
boot-config changes, and Redfish/IPMI resets are classified as destructive
and pass through a safety layer:
dry-run short-circuits first: it logs the intended call and skips it entirely — the confirm callback is never invoked, so dry runs never prompt or block.
confirmation — a callback that can veto any destructive call that would really be sent. The library default allows everything (so plain scripts work); the CLI installs an interactive
y/Nprompt unless you pass--yes.
The destructive set is defined explicitly in kvm_pilot.safety.DESTRUCTIVE_OPS
so it is auditable rather than guessed. A vision classification can never
trigger a destructive action on its own — you wire that yourself, and the
safety layer still applies. On the MCP side each destructive effect class
additionally needs an operator opt-in env gate plus a per-call approval backed
by a signed single-use receipt — the trust ladder
(READ_ONLY → DRY_RUN → per-effect ALLOW_*) is drawn in the
MCP server README.
This software controls real hardware and can power-cycle or interrupt a running machine. Read SECURITY.md before exposing a KVM to the internet.
No hard-coded model version
There is no model version string anywhere in the code. The Anthropic backend
resolves the newest vision-capable model at runtime via the Models API and
caches it; set KVM_PILOT_VISION_MODEL or pass model= to pin one. The local
backend uses whatever model you loaded on your server. Bring your own backend,
endpoint, and model.
How this differs from other clients
pikvm-lib is a fine general-purpose
PiKVM client. kvm-pilot is aimed at a different job:
Vision-based boot-phase detection — classify BIOS/GRUB/installer/crash states from screenshots, with blocking
wait_for_stateloops. This is the core feature andpikvm-libhas no equivalent.Pluggable local or cloud VLM — run inference on your own GPU at zero per-frame cost, or on Claude.
A safety layer around destructive operations (dry-run + confirmation).
GLKVM-fork awareness — documents the API-enable prerequisite and GL hardware quirks that bite GL-RM1PE users.
Stdlib-only client core — the driver/vision code imports only the standard library (the bundled MCP server pulls the
mcpSDK; feature extras are opt-in).
If you just want to script power and HID against a stock PiKVM and don't need
the vision layer, pikvm-lib may be the simpler choice.
On the BMC side, sushy, DMTF's
python-redfish-library, and
pyghmi (IPMI) are mature, far more complete BMC
management SDKs — if you need account/firmware/network configuration,
EventService subscriptions, or hardware-proven maturity, use them. kvm-pilot
trades that completeness for one uniform capability surface across device
classes (IP-KVMs and BMCs behind the same protocols), the same safety layer
gating every destructive call, and the vision loop on devices that have pixels.
Compatibility
Device | Status |
GL-RM1PE (Comet PoE) | Primary target — exercised live: read/ |
Dell iDRAC6 — IPMI (PowerEdge R710) | Exercised live: power / boot-device / sensors / event log (SEL) / SOL serial console all verified over |
Dell Latitude 5411 — Intel AMT/vPro | Exercised live (AMT 14.1.67): WS-Man power / info / single-use boot, remote SOL + KVM enablement, and a 1920×1080 BIOS/POST screenshot over KVM redirection — the firmware screen an HDMI-capture KVM can't see on a laptop. Captures graphical screens only (not legacy VGA text mode) |
GL-RM1 (Comet) | Expected to work (same firmware family); untested |
PiKVM v3 / v4 | Expected to work (upstream API); untested |
BliKVM | Expected to work (PiKVM-compatible API); untested |
Redfish BMCs (iDRAC7+, iLO, OpenBMC) | Emulator-verified (in-repo emulator + DMTF sushy-tools in CI); live-BMC validation pending (#29) |
The GL-RM1PE (read/snapshot paths), a Dell iDRAC6 over IPMI, and a Dell Latitude 5411 over Intel AMT are the combos run live so far — everything else is "expected to work" pending validation. The Hardware-Compatibility list is the authoritative, per-capability record. ATX power control needs the ATX adapter wired to the target's front-panel header: on the GL Comet family (GL-RM1 / GL-RM1PE) that is GL.iNet's separately sold ATX board (GL-ATXPC), while PiKVM v3/v4 kits include the ATX adapter in the box and BliKVM bundles vary by model — check yours. Without ATX wiring, ATX calls return errors from the device. Reports of success or failure on any hardware are exactly what this project needs — please open a hardware report.
Architecture
kvm-pilot is built on a modular, driver-plugin architecture so support can
expand to many KVM/BMC devices (PiKVM family, Redfish BMCs, IPMI BMCs, JetKVM, …).
Each device implements only the capability protocols its hardware supports; the
CLI, safety layer, and vision subsystem stay device-agnostic. A make_driver(kind)
registry (mirroring make_backend) builds drivers by name, and a hardware-free
FakeDriver lets you exercise the whole loop — capabilities, safety gating, the
analyzer — with no device (kvm-pilot capabilities --driver fake). See
docs/architecture.md for the design and diagram.
A RedfishDriver (make_driver("redfish")) speaks the DMTF Redfish API to
server BMCs — Dell iDRAC, HPE iLO, Supermicro, Lenovo XCC, OpenBMC — in one
stdlib-only client. It shows why capabilities are segmented: a BMC's set is
complementary to a PiKVM's (strong on structured state — power, boot phase,
sensors, logs, virtual media — with no keyboard/mouse/screenshot), and the driver
stays portable by following Redfish hypermedia rather than hard-coding vendor ids:
from kvm_pilot.drivers import make_driver
bmc = make_driver("redfish", host="idrac.lan", user="root", passwd="…")
bmc.get_boot_progress() # 'os_running' — structured, no screenshot
bmc.read_sensors()["temperatures"]
bmc.power_off(wait=True) # mapped to the target's actual ResetType, gatedAn IpmiDriver (make_driver("ipmi")) covers BMCs that predate Redfish
(e.g. Dell iDRAC6) over the system ipmitool: power, boot-device control,
sensors, the SEL event log, and an SOL serial console (kvm-pilot console).
Both are on the CLI too — kvm-pilot info --driver redfish --host idrac.lan ….
Capability-specific subcommands a BMC can't serve (type, snapshot, events)
fail cleanly rather than crashing. Add --redfish-auth basic for an endpoint
without a SessionService (emulators, or a BMC with session auth disabled).
An AmtDriver (make_driver("amt")) manages Intel AMT/vPro laptops and
desktops out-of-band over AMT's three native protocols — WS-Man (power / info /
single-use boot), SOL (kvm-pilot console), and KVM redirection — all
pure-stdlib. It is the first non-PiKVM driver with Video + HID: snapshot
returns a real firmware-level BIOS/POST/GRUB screenshot on a machine whose
HDMI a capture-KVM can't see boot on a laptop. SOL and KVM listeners are opened
remotely over WS-Man (kvm-pilot amt enable-sol / enable-kvm), no MEBx trip.
Help shape it — this is where you come in
kvm-pilot is built in the open. 1.0 shipped on the evidence of three device
types; what it still needs is not code — it's breadth of real hardware.
Three of the seven drivers
(redfish, pikvm, blikvm) have never run against a physical device, only
emulators. Every rating you see is derived from a run ledger that ships inside
the wheel, never hand-set, so the matrix only grows when someone runs it on real
metal. That someone could be you.
The single most valuable thing you can send: a
hardware report.
kvm-pilot test-report --profile <name> turns it into one command, it is
read-only by default, and an hourly job folds the result into the published
compatibility matrix. Failures are as welcome as successes — a driver that
returns a confident wrong answer on your BMC is a more useful report than one
that works, and it will be treated as a first-class finding, not swept up.
Also genuinely wanted:
⭐ Star the repo if the idea is useful to you. It is the cheapest signal that this problem is worth solving, and it is what brings in the operators whose hardware the matrix still needs.
🐛 Open an issue for anything: a bug, a device that misbehaves, a confusing error, a doc that lied to you. This repo is issue-per-finding — an issue is the unit of record, and "the error message didn't tell me what to do" is a legitimate report.
💬 Tell us what it got wrong. Review the safety model, the approval flow, the tool surface. Push back on the defaults. If an agent did something with your machine that surprised you, that is exactly the feedback that makes this safe for everyone else.
🔌 Ask for your device. Missing driver, unsupported BMC, a KVM we've never heard of? Open a driver request — the plugin architecture exists precisely so that adding one doesn't mean forking the project, and
docs/plugin-development.mdis the contract.🛠️ Send a PR.
docs/CONTRIBUTING.mdhas the full pre-PR checklist; good first issues are labelled.
Nothing here phones home. The project has no telemetry that reports itself — every row in the compatibility matrix is there because a human chose to send it. That's the deal, and it's why your report actually matters.
Documentation
Full user and developer docs live in docs/ (architecture, design
decisions, the Redfish reference, the
troubleshooting & FAQ,
contributing, and the security policy). The
project wiki is an
auto-generated, nicely formatted mirror of that folder, and the repo root
carries an llms.txt
doc map for AI agents.
License
Apache License 2.0 — see LICENSE and NOTICE. kvm-pilot is
independent and not affiliated with or endorsed by the PiKVM project, GL.iNet,
or Anthropic; those names are used only for compatibility description.
Available Tools
34 toolsaccess_pathsARead-onlyIdempotent
Which INDEPENDENT recovery paths are live for the device — the lockout view.
Rolls up the REST API, appliance-SSH, target-SSH, out-of-band power, and
console-HID paths, each labeled by its failure domain so redundancy is not
oversold: several live paths that all ride the same appliance are ONE
independent domain. summary.out_of_band_live=false means every path shares
the appliance's fate — a fully hung box can't be recovered remotely.
| Name | Required | Description | Default |
|---|---|---|---|
| profile | No | Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the safety profile (readOnly, idempotent, non-destructive, closed-world). The description adds real interpretive value beyond that: how domains are labeled, why several live paths on one appliance count as ONE domain, and what summary.out_of_band_live=false implies. It doesn't cover auth or rate limits, so not a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the core answer ('Which INDEPENDENT recovery paths are live') before elaborating. The domain and out_of_band_live sentences each carry weight, though the backtick-heavy, densely packed style is slightly harder to scan than necessary.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only analysis tool with no output schema, the description conveys what the result means (domain-labeled live paths, the out_of_band_live signal). It is complete enough to interpret the call, missing only explicit return-shape detail.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one parameter (profile) and schema description coverage is 100%, so the schema already fully documents it. The description adds nothing about the profile parameter, which is acceptable given the schema does the heavy lifting — baseline 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource (which live recovery paths exist for a device) and frames it as 'the lockout view'. The failure-domain framing clearly differentiates it from sibling reachability checks like ssh_reachable or healthcheck, which report a single path rather than an independence rollup.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The 'lockout view' phrasing implies the context (assessing whether a hung box can still be recovered remotely), but no sibling is named and there is no explicit when-to-use vs when-to-use-alternative guidance. Usage is implied rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
amt_enableADestructive
Enable an Intel AMT redirection listener over WS-Man (Intel AMT/vPro only). CONFIG MUTATION.
feature='sol' opens the SOL/IDE-R listener (16994); feature='kvm' opens
KVM redirection (5900) and sets the RFB password. Gated by the config effect
gate + per-invocation approval (typed same-path denials, #234).
consent_off=true (KVM only) DISABLES the on-screen user-consent prompt —
a surveillance escalation — and additionally requires the dedicated
KVM_PILOT_MCP_ALLOW_CONSENT_OFF operator gate (see README.md); leaving
it false keeps the prompt.
| Name | Required | Description | Default |
|---|---|---|---|
| confirm | No | Per-invocation approval when the client cannot prompt a human: set true to approve this exact call under the operator's standing policy. Leave false when the client supports elicitation (a human is asked). Never pre-set it speculatively; a denial returns outcome=not_confirmed. | |
| feature | Yes | 'sol' opens the SOL/IDE-R listener (port 16994); 'kvm' opens KVM redirection (5900) and sets the RFB password. | |
| profile | No | Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE). | |
| consent_off | No | KVM only: true disables the on-screen user-consent prompt (needs the KVM_PILOT_MCP_ALLOW_CONSENT_OFF gate too). Leave false to keep the prompt. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the destructive/non-idempotent annotations, it discloses the approval gate, typed same-path denials, the KVM_PILOT_MCP_ALLOW_CONSENT_OFF operator gate, and — critically — that consent_off=true is a surveillance escalation. That is exactly the kind of consequence an agent cannot infer from annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with purpose and mutation class, then structured per feature. Dense but nearly every clause carries signal; the '#234' tracker reference is the only marginal detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive mutation with no output schema, the description covers what is changed, the approval requirements, and the consent_off escalation. Return-value detail is absent but not strictly required given the schema and annotations already cover safety.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so feature, consent_off, profile, and confirm are already documented in the schema. The description reinforces feature/consent_off meaning but mostly restates the schema (including the not_confirmed outcome and the operator gate), so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (enable) and resource (Intel AMT redirection listener over WS-Man) and scopes it (Intel AMT/vPro only). No sibling in the list overlaps, and the CONFIG MUTATION label immediately frames the operation class.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explains what each feature value selects and the gating conditions (config effect gate, per-invocation approval), giving clear context for when the call applies. It does not name a when-not or an alternative tool, but none exists among the siblings, so the gap is minor.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
appliance_rebootADestructive
Reboot the KVM APPLIANCE (not the target) to clear a wedged encoder. DESTRUCTIVE.
Recovers the RV1126 encoder wedge (the only fix — the stuck threads are unkillable kernel threads). Drops all KVM control for ~60s; the target's power is untouched. Gated by the appliance effect gate + per-invocation approval, with typed same-path denials (#234). There is no out-of-band power to the appliance, so use this deliberately, never in an automated loop.
| Name | Required | Description | Default |
|---|---|---|---|
| confirm | No | Per-invocation approval when the client cannot prompt a human: set true to approve this exact call under the operator's standing policy. Leave false when the client supports elicitation (a human is asked). Never pre-set it speculatively; a denial returns outcome=not_confirmed. | |
| profile | No | Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already flag destructiveHint=true, but the description adds rich context beyond them: ~60s loss of all KVM control, that target power is untouched, gating by the appliance effect gate plus per-invocation approval, typed same-path denials (#234), and the absence of out-of-band power (brick risk). This is exactly the behavioral detail an agent needs before a destructive act.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the action, scope, and the DESTRUCTIVE warning in the first line, then supporting detail about the recovery scenario. Each sentence carries distinct information with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive two-parameter tool with full schema coverage and no output schema, the description covers the failure scenario, recovery rationale, downtime, gating, denial behavior, and brick risk. Nothing needed to invoke it safely is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both the confirm and profile parameters are fully documented in the schema, making 3 the baseline. The description's approval-gating context is tangentially relevant but adds no syntax or value semantics for the parameters themselves.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Reboot) and resource (the KVM APPLIANCE), and explicitly disambiguates from the target with '(not the target)' and 'the target's power is untouched.' That contrast distinguishes it from sibling verbs like power, which act on the target.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit triggering condition ('to clear a wedged encoder', 'recovers the RV1126 encoder wedge — the only fix') and an explicit exclusion ('never in an automated loop', 'use this deliberately'). It states both when and when-not, leaving nothing to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
appliance_statusARead-onlyIdempotent
Read-only diagnostics from the KVM APPLIANCE's own OS over SSH.
Targets the KVM appliance itself (its appliance_ssh channel), NOT the
managed target. Reports the 1-minute load and the RV1126 video-pipeline threads
in D-state. NOTE: on these units load sits at ~10 even when perfectly idle
(the driver parks those threads in D-state), so it is NOT a health signal on
its own — use the healthcheck encoder-wedge finding for the real tell.
| Name | Required | Description | Default |
|---|---|---|---|
| profile | No | Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false, and openWorldHint=false. The description adds important behavioral context beyond that: it operates over the appliance_ssh channel, not the managed host, reports specific OS-level diagnostics, and warns that idle load appears high due to driver-parked D-state threads.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The definition is front-loaded with the target and purpose, then adds the metric details and the critical interpretation caveat. Every sentence adds distinct value, and the NOTE cleanly separates the health-signal warning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given a simple read-only diagnostic tool with annotations covering safety and no output schema, the description supplies the missing return-value context and interpretation warning. It is complete enough for an agent to call it correctly without additional inference.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the single optional profile parameter, and the schema already explains the profile/config selection. The description adds no parameter-specific semantics, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: read-only diagnostics from the KVM appliance's own OS over SSH. It explicitly contrasts this with the managed target and names the specific metrics returned (1-minute load and RV1126 video-pipeline D-state threads), so an agent can distinguish it from siblings like healthcheck and ssh_reachable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives explicit routing guidance: target the appliance itself, not the managed target, and use the healthcheck encoder-wedge finding for the real health tell because load is not a reliable health signal. This names an alternative and the condition that selects it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
boot_optionsARead-onlyIdempotent
Show the host's current boot override (Redfish BootSourceOverride) — read-only.
Reports enabled (Disabled/Once/Continuous), the normalized target, the
mode (UEFI/Legacy, or null if the BMC doesn't expose it), and the
allowable targets the BMC advertises — so an actuator knows what
set_boot_device values this box will accept before trying one.
| Name | Required | Description | Default |
|---|---|---|---|
| profile | No | Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish readOnlyHint/idempotent/non-destructive, and the description adds real substance beyond them: it enumerates the returned fields, notes that 'mode' may be null when the BMC does not expose it, and that 'allowable' is BMC-advertised. Only the exact return shape/pagination is left unstated, which is minor here.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The core purpose and read-only nature are front-loaded in the first clause, followed by a compact enumeration of the returned fields and one forward-looking rationale. No sentence is filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description correctly carries the burden of describing return values (enabled, target, mode, allowable) with enough nuance (null mode, advertised allowable) for correct use. Combined with annotations covering safety, nothing essential is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the single 'profile' parameter is fully documented in the schema, so the description adds nothing about it. Per the high-coverage baseline, a 3 is appropriate for a one-parameter tool that needs no further elucidation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Show the host's current boot override') and names the underlying Redfish property (BootSourceOverride), pinning the concept precisely. It contrasts implicitly with the sibling set_boot_device as the read-side counterpart, so an agent can tell the two apart immediately.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives a concrete use context: an actuator should consult this before calling set_boot_device to learn which target values the box accepts. That is a clear when-to-use signal, though it does not state explicit exclusions or other alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
calibrate_mouseAIdempotent
Measure and store this host's mouse commanded→observed correction (#128).
Fixes "clicks where the button should be and misses". Pointer moves only —
no clicks, no keystrokes — but it visibly moves the live cursor ~10-30s,
so it is gated like HID input (KVM_PILOT_MCP_ALLOW_HID; one approval
covers the whole run). Preconditions: live video signal, a static
screen, and a visible cursor. Afterwards mouse percent
coords apply it transparently (calibrated: true); stored per (host,
capture resolution) — a resolution change makes it stale, never applied.
Mechanism details: the MCP server README.
| Name | Required | Description | Default |
|---|---|---|---|
| confirm | No | Per-invocation approval when the client cannot prompt a human: set true to approve this exact call under the operator's standing policy. Leave false when the client supports elicitation (a human is asked). Never pre-set it speculatively; a denial returns outcome=not_confirmed. | |
| profile | No | Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE). | |
| tolerance | No | Max held-out verification error, as a fraction of the screen, for the fit to be stored. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the annotations: discloses that the live cursor visibly moves for ~10-30s, that it is gated by KVM_PILOT_MCP_ALLOW_HID with one approval covering the run, that results are stored per (host, capture resolution), and that a resolution change makes the calibration stale and it is never applied. This is exactly the extra behavioral context annotations cannot carry.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the purpose, then gating, then preconditions, then persistence semantics — a sensible ordering. It is dense with parentheticals and an issue reference (#128) that costs a little space, but nearly every sentence carries decision-relevant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description still covers what an agent needs: preconditions, duration, approval/gating, side effects on the live cursor, and post-run state. The one failure mode it mentions (outcome=not_confirmed) is handled in the schema description, so nothing material is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so `confirm`, `profile`, and `tolerance` are already fully documented in the schema. The description only indirectly touches parameters ('stored per (host, capture resolution)') without adding syntax or semantics beyond the schema, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Measure and store this host's mouse commanded→observed correction') with the effect spelled out (fixes 'clicks where the button should be and misses'). It is clearly distinguishable from the sibling `mouse` tool, which the description explicitly says consumes this calibration afterwards.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit preconditions (live video signal, static screen, visible cursor), scope boundaries ('pointer moves only — no clicks, no keystrokes'), the approval model, and the relationship to the `mouse` tool. An agent can decide when to call this versus `mouse` or `type_text` without inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
capabilitiesARead-onlyIdempotent
List the capabilities the target's driver supports (read-only, offline).
Structural — makes no network call and runs no preflight; it answers "which
tools/actions can this device serve?" so you can pick the right interface up
front (a Redfish BMC has no video; a PiKVM has no BootProgress). Returned in
the capability enum's declaration order for stable output. video_scope
answers the question video cannot — whether BIOS/POST/GRUB are visible
through this interface (an HDMI-capture KVM is blind below the OS on a
laptop; AMT/BMC firmware video is not). live_evidence
additionally names which device+firmware combos this driver has real-hardware
run evidence for — structural support is not live verification; call
support_matrix for per-combo evidence and healthcheck for this exact
device+firmware.
| Name | Required | Description | Default |
|---|---|---|---|
| profile | No | Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint and destructiveHint=false, so the safety profile is covered. The description adds value beyond that by stating it is 'structural — makes no network call and runs no preflight' and that output is returned in capability-enum declaration order for stability. That is genuine behavioral context not present in the annotations, though it doesn't cover latency or any failure modes.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The key statement is front-loaded in the first sentence and the rest is dense, differentiated content rather than filler. It is somewhat long with several parenthetical asides ('a Redfish BMC has no video; a PiKVM has no BootProgress'), which slightly taxes scanning, but every clause carries useful routing information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description carries the return-value burden and does reasonably well: it explains the output is a capability list in enum declaration order and hints at items like video scope and live evidence. It stops short of describing the full returned structure or what a caller does with the result, so it is strong but not exhaustive for a no-output-schema tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the single `profile` parameter is fully documented in the schema, so the baseline of 3 applies. The description never mentions `profile` and instead discusses `video_scope`/`live_evidence`, which are not input parameters, so it adds no parameter-level meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('List the capabilities the target's driver supports') and immediately scopes it as read-only and offline. It goes further than the sibling `info` by clarifying this is about *which interfaces a device can serve*, and differentiates concrete cases (Redfish BMC has no video; PiKVM has no BootProgress), so an agent can pick it apart from `info`, `healthcheck` and `support_matrix` without opening schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit usage context — 'so you can pick the right interface up front' — and names the alternatives with the conditions that select them: `support_matrix` for per-combo evidence, `healthcheck` for this exact device+firmware. It also draws a sharp boundary ('structural support is not live verification'), which is exactly the when-not-to-use guidance an agent needs.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
classify_screenARead-onlyIdempotent
Classify the current screen's boot/run phase (read-only).
Uses the server-side vision backend when configured; cheap on-device gates (power-off, no-signal, boot-progress, OCR rules) resolve with no credentials at all. Return shapes:
server-side / cheap-gate → a dict with
mode="server"+ phase fields.no server vision → caller-side fallback, a
[json_text, Image]list: classify the image yourself against thesystem_prompt/phasesin the JSON block.
| Name | Required | Description | Default |
|---|---|---|---|
| hint | No | Optional context for the vision backend, e.g. what you expect on screen ('Fedora installer, language page'). | |
| profile | No | Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With annotations already covering the safety profile, the description still adds substantial context: it discloses that cheap gates resolve with no credentials at all, that server vision is used only when configured, and that a caller-side fallback returns [json_text, Image]. This is exactly the auth/behavior/return-shape information the annotations do not carry.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose is front-loaded, followed by mechanism and then return shapes in a bulleted structure. It is dense but every block earns its place given the dual-mode behavior; only minor tightening is possible.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-optional-param tool with no output schema and an unusual dual-mode contract, the description does the needed work by spelling out both return shapes and the pending caller-side responsibility. It is nearly complete, missing only when-to-use guidance.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents both 'hint' and 'profile' fully. The description adds no parameter-level meaning beyond the schema (it references system_prompt/phases in the return payload, not the inputs), so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Classify) and resource (the current screen's boot/run phase), and even parenthesizes scope with '(read-only)'. No sibling tool (power_state, snapshot, logs, etc.) overlaps this screen-classification role, so an agent can route to it unambiguously.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains the internal mechanism and return shapes but never states when to reach for this tool over alternatives or what conditions trigger it. There is no 'use this when...' clause and no exclusion criteria; usage is only weakly implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ctrl_alt_deleteADestructive
Send Ctrl+Alt+Del to the managed host over the keyboard. DESTRUCTIVE (reboot).
A reboot (or the OS's secure-attention screen) delivered through HID, so it
is classified power_soft and needs KVM_PILOT_MCP_ALLOW_POWER — the
power tool's gate — never the weaker HID gate. Prefer
power(action='reset') when the device has out-of-band power: that is
verifiable, this chord is not (a hung host simply ignores it). Returns the
typed act outcome; confirm with wait_for_state or snapshot.
| Name | Required | Description | Default |
|---|---|---|---|
| confirm | No | Per-invocation approval when the client cannot prompt a human: set true to approve this exact call under the operator's standing policy. Leave false when the client supports elicitation (a human is asked). Never pre-set it speculatively; a denial returns outcome=not_confirmed. | |
| profile | No | Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and non-idempotent, but the description adds substantial value beyond them: the power_soft classification, the specific env gate required, the fact that the chord is unverifiable on a hung host, and that the typed act outcome should be confirmed with wait_for_state or snapshot.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the action and its destructive nature, then layered with the gate requirement and alternative. Each sentence carries information, though the backticked formatting and gate discussion make it slightly denser than strictly necessary.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, and the description compensates by stating that the tool returns the typed act outcome and by naming the confirmation tools (wait_for_state, snapshot). For a single-action destructive tool, an agent has everything needed to call it correctly and verify the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and both parameters (confirm, profile) are already fully documented in the schema, including the elicitation semantics and the not_confirmed denial outcome. The description adds no parameter-level detail, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource: sending the Ctrl+Alt+Del chord to the managed host over HID, and immediately classifies it as a destructive reboot. It distinguishes itself from siblings by naming power(action='reset') as the preferred alternative when out-of-band power exists.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit when-to-use and when-not-to-use guidance: prefer power(action='reset') when the device has out-of-band power because that path is verifiable while this chord is not, since a hung host silently ignores it. It also states the required gate (KVM_PILOT_MCP_ALLOW_POWER) instead of the weaker HID gate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
doctrineARead-onlyIdempotent
Re-serve the bundled operating doctrine (read-only; offline, no device I/O).
The skill's playbooks ship inside this package; this tool re-serves them so
a session that never loaded the skill file — or has long since compacted it
away — can re-anchor on the written doctrine instead of a faded memory of
it. Call with no topic to list the topics; call with one for that
playbook's full text. Read recovery the moment a host goes dark or a
snapshot fails, and interfaces before picking how to do an action you
haven't done this session.
| Name | Required | Description | Default |
|---|---|---|---|
| topic | No | Playbook to return in full (e.g. 'recovery', 'interfaces'). Omit to list the available topics. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, openWorldHint=false, idempotentHint, and destructiveHint=false, so the safety profile is covered. The description adds that the doctrine is bundled/offline, explains the re-anchoring purpose, and distinguishes listing from full-text retrieval.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The purpose and invocation rules are front-loaded and easy to scan. The rationale about compacted skill files is helpful but slightly verbose for a one-parameter read-only tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only lookup tool with full schema coverage and clear annotations, the description covers purpose, calling convention, and when to use key topics. No important agent decision is left unaddressed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the single optional topic parameter is already documented in the schema with examples. The description reinforces omit-vs-provide behavior but does not add syntax or constraints beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: "Re-serve the bundled operating doctrine" and clarifies that it returns bundled playbooks. It also distinguishes this offline, no-device-I/O tool from the sibling device-operation tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly states both invocation modes: no topic lists available topics, and a topic returns that playbook's full text. It further names concrete situations for recovery and interfaces, so the agent knows when to reach for it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ejectAIdempotent
Detach the virtual media presented to the host (inverse of mount_iso). GATED, reversible.
Needs KVM_PILOT_MCP_ALLOW_MEDIA + per-invocation approval. With nothing
attached it returns detached=false and says so — not an error. Touches
neither power nor the boot order: a host running from the ISO keeps running
until it reboots; on BMCs, set_boot_device picks what boots next.
Returns the typed act outcome.
| Name | Required | Description | Default |
|---|---|---|---|
| confirm | No | Per-invocation approval when the client cannot prompt a human: set true to approve this exact call under the operator's standing policy. Leave false when the client supports elicitation (a human is asked). Never pre-set it speculatively; a denial returns outcome=not_confirmed. | |
| profile | No | Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Adds substantial context beyond the annotations: the gating requirements, that the operation is reversible, the no-op edge case (returns detached=false rather than an error), and the side-effect boundary (does not touch power or boot order; a running host keeps running until reboot). This is exactly the kind of behavioral disclosure annotations like idempotentHint/destructiveHint cannot convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core verb+resource and the sibling relationship, then layered with gating, edge-case and side-effect notes in order of importance. Dense rather than padded, though the closing 'Returns the typed act outcome' is mildly redundant given the earlier detached=false explanation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description still conveys the return contract (typed act outcome, detached=false when nothing is attached), the auth/approval prerequisites, and the side-effect scope. An agent has everything needed to invoke it correctly and interpret the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and both parameters (confirm, profile) are fully documented in the schema, so the baseline is 3. The description mentions 'per-invocation approval', which loosely maps to ``confirm``, but adds no syntax, default, or interaction detail beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (detach) applied to a specific resource (virtual media presented to the host) and explicitly frames itself as the inverse of ``mount_iso``. An agent can distinguish it from mount_iso, list_virtual_media and set_boot_device without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear operative context: it is gated behind KVM_PILOT_MCP_ALLOW_MEDIA plus per-invocation approval, and it routes boot-order concerns to ``set_boot_device``. It stops short of an explicit when-not clause, but the inverse-of-mount_iso framing and the boot-order hand-off leave little ambiguity.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
eventsARead-onlyIdempotent
Collect typed device events from the kvmd stream (read-only, bounded).
MCP twin of CLI events minus follow mode (#233 — an endless stream
doesn't fit the synchronous stdio transport): returns up to count
events or duration seconds' worth (capped 30 s), whichever first.
logs is the better first diagnostic; events add the live typed stream
(atx/msd/streamer state changes) to cross-check a vision wait against.
| Name | Required | Description | Default |
|---|---|---|---|
| count | No | Stop after this many events. | |
| profile | No | Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE). | |
| duration | No | Stop after this many seconds (capped at 30), whichever comes first. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly/idempotent/non-destructive/openWorld=false, so the safety profile is covered. The description still adds real value beyond them: the operation is bounded (up to count events or duration seconds, capped 30s), and follow mode is deliberately omitted due to synchronous stdio transport. That framing of boundedness and the CLI divergence is genuinely informative, though return-shape details are absent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the purpose and bounds before the sibling comparison and the #233 rationale. The CLI-twin and issue-reference aside is somewhat layered, but each sentence contributes routing or behavioral context rather than padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, yet the description explains what an event is (typed atx/msd/streamer state changes) and how the call terminates (count/duration). That covers most of what an agent needs to call it correctly; only explicit return formatting is left unstated.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the schema already documents count, duration, and the 'whichever comes first' cap. The description restates the count/duration interaction and the 30s cap but adds no format or syntax detail beyond the schema, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Collect typed device events from the kvmd stream') and immediately scopes it with '(read-only, bounded)'. It also differentiates from siblings by contrasting with the CLI twin and naming the content of the stream (atx/msd/streamer state changes). An agent can distinguish this from logs and wait_for_state without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly routes the agent: '``logs`` is the better first diagnostic; events add the live typed stream ... to cross-check a vision wait against.' This states both the alternative and the conditions selecting each, which is exactly what usage guidance should do.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
file_firmware_reportAIdempotent
File the device's firmware-currency report as a GitHub issue when the
registry is behind (MCP twin of CLI firmware-check, #189/#190).
EXTERNAL WRITE — writes outside the managed device.
The read/reconcile half always runs; registry current → nothing to file,
the result says so. Filing is gated as its own external_write effect
(KVM_PILOT_MCP_ALLOW_EXTERNAL_WRITE + per-invocation approval);
dry_run=true previews the exact issue title/body; a missing or
unauthenticated gh is a graceful filed=false reason.
| Name | Required | Description | Default |
|---|---|---|---|
| repo | No | GitHub repo to file in (owner/name). Defaults to kvm-pilot's own. | |
| source | No | Free-text provenance recorded in the issue (who/what observed the newer firmware). | |
| confirm | No | Per-invocation approval when the client cannot prompt a human: set true to approve this exact call under the operator's standing policy. Leave false when the client supports elicitation (a human is asked). Never pre-set it speculatively; a denial returns outcome=not_confirmed. | |
| dry_run | No | True previews the exact issue title/body without filing. | |
| profile | No | Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the annotations: discloses that it is an EXTERNAL WRITE, that filing is gated behind KVM_PILOT_MCP_ALLOW_EXTERNAL_WRITE plus per-invocation approval, that dry_run previews the payload, and that a missing/unauthenticated gh yields a graceful filed=false. It also explains the idempotent 'nothing to file' path, matching idempotentHint=true.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the core action and trigger, then escalates to the EXTERNAL WRITE warning, then supplies the mechanics. Dense but every clause (gating, dry_run, failure mode) carries information an agent needs.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a no-output-schema mutation tool it covers the essentials: preconditions, approval gating, preview path, and the exact result signals ('filed=false', 'outcome=not_confirmed', 'nothing to file'). Nothing an agent needs to call it safely is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the schema already documents each parameter richly, so the baseline is 3. The description still adds value by framing dry_run as a payload preview and confirming the confirm param's role in the external_write gating, tying the fields to the approval workflow.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('File the device's firmware-currency report as a GitHub issue') plus the triggering condition ('when the registry is behind'). It also positions itself against the read half and against the CLI tool it mirrors, so an agent can distinguish it from the sibling firmware_check.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Clearly explains the condition for acting ('registry current → nothing to file') and the gating/approval flow, so the agent knows the preconditions. It stops short of explicitly naming firmware_check as the read-only alternative, but since it embeds the read half itself, the routing gap is minor.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
firmware_checkARead-onlyIdempotent
Report the device's firmware currency vs the bundled registry (read-only).
The read half of file_firmware_report (#233): reconciles the device's
reported firmware/update state against the registry SSoT and says whether
the registry is behind — nothing is filed, no gate is consulted. When
registry_behind is true, file_firmware_report contributes the
report (gated external write).
| Name | Required | Description | Default |
|---|---|---|---|
| profile | No | Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint=false, so the safety profile is covered. The description adds real behavioral context beyond the annotations: 'nothing is filed, no gate is consulted' and that the write path is gated externally. It does not discuss failure modes or how the registry comparison is performed, but the annotation bar is lower here.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded first line gives the essential purpose, and the follow-up explains the relationship to file_firmware_report. The internal reference '(#233)' and markdown backticks add minor noise that does not help an agent, but the text is otherwise tight.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description carries some return-value burden; it does name the key signal ('registry_behind') and what the report tells you. Combined with rich annotations and full schema coverage, this is nearly complete, missing only explicit return shape details.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the single optional 'profile' parameter, and the schema already explains the config.toml selection and default. The description adds no parameter guidance, which is the expected baseline when the schema does the work.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The first sentence states a specific verb and resource with scope: 'Report the device's firmware currency vs the bundled registry (read-only).' It explicitly distinguishes itself from the sibling file_firmware_report by describing itself as 'the read half' of that tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It names the condition for escalation ('When registry_behind is true') and points to the alternative tool that performs the gated external write. The when/when-not split is explicit, so an agent can route without reading the sibling schema.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
healthcheckARead-onlyIdempotent
Audit the device's readiness/recovery, security posture, and firmware (#80).
Read-only. Returns per-check findings with a tiered severity; a CRITICAL
(e.g. no out-of-band reset path) is what should gate a subsequent destructive
op. The most valuable finding is recovery-path — whether a hung guest can
be reset at all when the KVM is remote. Served through the preflight cache
(#225): stable posture may come from the last assessment, and a firmware
change since then adds a firmware-delta finding of what cleared/regressed.
| Name | Required | Description | Default |
|---|---|---|---|
| profile | No | Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover readOnly/idempotent/non-destructive, and the description goes well beyond them: it discloses the tiered severity model, that results are served through the preflight cache so 'stable posture may come from the last assessment,' and that a firmware change injects a 'firmware-delta' finding. It also flags the single most valuable finding (recovery-path), which meaningfully changes how an agent should interpret results.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Content is front-loaded (purpose, then read-only, then return shape, then caching caveat) and each sentence carries real information. Minor waste in issue references (#80, #225) that mean nothing to an agent and a slightly verbose framing.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description compensates by describing the return shape (per-check findings, tiered severity), the standout field (recovery-path), and the cache-driven caveat (firmware-delta, stale posture). Nothing an agent needs to call and interpret this read-only audit is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single 'profile' parameter is fully documented in the schema (100% coverage), including its config.toml origin and the KVM_PILOT_PROFILE default, and the description adds nothing about it. Per the high-coverage rule, baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb ('Audit') and enumerates the resources covered (readiness/recovery, security posture, firmware), which is far more informative than the generic name 'healthcheck'. It does not explicitly contrast itself with near-neighbors such as firmware_check, info, or capabilities, so the sibling distinction is only implicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It clearly states the operative context: a CRITICAL finding 'is what should gate a subsequent destructive op,' which tells the agent when this tool is relevant. However, it names no alternative tool and states no when-not-to-use conditions, so the routing guidance is contextual rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
infoARead-onlyIdempotent
Identify the device and the system behind it (read-only).
Returns host/driver plus the driver's info block: model, vendor,
firmware and hardware detail as the device reports them (a PiKVM/GLKVM
describes the appliance; a BMC describes itself and the managed system).
Use it to confirm what you are talking to. It says nothing about whether
the device is safe to act on (healthcheck), what it can do
(capabilities), or the host's power (power_state).
| Name | Required | Description | Default |
|---|---|---|---|
| profile | No | Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly/idempotent/non-destructive, so the '(read-only)' tag is partly redundant, but the description goes further by disclosing what the payload contains (host/driver plus an info block with model, vendor, firmware, hardware) and that the appliance vs. managed system distinction depends on whether it is a PiKVM/GLKVM or BMC. It does not cover error behavior, auth/profile resolution, or the cost of the call, so it stops short of a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose and the sibling-routing exclusions are front-loaded, and every clause does work. The parenthetical about PiKVM/GLKVM vs. BMC is useful but slightly expands the block; overall efficient rather than padded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description must describe the return payload, and it does so concretely (host, driver, info block fields, appliance vs. managed-system semantics). Combined with annotations covering safety and 100% schema coverage on the single parameter, an agent has everything needed to call this correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one optional parameter (profile) and schema description coverage is 100%, so the schema already explains the profile lookup and the default fallback. The description adds nothing about profile selection, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('identify the device and the system behind it') and immediately names the shape of the answer (host/driver plus the driver's info block). It explicitly distinguishes itself from sibling informational tools (healthcheck, capabilities, power_state), so an agent can route without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit use case ('use it to confirm what you are talking to') followed by three named exclusions that each point at the right alternative: safety → healthcheck, capabilities → capabilities, power → power_state. This is a textbook when-to-use/when-not-to-use statement.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_virtual_mediaARead-onlyIdempotent
Inventory the KVM's virtual-media (MSD) storage (read-only).
Check this BEFORE asking the operator to download or upload an ISO — the
image may already be on the device (#127). Returns stored images, the
selected image, and attach state (online). host_visible_as (when
known, #78) is the device name the TARGET's boot menu shows for truly
presented media — match it to pick the right boot entry and to confirm the
medium is really inserted. Details: doctrine topic 'interfaces'.
| Name | Required | Description | Default |
|---|---|---|---|
| profile | No | Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the safety profile (readOnlyHint/idempotent/destructive=false), so the description's added value is in explaining the returned semantics: stored images, selected image, attach state ('online'), and what host_visible_as means for the target's boot menu. That is substantive behavioral context beyond the annotations, though it doesn't cover edge cases or pagination.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the action and the pre-download check, then layers return-field semantics. Dense and mostly earning its space, though the parenthetical issue references (#127, #78) add mild noise without aiding invocation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description carries the burden of explaining returns and does so thoroughly, including the key host_visible_as interpretation for boot-entry matching. For a simple read-only list tool with one optional param, nothing an agent needs is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is a single optional 'profile' parameter with 100% schema description coverage, which already documents its config.toml origin and default fallback. The description adds no parameter-level meaning, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Inventory the KVM's virtual-media (MSD) storage') with an explicit read-only scope. An agent can distinguish it from mount_iso/eject, which mutate media state, without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives a clear conditional trigger: 'Check this BEFORE asking the operator to download or upload an ISO — the image may already be on the device.' That is a concrete when-to-use rule. It does not name sibling tools (mount_iso/eject) as explicit alternatives, so it stops short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
logsARead-onlyIdempotent
Return the device/host event log as text (read-only).
seek is seconds of lookback (0 = the whole buffer). This is the go-to
diagnostic when video/streamer/encoder or power behaviour looks wrong: the
text log names a fault (e.g. a stuck encoder behind a snapshot 503) that
a screenshot cannot. Tail-follow is intentionally not exposed — it blocks
over the server's synchronous transport.
| Name | Required | Description | Default |
|---|---|---|---|
| seek | No | Seconds of lookback; 0 returns the whole buffer. | |
| profile | No | Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, destructiveHint=false and openWorldHint=false, so safety is covered structurally. The description adds real context beyond that: the seek lookback semantics, the diagnostic rationale, and the deliberate omission of tail-follow because it would block the synchronous transport.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The core purpose is front-loaded in the first clause, and the diagnostic framing follows. The tail-follow note is arguably tangential but it explains a real design constraint, so it earns its place; overall tight with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With full annotation coverage, 100% schema description coverage, and no output schema required (the description states the return is text), an agent has what it needs. The only mild gap is that the profile parameter's effect on target selection is left entirely to the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents both parameters in full. The description restates the seek semantics ('seconds of lookback (0 = the whole buffer)') without adding anything new, and never mentions the profile parameter, so this is baseline-level value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource ('Return the device/host event log as text') and immediately marks it read-only. It also implicitly separates itself from siblings like snapshot by noting the log names a fault a screenshot cannot, so an agent can tell it apart without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives a concrete when-to-use trigger: 'go-to diagnostic when video/streamer/encoder or power behaviour looks wrong', with a supporting example (stuck encoder behind a snapshot 503). It lacks an explicit when-not or a named alternative tool (e.g. events) for the case where a structured log is preferred.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mount_isoAIdempotent
Mount an ISO as virtual media on the host. GATED act (media effect gate); reversible.
source is a local path or an http(s):// URL; usb=true attaches as a
USB flash drive instead of a CD-ROM. Needs KVM_PILOT_MCP_ALLOW_MEDIA +
per-invocation approval. Mounting bumps the frame generation, so a mouse click
planned against the pre-mount screen is invalidated.
| Name | Required | Description | Default |
|---|---|---|---|
| usb | No | True presents it as a USB flash drive instead of a CD-ROM. | |
| name | No | Image name to store it under on the device; defaults to the source's basename. | |
| source | Yes | Local path on the server host, or an http(s):// URL the device fetches/streams. | |
| confirm | No | Per-invocation approval when the client cannot prompt a human: set true to approve this exact call under the operator's standing policy. Leave false when the client supports elicitation (a human is asked). Never pre-set it speculatively; a denial returns outcome=not_confirmed. | |
| profile | No | Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare the mutation/safety profile (readOnlyHint=false, destructiveHint=false), and the description adds substantial non-structured context: the media-effect gate, the required env flag and approval flow, reversibility, and the critical side effect that mounting bumps frame generation, invalidating a previously planned mouse click. That is exactly the behavioral detail structured fields cannot carry.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the action and gate status, then details parameters and side effects; every sentence carries information. The inline-code markup adds minor visual noise but no padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description covers the gate, approval requirement, reversibility, and the frame-generation side effect an agent must account for. It omits edge cases such as what happens if media is already mounted, keeping it just short of fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all five parameters are already documented (source, usb, name, confirm, profile). The description restates source semantics (local path or http(s) URL) and usb behavior without adding format or edge-case detail beyond the schema, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ("Mount an ISO as virtual media on the host") and is immediately distinguishable from siblings like list_virtual_media and eject. An agent can identify the action without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives concrete preconditions for use: it is a gated act requiring KVM_PILOT_MCP_ALLOW_MEDIA plus per-invocation approval, and notes the operation is reversible. It does not explicitly route the agent to alternatives (e.g., ejecting existing media first), so it falls short of a full when/when-not/alternative statement.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mouseADestructive
Move the mouse (and optionally click) on the host. DESTRUCTIVE (HID input).
A click must carry the observed_frame_ref it was planned against
(from a prior snapshot); it is refused — re-snapshot and retry — if
the host rebooted/swapped media since, the observation is older than
KVM_PILOT_MCP_FRAME_MAX_AGE (60s default, #141), or the ref wasn't
issued by this server. Move-only (button omitted) needs no ref.
coord_space: percent (0.0-1.0, default — survives resolution
changes), pixel, or raw kvmd. Gated by KVM_PILOT_MCP_ALLOW_HID
per-invocation approval.
| Name | Required | Description | Default |
|---|---|---|---|
| x | Yes | Horizontal target in coord_space units (percent: 0.0 left to 1.0 right). | |
| y | Yes | Vertical target in coord_space units (percent: 0.0 top to 1.0 bottom). | |
| button | No | Button to click after moving. Omit for a move only (no frame ref needed). | |
| confirm | No | Per-invocation approval when the client cannot prompt a human: set true to approve this exact call under the operator's standing policy. Leave false when the client supports elicitation (a human is asked). Never pre-set it speculatively; a denial returns outcome=not_confirmed. | |
| profile | No | Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE). | |
| coord_space | No | percent = fraction of the screen (survives resolution changes); pixel = capture pixels; raw = kvmd units. | percent |
| observed_frame_ref | No | frame_ref from the snapshot the click was planned on. Required for a click; a stale or foreign ref is refused. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Far beyond the annotations (which only give destructiveHint=true), it discloses the exact refusal conditions (host reboot/media swap, ref older than KVM_PILOT_MCP_FRAME_MAX_AGE of 60s, foreign ref), the env gating (KVM_PILOT_MCP_ALLOW_HID) plus per-invocation approval, and the not_confirmed outcome. This is unusually rich behavioral disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose is front-loaded in the first sentence, followed by the click-vs-move constraint and coordinate semantics. It is dense with backtick-heavy detail but every sentence carries actionable information; only minor tightening is possible.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive, approval-gated HID tool with no output schema, it covers preconditions, gating, and one outcome value (not_confirmed). A little more on the returned result shape would fully close the loop, but the agent has what it needs to call correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% so the baseline is 3, but the description adds rationale and failure semantics the schema lacks: coord_space 'survives resolution changes', why the frame ref is needed, and the confirm/approval interaction. It reinforces rather than merely repeats the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The first sentence states a specific verb and resource ('Move the mouse (and optionally click) on the host') and immediately flags the operation class ('DESTRUCTIVE (HID input)'). This is clearly distinguishable from siblings like calibrate_mouse or press_key.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives a clear conditional rule: a click requires an observed_frame_ref from a prior snapshot, while a move-only call needs none, and it directs the agent to re-snapshot and retry on refusal. It stops short of explicitly naming a sibling to use instead, but the snapshot-first workflow is unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
powerADestructive
Change host power state. DESTRUCTIVE.
Gated by the power effect gate + per-invocation approval (elicitation, or
confirm=true under standing policy); denials come back through the same
path with a typed outcome (#234). The result carries an honest effect
report (#168): verified is true/false when the driver has a trustworthy
power signal (Redfish PowerState, a wired ATX LED), and null — with the
reason and what to do instead — when it doesn't. A power action also
invalidates prior snapshot frame refs (generation bump), so a stale
mouse click can't land on the post-reboot screen.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | on/off are graceful (ACPI power button); off-hard forces power off (data loss); reset is a hard reset. Use wake for Wake-on-LAN. | |
| confirm | No | Per-invocation approval when the client cannot prompt a human: set true to approve this exact call under the operator's standing policy. Leave false when the client supports elicitation (a human is asked). Never pre-set it speculatively; a denial returns outcome=not_confirmed. | |
| profile | No | Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and non-idempotent, but the description adds substantial context the annotations cannot carry: the gating/approval flow, the typed outcome on denial, the tri-state verified effect report with null-plus-reason when no trustworthy power signal exists, and the generation-bump invalidation of prior snapshot frame refs. That last item is a non-obvious side effect an agent must know before calling.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The purpose and the DESTRUCTIVE warning are correctly front-loaded in the first two lines. The remainder is information-dense but slightly cluttered by parenthetical issue references (#234, #168) and backtick-laden identifiers, which cost a little readability without adding agent-relevant meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description still covers what an agent needs to know: the approval/denial outcome model, the shape and tri-state nature of the effect report, and the snapshot-ref invalidation side effect. Nothing material for correct invocation or interpretation is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so action, confirm and profile are already fully documented (including the enum's "use wake for Wake-on-LAN" pointer). The description reinforces the confirm/elicitation semantics but adds no syntax or format detail beyond the schema, which is the expected baseline when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ("Change host power state") and flags destructiveness up front, which cleanly separates it from the read-only sibling power_state. It stops short of naming power_state/wake as the alternatives, so the agent must infer the read-vs-write split from sibling names alone.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explains the approval path in detail (power effect gate, elicitation vs confirm=true, denial returns outcome=not_confirmed), which tells the agent how a call will be mediated. It never says when to prefer this over wake or power_state, so the selection guidance is only implied by the verb.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
power_stateARead-onlyIdempotent
Report whether the managed host is powered on (read-only).
Returns powered_on (bool) plus, on PiKVM-family devices, atx (the
power/HDD LEDs and button states); BMC/AMT drivers answer from the
controller's power state. The cheap check after power/wake when
their verified came back null, and before deciding whether a dark
snapshot means off or asleep. Changes nothing: to change power use
power, to wake a sleeping host use wake.
| Name | Required | Description | Default |
|---|---|---|---|
| profile | No | Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint/idempotentHint and no destruction, and the description reinforces this with 'Changes nothing.' It goes further by disclosing return shape (powered_on bool, atx LEDs/buttons on PiKVM) and driver-dependent behavior (BMC/AMT answer from controller state), which matters because there is no output schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the one-line purpose, then return values, then when-to-use, then sibling routing. Every sentence carries distinct information with no restatement of the tool name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only one-parameter tool with no output schema, the description covers purpose, return contents including device-family variance, and sibling routing—everything an agent needs to call it correctly and interpret the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is a single optional profile parameter whose schema description is fully covered (100%), so the schema carries the meaning. The description adds nothing about profile selection or defaults, which is acceptable at this coverage level but not additive.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Opens with a specific verb and resource: 'Report whether the managed host is powered on (read-only).' It also names the return field (powered_on) and distinguishes itself from the mutating siblings power and wake by name.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit trigger conditions: the cheap check after power/wake when their 'verified' came back null, and before deciding whether a dark snapshot means off or asleep. It also states the exclusions directly—use power to change power, wake to wake a sleeping host.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
press_keyADestructive
Press and release one key on the managed host's console. DESTRUCTIVE (HID).
For a single non-text key: Enter to submit, Escape, F2/F12
at POST, arrows and Tab in firmware menus. For a chord use
send_shortcut; for words use type_text; for Ctrl+Alt+Del use
ctrl_alt_delete (power gate). Nothing echoes back — snapshot after.
Same gating as type_text: KVM_PILOT_MCP_ALLOW_HID + per-invocation
approval. Returns the typed act outcome (receipt, or the denial reason).
| Name | Required | Description | Default |
|---|---|---|---|
| key | Yes | One kvmd key code, case-sensitive: Enter, Escape, Tab, F2, ArrowDown, Space, KeyA, Digit1... Not a chord. | |
| confirm | No | Per-invocation approval when the client cannot prompt a human: set true to approve this exact call under the operator's standing policy. Leave false when the client supports elicitation (a human is asked). Never pre-set it speculatively; a denial returns outcome=not_confirmed. | |
| profile | No | Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already flag destructive/non-idempotent, but the description adds non-structured context: no echo-back so 'snapshot after', the required env gate KVM_PILOT_MCP_ALLOW_HID plus per-invocation approval, and the return shape (receipt or denial reason). This goes well beyond what the annotations declare.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose and destructive warning are front-loaded, then routing guidance and behavioral notes follow in an ordered, skimmable block. Slightly dense with backticked literals, and 'DESTRUCTIVE (HID)' partly restates the annotation, but every sentence carries weight.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite no output schema, the description states what comes back (receipt or denial reason), documents the gating and approval flow, and covers the no-feedback follow-up. Nothing an agent needs to invoke it safely is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and each parameter is fully documented there (key code format, confirm semantics, profile selection), so the baseline is 3. The description adds the 'not a chord' constraint for key but nothing new about confirm or profile.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Press and release one key on the managed host's console') and explicitly distinguishes itself from three siblings (send_shortcut for chords, type_text for words, ctrl_alt_delete for Ctrl+Alt+Del). An agent can route to it without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives concrete when-to-use examples ('Enter to submit, Escape, F2/F12 at POST, arrows and Tab in firmware menus') and names the alternative for each neighboring case, so the boundary with siblings is fully specified.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
send_shortcutADestructive
Send a key chord — comma-separated kvmd key codes, e.g.
ControlLeft,AltLeft,Delete or ControlLeft,AltLeft,F2. DESTRUCTIVE.
Gated by effect, not transport: a reboot/power chord (Ctrl+Alt+Del, Magic
SysRq) is classified power_soft/power_hard and needs
KVM_PILOT_MCP_ALLOW_POWER; an ordinary session chord is hid_control and
needs KVM_PILOT_MCP_ALLOW_HID — so a reboot can't slip through the HID gate.
| Name | Required | Description | Default |
|---|---|---|---|
| keys | Yes | Comma-separated kvmd key codes pressed together, modifiers first: 'ControlLeft,AltLeft,F2'. | |
| confirm | No | Per-invocation approval when the client cannot prompt a human: set true to approve this exact call under the operator's standing policy. Leave false when the client supports elicitation (a human is asked). Never pre-set it speculatively; a denial returns outcome=not_confirmed. | |
| profile | No | Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the destructiveHint annotation, the description discloses the concrete gating model: chords are classified by effect (power_soft/power_hard vs hid_control) and require specific env vars (KVM_PILOT_MCP_ALLOW_POWER / KVM_PILOT_MCP_ALLOW_HID). This is real auth/permission context that annotations alone cannot convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the action and the DESTRUCTIVE flag, then explains the gate. It is dense but every clause carries information; the only minor cost is a somewhat wordy second sentence.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive, non-idempotent mutation with no output schema, the description covers the safety gate and the schema covers the confirm/profile mechanics. The main omission is the relationship to the near-duplicate siblings press_key and ctrl_alt_delete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and every parameter (keys, confirm, profile) has its own description, so the schema does the heavy lifting. The description's example key chords add marginal reinforcement but no new syntax beyond what the schema already documents.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb+resource ('Send a key chord') and specifies the exact input format (comma-separated kvmd key codes) with examples. It does not, however, distinguish itself from the very similar siblings press_key and ctrl_alt_delete, leaving an agent to guess which to use.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied through the gating explanation (power vs hid chords). There is no explicit statement of when to reach for send_shortcut over press_key or ctrl_alt_delete, nor any exclusions, so the agent must infer the boundary itself.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sessionARead-onlyIdempotent
Report this server's current operating posture (read-only; offline, no device I/O — answers even when the device is down).
Call this after a context compaction, when resuming a long flow, or before
planning act calls: it names the target, dry-run/read-only state, which
effect gates are open (by class name only — opening one is operator-only,
out of band), the approval posture, any live standing approvals (#192) with
their scope and time left, the recent act journal, and the last
wait_for_state result for the target. All journal/wait state is
in-memory: a server restart empties it (and voids receipts and frame refs),
so an empty journal after a restart is expected, not evidence nothing
happened. Pair with healthcheck for device health and doctrine for
the operating playbooks.
| Name | Required | Description | Default |
|---|---|---|---|
| profile | No | Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover read-only/idempotent/non-destructive, but the description adds substantial context beyond them: it works offline and answers even when the device is down, effect gates are exposed by class name only (opening is operator-only, out of band), and journal/wait state is in-memory so a restart empties it and voids receipts and frame refs. This is exactly the kind of non-obvious behavior an agent needs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose is front-loaded, followed by usage triggers, a return-value enumeration, and restart caveats — every clause is load-bearing. It is dense but slightly long, keeping it short of a 5.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description carries the return contract and does so thoroughly (target, dry-run state, effect gates, approval posture, standing approvals, act journal, last wait_for_state result), plus the restart caveat an agent would otherwise misread as 'nothing happened'.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the single profile parameter is fully documented there (including the config.toml source and KVM_PILOT_PROFILE default). The description adds nothing about the parameter, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Report) and resource (the server's current operating posture) and immediately differentiates itself from siblings by pairing with healthcheck (device health) and doctrine (playbooks). An agent can tell exactly what class of information this returns without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit when-to-use triggers are given: after a context compaction, when resuming a long flow, and before planning act calls. It also names the complementary tools (healthcheck, doctrine) so the routing decision is unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
set_boot_deviceADestructive
Set the next-boot (or persistent) boot device via BootSourceOverride. CONFIG MUTATION.
Gated by the config effect gate + per-invocation approval; denials come
back through the same path with a typed outcome (#234). none clears
the override; once=false makes it persistent; uefi=false selects
legacy BIOS mode where the target exposes it. A target the BMC doesn't
advertise fails fast (call boot_options first to see allowable).
| Name | Required | Description | Default |
|---|---|---|---|
| once | No | True = next boot only; false = persistent until cleared. | |
| uefi | No | True = UEFI boot mode; false = legacy BIOS where the BMC offers it. | |
| device | Yes | Boot source to override with; 'none' clears the override. Must be in boot_options' allowable list. | |
| confirm | No | Per-invocation approval when the client cannot prompt a human: set true to approve this exact call under the operator's standing policy. Leave false when the client supports elicitation (a human is asked). Never pre-set it speculatively; a denial returns outcome=not_confirmed. | |
| profile | No | Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already flag destructive/non-idempotent, and the description adds substantial context beyond them: it is a config mutation subject to the config effect gate plus per-invocation approval, denials return a typed outcome on the same path, and unadvertised targets fail fast. This is exactly the extra behavioral detail annotations cannot convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the mutation warning and quite dense for its length. The trailing issue reference '(#234)' is minor noise, and the clauses are packed, but nearly every sentence carries actionable content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive mutation tool with no output schema, the description covers approval behavior, the denial outcome, override-clearing semantics, and the fail-fast condition. An agent has everything needed to invoke it correctly and interpret the failure path.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so once/uefi/device/confirm/profile are already fully documented in the schema. The description restates the none/once=false/uefi=false semantics, adding little beyond what the schema already says. Baseline 3 applies when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Set the next-boot (or persistent) boot device via BootSourceOverride') and immediately labels it a CONFIG MUTATION. It is clearly distinguishable from the read-only sibling boot_options, which it names explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives the prerequisite workflow clearly ('call boot_options first to see allowable') and explains the gating/approval path. It stops short of an explicit when-not-to-use statement, but the fail-fast note and the boot_options pointer cover the practical routing decision.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
snapshotARead-onlyIdempotent
Capture the current KVM screen (read-only).
Returns [json_text, image]: the JSON carries a frame_ref
(host:generation:hash) — pass it back to the mouse tool as
observed_frame_ref so an absolute click can be refused if the host rebooted
or swapped media since you looked.
It also carries the live signal state (online/resolution/fps/format,
#143) and unchanged_since_last_snapshot (#141): a byte-identical frame
when the screen should have changed means the pixels are stale/cached — do
NOT trust them as ground truth; check signal and logs instead.
| Name | Required | Description | Default |
|---|---|---|---|
| profile | No | Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Even though annotations already declare readOnly/idempotent/non-destructive, the description adds substantial context the annotations cannot: the exact return shape, the frame_ref staleness-guard semantics, the live signal fields (online/resolution/fps/format), and the unchanged_since_last_snapshot failure mode with an explicit 'do NOT trust them as ground truth' instruction. That is exactly the behavioral disclosure annotations cannot carry.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core action, then organized into purpose, return contract, and caveat. Dense and mostly non-redundant, though the inline issue references (#143, #141) are low-value noise for an agent.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description must explain the return value, and it does: the [json_text, image] tuple, the frame_ref format, and the signal/unchanged fields. It also warns about the stale-frame edge case, leaving nothing critical for an agent to guess.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one parameter (profile) and schema description coverage is 100%, so the schema already documents its meaning and default. The description adds nothing about profile or how it interacts with the returned frame, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Opens with a specific verb+resource ('Capture the current KVM screen') and immediately qualifies it with '(read-only)', which cleanly separates it from the actuating siblings like mouse, type_text and power. The return contract ([json_text, image]) further pins down what the tool produces.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit downstream usage: pass the returned frame_ref to the mouse tool as observed_frame_ref, and explains why (absolute clicks refused after host reboot/media swap). It also tells the agent what to do when pixels look stale (check signal and logs). It does not, however, state when to prefer snapshot over the sibling classify_screen or wait_for_state, so the alternative-selection guidance is incomplete.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_discoverARead-onlyIdempotent
Scan a CIDR for hosts with an open SSH port. RISKY — opt-in.
An active network scan: noisy, and only acceptable on networks the user owns or
is authorized to probe. Use it ONLY to help find a target whose address the user
doesn't know, after they confirm the range — never by default. confirm=true
is required to acknowledge the scan.
| Name | Required | Description | Default |
|---|---|---|---|
| cidr | Yes | Network to scan in CIDR form, e.g. '10.0.1.0/24'. The user must own or be authorized to probe it. | |
| port | No | TCP port to probe. | |
| confirm | No | Per-invocation approval when the client cannot prompt a human: set true to approve this exact call under the operator's standing policy. Leave false when the client supports elicitation (a human is asked). Never pre-set it speculatively; a denial returns outcome=not_confirmed. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover the safety profile (readOnly, non-destructive, idempotent), and the description adds what they cannot: the scan is noisy, requires the user to own the range, demands confirm=true, and returns outcome=not_confirmed on denial. That is genuine operational context beyond structured fields.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The purpose and the RISKY flag are front-loaded in the first line, then authorization and the confirm requirement follow in descending priority. Slightly redundant with the schema's confirm description, but no sentence is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a three-parameter discovery tool with no output schema, the description covers purpose, risk, authorization, and the failure mode of a missing confirmation. It does not indicate the shape of a successful result (host list, timing), a minor gap given there is no output schema to lean on.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and every parameter already carries a detailed description, including the nuanced confirm/elicitation behavior. The description restates that confirm=true is required but adds no syntax or format detail the schema lacks, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Opens with a specific verb+resource+scope: 'Scan a CIDR for hosts with an open SSH port.' That cleanly separates CIDR-wide discovery from the single-target check implied by the ssh_reachable sibling. It stops short of naming that sibling explicitly, so an agent must infer the routing rather than read it.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit positive condition (only to find a target whose address the user doesn't know, after they confirm the range) and an explicit exclusion (never by default), plus the authorization precondition. This is exactly the when/when-not guidance an agent needs for a risky tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_execADestructive
Run a command on the managed host's OS over SSH. DESTRUCTIVE / in-band.
Gated by its own SSH effect gate (never the HID gate) + per-invocation
approval, with typed same-path denials (#234). host overrides the
profile/env ssh_host at runtime (e.g. a discovered install-time DHCP
address).
| Name | Required | Description | Default |
|---|---|---|---|
| host | No | Override the profile's ssh_host for this call only, e.g. an install-time DHCP address the profile cannot know yet. | |
| command | Yes | Shell command line to run on the managed host as the profile's SSH user. | |
| confirm | No | Per-invocation approval when the client cannot prompt a human: set true to approve this exact call under the operator's standing policy. Leave false when the client supports elicitation (a human is asked). Never pre-set it speculatively; a denial returns outcome=not_confirmed. | |
| profile | No | Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations (destructive, non-idempotent), it discloses that the call is gated by a dedicated SSH effect gate rather than the HID gate, requires per-invocation approval, and can return typed same-path denials. This adds real behavioral context the annotations do not carry.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Short and front-loaded, leading with the core action and the DESTRUCTIVE tag. The issue-reference fragment '(#234)' and the parenthetical are somewhat cryptic and cost a little clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive no-output-schema tool, it covers the essential safety and approval model that an agent must know before invoking. It could say more about error/denial outcomes, but the confirm parameter's schema description already covers the not_confirmed case.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so all four parameters are already documented. The description only re-explains the host override (already in the schema) and adds no semantics for command, confirm, or profile, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Run a command on the managed host's OS over SSH') and flags the safety profile with 'DESTRUCTIVE / in-band'. It doesn't explicitly distinguish itself from close siblings like ssh_reachable or ssh_discover, so it falls just short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It names the gating mechanism (SSH effect gate, per-invocation approval, same-path denials), which implies the operational context, but there is no explicit when-to-use versus ssh_reachable/ssh_discover guidance or stated preconditions for the target host.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_reachableARead-onlyIdempotent
Is the managed host's OS reachable over SSH? (read-only, in-band).
Targets the host behind the KVM (its own ssh_host / KVM_PILOT_SSH_HOST),
a different machine from the KVM appliance. Use this to prefer remote recovery
before asking a user to physically intervene.
host overrides the profile/env ssh_host at runtime — e.g. an install-time
DHCP address the profile can't know until the target boots.
| Name | Required | Description | Default |
|---|---|---|---|
| host | No | Override the profile's ssh_host for this call only, e.g. an install-time DHCP address the profile cannot know yet. | |
| profile | No | Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly/idempotent/non-destructive, so the bar is lower, but the description adds real value: 'read-only, in-band' and the clarification that it targets a different machine than the KVM appliance, plus the runtime-override behavior of host. It doesn't cover timeout/latency behavior, but that's minor here.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the core question, then layers scope, routing guidance, and the host override in a tight structured block. Every sentence carries information, though the host paragraph slightly restates the schema description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only reachability probe with full annotation coverage and no output schema, the description is nearly complete: it states the operation, the distinct target machine, and when to prefer it. It could note failure semantics (what an unreachable result implies), but nothing critical for correct invocation is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so both parameters are already documented in the schema, establishing the baseline of 3. The description reinforces the host override with a use case (install-time DHCP address), but adds no syntax or format detail beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Opens with a precise question ('Is the managed host's OS reachable over SSH?') that names a specific verb-like operation and resource, and explicitly disambiguates the target as the host *behind* the KVM, distinct from the appliance. This separates it cleanly from siblings like ssh_exec, ssh_discover, and healthcheck.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear context ('use this to prefer remote recovery before asking a user to physically intervene'), which tells the agent when this probe is the right call. It does not explicitly name when-not or enumerate alternatives (e.g. ssh_discover/ssh_exec), so it stops short of a full routing rationale.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
support_matrixARead-onlyIdempotent
What has actually been exercised on real hardware, per device+firmware+capability (read-only, offline — no device call).
Aggregated from the test-run ledger shipped in the package (the same data
behind the wiki Hardware-Compatibility page), with each combo's derived
maturity level (#98) joined from the shipped firmware registry. This is
EVIDENCE, not a guarantee: a capability listed in never_exercised (or a
combo with no row at all) is unverified on that hardware — treat it as
mock-only/alpha maturity and confirm destructive steps with the user.
status is "fail" when every recorded live attempt failed (e.g. RM1PE
V1.5.1 firmware_update, #94/#95). Filters are case-insensitive; product
matches as a substring.
| Name | Required | Description | Default |
|---|---|---|---|
| vendor | No | Filter: device vendor, case-insensitive exact match (e.g. 'GL.iNet', 'Dell'). | |
| product | No | Filter: product name, case-insensitive substring (e.g. 'RM1PE', 'iDRAC'). | |
| firmware_version | No | Filter: exact firmware version string as the device reports it. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover read-only/idempotent/no-destructive, but the description adds substantial context beyond them: no device call is made, the data is a shipped ledger rather than a live probe, it is 'EVIDENCE, not a guarantee', and missing rows imply unverified alpha/mock-only status. It even explains the meaning of the `status` value ('fail' = every recorded live attempt failed).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The core definition is front-loaded in the first sentence and the rest earns its place by defining the evidence semantics. It is slightly cluttered by internal issue references (#98, #94/#95) and a wiki cross-reference that an agent does not need to invoke the tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description does the work of explaining the return shape: rows per device+firmware+capability, a `status` field, and a `never_exercised` list. It stops short of describing the full field set or how maturity levels are derived, but an agent has enough to interpret results and act correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the schema descriptions already specify case-insensitive exact match for vendor and substring for product, so the description's 'Filters are case-insensitive; product matches as a substring' largely restates structured data. The phrase 'per device+firmware+capability' hints at how filters combine, but no syntax or edge-case detail is added, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The opening line states a specific resource and scope: what has been exercised on real hardware, keyed by device+firmware+capability. It also distinguishes itself from live-query siblings by declaring 'read-only, offline — no device call', so an agent can tell it apart from `capabilities` or `healthcheck` without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage context is clear: consult this before treating a capability as verified, and 'confirm destructive steps with the user' when a combo is unverified. It does not explicitly name the sibling alternative (e.g. live `capabilities`) or state when this tool should not be used, so it stops short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
type_textADestructive
Type a string on the managed host's console over the HID keyboard. DESTRUCTIVE.
For printable text (commands, installer fields, passwords); nothing echoes
back and no Enter is appended — press_key('Enter') to submit. Keys that
aren't text go through press_key; chords through send_shortcut.
Keystrokes land wherever the host's focus is: snapshot first to confirm
the screen, and after to see the effect. Needs KVM_PILOT_MCP_ALLOW_HID
per-invocation approval (elicitation, or
confirm=trueunder standing policy). Returns the typed act outcome (receipt, or the denial reason).
| Name | Required | Description | Default |
|---|---|---|---|
| text | Yes | Printable text to type verbatim. Press Enter separately with press_key('Enter'). | |
| confirm | No | Per-invocation approval when the client cannot prompt a human: set true to approve this exact call under the operator's standing policy. Leave false when the client supports elicitation (a human is asked). Never pre-set it speculatively; a denial returns outcome=not_confirmed. | |
| profile | No | Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already flag destructiveHint=true, but the description adds genuinely new behavior: nothing echoes back, no Enter is appended, keystrokes land wherever the host's focus is, and it requires KVM_PILOT_MCP_ALLOW_HID plus per-invocation approval (elicitation or confirm=true). It even names the denial outcome. This is context beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the action and the DESTRUCTIVE label, then each subsequent sentence carries unique, non-redundant information (echo behavior, alternatives, focus, auth, return). No filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description compensates by describing the return value (typed act outcome: receipt or denial reason) and the full auth/approval path. An agent has everything needed to invoke this destructive tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents text, confirm, and profile in detail. The description reinforces that text is typed verbatim with no Enter appended, but this largely restates what the schema's text description already says, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (type) on a specific resource (a string on the managed host's console over the HID keyboard) and immediately routes non-text keys to press_key and chords to send_shortcut, so the agent can distinguish it from siblings without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly covers when to use (printable commands, installer fields, passwords), when not to (non-text keys -> press_key, chords -> send_shortcut), and the surrounding workflow (snapshot before to confirm focus, after to see effect). Prerequisites for approval are also stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
wait_for_stateARead-only
Wait (bounded) until the screen reaches a boot/run phase (read-only).
Server-side twin of CLI watch: polls cheap power/signal/boot-progress
gates, then server-side vision, until phase (a classify_screen token;
unknown tokens fail fast with the valid list) is observed. timeout is
seconds, capped server-side at 300 — chain calls for longer waits. Success
returns phase/confidence plus a frame_ref to pass to mouse as
observed_frame_ref; a timeout returns reached=false with the last
observed state (never a hang, never a raised error). With no server-side
vision credentials only cheap-gate phases are waitable; others fail fast
pointing at classify_screen polling. Holds the driver open up to
timeout s. Details: doctrine topic 'interfaces'.
| Name | Required | Description | Default |
|---|---|---|---|
| hint | No | Optional context for the vision backend, e.g. what you expect on screen ('Fedora installer, language page'). | |
| phase | Yes | Target boot/run phase token as classify_screen names it (e.g. 'bios', 'bootloader', 'os_login'); an unknown token fails fast with the valid list. | |
| profile | No | Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE). | |
| timeout | No | Seconds to wait before returning reached=false; capped server-side at 300. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the annotations: bounded polling of cheap gates then vision, a 300s server-side cap with guidance to chain calls, timeout returns reached=false with last state and never hangs or raises, and it holds the driver open up to timeout. It also discloses the frame_ref handoff to mouse and the vision-credential dependency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core behavior and dense with specifics; some content (the 300s cap, phase token naming) is echoed in the schema, but every sentence carries operational detail and none is filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description carries the return contract itself: phase/confidence plus frame_ref on success, reached=false plus last state on timeout. Combined with the documented failure modes and credential caveat, an agent has everything needed to call and interpret it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% so the baseline is 3, but the description adds real meaning: phase is a classify_screen token with fail-fast validation on unknown tokens, timeout is capped server-side at 300, and frame_ref feeds mouse as observed_frame_ref. The phase-token relationship to a sibling tool is genuinely beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: wait (bounded) until the screen reaches a boot/run phase, and marks it read-only. It is clearly distinguishable from siblings like classify_screen and power_state because it describes active waiting on a phase token rather than a one-shot classification or a state query.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explains when to use this versus alternatives, naming classify_screen polling for non-cheap-gate phases and the no-vision-credentials exclusion. It's clear context, though it doesn't give an explicit 'prefer X over Y when Z' rule beyond those cases.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
wakeADestructive
Send a Wake-on-LAN magic packet to power the host on. POWER (soft).
Gated by the power effect gate + per-invocation approval (typed same-path
denials, #234). mac defaults to the profile's mac; broadcast to
its wol_broadcast. No KVM driver is contacted — WoL is a broadcast sent
from the server's own host onto the target's L2 segment.
| Name | Required | Description | Default |
|---|---|---|---|
| mac | No | Target NIC MAC (aa:bb:cc:dd:ee:ff). Defaults to the profile's mac. | |
| count | No | Magic packets to send (a few, spaced, survive loss). | |
| confirm | No | Per-invocation approval when the client cannot prompt a human: set true to approve this exact call under the operator's standing policy. Leave false when the client supports elicitation (a human is asked). Never pre-set it speculatively; a denial returns outcome=not_confirmed. | |
| profile | No | Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE). | |
| broadcast | No | Broadcast address to send to. Defaults to the profile's wol_broadcast, else 255.255.255.255. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true, idempotentHint=false and openWorldHint=false, so the safety profile is covered; the description adds genuinely new behavior: approval gating, the typed same-path denial mechanism, the not_confirmed outcome, and the fact that WoL is broadcast from the server's own host rather than through the KVM. It does not spell out side effects on an already-powered host, which is the remaining gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the action in the first sentence, then adds gating and defaults compactly with no padding. The parenthetical issue reference ('#234') and 'POWER (soft)' tag are internal shorthand that costs a little clarity without earning much for an external agent.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a five-parameter, no-required-args action tool with no output schema, the description covers the mechanism, approval flow, one return value (outcome=not_confirmed), and defaults, which is enough to invoke it correctly. It stops short of describing the full result shape or what happens if the host is already on.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all five parameters including defaults are already fully documented in the schema. The description only restates the mac and broadcast defaults, adding no format, syntax, or constraint detail beyond what the schema provides — the correct baseline of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Send a Wake-on-LAN magic packet to power the host on') and adds the mechanism detail that no KVM driver is contacted, which separates it from the sibling `power` tool. The trailing 'POWER (soft)' tag is unexplained jargon and the sibling `power` is never named directly, so the differentiation is implied rather than explicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains the gating context (power effect gate plus per-invocation approval) and gives real guidance on the `confirm` flag, including that denials return outcome=not_confirmed. However it never states when to choose `wake` over the sibling `power` or `power_state` tool, leaving the primary routing decision to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
34 tool updates
v1.0.0- Changed
access_paths1 field changed- added
Input schema / properties / profile / descriptionAdded value: +"Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE)."
- Changed
amt_enable4 fields changed- added
Input schema / properties / confirm / descriptionAdded value: +"Per-invocation approval when the client cannot prompt a human: set true to approve this exact call under the operator's standing policy. Leave false when the client supports elicitation (a human is asked). Never pre-set it speculatively; a denial returns outcome=not_confirmed." - added
Input schema / properties / consent_off / descriptionAdded value: +"KVM only: true disables the on-screen user-consent prompt (needs the KVM_PILOT_MCP_ALLOW_CONSENT_OFF gate too). Leave false to keep the prompt." - added
Input schema / properties / feature / descriptionAdded value: +"'sol' opens the SOL/IDE-R listener (port 16994); 'kvm' opens KVM redirection (5900) and sets the RFB password." - added
Input schema / properties / profile / descriptionAdded value: +"Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE)."
- Changed
appliance_reboot2 fields changed- added
Input schema / properties / confirm / descriptionAdded value: +"Per-invocation approval when the client cannot prompt a human: set true to approve this exact call under the operator's standing policy. Leave false when the client supports elicitation (a human is asked). Never pre-set it speculatively; a denial returns outcome=not_confirmed." - added
Input schema / properties / profile / descriptionAdded value: +"Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE)."
- Changed
appliance_status1 field changed- added
Input schema / properties / profile / descriptionAdded value: +"Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE)."
- Changed
boot_options1 field changed- added
Input schema / properties / profile / descriptionAdded value: +"Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE)."
- Changed
calibrate_mouse4 fields changed- added
Input schema / properties / confirm / descriptionAdded value: +"Per-invocation approval when the client cannot prompt a human: set true to approve this exact call under the operator's standing policy. Leave false when the client supports elicitation (a human is asked). Never pre-set it speculatively; a denial returns outcome=not_confirmed." - added
Input schema / properties / profile / descriptionAdded value: +"Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE)." - added
Input schema / properties / tolerance / descriptionAdded value: +"Max held-out verification error, as a fraction of the screen, for the fit to be stored." - added
Input schema / properties / tolerance / exclusiveMinimumAdded value: +0
- Changed
capabilities1 field changed- added
Input schema / properties / profile / descriptionAdded value: +"Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE)."
- Changed
classify_screen2 fields changed- added
Input schema / properties / hint / descriptionAdded value: +"Optional context for the vision backend, e.g. what you expect on screen ('Fedora installer, language page')." - added
Input schema / properties / profile / descriptionAdded value: +"Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE)."
- Changed
ctrl_alt_delete2 fields changed- added
Input schema / properties / confirm / descriptionAdded value: +"Per-invocation approval when the client cannot prompt a human: set true to approve this exact call under the operator's standing policy. Leave false when the client supports elicitation (a human is asked). Never pre-set it speculatively; a denial returns outcome=not_confirmed." - added
Input schema / properties / profile / descriptionAdded value: +"Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE)."
- Changed
doctrine1 field changed- added
Input schema / properties / topic / descriptionAdded value: +"Playbook to return in full (e.g. 'recovery', 'interfaces'). Omit to list the available topics."
- Changed
eject2 fields changed- added
Input schema / properties / confirm / descriptionAdded value: +"Per-invocation approval when the client cannot prompt a human: set true to approve this exact call under the operator's standing policy. Leave false when the client supports elicitation (a human is asked). Never pre-set it speculatively; a denial returns outcome=not_confirmed." - added
Input schema / properties / profile / descriptionAdded value: +"Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE)."
- Changed
events5 fields changed- added
Input schema / properties / count / descriptionAdded value: +"Stop after this many events." - added
Input schema / properties / count / minimumAdded value: +1 - added
Input schema / properties / duration / descriptionAdded value: +"Stop after this many seconds (capped at 30), whichever comes first." - added
Input schema / properties / duration / exclusiveMinimumAdded value: +0 - added
Input schema / properties / profile / descriptionAdded value: +"Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE)."
- Changed
file_firmware_report5 fields changed- added
Input schema / properties / confirm / descriptionAdded value: +"Per-invocation approval when the client cannot prompt a human: set true to approve this exact call under the operator's standing policy. Leave false when the client supports elicitation (a human is asked). Never pre-set it speculatively; a denial returns outcome=not_confirmed." - added
Input schema / properties / dry_run / descriptionAdded value: +"True previews the exact issue title/body without filing." - added
Input schema / properties / profile / descriptionAdded value: +"Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE)." - added
Input schema / properties / repo / descriptionAdded value: +"GitHub repo to file in (owner/name). Defaults to kvm-pilot's own." - added
Input schema / properties / source / descriptionAdded value: +"Free-text provenance recorded in the issue (who/what observed the newer firmware)."
- Changed
firmware_check1 field changed- added
Input schema / properties / profile / descriptionAdded value: +"Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE)."
- Changed
healthcheck1 field changed- added
Input schema / properties / profile / descriptionAdded value: +"Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE)."
- Changed
info1 field changed- added
Input schema / properties / profile / descriptionAdded value: +"Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE)."
- Changed
list_virtual_media1 field changed- added
Input schema / properties / profile / descriptionAdded value: +"Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE)."
- Changed
logs3 fields changed- added
Input schema / properties / profile / descriptionAdded value: +"Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE)." - added
Input schema / properties / seek / descriptionAdded value: +"Seconds of lookback; 0 returns the whole buffer." - added
Input schema / properties / seek / minimumAdded value: +0
- Changed
mount_iso5 fields changed- added
Input schema / properties / confirm / descriptionAdded value: +"Per-invocation approval when the client cannot prompt a human: set true to approve this exact call under the operator's standing policy. Leave false when the client supports elicitation (a human is asked). Never pre-set it speculatively; a denial returns outcome=not_confirmed." - added
Input schema / properties / name / descriptionAdded value: +"Image name to store it under on the device; defaults to the source's basename." - added
Input schema / properties / profile / descriptionAdded value: +"Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE)." - added
Input schema / properties / source / descriptionAdded value: +"Local path on the server host, or an http(s):// URL the device fetches/streams." - added
Input schema / properties / usb / descriptionAdded value: +"True presents it as a USB flash drive instead of a CD-ROM."
- Changed
mouse7 fields changed- added
Input schema / properties / button / descriptionAdded value: +"Button to click after moving. Omit for a move only (no frame ref needed)." - added
Input schema / properties / confirm / descriptionAdded value: +"Per-invocation approval when the client cannot prompt a human: set true to approve this exact call under the operator's standing policy. Leave false when the client supports elicitation (a human is asked). Never pre-set it speculatively; a denial returns outcome=not_confirmed." - added
Input schema / properties / coord_space / descriptionAdded value: +"percent = fraction of the screen (survives resolution changes); pixel = capture pixels; raw = kvmd units." - added
Input schema / properties / observed_frame_ref / descriptionAdded value: +"frame_ref from the snapshot the click was planned on. Required for a click; a stale or foreign ref is refused." - added
Input schema / properties / profile / descriptionAdded value: +"Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE)." - added
Input schema / properties / x / descriptionAdded value: +"Horizontal target in coord_space units (percent: 0.0 left to 1.0 right)." - added
Input schema / properties / y / descriptionAdded value: +"Vertical target in coord_space units (percent: 0.0 top to 1.0 bottom)."
- Changed
power3 fields changed- added
Input schema / properties / action / descriptionAdded value: +"on/off are graceful (ACPI power button); off-hard forces power off (data loss); reset is a hard reset. Use wake for Wake-on-LAN." - added
Input schema / properties / confirm / descriptionAdded value: +"Per-invocation approval when the client cannot prompt a human: set true to approve this exact call under the operator's standing policy. Leave false when the client supports elicitation (a human is asked). Never pre-set it speculatively; a denial returns outcome=not_confirmed." - added
Input schema / properties / profile / descriptionAdded value: +"Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE)."
- Changed
power_state1 field changed- added
Input schema / properties / profile / descriptionAdded value: +"Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE)."
- Changed
press_key3 fields changed- added
Input schema / properties / confirm / descriptionAdded value: +"Per-invocation approval when the client cannot prompt a human: set true to approve this exact call under the operator's standing policy. Leave false when the client supports elicitation (a human is asked). Never pre-set it speculatively; a denial returns outcome=not_confirmed." - added
Input schema / properties / key / descriptionAdded value: +"One kvmd key code, case-sensitive: Enter, Escape, Tab, F2, ArrowDown, Space, KeyA, Digit1... Not a chord." - added
Input schema / properties / profile / descriptionAdded value: +"Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE)."
- Changed
send_shortcut3 fields changed- added
Input schema / properties / confirm / descriptionAdded value: +"Per-invocation approval when the client cannot prompt a human: set true to approve this exact call under the operator's standing policy. Leave false when the client supports elicitation (a human is asked). Never pre-set it speculatively; a denial returns outcome=not_confirmed." - added
Input schema / properties / keys / descriptionAdded value: +"Comma-separated kvmd key codes pressed together, modifiers first: 'ControlLeft,AltLeft,F2'." - added
Input schema / properties / profile / descriptionAdded value: +"Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE)."
- Changed
session1 field changed- added
Input schema / properties / profile / descriptionAdded value: +"Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE)."
- Changed
set_boot_device5 fields changed- added
Input schema / properties / confirm / descriptionAdded value: +"Per-invocation approval when the client cannot prompt a human: set true to approve this exact call under the operator's standing policy. Leave false when the client supports elicitation (a human is asked). Never pre-set it speculatively; a denial returns outcome=not_confirmed." - added
Input schema / properties / device / descriptionAdded value: +"Boot source to override with; 'none' clears the override. Must be in boot_options' allowable list." - added
Input schema / properties / once / descriptionAdded value: +"True = next boot only; false = persistent until cleared." - added
Input schema / properties / profile / descriptionAdded value: +"Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE)." - added
Input schema / properties / uefi / descriptionAdded value: +"True = UEFI boot mode; false = legacy BIOS where the BMC offers it."
- Changed
snapshot1 field changed- added
Input schema / properties / profile / descriptionAdded value: +"Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE)."
- Changed
ssh_discover5 fields changed- added
Input schema / properties / cidr / descriptionAdded value: +"Network to scan in CIDR form, e.g. '10.0.1.0/24'. The user must own or be authorized to probe it." - added
Input schema / properties / confirm / descriptionAdded value: +"Per-invocation approval when the client cannot prompt a human: set true to approve this exact call under the operator's standing policy. Leave false when the client supports elicitation (a human is asked). Never pre-set it speculatively; a denial returns outcome=not_confirmed." - added
Input schema / properties / port / descriptionAdded value: +"TCP port to probe." - added
Input schema / properties / port / maximumAdded value: +65535 - added
Input schema / properties / port / minimumAdded value: +1
- Changed
ssh_exec4 fields changed- added
Input schema / properties / command / descriptionAdded value: +"Shell command line to run on the managed host as the profile's SSH user." - added
Input schema / properties / confirm / descriptionAdded value: +"Per-invocation approval when the client cannot prompt a human: set true to approve this exact call under the operator's standing policy. Leave false when the client supports elicitation (a human is asked). Never pre-set it speculatively; a denial returns outcome=not_confirmed." - added
Input schema / properties / host / descriptionAdded value: +"Override the profile's ssh_host for this call only, e.g. an install-time DHCP address the profile cannot know yet." - added
Input schema / properties / profile / descriptionAdded value: +"Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE)."
- Changed
ssh_reachable2 fields changed- added
Input schema / properties / host / descriptionAdded value: +"Override the profile's ssh_host for this call only, e.g. an install-time DHCP address the profile cannot know yet." - added
Input schema / properties / profile / descriptionAdded value: +"Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE)."
- Changed
support_matrix3 fields changed- added
Input schema / properties / firmware_version / descriptionAdded value: +"Filter: exact firmware version string as the device reports it." - added
Input schema / properties / product / descriptionAdded value: +"Filter: product name, case-insensitive substring (e.g. 'RM1PE', 'iDRAC')." - added
Input schema / properties / vendor / descriptionAdded value: +"Filter: device vendor, case-insensitive exact match (e.g. 'GL.iNet', 'Dell')."
- Changed
type_text3 fields changed- added
Input schema / properties / confirm / descriptionAdded value: +"Per-invocation approval when the client cannot prompt a human: set true to approve this exact call under the operator's standing policy. Leave false when the client supports elicitation (a human is asked). Never pre-set it speculatively; a denial returns outcome=not_confirmed." - added
Input schema / properties / profile / descriptionAdded value: +"Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE)." - added
Input schema / properties / text / descriptionAdded value: +"Printable text to type verbatim. Press Enter separately with press_key('Enter')."
- Changed
wait_for_state5 fields changed- added
Input schema / properties / hint / descriptionAdded value: +"Optional context for the vision backend, e.g. what you expect on screen ('Fedora installer, language page')." - added
Input schema / properties / phase / descriptionAdded value: +"Target boot/run phase token as classify_screen names it (e.g. 'bios', 'bootloader', 'os_login'); an unknown token fails fast with the valid list." - added
Input schema / properties / profile / descriptionAdded value: +"Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE)." - added
Input schema / properties / timeout / descriptionAdded value: +"Seconds to wait before returning reached=false; capped server-side at 300." - added
Input schema / properties / timeout / exclusiveMinimumAdded value: +0
- Changed
wake6 fields changed- added
Input schema / properties / broadcast / descriptionAdded value: +"Broadcast address to send to. Defaults to the profile's wol_broadcast, else 255.255.255.255." - added
Input schema / properties / confirm / descriptionAdded value: +"Per-invocation approval when the client cannot prompt a human: set true to approve this exact call under the operator's standing policy. Leave false when the client supports elicitation (a human is asked). Never pre-set it speculatively; a denial returns outcome=not_confirmed." - added
Input schema / properties / count / descriptionAdded value: +"Magic packets to send (a few, spaced, survive loss)." - added
Input schema / properties / count / minimumAdded value: +1 - added
Input schema / properties / mac / descriptionAdded value: +"Target NIC MAC (aa:bb:cc:dd:ee:ff). Defaults to the profile's mac." - added
Input schema / properties / profile / descriptionAdded value: +"Profile name from ~/.config/kvm-pilot/config.toml selecting which KVM/BMC (and its managed host) this call targets. Omit to use the server's default (KVM_PILOT_PROFILE)."
34 tool updates
v0.1.0- First observed
access_paths - First observed
amt_enable - First observed
appliance_reboot - First observed
appliance_status - First observed
boot_options - First observed
calibrate_mouse - First observed
capabilities - First observed
classify_screen - First observed
ctrl_alt_delete - First observed
doctrine - First observed
eject - First observed
events - First observed
file_firmware_report - First observed
firmware_check - First observed
healthcheck - First observed
info - First observed
list_virtual_media - First observed
logs - First observed
mount_iso - First observed
mouse - First observed
power - First observed
power_state - First observed
press_key - First observed
send_shortcut - First observed
session - First observed
set_boot_device - First observed
snapshot - First observed
ssh_discover - First observed
ssh_exec - First observed
ssh_reachable - First observed
support_matrix - First observed
type_text - First observed
wait_for_state - First observed
wake
TDQS
Scored across 34 tools
Most tools have clearly distinct roles, and the descriptions actively cross-reference boundaries such as power_state/power/wake, logs/events, type_text/press_key/send_shortcut, and ssh_reachable/ssh_exec/appliance_status. The main residual ambiguity is the large read-only introspection cluster (info, healthcheck, capabilities, support_matrix, session, doctrine, access_paths) and the overlapping Ctrl+Alt+Del paths, though the descriptions mitigate this well.
All names use snake_case, so the delimiter and casing are consistent. However the set mixes noun-only names (info, logs, snapshot, power_state, capabilities) with verb-oriented names (set_boot_device, mount_iso, ssh_exec) and inconsistent orderings such as firmware_check vs file_firmware_report and ssh_reachable vs ssh_discover.
34 tools is well above the typical 3-15 range for a well-scoped MCP server. Many are read-only diagnostics or meta tools (info, healthcheck, capabilities, support_matrix, doctrine, session, access_paths, power_state, logs, events, boot_options, list_virtual_media, ssh_reachable, appliance_status, firmware_check) that could be consolidated or exposed through a more compact interface.
Core KVM lifecycle coverage is strong: identify/health/capabilities, power state/change/wake, boot options/set, HID typing/keys/mouse/calibration, virtual media list/mount/eject, SSH reachable/exec, appliance status/reboot, logs/events, and firmware check/report. Minor gaps remain, such as no virtual-media upload/delete management, no detailed BMC sensor view, and no serial-console tool for non-video devices.
Maintenance
Related MCP Connectors
MCP server for building and testing AI agents with multi-model experimentation and insights.
MCP server for AI agents to plan, verify, and deploy Cloudflare-native apps.
MCP server for Wan AI video generation
Related MCP Servers
- AlicenseCqualityDmaintenanceThis MCP server connects AI agents to a PiKVM device, enabling full keyboard, mouse, and screen control of a physical machine without emulation.284GPL 3.0
- AlicenseNot gradedqualityDmaintenanceAn MCP server that gives AI agents direct control over QEMU virtual machines.15 npm1MIT
- AlicenseNot gradedqualityBmaintenanceMCP server that enables AI to see and control a physical computer via a JetKVM device for screen viewing, mouse/keyboard input, media mounting, and power management.17MIT
- FlicenseAqualityCmaintenanceMCP server for controlling Sipeed NanoKVM devices, enabling remote hardware control via keyboard, mouse, power, and screenshots. It allows AI assistants like Claude to manage headless machines at the BIOS level.20-