Skip to main content
Glama
EF-Code
by EF-Code

boxes-mcp

Tests TypeScript License: MIT

libvirt/virsh를 통해 GNOME Boxes 가상 머신을 관리할 수 있도록 호환 에이전트와 개발자 하네스를 지원하는 로컬 Model Context Protocol(MCP) 서버입니다. 안전하고 되돌릴 수 있는 VM 작업, 스냅샷, 스크린샷, 제한된 키보드 및 마우스 입력, 기능 게이트 SPICE 기능을 제공합니다.

이 프로젝트는 의도적으로 GNOME Boxes의 Linux libvirt/QEMU 스택을 대상으로 합니다. VMware와 VirtualBox는 현재 지원되지 않습니다. 해당 제품의 디스플레이, 입력, 게스트 에이전트, 클립보드, 드래그 앤 드롭 API는 신뢰 및 기능 계약이 다르므로 libvirt 구현에서 추론하지 말고 별도의 증거 기반 공급자로 추가해야 합니다.

Contents

Related MCP server: libvirt-mcp

Features

  • 🖥️ VM 수명 주기 관리 - VM 시작, 중지, 재부팅, 일시 중지 및 재개

  • 📸 스냅샷 작업 - VM 스냅샷 생성, 나열, 되돌리기 및 삭제

  • 🔍 VM 검색 - 모든 VM을 상세 정보와 함께 나열 및 검사

  • 🔒 안전한 작업 - 기본적으로 스토리지 보존, 파괴적 작업 없음

  • 🎯 GNOME Boxes 호환 - GNOME Boxes VM과 완벽하게 작동

  • 🖱️ 제어된 상호 작용 - 스크린샷, 허용 목록 키보드, 입력된 마우스 도구

  • 🔌 기능 게이트 SPICE - SPICE 입력, 클립보드 및 전송을 위한 선택적 네이티브 헬퍼 프로토콜

  • ⚡ 빠르고 가벼움 - 최소 오버헤드, 직접 virsh 통합

Installation

Host prerequisites

  • Ubuntu 22.04/24.04 (또는 호환되는 Linux 배포판)

  • libvirt-daemon-system, qemu-kvm 설치

  • Node.js 18+ 및 npm

  • libvirt 및 kvm 그룹의 사용자

  • 수명 주기, 스크린샷, 키보드 및 QMP 대체 작업을 위해 PATH에 virsh 사용 가능

SPICE 지원 도구는 추가로 SPICE 디스플레이, 게스트 virtio-serial 에이전트 채널, 실행 중인 spice-vdagent(또는 이에 상응하는 게스트 에이전트)가 필요합니다. 클립보드 지원은 해당 에이전트가 제공하는 게스트 데스크톱 통합에도 의존합니다. 표준 spice-vdagent 세션 구성 요소는 X11 지향적입니다. Wayland/Hyprland 게스트는 패키지와 서비스가 실행 중이더라도 클립보드에 대해 capability-missing을 보고할 수 있습니다. 호스트가 spice-client-glib, json-glib 및 GLib 개발 파일을 제공하는 경우에만 선택적 네이티브 헬퍼를 빌드하세요. 그래픽 XML이 listen type='none'을 사용하는 libvirt 도메인의 경우 헬퍼는 libvirt의 로컬 그래픽-FD API를 사용합니다. remote-viewer, virt-viewer 또는 공개 SPICE URI는 필요하지 않습니다:

npm run build:spice-helper
BOXES_SPICE_HELPER="$PWD/native/boxes-spice-helper" npm test

헬퍼는 자동으로 설치되거나 선택되지 않습니다. BOXES_SPICE_HELPER는 이 저장소에서 빌드한 검토된 실행 파일 또는 아래의 버전 프로토콜을 구현하는 다른 프로세스로만 설정하세요.

# Install dependencies
sudo apt install -y libvirt-daemon-system qemu-kvm virt-manager

# Add your user to required groups
sudo usermod -aG libvirt,kvm "$USER"
newgrp libvirt

npm에서 설치

npm 패키지에는 로컬 MCP 호스트용 안내 설치 프로그램이 포함되어 있습니다. Node 서버만 설치합니다. libvirt, virsh, QEMU 및 선택적 SPICE 개발 라이브러리는 호스트 사전 요구 사항으로 남습니다.

# Detect installed MCP hosts and configure them
npx -y boxes-mcp@0.1.0 setup

# Or install the command globally
npm install --global boxes-mcp@0.1.0
boxes-mcp setup

파일을 작성하지 않고 구성 미리 보기:

npx -y boxes-mcp@0.1.0 setup --dry-run

PATH에서 검색할 수 없는 경우 호스트를 명시적으로 구성합니다:

npx -y boxes-mcp@0.1.0 setup --client codex
npx -y boxes-mcp@0.1.0 setup --client claude
npx -y boxes-mcp@0.1.0 setup --client openclaw

설치 프로그램은 Codex, Claude Code, OpenClaw, Antigravity, Gemini CLI, OpenCode, Cursor, Windsurf, VS Code, Pi, Cline, Zed 및 Goose를 감지하거나 명시적으로 구성할 수 있습니다. 다른 stdio 지원 에이전트를 위해 이식 가능한 JSON 구성을 출력하려면 --client generic을 사용하세요:

npx -y boxes-mcp@0.1.0 setup --client generic

설정 명령은 선택한 MCP 항목만 작성하고, 기존 구성을 변경하기 전에 일회성 .boxes-mcp.bak 백업을 만들고, 원자적 교체를 사용하며, 운영 체제 패키지를 설치하거나 VM 정의를 변경하지 않습니다. 설정 후 구성된 에이전트 또는 하네스를 다시 시작하세요. boxes-mcp doctor를 실행하여 Node, virsh 및 감지된 호스트를 검사하세요.

선택적 호스트 설정은 설정 중에 유지할 수 있습니다:

npx -y boxes-mcp@0.1.0 setup \
  --libvirt-uri qemu:///session \
  --input-backend auto \
  --spice-helper /absolute/path/to/native/boxes-spice-helper \
  --transfer-root /absolute/path/to/approved/files

네이티브 SPICE 헬퍼는 범용 바이너리로 번들되지 않습니다. 호스트의 SPICE/libvirt 개발 패키지를 설치한 후 호환되는 Linux 호스트에서 빌드하고, 검토된 절대 경로를 --spice-helper 또는 BOXES_SPICE_HELPER로 전달하세요.

소스에서 설치

# Clone the repository for unreleased changes or development
git clone https://github.com/EF-Code/boxes-mcp.git
cd boxes-mcp

# Install dependencies
npm install

# Build the project
npm run build

# Run tests
npm test

# Configure a local checkout with the same guided installer
npm run setup:guided -- --client codex

구성

수동 설정의 경우 서버를 Claude Code 구성(~/.claude.json)에 추가하세요:

{
  "mcpServers": {
    "boxes": {
      "command": "node",
      "args": ["/absolute/path/to/boxes-mcp/dist/src/index.js"],
      "env": {
        "LIBVIRT_URI": "qemu:///system",
        "BOXES_INPUT_BACKEND": "auto"
      }
    }
  }
}

사용 가능한 도구

VM 관리

도구

설명

매개변수

boxes.list

모든 VM 나열

-

boxes.info

VM 세부 정보 가져오기

nameOrUuid: string

boxes.start

VM 시작

nameOrUuid: string

boxes.shutdown

VM 종료(정상)

nameOrUuid: string, force?: boolean

boxes.reboot

VM 재부팅

nameOrUuid: string

boxes.suspend

VM 일시 중지

nameOrUuid: string

boxes.resume

일시 중지된 VM 재개

nameOrUuid: string

boxes.undefine

VM 제거(스토리지 유지)

nameOrUuid: string, keepStorage?: boolean

boxes.display

SPICE/VNC 주소 가져오기

nameOrUuid: string

스냅샷 관리

도구

설명

매개변수

boxes.snapshots.list

VM 스냅샷 나열

nameOrUuid: string

boxes.snapshots.create

스냅샷 생성

nameOrUuid: string, snapshot: string, description?: string

boxes.snapshots.revert

스냅샷으로 되돌리기

nameOrUuid: string, snapshot: string

boxes.snapshots.delete

스냅샷 삭제

nameOrUuid: string, snapshot: string

디스플레이 및 상호 작용

도구

설명

매개변수

boxes.screenshot

실행 중인 도메인 디스플레이를 MCP 이미지 콘텐츠로 캡처

`nameOrUuid, screen?: number, backend?: auto

libvirt`

boxes.keyboard

virsh를 통해 제한된 허용 목록 Linux 키 시퀀스 전송

nameOrUuid, keys: string[], holdMs?: number

boxes.mouse

입력된 이동/버튼/클릭/스크롤 입력 전송

nameOrUuid, action, x, y, coordinateSpace?, button?, width?, height?, deltaX?, deltaY?, backend?

boxes.clipboard

SPICE 헬퍼를 통한 명시적 UTF-8 클립보드 읽기/쓰기

nameOrUuid, operation, selection?, text?

boxes.drag_drop

실험적 제한 전송 및 포인터 시퀀스와 별도 증거

nameOrUuid, sourcePath, x, y, coordinateSpace?, width?, height?, timeoutMs?

상호 작용 도구는 셸 조각, 원시 QMP JSON, 임의의 virsh 플래그, 게스트 명령 또는 임의의 전송 대상을 허용하지 않습니다. 새 작업은 실행 중인 도메인이 필요하며 백엔드를 사용할 수 없을 때 안정적인 기능/오류 코드를 반환합니다.

선택적 환경 변수

변수

기본값

목적

LIBVIRT_URI

qemu:///system

모든 도메인 작업에 사용되는 Libvirt 연결

BOXES_INPUT_BACKEND

auto

기본 마우스 백엔드 기본 설정: auto, spice 또는 qmp

BOXES_SPICE_HELPER

unset

버전이 지정된 SPICE 헬퍼 프로토콜을 구현하는 명시적 실행 파일

BOXES_SPICE_OPERATION_TIMEOUT_MS

30000

단일 헬퍼 요청의 최대 지속 시간

BOXES_ARTIFACT_DIR

프로세스 임시 디렉터리

임시 스크린샷을 위한 제어된 상위 디렉터리

BOXES_MAX_SCREENSHOT_BYTES

20971520

스크린샷 페이로드 제한

BOXES_TRANSFER_ROOT

unset

드래그 앤 드롭 소스 파일에 필요한 정규화된 호스트 루트

BOXES_MAX_TRANSFER_BYTES

104857600

전송 소스 크기 제한

BOXES_MAX_CLIPBOARD_BYTES

1048576

UTF-8 클립보드 페이로드 제한

BOXES_TRANSFER_ROOT는 추론되지 않고 의도적으로 필요합니다. 경로는 정규화되며 심볼릭 링크 이스케이프, 디렉터리 및 특수 파일은 거부됩니다.

boxes.capabilities는 관찰된 상태를 보고합니다. 구성만으로는 연결된 것으로 간주되지 않습니다. 외부 상태 프로브가 필요한 경우 probeQmp: true 및/또는 probeSpice: true를 사용하세요. SPICE 클립보드 및 전송에는 연결된 게스트 에이전트가 필요합니다. boxes.drag_drop은 외부 뷰어 하네스가 애플리케이션 수준 증거를 제공하지 않는 한 applicationAccepted: "unknown"을 보고합니다.

키보드 입력은 하나의 고정된 Linux virsh 코드셋을 사용합니다. 공개 키 이름은 대소문자를 구분하지 않으며 대문자로 정규화되지만 각 키는 제한된 코드당 한 번만 발생할 수 있습니다. 허용 목록은 ALT, BACKSPACE, CAPSLOCK, CTRL, DELETE, DIGIT_0부터 DIGIT_9, DOWN, END, ENTER, ESC, ESCAPE, F1부터 F12, HOME, INSERT, LEFT, META, NUMLOCK, PAGEDOWN, PAGEUP, PAUSE, PRINT, RIGHT, SHIFT, SPACE, SUPER, TAB, UP, A부터 Z입니다. 게스트 키보드 레이아웃이 결과 문자를 결정합니다. 키 허용 목록은 해당 레이아웃과 무관한 텍스트를 보장하지 않습니다.

사용 예제

Claude Code 사용

User: "List all my VMs"
Claude: [Uses boxes.list tool]

User: "Start ubuntu-24.04"
Claude: [Uses boxes.start with nameOrUuid="ubuntu-24.04"]

User: "Create a snapshot called 'before-update' for my fedora VM"
Claude: [Uses boxes.snapshots.create]

직접 사용

# Run the MCP server
LIBVIRT_URI=qemu:///system node dist/src/index.js

개발

프로젝트 구조

boxes-mcp/
├── src/
│   ├── index.ts          # MCP server entry point
│   ├── tools.ts          # Side-effect-free tool registry and handler boundary
│   ├── libvirt.ts        # virsh operations & parsers
│   ├── virsh.ts          # Shared executable and libvirt URI arguments
│   ├── exec.ts           # Safe command execution
│   ├── screenshot.ts     # Controlled libvirt screenshot capture
│   ├── keyboard.ts       # Allowlisted virsh send-key adapter
│   ├── mouse.ts/qmp.ts   # Typed mouse actions and QMP fallback
│   ├── spice.ts          # Versioned companion-helper protocol client
│   ├── clipboard.ts      # Explicit SPICE clipboard orchestration
│   ├── transfer.ts       # Confined host-file validation
│   ├── drag-drop.ts      # Experimental transfer/input coordination
│   ├── *.test.ts         # Unit tests
├── systemd/
│   └── boxes-mcp.service # Systemd user service
├── dist/                 # Compiled JavaScript
├── coverage/             # Test coverage reports
├── package.json
├── tsconfig.json
└── vitest.config.ts

테스트

# Run all tests
npm test

# Run tests in watch mode
npm run test:watch

# Generate coverage report
npm run test:coverage

로컬 테스트 커버리지: 현재 체크아웃은 95개의 통과 테스트와 기본적으로 건너뛰는 9개의 게이트 라이브 테스트를 실행합니다. 기본 스위트는 libvirt 액세스 없이 실행해도 안전합니다.

  • exec.ts: 100% 문

  • libvirt.ts: 81.3% 문, 92.85% 분기

  • 상호 작용 검증, 명령 구성, QMP 응답 매핑, 아티팩트 정리, 헬퍼 프레이밍, 기능 검색 및 경로 제한 테스트

명시적 로컬 네이티브 헬퍼 프로세스 검사를 실행하려면:

npm run test:spice-helper

세 가지 안전 변수를 모두 설정한 상태에서만 일회용 VM 스위트를 실행하세요:

BOXES_INTEGRATION=1 \
BOXES_TEST_VM=an-explicit-disposable-domain \
BOXES_TEST_VM_DISPOSABLE=1 \
npm run test:integration

라이브 스위트는 나열된 VM을 선택하거나, VM 정의를 변경하거나, 게스트 서비스를 직접 중지하지 않습니다. 게스트 에이전트 연결 해제 커버리지는 운영자가 명시적으로 일회용 게스트에서 spice-vdagent를 수동으로 연결 해제하고 BOXES_TEST_AGENT_DISCONNECTED=1을 추가해야 합니다. 일회용이 아닌 게스트에는 이 작업을 절대 수행하지 마세요.

기본 스위트는 모의(mocked)/로컬입니다. 실제 VM에 대해 QMP, SPICE, 클립보드 또는 드래그 앤 드롭이 작동한다는 것을 입증하지 않습니다. 라이브 테스트는 옵트인 방식이어야 하며 스냅샷이 있는 특정 이름의 일회용 VM을 대상으로 해야 합니다. 상호작용 도구가 임의의 첫 번째 도메인을 선택하는 경우는 없습니다.

빌드

# Build TypeScript
npm run build

# Watch mode for development
npm run dev

선택적 systemd 사용자 서비스

체크인된 유닛은 소스 체크아웃용입니다. 에이전트의 MCP 구성으로 서버를 실행하거나 npm으로 전역 설치하는 경우에는 필요하지 않습니다. 체크아웃을 빌드한 후 자동 시작을 위해 사용자 서비스로 설치하십시오:

BOXES_MCP_DIR="$(pwd)"
NODE_BIN="$(command -v node)"
mkdir -p ~/.config/systemd/user
cp systemd/boxes-mcp.service ~/.config/systemd/user/
sed -i \
  -e "s|/usr/bin/node|$NODE_BIN|g" \
  -e "s|%h/projects/boxes-mcp|$BOXES_MCP_DIR|g" \
  ~/.config/systemd/user/boxes-mcp.service
systemctl --user daemon-reload
systemctl --user enable --now boxes-mcp
journalctl --user -fu boxes-mcp

보안 고려 사항

  • ✅ 샌드박스 실행: Node.js execFile을 제한 시간 및 버퍼 한도와 함께 사용

  • ✅ 임의 명령 없음: 사전 정의된 virsh 작업만 허용

  • ✅ 타입이 지정된 입력 경계: QMP 명령과 SPICE 작업은 검증된 인수를 가진 내부 열거형

  • ✅ 제한된 페이로드: 키 수, 누름 지속 시간, 좌표, 스크롤 델타, 스크린샷, 클립보드 및 전송이 상한으로 제한됨

  • ✅ 경로 격리: 드래그 앤 드롭 소스는 정규화 후 BOXES_TRANSFER_ROOT 아래에 유지되어야 함

  • ✅ 스토리지 보존: VM 스토리지는 기본적으로 삭제되지 않음

  • ✅ LIBVIRT_URI 격리: 환경에 지정된 libvirt 연결을 존중

  • ⚠️ 필요한 권한: 사용자는 libvirt 그룹 구성원이어야 함

  • ⚠️ 네트워크 노출: 추가 보안 없이 원격 접근용으로 설계되지 않음

  • ⚠️ 확장된 제어 표면: 스크린샷과 게스트 클립보드 데이터는 신뢰할 수 없음. MCP 서버를 로컬 stdio에 유지

  • ⚠️ SPICE 헬퍼 신뢰: 헬퍼 실행 파일은 명시적 호스트 종속성이며 자격 증명, 클립보드 내용 또는 파일 내용을 기록해서는 안 됨

SPICE 헬퍼 프로토콜

TypeScript 서버는 하나의 지속적인 헬퍼 자식 프로세스를 시작하고 stdin을 통해 줄바꿈으로 구분된 버전 1 JSON 요청을 보내며 요청 ID를 기준으로 응답을 연관시킵니다. 헬퍼는 명시적 실행 파일 경로로 호출되며 호출자가 제어하는 인수는 없습니다. 요청 봉투의 형태는 다음과 같습니다:

{
  "version": 1,
  "id": "request-123",
  "operation": "clipboard.read",
  "domain": "guest-name",
  "display": { "uri": "spice://127.0.0.1:5900" },
  "arguments": { "selection": "clipboard", "maxBytes": 1048576 }
}

지원되는 작업 이름은 내부 전용입니다 (status, mouse, clipboard.read, clipboard.write, file.transfer, drag-drop). 헬퍼 오류는 SPICE_AGENT_DISCONNECTED, SPICE_CAPABILITY_MISSING 또는 SPICE_UNAVAILABLE과 같은 안정적인 MCP 오류로 매핑됩니다. 페이로드, 줄, 보류 중인 요청, 전송 크기, 클립보드 바이트 및 작업 시간은 제한됩니다. 진행 이벤트는 요청을 완료하지 않습니다. 헬퍼는 클립보드 내용, 파일 내용, SPICE 티켓 또는 자격 증명을 기록하지 않습니다.

기능 매트릭스

기능

Libvirt/virsh

QMP 폴백

SPICE 헬퍼

스크린샷

virsh screenshot을 통해 구현

사용 안 함

어댑터 예약됨, 헬퍼 없이는 사용 불가

키보드

허용 목록에 등록된 virsh send-key로 구현

사용 안 함

사용 안 함

마우스

사용 안 함

QMP 검색 후 타입이 지정된 input-send-event

헬퍼 상태가 채널과 형상을 입증한 후에만 auto에 의해 선택됨

클립보드

사용 불가

사용 불가

네이티브 헬퍼의 실제 에이전트 프로토콜; Wayland/Hyprland 게스트는 SPICE_CAPABILITY_MISSING을 보고할 수 있음

파일 전송

사용 불가

사용 불가

네이티브 헬퍼의 실제 SPICE 비동기 파일 복사 경로; 게스트 에이전트가 이를 알릴 때 라이브 전송 완료가 관찰됨

드래그 앤 드롭

사용 불가

사용 불가

실험적 전송 + 포인터 증거; 애플리케이션 수락 여부는 아직 알 수 없음

클립보드 지원은 게스트 데스크톱 통합에 따라 달라집니다. 현재 SPICE 게스트 에이전트는 X11 중심이므로 Hyprland/Omarchy와 같은 Wayland 게스트는 spice-vdagent가 설치되어 실행 중인 경우에도 SPICE_CAPABILITY_MISSING을 보고할 수 있습니다. 마우스와 파일 전송은 여전히 독립적으로 작동할 수 있습니다.

문제 해결

VM이 나열되지 않음

# Check libvirt URI
virsh -c qemu:///system list --all
virsh -c qemu:///session list --all

# Verify permissions
groups  # Should include 'libvirt' and 'kvm'

권한 거부

# Re-add to groups and re-login
sudo usermod -aG libvirt,kvm "$USER"
# Then logout/login or:
newgrp libvirt

Boxes에 VM이 표시되지 않음

virt-manager를 열고 VM이 사용하는 연결을 확인하십시오:

  • 시스템 연결: qemu:///system

  • 사용자 세션: qemu:///session

LIBVIRT_URI 환경 변수를 그에 맞게 설정하십시오.

SPICE 기능 오류

virsh domdisplay가 No graphical display found를 보고하고 도메인 XML에 <graphics type='spice'><listen type='none'/></graphics>가 있으면 이는 공개 리스너가 없는 의도적인 libvirt 구성입니다. 뷰어 URI를 얻기 위해 포트를 임의로 만들거나 VM 정의를 변경하지 마십시오. 네이티브 헬퍼가 구성된 경우 boxes-mcp는 내부 spice+libvirt-fd://local 전송을 사용하고 각 SPICE 채널에 대해 libvirt에 그래픽 FD를 요청합니다. 헬퍼는 MCP 프로세스와 동일한 libvirt 연결을 사용해야 합니다:

LIBVIRT_URI=qemu:///session npm run build:spice-helper
BOXES_SPICE_HELPER="$PWD/native/boxes-spice-helper" \
LIBVIRT_URI=qemu:///session node dist/src/index.js

도메인이 실행 중이어야 하고, 헬퍼가 libvirt 및 spice-client-glib에 링크되어 있어야 하며, 게스트가 virtio SPICE 에이전트 채널을 노출해야 합니다. 연결된 에이전트라도 클립보드 기능이 없을 수 있습니다. XML만으로 지원 여부를 추론하지 말고 probeSpice: true와 함께 boxes.capabilities를 검사하십시오.

probeSpice: true와 함께 boxes.capabilities를 사용하고 반환된 상태를 검사하십시오:

  • configured: 검토된 헬퍼와 SPICE 엔드포인트가 구성되어 있지만 연결 증명이 요청되지 않았습니다.

  • connecting: 헬퍼가 불완전한 채널 세트를 관찰했습니다.

  • connected: 필요한 채널이 연결되었습니다.

  • agent-disconnected: 게스트 에이전트가 연결되지 않았습니다.

  • capability-missing: 백엔드, 채널, 헬퍼 또는 게스트 기능이 없습니다.

예를 들어 파일 전송을 지원하지만 클립보드 기능을 알리지 않는 연결된 게스트 에이전트는 agent-disconnected가 아니라 capability-missing입니다. 클립보드를 활성화하려면 게스트에 해당 배포판의 spice-vdagent 서비스가 설치되어 있고, 데스크톱 세션에서 실행 중이며, virtio SPICE 에이전트 채널을 통해 연결되어 있어야 합니다. Wayland/Hyprland 데스크톱에서는 배포판의 에이전트가 해당 컴포지터를 실제로 지원하는지 확인하십시오. 활성 서비스만으로는 증거가 되지 않습니다. 라이브 Omarchy 게스트에는 spice-vdagent 0.23.0-1과 활성 사용자 서비스가 있었지만 xrandr output ID NOT FOUND를 기록했고 org.gnome.Mutter.DisplayConfig의 소유자가 없었으므로 boxes-mcp가 SPICE_CAPABILITY_MISSING을 올바르게 반환했습니다. 현재 업스트림 에이전트에는 X11 게스트 세션을 사용하거나 별도로 검증된 Wayland 클립보드 브리지를 제공하십시오. 서버는 게스트 패키지를 설치하거나 게스트 서비스를 자동으로 시작하지 않습니다.

지속적인 SPICE 클라이언트는 중단 신호도 수락합니다. 취소는 현재 헬퍼 프로세스를 종료하고 모든 보류 중인 작업을 결정적으로 실패시키며 다음 요청이 깨끗한 세션을 만들 수 있도록 합니다. 이는 OPERATION_CANCELLED로 보고됩니다.

VM에 입력을 보내지 않고 호스트 종속성과 헬퍼를 직접 확인하십시오:

pkg-config --modversion spice-client-glib-2.0 json-glib-1.0 gio-unix-2.0
npm run build:spice-helper

헬퍼의 로컬 프로토콜 테스트는 의도적으로 127.0.0.1:1에 연결하고 타입이 지정된 사용 불가/연결

Available Tools

19 tools
boxes.capabilitiesC

Report observed display and interaction capability state for a running VM

NameRequiredDescriptionDefault
probeQmpNo
nameOrUuidYesDomain name or UUID
probeSpiceNo

TDQS

C2.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description alone must reveal behavioral traits. 'Report' implies a read-only observation, but the optional probeQmp and probeSpice flags suggest active probing behavior that is never disclosed. The description does not say whether probing causes side effects, requires guest cooperation, or changes the result set.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no filler or repetition. It conveys the core operation efficiently, though it omits detail that would make it more informative.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no output schema, no annotations, and two undocumented probe parameters, one sentence is not enough context. It does not clarify what capabilities are reported, what probing does, what the output looks like, or what happens if the VM is not running.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 33%, and the description adds no information about probeQmp, probeSpice, or how they affect the reported capabilities. The two probe parameters remain semantically unexplained, so the description fails to compensate for the low schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description says 'Report observed display and interaction capability state for a running VM', which names a specific verb, resource, and scope. It is clearly distinct from sibling tools like boxes.keyboard or boxes.display, though it does not explicitly name an alternative.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'for a running VM' implies this tool is used to inspect capabilities of an active VM, and the purpose is reasonably inferable. However, it gives no explicit guidance about when not to use it or how it compares to siblings such as boxes.info or boxes.display.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

boxes.clipboardC

Read or write UTF-8 text through the SPICE guest agent clipboard

NameRequiredDescriptionDefault
textNo
operationYes
selectionNoclipboard
nameOrUuidYesDomain name or UUID

TDQS

C2.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It discloses the read/write nature but does not mention requirements like the guest agent must be running, potential side effects of writing, error scenarios, or return format. The mention of 'SPICE guest agent' hints at a dependency but is not elaborated.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence with no redundant words. It front-loads the core function (read/write) and the resource (clipboard). Though more detail could be added, the current length is appropriate for the tool's simplicity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 4 parameters, no output schema, and no annotations, this description is incomplete. Missing are prerequisites (e.g., guest agent running), error handling, return values, and clarification on how operation and text interact. An agent would have to rely on external knowledge or the schema to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 25% (only nameOrUuid has a description). The description adds no detail about the text, operation, or selection parameters. While 'UTF-8 text' hints at the text parameter's encoding, it doesn't clarify operation enum values or selection constraints, leaving the agent to infer semantics from the schema alone.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Read or write UTF-8 text through the SPICE guest agent clipboard' clearly states the verb (read/write), the resource (clipboard), and the mechanism (SPICE guest agent). It distinguishes from sibling tools like boxes.keyboard or boxes.display by focusing solely on clipboard access, though it doesn't explicitly name any alternative.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives like boxes.keyboard or boxes.drag_drop. The description implies clipboard access but does not give explicit conditions, exclusions, or comparisons with sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

boxes.displayA

Get SPICE/VNC display address for VM (useful to open viewer)

NameRequiredDescriptionDefault
nameOrUuidYesDomain name or UUID

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It reveals that the tool retrieves a display address in SPICE or VNC form and is intended for opening a viewer, which is meaningful. However, it does not mention whether the VM must be running, what the exact return format is, or whether any connection is initiated.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence that states the action, the target resource, and the practical use case. There is no redundant information and it is immediately useful.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a simple one-parameter tool with no output schema, and the description conveys the essential purpose and output type (SPICE/VNC address). It is complete enough for an agent to know what to call, though a note on return format or preconditions would make it fully comprehensive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already covers the only parameter (nameOrUuid) with 100% description coverage. The tool description does not add extra parameter semantics beyond 'Domain name or UUID', but since the schema is fully sufficient, a baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Get') and a concrete resource ('SPICE/VNC display address for VM'), clearly distinguishing the tool's output from sibling tools like boxes.screenshot (which captures screen pixels) and boxes.info (which returns general VM info). The phrase 'useful to open viewer' further clarifies why an agent would use this tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use it ('useful to open viewer') but does not explicitly contrast it with alternatives such as boxes.screenshot or boxes.info. There is no when-not-to-use guidance or named sibling for comparison, so the agent must infer the intended use case.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

boxes.drag_dropC

Experimental SPICE file transfer and mouse drag-and-drop operation

NameRequiredDescriptionDefault
xYes
yYes
widthNo
heightNo
timeoutMsNo
nameOrUuidYesDomain name or UUID
sourcePathYesFile beneath BOXES_TRANSFER_ROOT
coordinateSpaceNonormalized

TDQS

C2.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description bears full responsibility for disclosing behavior. It only says 'Experimental', which hints at instability but gives no detail on side effects, mutability, permission requirements, or consequences of the drag-and-drop (e.g., whether files are copied/moved/deleted). This is insufficient for a tool that likely performs file system operations on a guest VM.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is very brief (one sentence) and gets to the point. However, the word 'Experimental' is a placeholder that conveys no actionable information. It is not overly verbose but lacks structural organization (e.g., no usage hints or parameter context).

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no annotations, no output schema, and eight input parameters, this description is severely incomplete. It does not explain the meaning of width/height/timeout, coordinateSpace semantics, or preconditions (e.g., the BOXES_TRANSFER_ROOT directory). The 'Experimental' label is vague and does not clarify reliability or failure modes. The tool likely has significant side effects (file transfer, mouse manipulation) that are undisclosed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema descriptions only cover nameOrUuid and sourcePath (25% coverage). The description mentions 'SPICE file transfer' and 'mouse drag-and-drop', which implies x,y are coordinates and width/height likely define a target area, but it does not explicitly explain these or coordinateSpace, timeoutMs, or their relationships. The description adds minimal interpretive value beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb+resource (

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool over alternatives (e.g., boxes.upload, boxes.display). It does not mention prerequisites, typical interaction flows, or when this tool would be inappropriate (e.g., headless environments). Sibling tools like boxes.mouse and boxes.clipboard are not referenced at all, so the agent must infer usage context from the schema.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

boxes.infoB

Get detailed domain info

NameRequiredDescriptionDefault
nameOrUuidYesDomain name or UUID

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

There are no annotations, so the description carries the behavioral burden. 'Get' implies a read-only operation and no destructive side effects are suggested, but it does not disclose error behavior, required domain state, or the scope of information returned.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence with the verb and resource front-loaded. There is no filler, and the qualifier 'detailed' earns its place by distinguishing it from the list tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema and no annotations, the description is under-specified. 'Detailed domain info' does not say what fields or state are returned, nor what preconditions exist for a valid nameOrUuid.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already documents the only parameter as 'Domain name or UUID' with 100% coverage. The description adds no additional parameter meaning, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Get') and resource ('domain info'), and the qualifier 'detailed' separates it from the list sibling. It does not explicitly name sibling tools or state the one-domain scope, so it is clear but not fully differentiated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use or alternative conditions are provided. The description only restates the operation and gives no guidance for choosing between boxes.info and related siblings like boxes.list or boxes.capabilities.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

boxes.keyboardA

Send a bounded allowlisted key sequence to a running VM

NameRequiredDescriptionDefault
keysYes
holdMsNo
nameOrUuidYesDomain name or UUID

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must carry the behavioral disclosure burden. It does disclose that the key sequence is bounded and allowlisted, which are meaningful constraints beyond the tool name, and it states the running-VM precondition. However, it does not describe behavior on invalid keys, whether holdMs controls key hold duration, or whether the call blocks until input is delivered.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single front-loaded sentence with no filler or repetition. Every word contributes meaning, and the key constraints are placed directly after the verb.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no annotations and no output schema, the description leaves important invocation details underspecified: the meaning of holdMs, the contents of the allowlist, and the exact key naming convention expected in the keys array. The core purpose is clear, but the description is not complete enough for an agent to confidently call the tool in all cases.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 33%, so the description must compensate for undocumented parameters. 'Key sequence' and 'allowlisted' add useful meaning to the keys parameter, and 'bounded' aligns with the maxItems constraint. However, holdMs is not explained in either the schema or the description, leaving its semantics ambiguous.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Send') and resource ('a bounded allowlisted key sequence to a running VM'), making the tool's purpose immediately clear. It is also implicitly differentiated from siblings like boxes.mouse and boxes.clipboard by focusing on key sequences rather than pointer or clipboard input.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'to a running VM' implies the precondition that the VM must be running and suggests this tool is for keyboard input, but it does not explicitly explain when to prefer this over sibling input tools like mouse, clipboard, or drag_drop. No alternatives or exclusions are mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

boxes.listA

List all libvirt domains (VMs) managed by GNOME Boxes/libvirt

NameRequiredDescriptionDefault

No parameters

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description alone must communicate the operation type. 'List' implicitly indicates a read-only, non-destructive operation, so an agent can reasonably infer safety. However, it does not disclose what the returned list contains (e.g., domain names, UUIDs, status) or the output format, which is relevant when there is no output schema. For a simple listing tool this is acceptable, but it falls short of full transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, compact sentence that gets straight to the point, front-loading the verb and the resource. There is no redundant phrasing or filler. Every word contributes to the tool's definition. This is an ideal example of conciseness without under-specification.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a parameter-less listing tool with no output schema, the description is largely sufficient: it tells the agent exactly what is being listed. However, it leaves room for clarification about the return structure (e.g., does it return domain names, objects, or a list of IDs?). Given the sibling tool boxes.info exists, a brief note on the output shape would have made it complete. Nevertheless, the core functionality is fully specified, so this is slightly above average in completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the description does not need to elaborate on parameter meaning. The schema is empty and coverage is 100%, meaning there is nothing to document. The baseline for zero params is 4, and the description does not add any parameter-specific information because there are none to describe. This score appropriately reflects that the parameter burden is void.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('List') and a precise resource ('all libvirt domains (VMs) managed by GNOME Boxes/libvirt'). It unambiguously identifies the tool's purpose and clearly distinguishes it from sibling tools like boxes.info (which would provide details on a specific domain) and state-changing tools like boxes.start. There is no ambiguity about what this tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description makes it obvious that this tool is the enumeration/list command among the siblings. However, it does not explicitly state when to prefer this over boxes.info or mention that it returns all domains, which could be a useful precursor to calling boxes.info on a specific domain. The lack of explicit when/alternatives guidance is minor given the tool's self-explanatory nature, but a note about being a read-only enumeration step would have made it a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

boxes.mouseC

Send a typed mouse action through SPICE or QMP

NameRequiredDescriptionDefault
xYes
yYes
widthNo
actionYes
buttonNo
deltaXNo
deltaYNo
heightNo
backendNoauto
nameOrUuidYesDomain name or UUID
coordinateSpaceNonormalized

TDQS

C2.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure, but it only states the transport and that a mouse action is sent. It does not describe side effects, the meaning of 'auto' backend selection, coordinate-space semantics, or the constraints around deltas and dimensions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is one short sentence with no filler, and the transport mechanism is front-loaded. It is concise rather than bloated, though it is terse enough to omit important context.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a complex tool with 11 parameters, multiple oneOf action shapes, and no annotations or output schema, yet the description supplies almost no contextual information. Even with the schema, the roles of width/height, normalized versus pixel coordinates, and backend 'auto' behavior remain unclear.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds minimal hints about the backend ('SPICE or QMP') and the action concept, but it provides no meaning for x/y, width/height, coordinateSpace, button, or deltaX/deltaY. Since schema description coverage is only 9%, the description does not compensate for the parameter semantics gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Send') and identifies the resource ('mouse action') and transport ('through SPICE or QMP'), which distinguishes it from sibling input tools like boxes.keyboard or boxes.clipboard. The word 'typed' is slightly ambiguous, and the description does not explicitly say the target is a domain/VM, but the overall meaning is clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance about when to use this tool versus alternatives, nor when not to use it. It does not mention the backend options, coordinate-space choices, or any exclusions, so an agent must infer usage from the schema alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

boxes.rebootB

Reboot a running domain

NameRequiredDescriptionDefault
nameOrUuidYesDomain name or UUID

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It states the action but does not reveal side effects, such as whether the reboot is graceful, potential state loss, required permissions, or behavior when the domain is not running.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single front-loaded sentence with no redundant language. It efficiently conveys the action and the condition in minimal words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a state-changing operation with no annotations and no output schema, this description is insufficiently complete. It does not explain what happens during reboot, what prerequisites are needed beyond an implied running state, or what errors might occur, leaving an agent under-informed for a destructive-ish operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already fully documents the single parameter nameOrUuid with a clear description ('Domain name or UUID') and 100% coverage. The tool description adds no additional parameter context, so a baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses the specific verb 'reboot' and identifies the resource as 'a running domain'. This is a distinct action not covered by sibling tools like start, shutdown, suspend, or resume, so it is self-differentiating.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'a running domain' implies the tool is intended for active domains, but it gives no explicit guidance on when to use reboot compared to start/shutdown/suspend/resume. There is no mention of what to do if the domain is stopped or when not to use the tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

boxes.resumeC

Resume a suspended domain

NameRequiredDescriptionDefault
nameOrUuidYesDomain name or UUID

TDQS

C2.9/5.0
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, and the description offers no information about side effects, permissions required, or consequences of resuming. As a mutation operation, this leaves the agent blind to behavioral expectations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, clear sentence with no fluff. While it is brief, it does not waste words, and the essential action is conveyed. Structure is minimal but acceptable for such a simple operation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description omits critical context such as the expected state of the domain (must be suspended), any side effects on running processes, or the format of the response. It only states the action without surrounding context, leaving gaps for an agent making decisions.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already fully documents the single parameter 'nameOrUuid' with its description. The tool description adds no additional meaning or constraints beyond what the schema provides, so baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Resume') and resource ('suspended domain'), clearly indicating the action. Differentiates from siblings like 'suspend' and 'start' by implying the domain is in a suspended state, though not explicit about the distinction from 'start'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage when a domain is suspended and needs to be resumed, but does not explicitly state when to use this tool over 'start' (e.g., for stopped vs. suspended domains). Lacks clear guidance on prerequisites or scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

boxes.screenshotC

Capture a running VM display screenshot as MCP image content

NameRequiredDescriptionDefault
screenNo
backendNoauto
nameOrUuidYesDomain name or UUID

TDQS

C2.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. It does add a key constraint: the VM must be 'running' to capture a screenshot. It also states the output format ('as MCP image content'), which is useful. However, it omits details like whether the operation is read-only, any resolution limits, or side effects. Given the minimal but relevant information, a score of 3 is appropriate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-formed sentence that delivers the core purpose without any fluff. It is appropriately concise and front-loaded, with no wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 3 parameters, no output schema, and no annotations, the description is too sparse. It does not explain the 'screen' parameter (which screen index), the 'backend' parameter (what options mean, when to choose one), or the nature of the returned image content beyond a generic 'MCP image content'. An agent would struggle to use screen/backend correctly, and the lack of any output detail further limits completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 33% (only nameOrUuid has a description in the schema). The description does not explain the meaning or usage of 'screen' or 'backend' at all, nor does it clarify the expected values or defaults. Since the description fails to compensate for the low schema coverage, this dimension scores low – the tool cannot be invoked correctly without additional knowledge of these parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb ('Capture') and resource ('running VM display screenshot') and specifies the output type ('as MCP image content'). It is specific enough for an agent to understand the tool's function, though it does not explicitly differentiate from the sibling boxes.display, which could also capture display-related data. This slight ambiguity prevents a perfect score.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives like boxes.display. There is no mention of preconditions beyond 'running VM' (which is more a behavioral requirement than usage guidance). The description does not state when not to use it or what makes it the right choice among siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

boxes.shutdownA

Shutdown/Power off a domain (graceful by default)

NameRequiredDescriptionDefault
forceNoIf true, force off (destroy)
nameOrUuidYesDomain name or UUID

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

There are no annotations, so the description is the only source of behavioral info. It discloses 'graceful by default', which adds context beyond the schema, but it does not mention other behavioral aspects such as error handling or consequences of force (which are covered in the schema's force parameter description). The description is minimal but not misleading.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with no filler, front-loading the purpose and the key default. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with only two parameters and no output schema, the description covers the essential purpose and the default behavior. The schema covers the parameters, so the description is sufficient. It does not discuss edge cases, but for this simple operation it is adequately complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already documents both parameters with 100% coverage. The description adds the default behavior of graceful shutdown, clarifying that force is optional and non-default, which gives extra meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb (shutdown/power off) and the resource (a domain), and the default behavior is noted. It distinguishes from siblings like start, reboot, and suspend.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description is clear about what the tool does, providing the context of shutting down a domain. It does not explicitly mention alternatives or when not to use it, but the sibling names (start, reboot) make the distinction obvious. However, it lacks explicit guidance on when to choose shutdown over reboot or suspend.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

boxes.snapshots.createB

Create a snapshot for a domain

NameRequiredDescriptionDefault
snapshotYesSnapshot name
nameOrUuidYesDomain name or UUID
descriptionNoSnapshot description

TDQS

B3.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It only states that a snapshot is created; it does not mention overwrite behavior, whether the domain must be running or shut off, side effects, return values, or failure conditions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single short sentence with no wasted words and is appropriately front-loaded. It is concise, though it achieves brevity at the cost of useful behavioral or usage context.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no annotations and no output schema, the description should carry more context about prerequisites, side effects, and invocation behavior. It only states the action, which is insufficient for a mutation tool, even though the schema fully documents the parameters.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, with the three parameters already documented as snapshot name, domain name or UUID, and snapshot description. The tool description adds no additional parameter meaning beyond what the schema provides, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Create') and resource ('snapshot for a domain'), and the create verb clearly separates it from sibling snapshot tools like list, revert, and delete. The resource scope is clear enough for an agent to identify what the tool operates on.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies this is the tool to use when creating a snapshot, but it never explicitly states when to use it versus alternatives or when not to use it. No prerequisites, conflicts, or exclusions are mentioned, leaving usage context to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

boxes.snapshots.deleteB

Delete a snapshot

NameRequiredDescriptionDefault
snapshotYesSnapshot name
nameOrUuidYesDomain name or UUID

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Since no annotations are provided, the description carries the full burden of behavioral disclosure. It merely states 'Delete a snapshot' but does not reveal that the operation is permanent and irreversible, nor does it mention potential failure conditions (e.g., snapshot not found, domain in use). This is a significant omission for a destructive action.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, direct sentence that is appropriately concise. It is front-loaded and wastes no words, achieving maximum efficiency. Every word contributes to the meaning without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive operation with no annotations and no output schema, the description is too minimal. It lacks information about required conditions, side effects, error handling, or results. An agent would not know whether the deletion is idempotent, what happens if the snapshot is in use, or how the operation might fail. This incompleteness is unwarranted given the tool's simplicity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% coverage, meaning both parameters (snapshot and nameOrUuid) already have descriptive definitions. The description adds no extra information about the parameters, so the baseline score of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description 'Delete a snapshot' is a specific verb-resource pair that unambiguously identifies the action. It clearly distinguishes this tool from sibling snapshot tools like list, create, and revert, all of which have different verbs. There is no ambiguity about what it does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. It does not mention prerequisites such as the snapshot existing or the domain being stopped, nor does it indicate when one should prefer revert or create over delete. An agent must infer usage from the tool name and parameters alone, with no explicit direction.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

boxes.snapshots.listA

List snapshots for a domain

NameRequiredDescriptionDefault
nameOrUuidYesDomain name or UUID

TDQS

A3.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full responsibility for behavioral transparency. It does not explicitly state that the operation is read-only, non-destructive, or describe any side effects. The term 'list' hints at safety, but no explicit disclosure is provided.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence, starts with the verb, and contains no unnecessary words. It is perfectly front-loaded and efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list operation with one parameter and no output schema, the description adequately conveys the core purpose. It does not cover potential error scenarios or details about the returned list, but given the simplicity, this is acceptable.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema fully covers the one parameter with a description. The tool description adds no additional meaning beyond repeating 'domain', so it matches the baseline for full schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('List') and the resource ('snapshots') scoped to a domain. It is easily distinguished from sibling tools like create, revert, and delete, which have explicit different actions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use it (to view existing snapshots) but does not explicitly contrast it with alternatives or mention scenarios like checking before creating or reverting. The sibling list provides context, but the description itself is minimal.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

boxes.snapshots.revertB

Revert a domain to a snapshot

NameRequiredDescriptionDefault
snapshotYesSnapshot name
nameOrUuidYesDomain name or UUID

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of disclosing behavioral traits. Reverting is a destructive action that likely overwrites the current domain state and may be irreversible, but the description does not mention this, nor does it note any impact like a reboot or data loss.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence with the action front-loaded. It has no fluff or redundancy, making it efficient. However, it sacrifices important contextual detail, which prevents a perfect score.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a mutation tool with no annotations and no output schema, the description is incomplete. It fails to explain the consequences of reverting (e.g., potential data loss, need for domain to be stopped or rebooted), nor does it clarify any behavioral side effects. An agent calling this tool lacks critical information to use it safely.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already documents both parameters with descriptions ('Domain name or UUID' and 'Snapshot name'), achieving 100% coverage. The description adds no additional meaning, nuance, or constraints beyond what the schema provides, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Revert') and resource ('a domain to a snapshot'), clearly indicating the action and distinguishing it from siblings like create, delete, and list. An agent can immediately understand what this tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives. There is no mention of prerequisites, common scenarios, or conditions that would make this the correct choice over other snapshot operations.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

boxes.startC

Start a domain (VM)

NameRequiredDescriptionDefault
nameOrUuidYesDomain name or UUID

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided (readOnlyHint, destructiveHint absent), so the description carries the full behavioral burden. The single sentence discloses no side effects, no requirement that the VM be in a stopped state, no mention of whether this is non-blocking (queues the boot) or blocking, and no idempotency semantics. For a state-changing operation with zero annotation coverage, this is a notable gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One short, wasteful sentence that communicates the verb, object, and domain context efficiently. It is not padded with filler, though the brevity is as much a product of under-specification as it is of restraint.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is trivial (one fully-documented parameter, no nested objects, no output schema, no enums), so there is little metadata for the description to duplicate or supplement. The main hole is the lack of guidance about VM state (stopped vs. running vs. suspended) and the absence of any side-effect or prerequisite details. It is acceptable but leaves the most useful contextual information on the table.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% — the single parameter nameOrUuid is fully self-documenting with the description 'Domain name or UUID'. The description adds nothing beyond the schema, but with full coverage the baseline of 3 applies; the parameter meaning is entirely contained in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific, active verb ('Start') with a clear resource ('a domain (VM)'), and the parenthetical disambiguates 'domain' as a libvirt VM rather than a DNS domain. It distinguishes itself from siblings by being the power-on counterpart to shutdown/resume, though it doesn't explicitly disambiguate when to use 'start' vs 'resume' — a distinction an agent would have to infer.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No usage guidance is provided whatsoever. The description neither states when this tool is appropriate nor differentiates it from the semantically overlapping sibling 'boxes.resume' (both power-on-like operations) or from 'boxes.reboot'. An agent cannot tell from the text whether to call this on a stopped VM, a suspended VM, or both.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

boxes.suspendC

Suspend a running domain

NameRequiredDescriptionDefault
nameOrUuidYesDomain name or UUID

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. It states only that the tool suspends a running domain but does not explain effects (e.g., state preservation, reversibility via 'resume', or resource implications). This is a significant transparency gap for a state-changing operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, unambiguous sentence with no fluff, and the action is front-loaded. It is appropriately concise for a simple operation, though it borders on under-specification, which is captured in other dimensions.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the lack of annotations and output schema, the description is incomplete. It fails to mention when to use suspend, what happens to the domain, or any side effects. An agent would lack essential context to decide between suspend and shutdown, making the tool risky to invoke without further research.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already documents the sole parameter as 'Domain name or UUID' with 100% coverage. The description adds no additional meaning about the parameter, such as format requirements or how it relates to the operation, so the baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'suspend' and the resource 'domain', which distinguishes it from sibling operations like 'start', 'shutdown', 'reboot', and 'resume'. However, it does not explicitly contrast with alternatives, so it stops short of the strongest clarity score.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use 'suspend' versus other lifecycle operations such as 'shutdown' or 'reboot'. It also fails to mention prerequisites like the domain needing to be in a running state, leaving the agent to infer usage from the name alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

boxes.undefineA

Undefine a domain (remove from libvirt). Storage is NOT deleted.

NameRequiredDescriptionDefault
nameOrUuidYesDomain name or UUID
keepStorageNoKeep storage (default: true)

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the burden of behavioral disclosure. It explicitly states that storage is not deleted, which is critical. However, it omits other behavioral aspects such as whether the domain must be inactive, what happens to snapshots, or if the operation is reversible. Not fully transparent, but the storage caveat is valuable.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, front-loaded sentence conveys the essential purpose and a critical caveat with zero waste. It is highly concise while retaining clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (2 parameters, no output schema, no annotations), the description covers the primary purpose and storage behavior but misses important contextual details like preconditions (e.g., domain state), side effects on other metadata, and any error scenarios. It is minimally adequate but not fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both parameters are already documented. The description's note about storage not being deleted reinforces the default of keepStorage=true, adding slight clarity beyond the schema's 'Keep storage (default: true)' but not introducing new information. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific verb ('Undefine'), resource ('a domain'), and the precise effect ('remove from libvirt'), plus a key qualifier ('Storage is NOT deleted'). This distinguishes it from sibling tools like start, shutdown, or snapshots without ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not specify when to use this tool versus alternatives, nor any prerequisites (e.g., domain must be shut down). It simply states what it does, leaving the agent to infer appropriate context from the name and sibling list.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 19 tool updatesv2.0.0
    • First observedboxes.capabilities
    • First observedboxes.clipboard
    • First observedboxes.display
    • First observedboxes.drag_drop
    • First observedboxes.info
    • First observedboxes.keyboard
    • First observedboxes.list
    • First observedboxes.mouse
    • First observedboxes.reboot
    • First observedboxes.resume
    • First observedboxes.screenshot
    • First observedboxes.shutdown
    • First observedboxes.snapshots.create
    • First observedboxes.snapshots.delete
    • First observedboxes.snapshots.list
    • First observedboxes.snapshots.revert
    • First observedboxes.start
    • First observedboxes.suspend
    • First observedboxes.undefine

TDQS

B3/5.0

Scored across 19 tools

Disambiguation4/5

Most tools map cleanly to a distinct resource+action (e.g., snapshots.list, snapshots.revert). The only potential confusion is `boxes.capabilities`, which could overlap with `boxes.info` (state info) and `boxes.display` (screen state) for an agent. The input/interaction tools (keyboard, mouse, clipboard, screenshot) are clearly separated by modality.

Naming Consistency3/5

Top-level lifecycle tools use consistent single verbs (start, shutdown, reboot, suspend, resume, undefine), but interaction tools shift to bare nouns (keyboard, mouse, clipboard, screenshot, capabilities). Snapshot nesting is consistent and clear. Mixing namespace prefixes (boxes.* and boxes.snapshots.*) with singular noun tools creates minor inconsistency in expected verb-phrase form.

Tool Count4/5

19 tools is slightly above the typical sweet spot but justified given the breadth: 5 lifecycle, 4 snapshot, 2 info, and 8 interaction/display tools. The interaction sub-surface is granular (keyboard, mouse, clipboard, drag_drop, capabilities) and could be consolidated, but each maps to a real distinct operation. It never feels bloated enough to warrant a 3.

Completeness4/5

Lifecycle operations are well-covered for read/start/stop, snapshots have full CRUD with revert, and interaction features (screenshot, input, clipboard) are thorough. Missing pieces include VM creation/clone, device/storage management, and define/undefine pairing is lopsided (only undefine). Snapshot and interaction workflows feel complete for the stated GNOME Boxes/libvirt scope.

Maintenance

ActivityStale
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    D
    maintenance
    Enables AI models to securely query and manage virtual machines and virtualized resources via the libvirt API through the Model Context Protocol.
    1
    MIT
  • A
    license
    Not graded
    quality
    D
    maintenance
    Enables management of KVM/QEMU virtual machines on remote libvirt hosts via SSH, with tools for inspection, lifecycle management, snapshots, and cloning.
    1
    AGPL 3.0
  • A
    license
    A
    quality
    D
    maintenance
    Enables management of GNOME Boxes virtual machines through libvirt/virsh with lifecycle and snapshot operations.
    13
    9 npm
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables AI agents to control and automate Incus/QEMU virtual machines via SSH, supporting mouse/keyboard, screenshots, commands, and lifecycle management.
    MIT