Skip to main content
Glama

TerminalMCP

Give your AI agent a real terminal — and stop paying for it in tokens.

A zero-dependency MCP server that hands an AI complete control of a machine — shell, filesystem, git, package managers, processes, network — and is built so that the whole thing costs a fraction of the tokens a naive tool server burns.

CI Node Dependencies Tests MCP Platforms License


git clone https://github.com/Fonlogen/TerminalMCP && cd TerminalMCP
./start.sh --doctor          # or: start.cmd --doctor  on Windows

No npm install. No build step. No dependencies. Just Node 18+.


The problem this solves

Most shell MCP servers expose run_command and stop there. That works, and it is ruinously expensive, because of something easy to miss:

Tool schemas are re-sent to the model on every single request.

On this server's full profile that is ~11,500 tokens of JSON schema per call. An agent that runs five commands one at a time pays it five times — roughly 57,000 tokens of schema, where one batched call would have spent 11,500 — plus the whole conversation, re-sent five times instead of once. The five commands themselves were under 600 bytes.

So token efficiency here is not a nice-to-have that got bolted on. It is the constraint the whole design answers:

Naive approach

TerminalMCP

Five commands in sequence

5 round-trips

1 (shell_bulk)

Find a symbol in a repo

read the files

search_text returns matching lines only

Change 3 lines of a 2,000-line file

rewrite the file

file_edit patches 3 lines

Understand an unfamiliar repo

a dozen ls + cat

1 (project_info)

Reuse a value from an earlier step

re-send it every time

${vars.name}, kept server-side

Tools you don't need this session

pay for them anyway

--tools profiles

Everything else — 26 tools, two transports, cross-platform shells — exists so the agent never has to fall back to an expensive pattern to get something done.


Related MCP server: vps-mcp-server

Quick start

1. Check the environment

./start.sh --doctor          # Linux / macOS / Git Bash / WSL
start.cmd --doctor           # Windows

--doctor reports the platform, which shells it found, the working directory, the active limits and what the current tool profile costs per request.

2. Register it with your client

node bin/terminalmcp.js --print-config

That prints ready-to-paste snippets with the correct absolute path. In short:

claude mcp add terminal -- node "/absolute/path/to/TerminalMCP/bin/terminalmcp.js"
{
  "mcpServers": {
    "terminal": {
      "command": "node",
      "args": ["C:\\path\\to\\TerminalMCP\\bin\\terminalmcp.js"],
      "env": { "TERMINALMCP_SHELL": "gitbash" }
    }
  }
}
{
  "servers": {
    "terminal": {
      "type": "stdio",
      "command": "node",
      "args": ["/path/to/TerminalMCP/bin/terminalmcp.js"]
    }
  }
}
npm run install-skill                      # → ~/.claude/skills/terminalmcp
node scripts/install-skill.mjs --project    # → ./.claude/skills/terminalmcp

The bundled skill teaches the model how to use the server cheaply — which tool to reach for, when to batch, how to avoid reading whole files. Without it the tools still work; with it they get used well.


What this makes possible

Concrete things that are awkward or impossible with a bare run_command:

Autonomous build-test-fix loops. shell_bulk runs a whole pipeline with conditions and retries in one call, so the agent plans the sequence up front instead of narrating it step by step:

{
  "cwd": "/srv/app",
  "capture": "on_failure",
  "steps": [
    { "id": "deps",  "command": "npm ci" },
    { "id": "test",  "command": "npm test", "timeout_ms": 600000 },
    { "id": "build", "command": "npm run build", "when": "step.test.ok" },
    { "id": "deploy", "command": "./deploy.sh",
      "when": "step.build.ok", "retry": { "count": 2, "delay_ms": 5000 } },
    { "id": "smoke", "command": "curl -fsS localhost:8080/health",
      "when": "step.deploy.ok", "delay_before_ms": 3000,
      "retry": { "count": 5, "delay_ms": 2000 } }
  ]
}

capture: "on_failure" means: silence while everything passes, full output exactly where it broke.

Running dev servers and long builds without blocking. Start it in the background, then read new output with a single blocking call instead of a polling loop:

shell_exec_async { command: "npm run dev", name: "dev" }   → job_id=job1
shell_job { action: "output", job_id: "job1", wait_ms: 30000, offset: 4096 }

Driving a remote machine. The same server speaks HTTP, so an agent can operate a build box, a NAS or a VPS from anywhere on your network.

Working in repos it has never seen. project_info returns languages, package manager, dependencies, frameworks, scripts, entry points, likely test/build commands and git state in one call.

Carrying state between calls. Capture a value once and reference it forever, without it travelling back through the conversation:

shell_exec { command: "git rev-parse --short HEAD", assign: "sha" }
shell_exec { command: "docker build -t app:${vars.sha} ." }

Using secrets without exposing them. A variable marked secret: true works everywhere ${vars.…} works but is never echoed back — not in listings, not in results, not in the audit log.


The three ideas that make it different

1. Batching — shell_bulk

One call, many commands, with real control flow. Each step supports:

Field

Effect

id

Name the step, so later steps can test step.<id>.ok

when

Run only if a condition holds

expect_exit

Which exit codes count as success — a number, an array, or "any"

on_failure

"stop" (default) or "continue"

retry

{ count, delay_ms } for flaky commands

delay_before_ms / delay_after_ms

Wait for a service to come up

assign

Capture the output into a variable, for later steps and later calls

capture

How much output to return: full, head, tail, on_failure, none

cwd, shell, env, timeout_ms, stdin

Per-step overrides

Conditions are a real (if small) expression language, evaluated by a dedicated parser — no eval, no access to arbitrary functions:

prev.ok                                    the step before succeeded
prev.exit == 0 && contains(prev.stdout, "0 failing")
step.build.ok && !step.lint.ok             by step id
steps[0].exit == 0                         by position
vars.branch == "main"
failed_count == 0

Shorthands: always, never, prev_success, prev_failure, all_success, any_failure. Functions: contains, icontains, matches, empty, exists, len, lines, first_line, last_line, int, num, lower, upper, trim. Operators: == != > < >= <= && || !, plus =~ / !~ for regex and and / or as words.

2. Server-side variables

Values the agent captures can stay on the server. Store once, reference as ${vars.<name>} in any later call — the value itself never returns to the conversation.

vars { action: "set", name: "api", value: "https://api.example.com" }
vars { action: "list" }          names, types, sizes — never full values
vars { action: "get", name: "api" }
vars { action: "load", name: "conf", path: "config.json", json: true }

Three tools write straight into the store: shell_exec assign, http_request assign, and per-step assign in shell_bulk.

${...} expands in commands, cwd, env values, stdin, file paths, URLs, request headers, query params, git messages and refs, and every bulk step. Deliberately not in file content, regex patterns or patch bodies — a JavaScript template literal, a GitHub Actions workflow and a regex all legitimately contain ${...}, and rewriting them silently would be worse than asking. The eligible fields are declared in a single table (src/tools/interpolate.js) rather than scattered across handlers, so the expansion surface is auditable at a glance.

It does not fight the shell. ${...} is shell syntax too. Anything that does not name a variable the server knows is passed through untouched, so echo ${HOME}, ${PATH%%:*} and ${#arr} reach bash intact. A ${vars.typo} that looks like ours but matches nothing is passed through literally and reported in the result, so a mistyped name reads as a mistake rather than becoming a silent empty string.

3. Tool profiles

Since schemas cost tokens on every request, you choose how many you want to carry. Measured on this repo:

Profile

Tools

Schema tokens per request

core

10

~4,800

ops

18

~8,500

dev

20

~9,200

all (default)

26

~11,500

node bin/terminalmcp.js --tools core             # shell, jobs, bulk, files, vars
node bin/terminalmcp.js --tools dev              # + search, git, fs, dev, data
node bin/terminalmcp.js --tools core,git,search  # pick groups
node bin/terminalmcp.js --tools all,-watch       # everything except one

core and vars are always included. --list-tools and --doctor print the cost of every group, and shell_info reports it to the model at runtime — so trimming is an informed decision rather than a guess. Nothing is ever lost: whatever isn't exposed as a tool is still reachable through shell_exec.


Tool reference

26 tools in 11 groups. Most use an action parameter rather than one tool per verb — git alone would otherwise be twenty tools.

core — always on

Tool

Purpose

shell_exec

Run a command and wait. Exit code, stdout, stderr.

shell_exec_async

Start a command in the background, return a job_id.

shell_job

list, status, output, wait, write, kill, remove.

shell_bulk

Many commands in one call, with delays, conditions, retries, variables.

file_read

Whole file, a line range, the tail, or only lines matching a regex.

file_write

overwrite, append, prepend, create_new.

file_edit

Several surgical edits in one atomic call.

fs_list

Directory listing with depth and glob filter.

shell_info

Platform, shells, config, guardrails, active profile.

vars — always on

Tool

Purpose

vars

set, get, list, delete, clear, append, incr, load, save.

Tool

Purpose

search_text

Grep a whole tree: regex or literal, matching lines with optional context. Skips .git, node_modules, build output and binaries; honours .gitignore. files_only and count_only cost even less. With replace, a project-wide find-and-replace (dry_run shows a diff first).

search_files

Find files and directories by glob, name, size or age. Sort by path, size or mtime.

git

One tool, ~30 actions, compact output, plus action: "raw" for anything not covered.

Read: status, log, diff, show, blame, branches, tags, remotes, stash_list, file_history, current, root, config_get Write: add, unstage, commit, checkout, branch_create, branch_delete, merge, rebase, reset, revert, restore, stash, stash_pop, tag_create, fetch, pull, push, apply, clean, init

git is invoked directly rather than through a shell, so a commit message containing quotes, newlines or $ needs no escaping.

fs

Tool

Purpose

fs_op

copy, move, delete, mkdir, touch, stat, chmod, symlink, readlink, hash (md5/sha1/sha256/sha512), disk_usage (what's eating space), tree. delete refuses a non-empty directory without recursive: true.

archive

Tool

Purpose

archive

create, list, extract, gzip, gunzip for zip, tar, tar.gz and gzip. ZIP and TAR are implemented in-process (Node ships only zlib), so archives behave identically everywhere with no tar/zip binary required. Extraction refuses entries whose path escapes the destination.

sys

Tool

Purpose

sys_info

overview, cpu, memory, disk (free space per mount), network, env, uptime, user.

proc

list (filter by name, sort by cpu/memory), tree, info, kill (by pid, optionally with children, or by name — which requires confirm: true).

net

Tool

Purpose

http_request

HTTP(S) client: status, timing, headers, body. JSON is pretty-printed, long bodies truncated. json, form, query, insecure, headers_only, assign.

net

dns (A/AAAA/MX/TXT/CNAME/NS/PTR/ALL), tcp_check, listening (open ports and which pid owns them), interfaces, ping.

dev

Tool

Purpose

pkg

Drive whichever package manager the project actually uses, detected from its lockfile: npm, pnpm, yarn, bun, deno, pip, uv, poetry, pipenv, cargo, go, composer, bundler, maven, gradle, dotnet. Actions: detect, install, add, remove, run, scripts, list, outdated.

project_info

Orient yourself in an unfamiliar repository in one call.

code

outline (functions, classes and types with line numbers — read this before the file), imports, todos, stats (lines of code by language).

data

Tool

Purpose

json_tool

get, set, delete, merge (deep), keys, validate, format on a JSON file or inline text. Paths look like scripts.build or items[0].name. Patches one path instead of rewriting the document.

diff

files (unified diff between two files), text, apply (hunks are located by context, so a patch still applies after unrelated edits shifted the file).

encode

base64 / hex / url / html encode and decode, hash, uuid, random, jwt_decode (signature not verified), timestamp.

watch

Tool

Purpose

watch

start returns a watch_id; poll blocks up to wait_ms for changes (one call instead of a polling loop); list, stop. Events are coalesced per path, so one save reads as one change.


Transports

stdio (local, default)

The normal way to run an MCP server. Your client spawns the process and talks over stdin/stdout.

HTTP (remote)

The same server can run as a network service. There is no authentication — see Security before exposing it.

./start-http.sh                  # 0.0.0.0:8787, reachable from other machines
start-http.cmd                   # same, on Windows
PORT=9000 ./start-http.sh

./start.sh --http                # local only (127.0.0.1:8787)
node bin/terminalmcp.js --http --host 0.0.0.0 --port 8787

Both MCP HTTP transports are served at once, so current and older clients work against the same port:

Method

Path

Purpose

POST

/mcp

Streamable HTTP (MCP 2025-03-26 / 2025-06-18)

GET

/mcp

SSE stream for server-initiated messages

DELETE

/mcp

End the session

GET

/sse

Legacy HTTP+SSE (MCP 2024-11-05) handshake

POST

/messages?sessionId=…

Legacy message channel

GET

/health or /

Status, tools, sessions, running jobs, as JSON

claude mcp add --transport http terminal http://<ip>:8787/mcp
curl http://<ip>:8787/health
node bin/terminalmcp.js --print-config --http --host 0.0.0.0

Sessions. initialize issues an Mcp-Session-Id, returned as a header and echoed back by the client. Each session keeps its own negotiated protocol version, so clients on different MCP revisions can talk to one server simultaneously. Idle sessions expire after 30 minutes. By default an unknown session id is still served rather than 404'd — nothing here is authenticated, so strictness would only break clients that forget the header; --strict-sessions turns that on.

Shared state, deliberately. Jobs and variables are shared across sessions, because this server drives one machine: a job started by one client stays readable from another, and from the same client after a reconnect.

Long commands. HTTP-level timeouts are disabled, so a ten-minute command isn't cut off. Behind a reverse proxy that closes idle responses, add --sse-replies for keepalive comments — though shell_exec_async plus shell_job is the better answer regardless.


Configuration

Precedence, strongest first: per-call parameters → TERMINALMCP_* environment variables → config file → defaults.

The config file is looked up in this order:

  1. $TERMINALMCP_CONFIG

  2. ./terminalmcp.config.json

  3. ./.terminalmcp.json

  4. ~/.terminalmcp/config.json

cp terminalmcp.config.example.json terminalmcp.config.json

// comments and trailing commas are tolerated.

Choosing a shell

"auto" picks the system default: pwshpowershellcmd on Windows, $SHELL then bashzshsh elsewhere.

Value

Shell

"bash"

Bash (finds Git Bash on Windows)

"gitbash"

Git Bash, Windows only

"zsh", "fish", "sh"

The respective POSIX shells

"cmd"

cmd.exe

"powershell"

Windows PowerShell 5.x

"pwsh"

PowerShell 7+

"wsl"

bash inside WSL

"C:/Program Files/Git/bin/bash.exe"

any absolute path

Custom shells can be named and then selected per call:

{
  "shells": {
    "docker": { "command": "docker", "args": ["exec", "-i", "web", "sh", "-c"] }
  }
}

On Windows, cmd and PowerShell commands run via a temporary script file, so multi-line scripts and quoting behave the way you expect.

Main options

Field

Default

Meaning

shell

"auto"

Shell to use.

login

false

Use a login shell (-lc) so ~/.profile aliases and PATH apply.

cwd

start dir

Default working directory.

timeoutMs

120000

Per-command timeout. Kills the whole process tree. 0 = unlimited.

maxOutputBytes

16000

Byte cap per returned stream (~4 bytes per token).

maxBufferBytes

8388608

In-memory buffer per stream for background jobs.

env

{}

Environment variables injected into every command.

keepAnsi

false

Keep ANSI colour codes (they cost tokens).

maxJobs

32

Concurrent background jobs.

jobRetentionMs

1800000

How long finished jobs stay readable.

tools

"all"

Tool profile — see Tool profiles.

varsFile

null

Mirror the variable store to this file so it survives a restart.

persistSecrets

false

Also write secret variables to that file.

maxVars / maxVarBytes / maxVarsTotalBytes

200 / 1MB / 8MB

Variable store limits.

Command-line options

node bin/terminalmcp.js --help

--cwd, --shell, --config, --timeout-ms, --max-output-bytes, --login, --tools, --vars-file, --persist-secrets, --max-vars, --max-var-bytes, --read-only, --allowed-root, --log-file.

HTTP: --http, --host, --port, --path, --no-cors, --strict-sessions, --sse-replies, --max-body-bytes.

Commands: --doctor, --print-config, --list-tools, --help, --version.

Environment variables

TERMINALMCP_SHELL, TERMINALMCP_CWD, TERMINALMCP_TIMEOUT_MS, TERMINALMCP_MAX_OUTPUT_BYTES, TERMINALMCP_LOGIN, TERMINALMCP_KEEP_ANSI, TERMINALMCP_READ_ONLY, TERMINALMCP_LOG_FILE, TERMINALMCP_ALLOWED_ROOTS, TERMINALMCP_CONFIG, TERMINALMCP_TOOLS, TERMINALMCP_VARS_FILE, TERMINALMCP_HTTP, TERMINALMCP_HTTP_HOST, TERMINALMCP_HTTP_PORT, TERMINALMCP_HTTP_PATH, TERMINALMCP_HTTP_CORS.


Security

Be clear-eyed about what this is. TerminalMCP gives an AI the same privileges as the user account running it. There is no sandbox, and that is the point — a sandboxed terminal cannot install a dependency, restart a service or read a log. Run it where you would be comfortable handing someone a shell.

Network exposure

The library default binds 127.0.0.1, because opening up should be a deliberate act. start-http.sh / start-http.cmd bind 0.0.0.0 — they exist for remote use — and the server says so loudly at startup.

There is no authentication, so the port is the credential. Two cheap measures that change a lot:

  • Keep it off the public internet. A LAN, a VPN (Tailscale, WireGuard) or an SSH tunnel is enough: ssh -L 8787:127.0.0.1:8787 user@host, then point the client at http://127.0.0.1:8787/mcp while the server stays bound to localhost.

  • On an untrusted network, put a reverse proxy (Caddy, nginx) in front with TLS and Basic Auth. The server neither knows nor cares.

Optional guardrails

All off by default, because the server's purpose is unrestricted access. Turn them on to narrow capability rather than network:

Field

Effect

allowedRoots

File tools cannot leave these directories — symlink escapes included.

denyCommands

Regexes; a matching command is refused.

denyPaths

Regexes; a matching write is refused.

readOnly

Blocks all writes and all command execution.

logFile

Appends one JSONL audit line per tool call.

A refusal reaches the model as Policy: …, so it understands this is an operator decision rather than an error to route around. Guardrails apply uniformly: a git write and a pkg install pass through the same gates as shell_exec, not around them.

Handling of secrets

A variable marked secret: true is usable via ${vars.…} but never returned: listings show (secret), get masks it unless reveal: true, the audit log records <secret>, and it is not written to the store file unless persistSecrets is explicitly enabled.


Architecture

bin/terminalmcp.js        CLI: arguments, --doctor, --print-config, startup
src/server.js             JSON-RPC 2.0, MCP methods, sessions, audit log
src/http.js               HTTP transport: Streamable HTTP + legacy HTTP+SSE
src/exec.js               spawning, timeouts, process-tree kills, buffering
src/jobs.js               background job registry
src/bulk.js               sequential runner: conditions, retries, variables
src/expr.js               the mini-language for `when` and `${...}`
src/vars.js               variable store: TTL, caps, secrets, atomic persistence
src/diff.js               line diff (LCS) and unified-patch application
src/glob.js               glob matching and .gitignore semantics
src/walk.js               one directory walker, shared by every crawling tool
src/archive.js            ZIP and TAR, written by hand
src/files.js              file_read / file_write / file_edit / fs_list
src/shells.js             shell detection and per-platform invocation
src/config.js             configuration loading and precedence
src/guards.js             optional guardrails
src/format.js             output cleanup and truncation
src/tools/index.js        registry: groups, profiles, token cost
src/tools/interpolate.js  which fields accept ${...}, declared in one place
src/tools/*.js            one module per tool group
skills/terminalmcp/       the skill that teaches a model to use it well

Roughly 9,300 lines of source, 1,900 lines of tests, zero dependencies.

Implementation notes

  • The MCP protocol is implemented by hand (JSON-RPC 2.0, newline-delimited on stdio) specifically to keep the dependency count at zero. Clone and run.

  • stdout carries only protocol. Every diagnostic goes to stderr.

  • Requests don't block each other. A long shell_exec doesn't stop a concurrent shell_job poll.

  • Timeouts kill the whole process groupprocess.kill(-pid) on POSIX, taskkill /T /F on Windows — so a command that spawned children doesn't leave orphans behind. There's a regression test for exactly that.

  • Over HTTP, replies are plain JSON when the client accepts JSON. Clients send Accept: application/json, text/event-stream on every request, so wrapping every short reply in an event stream would buy nothing. SSE is used when the client won't take JSON, or on demand via --sse-replies.

  • when and ${...} use a dedicated parser. No eval, no reachable arbitrary functions.

  • Atomic where it matters. file_edit is all-or-nothing; diff apply refuses a partial patch rather than leaving a half-edited file; the variable store persists via write-then-rename.

Output shaping

Every result passes through the same pipeline, because this is where tokens quietly disappear:

  • ANSI escape codes stripped, trailing whitespace trimmed, runs of blank lines collapsed.

  • Truncation in the middle, keeping head and tail — errors live at the end of a log — with a note of how many bytes were dropped.

  • Empty sections omitted entirely. No stderr: (empty).

  • Background job output read incrementally by offset, so bytes already seen never come back.


Testing

npm test                 # 383 assertions
npm run test:smoke       # stdio protocol, exec, jobs, bulk, files, profiles (97)
npm run test:guards      # guardrails: readOnly, allowedRoots, deny*         (14)
npm run test:tools       # extended tools: search, git, fs, archive, …      (156)
npm run test:vars        # variables, interpolation, secrets, persistence    (67)
npm run test:http        # HTTP transport: streamable + legacy SSE           (49)

The tests spawn the real server and speak MCP to it — over stdio for the main suites, over real HTTP (sessions, SSE, CORS, batching, 413s) for the transport suite. So they cover the handshake, JSON-RPC framing and protocol negotiation, not just internal logic. Fixtures include a synthetic repository and a local HTTP server, so git, pkg, search_text and http_request are exercised against something real.


Compatibility

Status

Node.js

18 and later

Linux

Supported and tested

macOS

Supported; shares the POSIX code paths with Linux

Windows

Supported and tested — Git Bash, cmd, PowerShell 5, pwsh 7, WSL, taskkill process trees, CIM process listing, PowerShell disk queries

MCP protocol

2024-11-05, 2025-03-26, 2025-06-18 (negotiated per session)


Things worth knowing

  • Every command runs in a fresh shell. cd, export and source do not carry across calls or bulk steps. Use cwd, env, or chain inside one command string (cd x && make).

  • Output is middle-truncated at maxOutputBytes. Raise it if you genuinely need the middle of a long log, or read the log file with file_read { tail_lines: n } instead.

  • search_text honours .gitignore by default. Pass respect_gitignore: false when you're looking for something in build output.

  • code outline is pattern-based, not a real parser. It's for orientation; file_read is the source of truth.


Roadmap

  • Parallel step groups in shell_bulk

  • Persistent shell sessions (keeping cd / export state)

  • A SQL client

  • An optional token for the HTTP transport

Contributions and issues are welcome. The test suite is the contract: if you add a tool, add assertions that drive it through the real server.


License

MIT

Available Tools

26 tools
archiveA

Create, list and extract archives: zip, tar, tar.gz (tgz) and plain gzip. Implemented in process, so it behaves the same on Windows, macOS and Linux with no zip/tar binary needed. create takes a directory or a file list (with glob filters); extract refuses paths that escape the destination.

ParametersJSON Schema
NameRequiredDescriptionDefault
toNoextract: destination directory. gzip/gunzip: output file.
baseNocreate: strip this leading path from stored names. Default: the "from" directory.
fromNocreate: directory (or single file) to pack.
globNocreate/extract: only these paths (globs).
pathYesThe archive file. For create, the archive to write.
filesNocreate: explicit file list instead of "from".
levelNocreate/gzip: compression level 0-9. Default 6; 0 stores without compressing.
actionYesWhat to do.
formatNoOverride the format. Default: inferred from the file name, then the magic bytes.
excludeNocreate/extract: skip these paths (globs).
max_bytesNoByte cap on returned output.
overwriteNoextract: replace existing files. Default false (they are skipped).
skip_dirsNocreate: directory names not to pack.
show_hiddenNocreate: include dotfiles. Default true.
strip_componentsNoextract: drop this many leading path segments, like tar --strip-components.

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden, and it adds real value: it discloses the cross-platform, in-process implementation (consistent behavior with no external binary) and a security-relevant guard for extract. It does not cover what 'list' returns, permission/auth requirements, or how overwrite/skip semantics interact, but the core traits an agent needs are present.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences with no filler: capability and formats first, then the implementation trait, then the safety/behavior note. Every clause earns its place and the most important information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 15-parameter tool with no annotations and no output schema, the description is adequate but incomplete: it never mentions the gzip/gunzip actions that the schema declares, nor what 'list' produces, leaving the agent to reconcile actions between description and schema. The 100% schema coverage and the extract safety note keep it at minimum viable rather than deficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all 15 parameters in detail. The description adds only marginal framing: that 'create' accepts either a directory or a file list with glob filters, and that extract path-escapes are rejected. That is a baseline 3 when the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names concrete verbs (create, list, extract) and the exact resource and formats (zip, tar, tar.gz/tgz, plain gzip), so the tool's scope is unambiguous. It also hints at a differentiator from shell-based siblings by noting it works 'in process' with 'no zip/tar binary needed', though it never names an alternative tool explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied through the action list and a few conditional phrases ('create takes a directory or a file list', 'extract refuses paths that escape the destination'). There is no explicit statement of when to reach for this tool versus shell_exec/shell_bulk, nor any when-not guidance or prerequisites.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

codeA

Structural views of source code: outline (functions, classes, types in a file, with line numbers — read this before reading the file), imports (what a file depends on), todos (TODO/FIXME/HACK/XXX across the tree), stats (lines of code by language).

ParametersJSON Schema
NameRequiredDescriptionDefault
globNotodos/stats: restrict to these globs.
pathNooutline/imports: the file. todos/stats: directory to scan. Default: server cwd.
tagsNotodos: which markers to look for. Default TODO, FIXME, HACK, XXX, BUG.
limitNotodos: max results. Default 100.
actionYesWhich view.
max_bytesNoByte cap on returned output.
max_depthNotodos/stats: recursion depth. Default 24.

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description carries the full behavioral burden. It implies a read-only inspection tool and mentions a byte cap via parameter, but says nothing about permissions, whether output is truncated/ordered, or the cost of tree-wide todos/stats scans. It adds some value but leaves meaningful behavioral gaps for a 7-parameter tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence, front-loaded with the domain and then broken into four clearly labeled action clauses. Every clause earns its place by explaining what a distinct action returns, with no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description usefully summarizes each action's return shape (functions/classes/types with line numbers, dependencies, markers, LOC by language), which is what an agent needs to pick an action. It omits output ordering, truncation behavior, and how limit/max_bytes interact with results, so it is strong but not exhaustive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents path, glob, tags, limit, max_bytes and max_depth. The description only restates the per-action applicability (outline/imports vs todos/stats) that the schema itself already encodes, adding no new parameter meaning. Baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific domain (structural views of source code) and enumerates the four actions with their return content, so an agent can tell it apart from file_read or search_text. It stops short of naming a sibling explicitly or summarizing a single unifying verb beyond 'views', which keeps it out of the top band.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives an explicit usage rule for one action ('read this before reading the file' for outline) and each action's parameter descriptions state the applicable scope (path is a file for outline/imports, a directory for todos/stats). There is no guidance on when to prefer search_text or fs_list over this tool, so it falls short of 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

diffA

Compare and patch text: files (unified diff between two files), text (between two inline strings), apply (apply a unified diff to a file — hunk line numbers are matched by context, so a patch still applies after unrelated edits shifted the file).

ParametersJSON Schema
NameRequiredDescriptionDefault
aNotext: the "before" string.
bNotext: the "after" string.
toNofiles: the second file.
pathNofiles: the first file. apply: the file to patch.
statNoReport only the added/removed line counts.
patchNoapply: the unified diff to apply.
actionYesWhat to do.
contextNoLines of context per hunk. Default 3.
dry_runNoapply: report what would happen without writing.
max_bytesNoByte cap on returned output.

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It adds a valuable trait for apply—context-based hunk matching so patches survive shifted lines—but omits mutation/permission details, and does not mention dry_run or what the tool returns.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single dense sentence, front-loaded with the core purpose, followed by parenthetical mode definitions. Every clause contributes information, though bullets would be slightly easier to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 10-parameter tool with three modes and no output schema, the description covers mode selection and a key apply behavior. However, it does not describe return values, dry_run semantics, or error handling, leaving gaps that the missing output schema cannot fill.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the parameter meanings are already documented. The description adds action-to-parameter grouping (files uses path/to, text uses a/b, apply uses path/patch), but no syntax or format details beyond the schema; baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource (compare/patch text) and enumerates the three modes: files, text, apply. Each mode is defined concisely, so an agent can immediately tell this tool apart from file_edit or search_text without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives clear context for when to use each action: files for two file paths, text for inline strings, apply for a unified diff. There are no exclusions or explicit alternatives (e.g., use file_edit instead), but the mode descriptions provide strong selection guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

encodeA

Small conversions: base64/hex/url/html encode and decode, hash (md5/sha1/sha256/sha512), uuid, random bytes, jwt_decode (header and payload — signature is NOT verified), timestamp (epoch <-> ISO). Reads inline text or a file.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathNoRead the input from this file instead of "text".
textNoInput text. For timestamp: an epoch number or an ISO string.
countNouuid: how many. random: how many bytes. Default 1 / 32.
actionYesWhich conversion.
encodingNorandom: output encoding. Default hex.
algorithmNohash: digest. Default sha256.
max_bytesNoByte cap on returned output.

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It usefully flags that jwt_decode does NOT verify the signature and mentions a max_bytes cap on output, which are real behavioral facts. It omits error behavior, file-size limits for path reads, and whether random output is cryptographically secure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single dense capability sentence is front-loaded with the operation list, followed by a short input-source sentence. No filler, though the enumeration is long and could be tabular.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, yet the description conveys enough for a multi-action converter: the action set, input source, and the key cryptographic caveat. It is close to complete; return-value specifics per action remain implicit.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. The description's parentheticals (hash algorithms, jwt header/payload, input from text or file) largely restate what the schema fields already document, adding little beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names the exact operation set (base64/hex/url/html encode-decode, hash, uuid, random, jwt_decode, timestamp) matching the enum verbatim, so an agent knows precisely what it does. It is scoped as 'small conversions', but does not explicitly differentiate itself from siblings like shell_exec or json_tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the enumerated action list and the 'Reads inline text or a file' input note, and 'Small conversions' bounds the intended scope. However, there is no explicit when-to-use-vs-alternatives guidance (e.g., vs shell_exec), leaving routing to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

file_editA

Patch parts of a file — several edits in ONE call. ops types: replace_lines, delete_lines, insert_before, insert_after, replace_text (exact string), regex_replace, append, prepend. Line numbers in every op refer to the ORIGINAL file and line ranges must not overlap, so you can plan all edits from a single file_read. replace_text fails unless it matches expect_count times (default 1) — pass all=true for every occurrence. Use dry_run=true to preview a diff first.

ParametersJSON Schema
NameRequiredDescriptionDefault
eolNoLine endings. Default keep.
opsYesEdits applied atomically: nothing is written unless all of them succeed.
pathYesFile to patch.
dry_runNoPreview the diff without writing.

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does well: it discloses the reference-frame rule (line numbers are against the ORIGINAL file), a hard constraint (line ranges must not overlap), failure semantics (replace_text fails unless it matches expect_count, default 1), and a safe preview path via dry_run. Missing are permission/backup behavior and what the dry_run output actually looks like, so not a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three dense sentences, each front-loaded with high-value constraints: batching first, then op list, then the line-number/overlap rule, then failure and preview semantics. No filler and no repetition of the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a multi-op mutation tool with no output schema and no annotations, the description covers the operation model, ordering constraints, failure conditions, and preview path — enough to call it correctly. It leaves the return value of a write/dry_run unexplained and does not address concurrent-edit or stale-file handling beyond expect_match's mention in the schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline would be 3, but the description adds genuine meaning beyond the schema: the non-overlap constraint and original-file line numbering for start_line/end_line, expect_count's default of 1 and all=true override for replace_text, and dry_run's diff-preview behavior. It doesn't explain eol or expect_match/allow_no_match, which the schema covers.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource with scope ('Patch parts of a file — several edits in ONE call') and enumerates the op types, which makes it unmistakably the incremental-edit tool rather than file_write. It does not explicitly name a sibling or draw the boundary against file_write, so it stops short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives real usage context: plan all edits from a single file_read because line numbers refer to the original file, and preview with dry_run=true. It also distinguishes replace_text (with expect_count/all) from the line-based ops. There is no explicit 'when not to use' or named alternative (e.g. use file_write for a full rewrite), so it is clear but not exhaustive.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

file_readA

Read a file, or just the part you need: a line range (start_line/end_line, negatives count from the end), head_lines/tail_lines, or match="regex" to return only matching lines with optional context — far cheaper than reading a whole file. Output is line-numbered and middle-truncated at max_output_bytes.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYesFile path, absolute or relative to the server cwd.
matchNoRegex: return only lines that match (grep mode).
contextNoLines of context around each match. Default 0.
encodingNobase64 to read binary bytes.
end_lineNo1-based last line, inclusive. Negative counts back from the end.
max_bytesNoByte cap on returned output before middle-truncation. Lower it to save tokens.
force_textNoRead as UTF-8 even if the file looks binary.
head_linesNoJust the first N lines.
start_lineNo1-based first line. Negative counts back from the end.
tail_linesNoJust the last N lines.
ignore_caseNoShorthand for match_flags="i".
match_flagsNoRegex flags for match, e.g. "i".
max_matchesNoCap on matches in grep mode. Default 200.
line_numbersNoPrefix lines with numbers. Default true.

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description carries the burden. It usefully discloses output shape (line-numbered, middle-truncated at max_output_bytes) and negative-index semantics, which is real behavioral context. It says nothing about error behavior for missing files, permissions, or how conflicting modes (e.g. start_line vs head_lines) resolve.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One dense, front-loaded sentence with the primary capability ('Read a file') first and the qualifiers following. It is information-rich with no filler, though the em-dash chain makes it slightly harder to scan than a short bulleted breakdown would be.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 14-parameter tool with no annotations and no output schema, the description covers the headline modes and truncation behavior adequately. It stops short of explaining error handling, parameter conflicts, or binary/base64 handling, leaving some gaps that the schema only partially fills.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 100% schema description coverage, the schema already documents all 14 parameters including defaults and enums; baseline is 3. The description reinforces the most important ones (start_line/end_line negatives, head_lines/tail_lines, match regex) but adds no syntax or precedence detail beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('Read a file') and immediately enumerates the access modes (line range, head/tail, regex match), so an agent knows exactly what capability it offers. The 'middle-truncated at max_output_bytes' and 'line-numbered' phrasing further pins down the behavior in a way that distinguishes it from raw shell reads.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives a clear usage rationale ('far cheaper than reading a whole file') that steers the agent toward partial reads rather than whole-file reads. However, it never names the sibling tools (search_text, search_files) or states when those should be preferred over match= mode, so no explicit exclusions are provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

file_writeA

Write a whole file. mode: overwrite (default) | append | prepend | create_new (fails if it exists). Creates parent directories and keeps the file existing EOL style. For a small change to a big file use file_edit.

ParametersJSON Schema
NameRequiredDescriptionDefault
eolNoLine endings. Default keep (detect from the file, else LF).
modeNoDefault overwrite.
pathYesFile path, absolute or relative to the server cwd.
contentYesFull new content (or the chunk to append/prepend).
encodingNobase64 to write binary content.
create_dirsNoCreate missing parent directories. Default true.
ensure_trailing_newlineNoEnd the file with a newline. Default true.

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It usefully discloses side effects: parent directories are created and existing EOL style is preserved, and create_new fails on existing files. However, it never states that the default 'overwrite' destroys existing content irreversibly, nor anything about permissions or failure behavior for the other modes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, zero filler, with the core action first and the alternative-tool routing last. Every clause carries information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 7-param mutation tool with no annotations and no output schema, the description covers the destructive default, the mode failure case, and side effects like directory creation and EOL preservation. The main remaining gap is not flagging the data-loss risk of the default overwrite mode.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds semantics the schema lacks: the per-mode behavior of overwrite/append/prepend and the failure condition for create_new, which the enum only labels 'Default overwrite'. Other params (eol, encoding, create_dirs) are left entirely to the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Write a whole file') with explicit scope ('whole', as opposed to partial edits), and names the sibling it is not by routing to file_edit. An agent can distinguish it from file_edit or shell-based writes without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly routes the agent: 'For a small change to a big file use file_edit.' It also documents the discriminating condition for create_new ('fails if it exists'). No guidance on when-not to use it versus shell_bulk or other write paths, but the primary alternative is covered.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fs_listB

List a directory (or stat one path). Recurses to "depth", filters with a glob "pattern", and skips .git/node_modules/dist and friends by default.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathNoDirectory (or file) to list. Default: server cwd.
depthNoRecursion depth. Default 1.
detailsNoInclude file sizes. Default true.
patternNoGlob filter on the relative path, e.g. "*.ts" or "src/**/*.js".
max_bytesNoByte cap on returned output before middle-truncation. Lower it to save tokens.
skip_dirsNoDirectory names not to descend into.
max_entriesNoCap on listed entries. Default 500.
show_hiddenNoInclude dotfiles. Default false.

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden, and it does disclose non-obvious default behavior: recursion to depth, glob filtering, and default skipping of .git/node_modules/dist. However, it does not describe permissions, error behavior, or the fact that output is middle-truncated (that detail lives only in the schema), and 'and friends' is vague about the actual skip list.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single tight sentence with the primary action front-loaded and the modifier behaviors trailing. No filler, though 'and friends' sacrifices precision for brevity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an 8-parameter read tool with no annotations and no output schema, the description covers the core behaviors but never explains the shape of what is returned or the truncation semantics. Adequate, not complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so every parameter is already documented, setting the baseline at 3. The description echoes depth and pattern and adds the default skip behavior, but contributes no additional syntax or constraint detail beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('List a directory') and extends it to the stat case ('or stat one path'), which an agent can act on immediately. It does not explicitly contrast itself with overlapping siblings like search_files or file_read, so it falls short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance and no mention of alternatives, despite siblings such as search_files, file_read, and shell_exec plausibly covering some of the same ground. The only routing-ish information is implicit in the behavior sentence.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fs_opB

Filesystem operations other than reading/writing content: copy, move, delete, mkdir, touch, stat, chmod, symlink, readlink, hash (md5/sha1/sha256/sha512), disk_usage (recursive size, biggest files), tree (indented listing). Works on files and directories; recursive where it makes sense. delete refuses a non-empty directory unless recursive=true.

ParametersJSON Schema
NameRequiredDescriptionDefault
toNoDestination path for copy, move and symlink.
topNodisk_usage: how many biggest entries to list. Default 15.
modeNochmod: octal mode as a string, e.g. "755". mkdir: mode for new directories.
pathYesTarget path (the source, for copy/move).
depthNotree: levels to show (default 3). disk_usage: levels to break down (default 2).
forceNocopy/move: overwrite the destination if it exists. delete: ignore a missing path.
actionYesOperation to perform.
algorithmNohash: digest to use. Default sha256.
max_bytesNoByte cap on returned output.
recursiveNocopy/delete: include directory contents. Required to delete a non-empty directory.
skip_dirsNotree/disk_usage: directory names not to enter.
max_entriesNotree: cap on listed entries. Default 400.
show_hiddenNotree/disk_usage: include dotfiles.

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. It adds one specific rule (delete refuses a non-empty directory unless recursive=true) and a vague 'recursive where it makes sense,' but omits critical context: whether delete is permanent, what happens on overwrite (force), permission requirements, error modes, and return formats. For a tool performing destructive operations, this is a significant gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded paragraph that efficiently packs scope, action list, and one behavioral note. It avoids redundancy and is appropriately sized for a 13-parameter tool, though minor structural improvements (e.g., separating the behavioral note) could enhance scannability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (12 actions, 13 parameters, no output schema, no annotations), the description adequately covers selection by stating scope and exclusions, and the schema covers parameter invocation. However, it lacks detail on what each action returns or how errors surface — gaps that could mislead an agent about output expectations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so each parameter is fully documented in the schema. The description restates the list of actions and hash algorithms, which duplicates the enum values with no added syntax or format detail. Per the rubric, a baseline of 3 is appropriate when the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names the resource (filesystem) and enumerates all supported operations, with an explicit exclusion: 'other than reading/writing content.' This immediately distinguishes it from siblings like file_read and file_write, giving an agent a precise sense of what the tool does and does not cover.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The exclusion of reading/writing content implies that file_read and file_write should be used for those tasks, but no explicit when-to-use guidance or named alternatives are provided. The delete condition (needs recursive=true for non-empty dirs) is a behavioral rule, not usage routing. Overall, usage is implied rather than stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

gitA

Run git with compact, token-cheap output. Read: status, log, diff, show, blame, branches, tags, remotes, stash_list, file_history, current, root, config_get. Write: add, unstage, commit, checkout, branch_create, branch_delete, merge, rebase, reset, revert, restore, stash, stash_pop, tag_create, fetch, pull, push, apply, clean, init. Anything else: action="raw" with args=["..."]. git runs directly, not through a shell, so commit messages with quotes and newlines need no escaping.

ParametersJSON Schema
NameRequiredDescriptionDefault
allNoadd: stage everything. commit: stage tracked changes first (-a). branches: include remotes.
cwdNoRepository directory. Default: server cwd.
keyNoconfig_get: the config key, e.g. user.email.
refNoBranch, tag, commit or range — depends on the action (show, diff, checkout, merge, reset, ...).
argsNoFor action="raw": the full git argv, e.g. ["bisect","start"]. For other actions: extra flags appended to the command.
hardNoreset: --hard (DISCARDS working tree changes) instead of --mixed.
statNodiff/show/log: summarise as changed files + line counts instead of full patch. Much cheaper.
amendNocommit: amend the previous commit.
forceNopush/branch_delete/clean: force the operation.
limitNolog/file_history: how many commits. Default 20.
patchNoapply: the unified diff text to apply.
pathsNoFiles/paths the action applies to (add, diff, checkout, restore, blame, file_history, ...).
actionYesWhat to do. Use "raw" with args for any git command not listed.
remoteNofetch/pull/push: remote name. Default origin.
stagedNodiff: show the staged changes (--cached).
messageNocommit/tag_create/stash: the message.
max_bytesNoByte cap on returned output.
timeout_msNoKill git after this long. Network actions default to 120000.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does meaningful work: it discloses the token-cheap output preference, that git runs directly without a shell, and that quoting/newlines need no escaping — all non-obvious execution-model facts. It stops short of warning about destructive write actions (force push, reset --hard, clean) or auth needs for fetch/pull/push, so it is not exhaustive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is deliberately compressed: the main behavior and routing rule are front-loaded, action lists are comma-dense, and the closing escaping note is one clause. No sentence is filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an 18-parameter mutation-capable tool with no output schema and no annotations, the description covers action coverage and execution semantics well. It could do more on destructive-operation consequences and output shape, but the schema's explicit warnings (e.g. hard: 'DISCARDS working tree changes') fill part of that gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all 18 parameters including enum values and per-action flags; the baseline of 3 applies. The description reinforces the raw-action pattern and the no-escape rule for messages, but adds little parameter meaning the schema does not already provide.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Run git') with an explicit quality goal ('compact, token-cheap output'), then enumerates the read and write action families so the agent immediately knows the tool's surface. It is trivially distinguishable from shell_exec because it is git-specific.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description partitions the supported actions into Read and Write lists and gives a clear fallback ('Anything else: action="raw" with args'), which tells the agent exactly when to use which mode. It does not, however, say when to prefer this over the sibling shell_exec/shell_exec_async tools, which is the main remaining gap.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

http_requestA

Make an HTTP(S) request and report status, timing, headers and body — for testing the API you are building or calling. JSON bodies are pretty-printed; large bodies are truncated. Pass json= for a JSON body (sets Content-Type), or body= for anything else.

ParametersJSON Schema
NameRequiredDescriptionDefault
urlYesFull URL. http:// is assumed if no scheme is given.
bodyNoRaw request body.
formNoBody sent as application/x-www-form-urlencoded.
jsonNoBody sent as JSON (any value). Sets Content-Type: application/json.
queryNoQuery parameters appended to the URL.
assignNoStore the response body in the server variable of this name instead of relying on it coming back through the conversation. See the vars tool.
methodNoGET (default), POST, PUT, PATCH, DELETE, HEAD, OPTIONS...
headersNoRequest headers.
insecureNoAccept invalid TLS certificates (self-signed dev servers).
max_bytesNoByte cap on the returned body. Default: server maxOutputBytes.
timeout_msNoAbort after this long. Default 30000.
headers_onlyNoReport status and headers, skip the body.
follow_redirectsNoFollow 3xx. Default true.

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full load and does disclose genuinely non-obvious behavior: JSON bodies are pretty-printed, large bodies are truncated, and json= sets Content-Type. It omits error-surface behavior, auth/credential handling, and side effects of the `assign` variable write.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the core capability and outcome, then the body-mode distinction. No filler and nothing repeated.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 13-parameter, no-output-schema tool with no annotations, the description covers purpose, return shape and body semantics; the per-parameter detail is fully carried by the schema. It would be complete if it mentioned the variable-storage side effect and TLS/redirect caveats at a high level, but nothing critical is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all 13 parameters are already documented in the schema; baseline is 3. The description only re-frames the json-vs-body choice, which the schema already covers, and adds no syntax or format detail beyond it.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource (make an HTTP(S) request) plus exactly what it reports (status, timing, headers, body) and its intended context. It does not distinguish itself from the sibling `net`, which is the only remaining ambiguity for an agent choosing between them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

"for testing the API you are building or calling" gives a clear usage context, and the json=/body= sentence steers the two main body modes. It stops short of stating when NOT to use it (e.g. versus shell_exec + curl) or naming alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

json_toolA

Query and patch JSON without rewriting the whole file: get (read a path), set, delete, merge (deep), keys (list a level), validate, format (pretty-print or minify). Paths look like "scripts.build" or "items[0].name". Works on a file (path=) or inline text (content=).

ParametersJSON Schema
NameRequiredDescriptionDefault
pathNoJSON file to read (and write, for set/delete/merge/format).
valueNoset: the new value (any JSON type). merge: the object to merge in.
actionYesWhat to do.
indentNoIndent for written/formatted output. Default 2; 0 minifies.
contentNoInline JSON text instead of a file. Nothing is written in this mode.
json_pathNoDotted/bracketed path inside the document, e.g. "a.b[0].c". Omit for the root.
max_bytesNoByte cap on returned output.
create_missingNoset: create intermediate objects that do not exist. Default true.

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are supplied, so the description carries the burden, and it does useful work: 'without rewriting the whole file' discloses the partial-mutation behavior, and 'Nothing is written in this mode' clearly marks the content= mode as non-destructive. It omits auth/permission needs, error behavior on missing paths, and write scope beyond path=.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One dense paragraph with the core value proposition ('without rewriting the whole file') front-loaded, followed by the action list, path syntax, and mode selection. Every clause earns its place, though the action enumeration and examples make it slightly list-heavy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an 8-parameter, 7-action tool with no annotations and no output schema, the description covers actions, path syntax, and file-vs-inline modes well. It does not describe return values or per-action error semantics, which is a modest gap given there is no output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3; the description adds value by giving concrete path syntax ('scripts.build', 'items[0].name') and clarifying that content= is inline and produces no writes. It still leaves the value/create_missing/max_bytes semantics to the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb+resource and enumerates every action (get, set, delete, merge, keys, validate, format) so the agent knows exactly what the tool covers. It also distinguishes itself from generic file siblings with 'without rewriting the whole file', signaling a JSON-aware partial-patch tool rather than file_read/file_write/file_edit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It clearly states the two operating modes ('Works on a file (path=) or inline text (content=)'), which tells the agent when to supply which parameter. It does not explicitly say when to prefer this over file_edit or file_read, so it stops short of full routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

netA

Network probes: dns (A/AAAA/MX/TXT/CNAME/NS/PTR lookup), tcp_check (is host:port accepting connections, with timing), listening (which ports are open on this machine, and which pid owns them), interfaces (local addresses), ping.

ParametersJSON Schema
NameRequiredDescriptionDefault
hostNoHostname or IP for dns, tcp_check and ping.
portNotcp_check: port to connect to. listening: only report this port.
typeNodns: record type. Default A.
countNoping: how many packets. Default 3.
portsNotcp_check: several ports at once.
actionYesWhich probe to run.
max_bytesNoByte cap on returned output.
timeout_msNoPer-probe timeout. Default 5000.

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It does disclose some traits the schema does not: tcp_check reports timing, listening identifies the owning pid, and ping is packet-based. It omits what happens on failure, whether elevated privileges are needed for port/pid enumeration, and the default timeouts and byte caps that the schema only names.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single dense sentence front-loads the tool's identity ('Network probes') and then itemizes each action with its defining detail. No filler, no restatement of the name, and every clause adds distinguishing information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an eight-parameter, no-annotation, no-output-schema tool, the description covers what each action does but says nothing about return shape, error behavior, or privilege requirements for the more sensitive probes (listening, interfaces). It is adequate but leaves gaps an agent would need to discover by trial.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and all eight parameters are documented there, including which action each one belongs to, so the description need not repeat them. The description adds nothing about parameter interaction beyond what the schema already states, which is the baseline for a fully covered schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description enumerates five concrete probes (dns, tcp_check, listening, interfaces, ping) and states what each one returns, so the agent knows exactly what the tool does. It does not, however, differentiate itself from siblings like http_request or shell_exec, which could also answer some of these questions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Enumerating the five actions with their meaning implies when each sub-action applies, which is useful selection guidance. But there is no explicit 'use this instead of X' routing against siblings (http_request, shell_exec, sys_info), and no stated prerequisites such as privileges for the listening probe.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

pkgA

Drive whichever package manager the project uses, without having to know which: npm, pnpm, yarn, bun, deno, pip, uv, poetry, pipenv, cargo, go, composer, bundler, maven, gradle, dotnet. Actions: detect, install, add, remove, run (a script/task), scripts (list them), list, outdated. Detection reads lockfiles, so it picks the manager the repo actually uses.

ParametersJSON Schema
NameRequiredDescriptionDefault
cwdNoProject directory. Default: server cwd.
devNoadd: install as a dev dependency.
argsNorun: arguments passed to the script.
actionNoWhat to do. Default detect.
scriptNorun: the script or task name.
managerNoForce a manager instead of detecting one.
packagesNoadd/remove: package names (versions allowed, e.g. "lodash@4").
max_bytesNoByte cap on returned output.
timeout_msNoTimeout. Installs default to 600000 (10 min).

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden, and it does disclose the detection mechanism (lockfile reads). However it never distinguishes read-only actions (detect/scripts/list/outdated) from mutating ones (install/add/remove), nor warns about long install durations, required permissions, or network access needed by the underlying managers.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the core value proposition, then the action list, then the detection detail—logical and mostly waste-free. The 15-manager enumeration is long but earns its place by scoping applicability; overall appropriately sized.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 9-parameter tool with no annotations and no output schema, the description covers actions and detection well but omits return format, output truncation behavior (max_bytes), timeouts, and mutation semantics. Adequate but with visible gaps for such a broad tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents every parameter including the action enum and per-action parameters. The description's action list adds minor mapping value (run a script, list scripts, detect) but does not go beyond the structured fields, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource (drive a package manager) and enumerates the exact managers and actions supported, so an agent immediately knows this wraps npm/pnpm/cargo/etc. rather than being another generic shell runner. It is clearly distinguishable from siblings like shell_exec or proc.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explains the key selection condition: detection reads lockfiles so it picks the manager the repo actually uses, and manager can be forced. It gives clear context for when to reach for this over a raw shell tool, but offers no explicit when-not guidance or edge cases (e.g., no lockfile present).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

procB

Processes on this machine: list (filter by name, sort by cpu/memory), tree (parent/child hierarchy), info (one pid in detail), kill (by pid, or every process matching a name — which requires confirm=true). Uses ps on Unix and PowerShell/tasklist on Windows.

ParametersJSON Schema
NameRequiredDescriptionDefault
pidNoinfo/kill/tree: the process id.
nameNolist/kill: regex matched against the process name and command line.
sortNolist: ordering. Default cpu.
treeNokill: also kill the children of the target.
limitNolist: how many processes to show. Default 25.
actionNoWhat to do. Default list.
signalNokill: SIGTERM (default), SIGKILL, SIGINT. Ignored on Windows, which always force-kills.
confirmNoRequired to kill by name, since a regex can match more than you meant.
max_bytesNoByte cap on returned output.

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It does add real value: the confirm=true guardrail for killing by name, the destructive kill semantics, and the cross-platform implementation (ps on Unix vs PowerShell/tasklist on Windows). It omits permissions required, reversibility, and output characteristics for a tool that can terminate processes, so it is not fully transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

It is a single dense sentence that is front-loaded with the resource and organized as labeled per-action clauses, so nothing is wasted. The heavy parenthetical nesting and run-on length keep it from being maximally scannable, but it is efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 9-parameter, multi-action, destructive-capable tool with no annotations and no output schema, the description covers the action surface and cross-platform behavior but leaves gaps: no return/output shape is described (only a max_bytes hint exists in schema) and no safety or permission caveats beyond confirm=true. Adequate but not complete for the complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so every parameter is already documented in the schema and the baseline is 3. The description largely restates schema content (filter by name, sort by cpu/memory, kill by pid) rather than adding syntax or edge-case meaning beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names the resource (processes on this machine) and enumerates four distinct operations (list/tree/info/kill) with what each does, so an agent immediately knows this is a process-inspection/control tool rather than general shell execution. It does not explicitly name any sibling to rule out (e.g., shell_exec), so it stops short of full sibling differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied through the action-by-action breakdown (filter by name, sort by cpu/memory, kill by pid or name), which gives an agent enough to select the right action. However, there is no explicit when-to-use vs. when-not guidance and no alternative named (e.g., sys_info for machine stats or shell_exec for arbitrary commands), leaving the routing to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

project_infoA

Orient yourself in an unfamiliar repository in ONE call: languages by file count and lines, package manager and manifests, dependencies and detected frameworks, available scripts, entry points, test/build/lint commands, git branch and dirty state, and config files. Much cheaper than exploring the tree by hand.

ParametersJSON Schema
NameRequiredDescriptionDefault
cwdNoProject directory. Default: server cwd.
depsNoInclude the dependency list. Default true.
max_bytesNoByte cap on returned output.
max_filesNoCap on files scanned for language stats. Default 20000.

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full disclosure burden, and it does reasonably well: it enumerates the returned fields (git dirty state, entry points, build/test/lint commands, config files) and notes the cost advantage of a single aggregated call. It does not explicitly state that the operation is read-only/side-effect free, nor anything about the effect of the max_bytes cap on truncation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The scoping statement is front-loaded, and the enumeration is dense but every clause earns its place by telling the agent what it will get back. The closing comparative sentence justifies the single-call design in six words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description must describe return contents, and it does so thoroughly enough for an agent to decide and call correctly. Combined with the fully documented input schema and self-evident read-only nature, nothing critical is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all four parameters (cwd, deps, max_bytes, max_files) are already documented in the schema. The description adds no additional meaning about any parameter, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific action ('orient yourself in an unfamiliar repository') and exhaustively enumerates the resource it returns: languages, package manager, dependencies, frameworks, scripts, entry points, commands, git state, config files. That content list makes it clearly distinguishable in practice from fs_list, search_files, or git, though no sibling is named explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states a clear use context ('unfamiliar repository', 'ONE call') and contrasts with the alternative approach ('cheaper than exploring the tree by hand'). However it never names a sibling tool or states when not to use it (e.g. when you only need one targeted file read), so no exclusions are given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_filesA

Find files and directories by name glob, size, age or type — the find you would otherwise shell out for, with consistent output on every platform. Sorts by path, size or mtime.

ParametersJSON Schema
NameRequiredDescriptionDefault
globNoOnly these paths, as globs: ["*.ts","src/**/*.js"]. A pattern without "/" matches the basename at any depth.
nameNoRegex on the file name (alternative to glob).
pathNoFile or directory to search. Default: server cwd.
sortNoOrdering. size and mtime sort descending.
typeNoWhat to return. Default file.
limitNoMax entries returned. Default 300.
detailsNoInclude size and mtime. Default true.
excludeNoGlobs to skip.
max_sizeNoOnly entries at most this many bytes.
min_sizeNoOnly entries at least this many bytes.
max_bytesNoByte cap on the returned text. Lower it to save tokens.
max_depthNoRecursion depth. Default 24.
skip_dirsNoDirectory names not to enter.
show_hiddenNoInclude dotfiles.
respect_gitignoreNoHonour .gitignore. Default true.
modified_before_hoursNoOnly entries untouched for at least N hours.
modified_within_hoursNoOnly entries touched in the last N hours.

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden; it usefully discloses cross-platform consistent output and default sort direction, which goes beyond the bare name. However, it never confirms this is a read-only/non-mutating operation, nor mentions traversal safety, performance, or output shape for a 17-param tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single tight sentence with zero filler that front-loads the verb and resource before the differentiator and sort options. Nothing is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 17-parameter tool with no annotations and no output schema, the description is thin — it says nothing about return values or how the many filtering parameters interact. The rich schema compensates somewhat, but the description stops at minimum viability.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema fully documents all 17 parameters, making the baseline 3 appropriate. The description's mention of sorting by path/size/mtime merely restates what the schema already provides and adds no new parameter meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Find) and resource (files and directories) with the full dimension set (name glob, size, age, type). The phrase 'the find you would otherwise shell out for' implicitly distinguishes it from shell_exec/shell_bulk, while the file-oriented framing separates it from the content-oriented search_text sibling.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The 'instead of shelling out for find' line implies usage but never states explicit when-to-use vs the shell_* or search_text siblings. No exclusions, prerequisites, or decision criteria are given, so routing relies on inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_textA

Grep a whole tree: regex (or literal) across files, returning only matching lines with file:line and optional context. Skips .git/node_modules/build dirs and binaries, honours .gitignore. Use files_only=true to just locate files, count_only=true for tallies. Set replace= to rewrite every match (dry_run=true first shows a diff).

ParametersJSON Schema
NameRequiredDescriptionDefault
globNoOnly these paths, as globs: ["*.ts","src/**/*.js"]. A pattern without "/" matches the basename at any depth.
pathNoFile or directory to search. Default: server cwd.
wordNoMatch whole words only.
contextNoLines of context on both sides of each match.
dry_runNoWith replace: show the diff without writing.
excludeNoGlobs to skip.
literalNoTreat pattern as plain text, not a regex.
patternYesRegex to search for (JS syntax), or a literal string when literal=true.
replaceNoReplacement text ($1 backrefs work). Rewrites the files unless dry_run=true.
max_bytesNoByte cap on the returned text. Lower it to save tokens.
max_depthNoRecursion depth. Default 24.
max_filesNoStop after this many files with matches. Default 100.
multilineNoLet the pattern span lines (. matches newline).
skip_dirsNoDirectory names not to enter (replaces the default list).
count_onlyNoReturn just a match count per file.
files_onlyNoReturn just the list of matching file paths — the cheapest mode.
ignore_caseNoCase-insensitive match.
max_resultsNoStop after this many matching lines. Default 200.
show_hiddenNoSearch dotfiles too.
max_file_bytesNoSkip files bigger than this. Default 2000000.
respect_gitignoreNoHonour .gitignore. Default true.

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does well: it discloses the default exclusions (.git/node_modules/build, binaries), .gitignore honouring, and — critically — that replace rewrites files on disk while dry_run only shows a diff. It stops short of stating permission requirements or interaction with respect_gitignore/skip_dirs overrides.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three dense sentences, zero filler, and the core capability plus the two most decision-relevant modes are front-loaded before the riskier replace/dry_run note.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 21-parameter tool with no output schema, the description supplies the essentials an agent needs: what it searches, what it skips, what the output contains, and the one dangerous mode. It is reasonably complete, though it could say more about the interaction between user-supplied skip_dirs/glob/exclude and the built-in defaults.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all 21 parameters thoroughly. The description restates a handful of them (files_only, count_only, replace, dry_run) in workflow terms, which is modest added value, but most parameter meaning lives in the schema and the description adds no syntax or default detail beyond it.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Names a specific verb and resource ("Grep a whole tree") and describes the output shape ("matching lines with file:line and optional context"), which is concrete and unambiguous. It never differentiates itself from the sibling search_files, so an agent must still infer the routing between the two.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit mode-selection guidance: "Use files_only=true to just locate files, count_only=true for tallies" and the replace/dry_run workflow. This covers when to pick each mode, but offers no guidance on when to prefer this tool over siblings like search_files or shell_exec, and no exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

shell_bulkA

Run MANY commands in one call, in order — the token-efficient way to work. Each step supports: delay_before_ms/delay_after_ms, when (condition), expect_exit, retry, on_failure, assign (capture output into a variable) and capture (how much output to return). Conditions and ${...} interpolation can read earlier steps: prev.ok, prev.exit, prev.stdout, step..ok, steps[0].exit, vars., failed_count. Prefer capture="on_failure" for long pipelines: silent on success, full output where it broke.

ParametersJSON Schema
NameRequiredDescriptionDefault
cwdNoWorking directory. Relative paths resolve against the server cwd. Default: server cwd.
envNoExtra environment variables.
varsNoExtra variables for this run, layered over the persistent store. Everything already in the store is readable as vars.<name> without repeating it here.
shellNoOverride shell for this call: auto|bash|gitbash|zsh|fish|sh|cmd|powershell|pwsh|wsl, a configured name, or an absolute path.
stepsYesSteps executed sequentially. A plain string is shorthand for {command: "..."}.
captureNoDefault capture mode for every step. Default full.
timeout_msNoKill the command (whole process tree) after this many ms. 0 = no limit.
max_total_bytesNoTotal output budget for the whole run; later steps get suppressed once spent. Default 40000.
stop_on_failureNoAbort the run at the first failing step. Default true.
max_output_bytesNoByte cap on returned output before middle-truncation. Lower it to save tokens.

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It does disclose meaningful behavior: in-order sequential execution, per-step retry/condition/failure handling, cross-step state reading (prev.*, steps[i], vars.<name>, failed_count), and token-cost tradeoffs via capture. It omits the risky part of the picture: no warning about destructive side effects, no statement of permissions or sandboxing, and no hint about the shape of what comes back. Adequate but incomplete for a shell-execution tool with zero annotation coverage.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four sentences, front-loaded with the core purpose and then the step capabilities and expression namespaces. Dense but readable, with no filler prose. The middle list partially mirrors schema fields, which is slight redundancy, but it earns its place by framing the features before the agent opens the nested schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 10-parameter tool with nested step objects, no output schema and no annotations, the description covers the essential mental model: batching, ordering, per-step conditions, retries, failure policy, variable assignment, and output capture. What is missing is the return structure of a run and explicit positioning against the other shell siblings, but the condition namespaces (prev.ok, failed_count) hint at the result shape.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description still adds value beyond the schema: it enumerates the readable namespaces for conditions and ${...} interpolation (prev.ok, prev.exit, prev.stdout, step.<id>.ok, steps[0].exit, vars.<name>, failed_count), which the schema only gestures at with an example. It also paraphrases assign and capture succinctly, so an agent can grasp the semantics without reading every nested property.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource with a distinguishing scope: 'Run MANY commands in one call, in order', which implicitly separates it from the single-command siblings like shell_exec. It also tags the value proposition ('token-efficient way to work'). It stops short of naming an alternative tool outright, so the differentiation is inferred rather than stated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives one concrete usage preference ('Prefer capture="on_failure" for long pipelines') with the reason why (silent on success, full output where it broke). However, it never says when to choose shell_bulk over shell_exec or shell_exec_async, nor when sequential batching is inappropriate. Usage is implied by the batching framing rather than asserted.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

shell_execA

Run a shell command and wait for it to finish. Returns exit code, stdout and stderr. Full system access via the default shell (or the one you name). Use for anything short-lived.

ParametersJSON Schema
NameRequiredDescriptionDefault
cwdNoWorking directory. Relative paths resolve against the server cwd. Default: server cwd.
envNoExtra environment variables.
loginNoRun through a login shell so ~/.profile aliases and PATH apply.
quietNoReturn only the exit code line, no output. Default false.
shellNoOverride shell for this call: auto|bash|gitbash|zsh|fish|sh|cmd|powershell|pwsh|wsl, a configured name, or an absolute path.
stdinNoText piped to the command on stdin.
assignNoStore the trimmed stdout in the server variable of this name, reusable later as ${vars.<name>} without passing it back. See the vars tool.
commandYesCommand line to run in the shell. Multi-line scripts are supported.
timeout_msNoKill the command (whole process tree) after this many ms. 0 = no limit.
merge_streamsNoReport stderr inside stdout as one block (fewer tokens). Default false.
max_output_bytesNoByte cap on returned output before middle-truncation. Lower it to save tokens.

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden and does disclose meaningful traits: 'Full system access' signals the elevated privilege/risk, and it names the exact return surface (exit code, stdout, stderr) plus the blocking wait. It omits auth/permission requirements and side-effect warnings, so not a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences with the core action, return values, privilege scope, and usage condition all front-loaded. No filler or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an 11-param, mutation-capable tool with no output schema, the description supplies the missing return-value semantics (exit code/stdout/stderr) and the privilege level, while the rich schema covers parameters. It stops short of only because destructive/irreversibility guidance is absent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all 11 parameters in detail. The description adds only 'or the one you name' for the shell override and the return-value surface; it contributes little semantic detail beyond the schema, which is the correct baseline 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('Run a shell command') and scopes it behaviorally with 'wait for it to finish' and 'short-lived', which implicitly separates it from shell_exec_async. It never names the async sibling outright, so it falls just short of full sibling differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Use for anything short-lived' gives clear positive guidance and, combined with 'wait for it to finish', implies that long-running work belongs elsewhere (shell_exec_async/shell_job). No explicit exclusion or named alternative, so it stops short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

shell_exec_asyncA

Start a command in the background and return a job_id immediately. For long builds, dev servers, watchers and tailing logs. Read or stop it later with shell_job.

ParametersJSON Schema
NameRequiredDescriptionDefault
cwdNoWorking directory. Relative paths resolve against the server cwd. Default: server cwd.
envNoExtra environment variables.
nameNoLabel for the job, to recognise it in shell_job list.
loginNoRun through a login shell.
shellNoOverride shell for this call: auto|bash|gitbash|zsh|fish|sh|cmd|powershell|pwsh|wsl, a configured name, or an absolute path.
commandYesCommand line to run in the shell. Multi-line scripts are supported.
timeout_msNoKill the command (whole process tree) after this many ms. 0 = no limit.
interactiveNoKeep stdin open so you can send input with shell_job action="write".

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does disclose key behavior: non-blocking start, immediate job_id return, and lifecycle management via shell_job. It doesn't cover output capture/buffering, resource cleanup, or permission needs, leaving some behavioral gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences, front-loading the core behavior, then use cases, then the follow-up tool. Every sentence earns its place with zero filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, and the description does explain the key return value (job_id) and how to interact with it later via shell_job. Covers the essentials for an 8-param tool; only minor gaps remain around output handling and cleanup.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% – cwd, env, name, login, shell, timeout_ms, and interactive are all documented in the schema. The description adds no parameter-level detail beyond what the schema provides, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a precise verb+resource+behavior ('Start a command in the background and return a job_id immediately'), which clearly distinguishes it from the foreground shell_exec and pairs it with shell_job. An agent knows exactly what this does without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives concrete use cases ('long builds, dev servers, watchers and tailing logs') and names the companion tool shell_job for reading/stopping the job. It does not explicitly state when NOT to use it (e.g., use shell_exec for short/blocking commands), but the async framing implies it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

shell_infoA

Report the environment: platform, server cwd, active shell, which shells are installed, effective config and any active guardrails. Call this once at the start if you need to know what you are driving.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. 'Report' plus 'call this once' implies a safe, idempotent read with no side effects, and it discloses that guardrails and effective config are included. It does not explicitly confirm read-only/no-mutation behavior, nor describe the output shape, so the behavioral picture is only partially filled in.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the scope enumeration and closed with the actionable usage cue. No filler, no restatement of the tool name.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description must convey what comes back, and listing the reported categories (platform, cwd, shell, config, guardrails) does that reasonably well. It could be slightly more explicit about return structure, but an agent has enough to decide to call it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so there is nothing for the description to document beyond what the schema already shows; the baseline of 4 applies. The description correctly does not invent parameter guidance.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Report') and resource ('the environment') and enumerates exactly what is covered: platform, server cwd, active shell, installed shells, effective config, guardrails. It is clearly an inspection tool, though it never explicitly differentiates itself from the nearby sys_info or project_info siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

"Call this once at the start if you need to know what you are driving" gives a clear when-to-use condition and a frequency constraint ('once'). It stops short of naming alternatives (sys_info, vars) that an agent might choose instead for overlapping information.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

shell_jobA

Inspect and control background jobs. actions: list | status | output | write | kill | wait | remove. output/wait can block up to wait_ms until new output appears, so one call replaces a polling loop; pass the returned next_offset back as offset to stream without re-reading what you already saw.

ParametersJSON Schema
NameRequiredDescriptionDefault
dataNoFor action="write": text to send to stdin (add \n yourself).
actionYeslist: all jobs. status: one job without output. output: incremental output. wait: block until the job exits. write: send stdin. kill: terminate. remove: kill and forget.
job_idNoRequired for every action except "list".
offsetNoByte offset to read from (use next_offset from the previous call). Default 0.
signalNoFor action="kill": SIGTERM (default), SIGKILL, SIGINT.
streamNoWhich stream to read. Default combined.
wait_msNoBlock up to this long for new output / for exit. Default 0 (return at once).
max_output_bytesNoByte cap on returned output before middle-truncation. Lower it to save tokens.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden and usefully discloses that output/wait can block up to wait_ms and that offset supports incremental streaming via next_offset. It does not discuss permissions, side effects of kill/remove, or default behavior beyond what the schema already states, but the key blocking and streaming behaviors are surfaced.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three compact sentences: purpose and action list first, then blocking behavior, then offset streaming. Every sentence adds useful information with no repetition or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an eight-parameter control tool with no output schema, the description covers the core mental model and the critical streaming protocol. It leaves some return-value and destructive-action context to the schema, but it is complete enough to invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds meaningful semantics for offset and wait_ms by explaining how next_offset enables streaming without re-reading. It does not explain every parameter, but it improves the most important ones beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Inspect and control background jobs.' It enumerates all seven actions, making clear that this is the job-management tool rather than an execution tool like shell_exec or shell_exec_async.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives clear context for using output and wait, including that blocking up to wait_ms replaces a polling loop and that next_offset should be reused as offset. It does not explicitly name alternatives such as shell_exec_async or state when not to use this tool, so it stops short of full routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sys_infoA

Facts about the machine: overview (default), cpu, memory, disk (free space per mount), network (interfaces), env (environment variables), uptime, user. Read-only.

ParametersJSON Schema
NameRequiredDescriptionDefault
actionNoWhich facts to return. Default overview.
filterNoenv: regex on the variable name, e.g. "^(PATH|NODE)".
max_bytesNoByte cap on returned output.
show_valuesNoenv: include values. Default true; set false to list names only.

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It does disclose "Read-only" and clarifies scope for disk (free space per mount) and network (interfaces), but says nothing about output truncation despite max_bytes, nor about whether env output can expose sensitive values.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence front-loads the resource, then enumerates modes compactly, closing with the safety trait. No filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so describing what each action returns (free space per mount, interfaces, env variables) is the right move and it is done adequately. Minor gaps: no truncation behavior for max_bytes and the omitted "all" mode.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description glosses the enum values (memory, disk, network, env) with short parentheticals, which adds marginal meaning, but filter/show_values/max_bytes semantics live entirely in the schema and the "all" action is never mentioned.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names the resource (machine facts) and enumerates the specific fact categories it returns, so an agent knows exactly what it will get. It does not differentiate itself from plausible siblings such as proc or shell_info, leaving the boundary to inference.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

"overview (default)" implies the common usage path and "Read-only" frames the operation, which is useful implied guidance. There is no explicit when-to-use/when-not guidance and no mention of when a sibling like proc would be preferable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

varsA

Server-side variables that persist between calls, so a value never has to be re-sent through the conversation. Store once, then reference it as ${vars.} in later calls — in a command, cwd, env, a path, a URL, a header, a git message, a bulk step. list shows names, types and sizes but NOT full values (that is the saving). Mark a token secret:true and it stays usable via ${vars.…} while never being echoed back. shell_bulk assign, shell_exec assign and http_request assign all write here.

ParametersJSON Schema
NameRequiredDescriptionDefault
jsonNoload: parse the file as JSON instead of storing it as text.
nameNoVariable name. Letters, digits, _ . - starting with a letter or _.
pathNoload: file to read into the variable. save: file to write the variable to.
textNoappend: the text (or array element) to add.
deltaNoincr: how much to add. Default 1.
namesNoget/delete: act on several names at once.
valueNoset: the value — any JSON type. A string is itself ${...}-expanded, so you can compose from other variables.
actionYesset | get | list | delete | clear | append (to a string/array) | incr (numeric) | load (read a file into a variable) | save (write a variable to a file).
revealNoget: return a secret value in plain text. Only when you actually need to read it.
secretNoset/load: never echo this value back in get or list. It still works in ${vars.…}.
ttl_msNoset: forget the variable after this long.
confirmNoclear: required, since it drops every variable.
max_bytesNoget: byte cap on the returned value.

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden, and it does well: it discloses that list shows names/types/sizes but not full values, that secret:true values remain usable via ${vars.…} while never being echoed, and that clear drops every variable. It omits permission/auth requirements and error behavior, keeping it short of a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, front-loaded with the core concept and followed by reference syntax and behavioral notes. The middle list of contexts is long but each item is informative; little is wasted, though it could be tightened.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 9-action, 13-parameter tool with no output schema, the description covers the crucial cross-cutting behaviors (persistence, reference syntax, secret handling, list redaction) that an agent cannot infer from the schema. The per-action semantics rest on the 100%-covered schema, so the combination is nearly complete; only auth/permission context is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% so the baseline is 3, but the description adds genuine semantics beyond the schema: the ${vars.<name>} expansion syntax, that a set value string is itself ${...}-expanded for composition, and the secret/reveal trade-off. These enrich interpretation rather than merely restating parameter names.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the resource (server-side variables that persist between calls) and its core value proposition (store once, reference via ${vars.<name>}). It conveys the multi-action nature by naming list, secret marking, and the writing tools, though it never frames itself explicitly as an action-dispatched store, so an agent must open the schema to grasp the full action set.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives a clear when-to-use rationale ('so a value never has to be re-sent through the conversation') and enumerates the contexts where references work (command, cwd, env, path, URL, header, git message, bulk step). It also clarifies that secret values are excluded from list output, but gives no explicit when-not-to-use or disambiguation against sibling read/write tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

watchA

Watch a file or directory for changes. start returns a watch_id; poll blocks up to wait_ms for new events and returns them (so one call replaces a polling loop); list shows active watchers; stop ends one. Events are coalesced per path, so a save that fires three times is reported once.

ParametersJSON Schema
NameRequiredDescriptionDefault
globNostart: only report paths matching these globs.
pathNostart: file or directory to watch.
clearNopoll: drop the returned events from the buffer. Default true.
actionYesWhat to do.
excludeNostart: ignore paths matching these globs.
wait_msNopoll: block up to this long for the first event. Default 0 (return at once).
watch_idNopoll/stop: which watcher.
max_bytesNoByte cap on returned output.
recursiveNostart: watch subdirectories. Default true.
settle_msNopoll: after the first event, wait this long for related ones before returning. Default 300.

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does well: it discloses that start returns a watch_id, that poll blocks up to wait_ms, and that events are coalesced per path so a triple-save is reported once. It omits error/failure behavior and permission requirements, so it's strong but not complete.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three dense sentences with no waste, front-loaded with the tool's purpose before the action semantics. Every clause (watch_id return, poll blocking, coalescing) earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 10-parameter, multi-action tool with no annotations and no output schema, the description covers the action lifecycle and key behaviors adequately. It doesn't describe the shape of returned events, but it covers enough for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all ten parameters with per-action notes and defaults. The description adds only the coalescing and blocking semantics, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Watch a file or directory for changes') and enumerates the four sub-actions, so the tool's scope is unmistakable. It doesn't explicitly contrast itself with siblings like fs_list or search_files, which keeps it short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It tells the agent how to use poll effectively ('one call replaces a polling loop') and what each action does, which is genuine usage guidance. However, there is no explicit when-to-use-this-vs-alternatives or when-not, so it stays at implied usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 26 tool updatesv0.1.0
    • First observedarchive
    • First observedcode
    • First observeddiff
    • First observedencode
    • First observedfile_edit
    • First observedfile_read
    • First observedfile_write
    • First observedfs_list
    • First observedfs_op
    • First observedgit
    • First observedhttp_request
    • First observedjson_tool
    • First observednet
    • First observedpkg
    • First observedproc
    • First observedproject_info
    • First observedsearch_files
    • First observedsearch_text
    • First observedshell_bulk
    • First observedshell_exec
    • First observedshell_exec_async
    • First observedshell_info
    • First observedshell_job
    • First observedsys_info
    • First observedvars
    • First observedwatch

TDQS

A3.7/5.0

Scored across 26 tools

Disambiguation4/5

Most tools target a distinct resource or action, and descriptions explicitly clarify usage (e.g. shell_exec vs shell_bulk vs shell_exec_async). However, there are overlapping areas such as shell_info vs sys_info, fs_list vs fs_op stat, and pkg vs project_info that could cause hesitation.

Naming Consistency4/5

All names use lower_snake_case, and multi-word tools follow a clear resource-oriented pattern (file_read, fs_list, http_request, shell_exec). Minor deviations exist: search_text/search_files invert the order to action_resource, and several single-word names (git, net, vars) break the verb_noun expectation.

Tool Count3/5

26 tools is borderline heavy, sitting just above the 25-tool threshold. The breadth of the terminal domain justifies many of them, but there is some redundancy (shell_info/sys_info, fs_list/fs_op, pkg/project_info) that suggests consolidation could reduce the count.

Completeness4/5

Coverage is very broad for a terminal server: shell execution, filesystem, git, process management, networking, HTTP, packages, code introspection, JSON, diffing, encoding, archives, and watching. Missing or thin areas include remote/SSH operations, service/daemon management, and structured config formats beyond JSON, but agents can work around these via shell_exec.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    D
    maintenance
    Enables AI agents to SSH into Linux servers, run commands, deploy code, and manage servers via natural language, also doubles as a CLI for manual use.
    3
    MIT
  • A
    license
    B
    quality
    B
    maintenance
    Enables AI tools to perform server operations such as log inspection, system monitoring, code management, Nginx and certificate management, with support for local and remote SSH modes and built-in security controls.
    23
    200
    MIT