Skip to main content
Glama

docker-mcp-server

docker-mcp MCP server

More than just a fully featured MCP server that lets AI agents manage Docker - containers, images, networks, volumes, swarm services, secrets, configs, nodes, plugins, etc., it helps you create workflows to easily manage your Docker environments.

It gives you much more control and flexibility than calling the Docker CLI directly: each operation is exposed as its own typed tool, marked read-only or not, with destructive actions separately flagged. This means a client can auto-approve reads while always confirming anything destructive, and the whole server can also be switched into a read-only or no-destructive mode as a blanket safeguard. Output is bounded rather than left to grow unboundedly - capped with a truncated flag instead of silently overflowing the agent's context.

For simple cases, you can just install and go with no configuration required - once loaded it will discover your local Docker socket and expose the full command surface to your AI agent. For more advanced users it can manage multiple Docker daemons, e.g. both your local dev environment and also a remote production environment over TCP, TLS or SSH in a single session. It can also be configured to mark some daemons as read-only, so you can monitor them without the risk of making accidental changes.

It can even be run on a machine without Docker installed and manage remote daemons over SSH, TLS or TCP (some features require SSH). The AI itself does not require shell or SSH access.

The MCP server also exposes things like logs and stats as resources so that you can monitor and triage, enabling you to answer questions like 'why did my container crash?', 'what is the state of my swarm?', 'am I suffering memory pressure?', 'what is the disk usage of my volumes?', 'what differences are there between my test and production systems?', and more...

Documentation is built for the agent, not just the person configuring it: an MCP resource exposes the Docker SDK reference in-session (with a tool-callable fallback for clients that can't read resources), and a live tool-catalog resource reports exactly what's registered under the current configuration. Each tool's own description names its nearest siblings and when to prefer each, states preconditions and side effects in plain language, and is honest about when it can still fail - so an agent can pick the right tool on the first try among 150+ options, not guess.

docker-mcp-server is optimized to work efficiently with the new generation of MCP clients that support lazy tool loading. For clients that still eagerly load all tools, the server can optionally be configured to exclude tools from a subset of domains (e.g. exclude 'swarm' and 'scout' tools) to reduce the tool list size. It's also possible to put the MCP server into 'read-only' or 'no-destructive' modes that prevent any tools with write or destructive capabilities from being registered, which again reduces the footprint.

The server runs entirely on your machine, either natively, as an mcpb bundle, or containerized, and sends no telemetry. You are entirely in control - see the Privacy Policy.

Requirements

Note: If you're using the containerized MCP server or MCPB bundle, the Python and uv requirements are taken care of for you.

  • A running Docker daemon reachable from the host that runs the server (the standard DOCKER_HOST / unix socket conventions apply)

  • Python ≥ 3.14

  • uv for dependency management

  • Intel (x86_64) macOS only: installing natively (via uvx/pip, or the .mcpb bundle, both of which resolve dependencies locally) requires Rust and OpenSSL 3.x, because cryptography - a transitive dependency, via mcp -> pyjwt[crypto] - has shipped no x86_64 macOS wheel since version 49.0.0 and must be built from source there. If you'd rather not install a build toolchain, use the container image instead - it runs the same prebuilt Linux binary regardless of your Mac's CPU architecture, so this doesn't apply to it. See Security considerations for more.

Related MCP server: Docker MCP Server

Using the server

The server is published to PyPI as docker-mcp-server. Add an entry to your AI tool's MCP configuration (commonly mcp.json or the equivalent in your client) pointing uvx at it - uv will fetch and cache the package on first use:

{
  "mcpServers": {
    "docker-mcp-server": {
      "command": "uvx",
      "args": ["docker-mcp-server"],
      "env": {}
    }
  }
}

To pin a specific version, append ==<version> to the package name (e.g. docker-mcp-server==1.5.0). If you'd rather install it onto your PATH, pipx install docker-mcp-server gives you the docker-mcp-server console script (a docker-mcp alias is also installed).

Installing from git instead. To run an unreleased revision straight from this repository:

{
  "mcpServers": {
    "docker-mcp-server": {
      "command": "uvx",
      "args": [
        "--from",
        "git+https://github.com/L337-org/docker-mcp.git",
        "docker-mcp-server"
      ],
      "env": {}
    }
  }
}

To pin a specific revision, append @<tag-or-commit> to the git URL.

Install as a Desktop Extension (.mcpb)

For Claude Desktop, a one-click bundle is attached to each GitHub Release as docker-mcp-server-<version>.mcpb (with a matching .sha256). Download it and drag it into Settings > Extensions, or use Settings > Extensions > Advanced settings > Install extension... and pick the file. The install dialog surfaces a Docker host(s) field and the read-only / no-destructive / disabled-domain switches, so no manual JSON editing is needed.

It's a uv-type bundle: Claude Desktop's managed uv resolves the dependencies and runs the server, so the only host prerequisite is Docker itself - no separate Python, uv, or git. Leave the Docker host(s) field blank to use your default Docker context; set one endpoint (ssh://user@host) for a remote daemon, or list several (see Managing several daemons).

Run as a container

Running the server as a container removes the Python / uv / git prerequisites entirely - the only thing the host needs is Docker, which you already have. Prebuilt multi-arch images (linux/amd64 + linux/arm64) are published on each release to Docker Hub (gavinlucas/docker-mcp-server) and GHCR (ghcr.io/l337-org/docker-mcp-server) - the two are identical. Point your MCP client at docker run:

{
  "mcpServers": {
    "docker-mcp-server": {
      "command": "docker",
      "args": [
        "run", "--rm", "-i",
        "-v", "/var/run/docker.sock:/var/run/docker.sock",
        "gavinlucas/docker-mcp-server:latest"
      ],
      "env": {}
    }
  }
}

-i is required (the server speaks MCP over stdio); --rm cleans up when the client disconnects. To pin a version, replace :latest with a release tag (e.g. :1.5.1). To pull from GHCR instead, use ghcr.io/l337-org/docker-mcp-server:latest.

Image renamed. As of 1.5.0 the image is published as docker-mcp-server (matching the PyPI name). The old ghcr.io/gavinlucas/docker-mcp image is frozen at 1.4.0 and no longer updated - point new pulls at ghcr.io/l337-org/docker-mcp-server.

Image variants. Two variants are published to both registries (gavinlucas/docker-mcp-server on Docker Hub and ghcr.io/l337-org/docker-mcp-server on GHCR), both built from one Dockerfile. The CLI-backed domains (Compose, Stack, Buildx, Scout, Context) shell out to the docker CLI and its plugins.

Variant

Tags

Approx. size

Includes

full (default)

:latest, :<version>

~510 MB

docker CLI + compose + buildx + scout

no-scout

:no-scout, :<version>-no-scout

~315 MB

docker CLI + compose + buildx

Scout's plugin binary alone accounts for the ~195 MB jump from no-scout to full. The no-scout image also defaults DOCKER_MCP_SERVER_DISABLE=scout, so the scout tools don't register - the agent is never offered tools whose CLI plugin isn't present (it sees a smaller, fully-working tool list rather than scout tools that error on every call). Override at runtime with -e DOCKER_MCP_SERVER_DISABLE=... if you ever need to change the disabled set (note it replaces, not appends).

Building it yourself. All variants build from the repo's Dockerfile via build args:

docker build -t docker-mcp-server:full .                                    # full (default)
docker build --build-arg INSTALL_SCOUT=0 --build-arg DISABLE_DOMAINS=scout \
  -t docker-mcp-server:no-scout .                                           # no-scout
docker build --build-arg INSTALL_CLI=0 -t docker-mcp-server:lite .          # lite (SDK-only, ~165 MB)

The lite image (docker-py SDK tools only - Compose/Buildx/Scout/Context degrade to "plugin unavailable") is buildable but not published.

Reaching the daemon from inside the container. The image defaults DOCKER_HOST to unix:///var/run/docker.sock, so mounting your host's socket onto that path is all that's needed. Where the host socket is, however, varies - and the server prints a platform-aware hint to stderr if it can't connect at startup:

  • Linux: -v /var/run/docker.sock:/var/run/docker.sock (rootless: -v $XDG_RUNTIME_DIR/docker.sock:/var/run/docker.sock).

  • macOS (Docker Desktop): the real socket is usually ~/.docker/run/docker.sock - mount it onto the in-container path: -v $HOME/.docker/run/docker.sock:/var/run/docker.sock (or enable Settings > Advanced > Allow the default Docker socket and use /var/run/docker.sock).

  • Windows (Docker Desktop / WSL2): the engine uses a named pipe, not a Unix socket - prefer -e DOCKER_HOST=tcp://host.docker.internal:2375 (enable the TCP endpoint in Docker Desktop). That endpoint is unauthenticated and unencrypted - keep it bound to localhost, disable it when you're not using it, and use TLS or DOCKER_HOST=ssh://... for any remote daemon.

  • Remote / TLS / SSH daemon: skip the socket mount and pass -e DOCKER_HOST=... (plus the TLS vars below) - see Talking to a remote daemon.

Host filesystem access. Inside a container, the file-path tools (image_save / container_export with dest_path, image_load / container_archive_put with from_file, container_archive_get_to_file, and compose project_dir / files) resolve paths inside the container, not on your host. Bind-mount any directory you want to exchange files through - using the same path inside and out keeps host and container paths identical:

-v $HOME/docker-work:$HOME/docker-work

If you call one of these tools with a path that isn't on a bind mount, the server refuses up front with a message telling you exactly which -v to add - a write to an unmapped path would otherwise be silently discarded when the container exits. (The in-band byte tools, capped at 32 MiB, need no mount.) Configuration env vars (DOCKER_MCP_SERVER_READONLY, DOCKER_HOST, etc.) go in the client's env block exactly as for the uvx install.

Talking to a remote daemon

When DOCKER_HOST is set the server uses it directly (via docker.from_env(), so DOCKER_TLS_VERIFY / DOCKER_CERT_PATH are honoured too). Common overrides via env:

"env": {
  "DOCKER_HOST": "tcp://remote-host:2375",
  "DOCKER_TLS_VERIFY": "1",
  "DOCKER_CERT_PATH": "/path/to/certs"
}

Default daemon (no DOCKER_HOST). With DOCKER_HOST unset, the server resolves the daemon the way the docker CLI does, rather than assuming /var/run/docker.sock: it follows the active Docker context (DOCKER_CONTEXT, else currentContext from ~/.docker/config.json, reading the endpoint from that context's meta.json), and if that yields nothing it probes the well-known socket locations (~/.docker/run/docker.sock for Docker Desktop 4.13+, $XDG_RUNTIME_DIR/docker.sock for rootless, then /var/run/docker.sock). This matters because docker.from_env() alone ignores contexts and would fall back to /var/run/docker.sock - which Docker Desktop 4.13+ no longer creates by default (it uses the desktop-linux context unless you enable Settings > Advanced > Allow the default Docker socket), so a stock Desktop install reachable by your CLI would otherwise fail here. Precedence: a non-empty DOCKER_HOST always wins and goes straight through docker.from_env() (which ignores contexts); DOCKER_CONTEXT / currentContext is consulted only when DOCKER_HOST is unset, and the socket probe only when neither resolves. TLS material attached to a remote context is not applied automatically - a tcp:// + TLS context still needs DOCKER_HOST / DOCKER_CERT_PATH.

Over SSH

DOCKER_HOST=ssh://user@remote-host is supported via a pure-Python transport (paramiko, pulled in by the docker[ssh] dependency) - there is no system ssh binary requirement, so it works the same on the host install and inside the container images. It authenticates with your normal SSH setup:

  • Keys / agent. Use key-based auth; load the key into your agent (ssh-add) and make sure SSH_AUTH_SOCK is set in the server's environment (or place the key at the default ~/.ssh/id_* path).

  • Known hosts. paramiko verifies the host key against ~/.ssh/known_hosts and rejects an unknown host. Add the host key only after verifying its fingerprint through a trusted channel - connect once interactively with ssh user@remote-host and confirm the prompt, or compare ssh-keyscan remote-host | ssh-keygen -lf - against a known-good fingerprint before appending it. Avoid blindly piping ssh-keyscan straight into known_hosts, which trusts whatever key is returned (including a MITM's).

  • In a container. Mount your SSH material read-only - -v $HOME/.ssh:/root/.ssh:ro (key + known_hosts) - or forward your agent socket; no socket mount and no ssh package needed.

CLI-backed tools (Compose, Stack, Buildx, Scout, Context) shell out to the docker CLI, which would otherwise use the system ssh binary over an ssh:// endpoint. Instead, run_docker() detects DOCKER_HOST=ssh://... and transparently starts a per-call local TCP proxy (docker_mcp/tools/_ssh_proxy.py) that opens the same paramiko connection docker-py would, runs docker system dial-stdio over it, and points the CLI subprocess at tcp://127.0.0.1:<ephemeral port> for the duration of that one call. So the CLI-backed tools authenticate with the exact same credentials and host-key policy as the docker-py-backed tools above - no system ssh binary for the direct connection, identical on the host install and inside the container images. The one exception is a ProxyCommand in ~/.ssh/config (bastion/jump-host setups): paramiko runs that command as-given, and it's commonly ssh -W %h:%p ..., so a jump-host hop still shells out to the system ssh client even though the direct connection does not.

That ephemeral 127.0.0.1 listener bridges to the remote (root-equivalent) daemon with your SSH credentials for the duration of a single CLI call, so any process sharing the same loopback could reach it during that brief window. The exposure is narrow - localhost-only and torn down when the call returns - and inside a container it's narrower still, reachable only by processes within that container's network namespace. The daemon remains the trust boundary either way (see Security considerations).

No local Docker

If Docker is not installed locally - or the plugin a call needs is missing - most tools will still operate on a remote host exactly as before. A few tool families (Compose, Stack, Buildx, Scout) will be run on the target host itself, over SSH. For these commands TCP and TLS connections will not work without a local Docker install.

Worth knowing:

  • It's a fallback, never a preference. A local CLI that can serve the call - binary plus the plugin that call needs - is always used instead, so nothing changes for a normal install.

  • Local files a command reads are copied onto the remote first - a Compose project directory, a bake file, a build context (honouring .dockerignore) - into a private 0700 temp directory that is removed when the call returns - best-effort, since a dropped SSH connection leaves nothing able to run the cleanup. A survivor is named docker-mcp-server.stage.* and the failure is logged.

  • The remote host's credentials apply. Registry logins come from its ~/.docker/config.json, so a private-registry compose_pull, a stack deploy --with-registry-auth, or most Scout operations may need docker login there. system_login talks to the daemon and does not write the remote CLI's config.

  • The whole working directory is copied, because nothing can tell which files a Compose file references (build:, env_file:, include: all name arbitrary paths). Point tools at a project directory rather than a large parent, or the call is refused with a size-limit error (200 MiB / 50 000 entries).

  • compose_cp relays whichever side of the copy is local, over the same SSH connection: a host source is staged like any other input, and a container result is fetched back to the real destination once the copy succeeds - the actual copy still runs through the real docker compose cp on the far host, so every parameter behaves as it does locally. The one difference: a container-to-host copy is refused if the local destination already exists, since only this host knows that.

  • A few things are refused rather than half-done: for buildx_build a filesystem dest= in output/cache_to, a local src= in cache_from, or any ssh= - each would resolve on the remote machine.

  • The remote must present a POSIX shell. Any Linux/macOS/BSD host qualifies, and sshd running inside a WSL distro is supported (it is a Linux target - and with Docker Desktop's WSL2 backend the daemon lives there anyway). A Windows-side cmd/PowerShell sshd is refused with an explanatory error, as is a uname from MSYS/MinGW/Cygwin; a Windows dialect is architected but not implemented. A Windows sshd whose shell is wsl.exe runs commands in WSL while its SFTP subsystem stays on the Windows side, so file-copying tools are refused there - the ones that only run a command still work.

  • context_* tools never fall back. They manage this host's CLI context registry, which a remote host knows nothing about.

Managing several daemons

Everything above targets one daemon. To manage several in a single session - e.g. local dev plus a remote production daemon - set DOCKER_MCP_SERVER_HOSTS to a comma-separated list of name=endpoint pairs:

"env": {
  "DOCKER_MCP_SERVER_HOSTS": "local=auto, prod=ssh://ops@prod.example.com(ro)"
}
  • endpoint is auto (your default context/socket, as above), local (the platform-local socket, ignoring contexts), or a unix:// / tcp:// / ssh:// / npipe:// URL. ssh:// is the recommended remote transport (per-host auth via your SSH keys, no TLS cert plumbing). A tcp:// daemon over TLS takes a (tls=<dir>) marker pointing at a cert directory, e.g. prod=tcp://prod:2376(tls=/etc/docker/prod). That directory must hold ca.pem (the daemon is always verified against it - so a self-signed daemon works, you just pin its cert here); add cert.pem and key.pem only if the daemon requires a client certificate (mutual TLS). There is no unverified-TLS mode - a TLS connection always authenticates the daemon, so encryption never comes without verification.

  • (ro) after an endpoint marks that host read-only: mutating and destructive tools refuse to act on it. This is a per-host guard enforced at call time, independent of the server-wide DOCKER_MCP_SERVER_READONLY switch - mark production (ro) and the agent can inspect it all day but can't change it, while local stays read-write.

  • (nd) marks a host non-destructive: only destructive tools (removals, prunes, kills) refuse to act on it - reads and ordinary mutations (start/stop/create) still work. This mirrors the server-wide DOCKER_MCP_SERVER_NO_DESTRUCTIVE switch, per host. (ro) already implies it, so (ro)(nd) combines without error but is redundant.

  • Single daemon, simpler form. A bare value with no name= is shorthand for one host - DOCKER_MCP_SERVER_HOSTS=ssh://ops@prod (or auto, or blank). So this one field also covers the single-remote case. DOCKER_HOST keeps working when DOCKER_MCP_SERVER_HOSTS is unset, but DOCKER_MCP_SERVER_HOSTS takes over when set (DOCKER_HOST is then ignored, with a one-time notice to stderr).

How the agent drives it. With two or more hosts, every daemon-targeting tool gains an optional host argument constrained to your configured names: read-only tools default to the first host when you omit it, while mutating and destructive tools require an explicit host (so the agent can't change the wrong daemon by accident). host_list (and the docker-mcp://hosts resource) report the configured hosts and which is the default; the container/service observability resources become host-aware - the default host's log tail is docker-logs:///{id} (note the empty authority) and a named host's is docker-logs://{host}/{id}, with the same pattern for docker-stats://, service-logs:// and service-tasks://; the single-host bare forms (docker-logs://{id}, ...) are not registered once several hosts are configured. The survey_hosts prompt sweeps every host read-only. The auto/local endpoints are resolved to concrete URLs and pinned at startup, so the SDK and CLI always agree on which daemon a name means - restart to re-resolve after changing a Docker context.

What the agent can do

Once loaded, the agent gets MCP tools grouped by Docker domain. A few examples:

  • Containers - container_run, container_list (managed_only=True to list only what this server created - see Provenance labels), container_exec, container_logs, container_stop, container_commit, container_wait (block until exit, until="healthy" to poll a healthcheck, or until="log-match" to poll for a log line containing pattern), container_export / container_archive_get_to_file / container_archive_put (stream tar archives to/from a host path)

  • Images - image_build, image_pull, image_push, image_tag, image_prune, image_prune_builds (clear the daemon's build cache - a separate resource from dangling images), image_save / image_load (stream image tarballs to/from a host path via dest_path / from_file), image_import (build a single-layer image from a flat rootfs tarball, URL, or existing image - docker import, not to be confused with image_load)

  • Plugins - plugin_install (pull from a registry), plugin_privileges (read what host access a plugin demands before installing it - the daemon grants them non-interactively), plugin_create (build one from a local config.json + rootfs), plugin_push (publish it back), plugin_enable / plugin_disable, plugin_configure, plugin_upgrade, plugin_list / plugin_inspect, plugin_remove (managed engine plugins - volume/network/logging drivers - not the CLI plugins that extend the docker command itself)

  • Networks / Volumes - network_create, network_connect, volume_create, volume_prune

  • Swarm - swarm_init, swarm_join_tokens (close the init-to-join loop), swarm_update (rotate join tokens / unlock key), service_create, service_scale, service_rollback (re-apply the previous service spec), service_wait (block until tasks converge, or a rolling update completes), swarm_task_list / swarm_task_inspect (every task in the cluster, filterable by node or desired state - no single CLI command does this), node_list, node_wait (block until a node reaches a target state - e.g. ready after joining), node_remove, secret_create, config_create

  • System - system_ping, system_info, system_version, system_df, system_events, host_list (the configured daemons and which is the default - see Managing several daemons), system_login / system_logout (cache or clear registry credentials), system_reconnect (rebuild a host's SDK client to recover a wedged connection)

  • Compose - compose_up, compose_down, compose_stop, compose_start, compose_restart, compose_pause / compose_unpause, compose_kill, compose_ps, compose_list, compose_images, compose_top, compose_port, compose_logs, compose_config, compose_build, compose_pull, compose_run, compose_exec, compose_cp, compose_wait (wraps the docker compose CLI plugin)

  • Stacks - stack_deploy, stack_list, stack_ps, stack_services, stack_remove (deploy a Compose file to a swarm as a stack; wraps the docker stack CLI - requires a swarm manager)

  • Contexts - context_list, context_inspect, context_create, context_use, context_remove (wraps the docker context CLI)

  • Registry / Hub - registry_tags, registry_tag_wait (block until a specific tag lands - e.g. waiting on a CI push), registry_manifest, registry_image_config (read an image's env/entrypoint/labels without pulling), hub_tags, hub_repo_info, hub_rate_limit (remaining pull budget) (HTTPS to OCI v2 registries and the Docker Hub API - no daemon required; transparent retry on a brief 429)

  • Buildx - buildx_build, buildx_bake, buildx_imagetools_inspect, buildx_imagetools_create, buildx_list, buildx_inspect, buildx_du, buildx_history_list / buildx_history_inspect (drill into past build records), buildx_prune, buildx_create, buildx_use, buildx_remove (wraps the docker buildx CLI plugin). Use buildx_imagetools_* in place of docker manifest - that command is in maintenance mode and lacks support for OCI image indexes and attestations.

  • Scout - scout_cves, scout_quickview, scout_recommendations, scout_compare, scout_sbom (wraps the docker scout CLI plugin; most features benefit from docker login on the host running this server).

The SDK-backed surface mirrors the Docker SDK reference - if it's documented there, it's available here. The Compose and Context surfaces follow the Compose CLI and docker context references.

The server also publishes the Docker SDK for Python reference and selected Docker CLI / registry references as MCP resources so the agent can consult them at runtime: read docker-docs://contents for the section index, then docker-docs://<section> (e.g. docker-docs://containers, docker-docs://compose, docker-docs://oci-distribution-spec, docker-docs://dockerfile, docker-docs://build-best-practices, docker-docs://engine-security, docker-docs://engine-api) for the rendered page. For MCP clients that can't read resources (e.g. Claude Desktop, Cursor), the docs_lookup tool mirrors the same content - call it with no arguments for the section index, or docs_lookup(section=...) for a page; it's always available regardless of DOCKER_MCP_SERVER_DISABLE. A further resource, docker-mcp://tool-catalog, lists every tool this server knows about with its domain, mutation category, and whether the active configuration registered it - useful for confirming the blast radius of a tool, or why one is absent from the live list. The tool_list tool mirrors it for clients that can't read resources, and adds filtering: tool_list(domain="buildx") for a one-line-per-tool briefing on an area, tool_list(category="destructive") to see what can destroy data, or tool_list(keyword="logs") to search names, summaries and parameter names. It lists only what the current configuration registered, and returns an explicit empty result when nothing matches. Like docs_lookup it is always available regardless of DOCKER_MCP_SERVER_DISABLE.

Container and service observability is also exposed as resources, so a client can attach live state as context without a tool call: docker-logs://<id-or-name> for a bounded tail of a container's logs (readable even after it exits - handy for diagnosing why) and docker-stats://<id-or-name> for a computed resource-usage summary (CPU %, memory, network and block I/O) of a running container. Swarm services get the same pattern - service-logs://<id-or-name> for a bounded log tail and service-tasks://<id-or-name> for a computed task/rollout summary (running vs. desired task counts, failing tasks, and the current rolling-update state). Enumerate with container_list / service_list to find the id or name to plug in. These complement the equivalent tools (container_logs/container_stats, service_logs) and are hidden when their domain (containers/services) is disabled.

Example prompts

Many AI clients let you invoke registered MCP prompts directly (in Claude Code, type / to see them). The server ships a small library of templates in docker_mcp/tools/prompts.py that scaffold multi-step workflows - they emit a structured plan that the agent then carries out using the docker tools.

Looking things up in the SDK docs

/lookup_docker_docs section=services
/verify_docker_method method=containers.run section=containers

...or just ask in plain English:

Read docker-docs://networks and tell me the difference between create and connect. Before changing any code, check docker-docs://containers and confirm run accepts a restart_policy argument.

Creating and managing containers

/deploy_container image=nginx:1.27 name=web
/monitor_container_fleet
/triage_incident window_minutes=30
/troubleshoot_container container=api-1
/migrate_container container=api-1 new_image=myorg/api:v2
/inspect_stack label=com.example.app=web
/clean_environment scope=stopped
/plan_compose_stack description="wordpress + mysql sharing a named volume"

Compose, contexts, and registries

/deploy_compose_project project_dir=/srv/myapp
/troubleshoot_compose_project project_dir=/srv/myapp
/deploy_swarm_stack stack_name=web compose_file=/srv/myapp/docker-stack.yml
/audit_docker_contexts
/find_latest_image_tag image=ghcr.io/org/repo

Auditing, security, and host operations

/review_dockerfile dockerfile_path=/srv/myapp/Dockerfile
/audit_container_security
/debug_container_networking source=web target=db
/investigate_disk_usage
/backup_volume volume=pgdata dest_path=/backups/pgdata.tar
/restore_volume volume=pgdata source_path=/backups/pgdata.tar
/audit_swarm_health

Buildx, Scout, and multi-arch manifests

/plan_multiarch_build image=ghcr.io/org/app:v1 platforms=linux/amd64,linux/arm64
/audit_image_cves image=alpine:3.19
/compare_image_versions old_image=org/app:v1 new_image=org/app:v2
/recommend_base_image image=org/app:v1
/inspect_multiarch_manifest image=alpine:3.19
/create_multiarch_manifest target_tag=org/app:v1 source_tags=org/app:v1-amd64,org/app:v1-arm64
/migrate_from_docker_manifest

...or in plain English:

Pull redis:7-alpine and run it as a container called cache on a new app-net network, exposing port 6379 only inside that network. Container api-1 keeps restarting - grab the last 200 log lines, inspect its state and exit code, and tell me what's wrong before changing anything. Replace the running web container with nginx:1.27 while keeping its current ports, mounts, and restart policy. Plan a wordpress + mysql stack on a private network with a named volume for the database. Show me the plan before creating anything. Show every container, network, and volume tagged com.example.app=web as one table. Don't change anything. We're tight on disk - show system_df, prune stopped containers and dangling images, then show system_df again. Skip volumes. Bring up the compose project in /srv/myapp, but show me the rendered config and pull the images before starting anything. List my Docker contexts and tell me which daemon this MCP server is currently talking to. Find the most recent stable tag for ghcr.io/org/repo without pulling it, and tell me which platforms it supports.

Configuration

Env var naming. The server's environment variables are namespaced DOCKER_MCP_SERVER_* to match the published package name. The pre-2.0 DOCKER_MCP_* alias spellings are no longer honoured - see MIGRATION-2.0.md for the full 1.x -> 2.0 change list.

To choose which daemon(s) the server talks to, see Talking to a remote daemon and Managing several daemons (DOCKER_MCP_SERVER_HOSTS / DOCKER_HOST). The variables below instead restrict which tools are registered.

Three environment variables restrict which tools are registered when the server starts. Because they drop tools at registration time, a disabled tool never appears in the client's tool list - this is a server-side guarantee, not a client-side prompt. Set the two boolean switches to 1 / true / yes / on:

  • DOCKER_MCP_SERVER_READONLY - register only read-only tools (queries, log/data reads, scans). Every tool that changes state is omitted. Use this for monitoring or inspection agents that must not be able to modify anything.

  • DOCKER_MCP_SERVER_NO_DESTRUCTIVE - register everything except destructive tools (remove_*, prune_*, container_kill, compose_down, swarm_leave, context_remove, buildx_prune, buildx_remove). A "no data loss" mode that still allows creating and starting resources. DOCKER_MCP_SERVER_READONLY is stricter and wins if both are set.

  • DOCKER_MCP_SERVER_DISABLE - a comma-separated list of domains (feature areas) to drop wholesale, regardless of category: e.g. DOCKER_MCP_SERVER_DISABLE=swarm,services,nodes,configs,secrets removes the entire swarm surface from a single-host server, and DOCKER_MCP_SERVER_DISABLE=scout,buildx trims build/scan tooling an agent will never use. A domain is a tool module's name - containers, images, networks, volumes, compose, stack, context, buildx, scout, registry, swarm, services, nodes, plugins, configs, secrets, system. Names are case-insensitive; an unrecognized name is ignored (and surfaced as unknown_disabled_domains in the tool catalog, see below). This stacks with the category switches - a tool registers only if its category survives and its domain is enabled. Disabling a domain drops more than its tools: the matching workflow prompts are skipped (so the agent isn't handed a prompt that drives a feature area this server no longer exposes - e.g. disabling scout removes the audit_image_cves prompt that would otherwise tell the agent to call a tool that isn't registered) and the matching documentation resources are hidden from docker-docs://contents (e.g. the scout / scout-cli sections). The tool catalog's prompts list and disabled_doc_sections field make both auditable. Trimming domains an agent doesn't need also cuts the tool-list size the client has to reason about, which matters at this server's ~150-tool scale.

None of the three is a network control. DOCKER_MCP_SERVER_READONLY restricts what the agent can change, not what the server can reach: the registry and Hub tools are read-only, so a read-only server still makes outbound HTTPS requests to whichever registry host a tool argument names - from wherever the server runs, which may be a machine with more network reach than the daemon it manages. Those requests carry no credentials unless the registry answers with a token challenge, and a credential-bearing token endpoint is validated first (scheme, no plaintext to a public host, and no public registry pointing its realm at a private or loopback address), but the request itself is still made and its response is returned to the agent. docs_lookup and the docker-docs:// resources likewise fetch from a fixed list of documentation hosts. If outbound requests are what you need to stop, DOCKER_MCP_SERVER_DISABLE=registry removes that domain entirely, and network policy on the host is the control for the rest - see PRIVACY.md for the full list of what this server contacts.

Independently, every registered tool carries MCP ToolAnnotations - readOnlyHint on queries and destructiveHint on destructive operations (plus idempotentHint on the prune family) - so a client like Claude Code can auto-allow safe reads and gate destructive calls. The classification lives in TOOL_CATEGORIES in docker_mcp/server.py. To see the full picture at runtime - every tool with its domain, category, and whether the active switches registered it - read the docker-mcp://tool-catalog MCP resource.

For private registries, the HTTPS-backed registry_* tools fall back to DOCKER_MCP_SERVER_REGISTRY_USERNAME / DOCKER_MCP_SERVER_REGISTRY_PASSWORD from the server's environment when no explicit username/password arguments are passed (explicit arguments win; the env pair is only used when both arguments are unset). Setting credentials in the environment keeps them out of tool arguments, which many MCP clients log verbatim - the password may be a personal-access token.

Provenance labels

Every Docker object the agent creates through this server - containers, networks, volumes, swarm services, configs, and secrets - is stamped with a small set of docker-mcp-server.* labels recording that this server made it (docker-mcp-server.managed=true), the server version, the originating tool, and a creation timestamp. This lets you (or a cleanup job) later enumerate exactly the footprint the agent created with a single docker ... --filter label=docker-mcp-server.managed=true; the managed_only=True argument on container_list, network_list, volume_list, and service_list is the in-tool shortcut (it combines with any other filters you pass). The stamping is additive (a label you pass yourself always wins on a key collision) and uniquely namespaced, so it's safe by default; DOCKER_MCP_SERVER_NO_LABELS=1 turns it off entirely. Image builds are deliberately not stamped, because a build label changes the resulting image digest.

To tear down only what the server created - and nothing else - use the prune_managed workflow prompt, which scopes every removal step to the docker-mcp-server.managed=true label (volumes only when you pass include_volumes=True, and only after confirmation).

Example: a read-only monitoring server

All of these go in the env block of the server entry in your MCP client config (the same place as DOCKER_HOST above). For example, a read-only inspection server against a remote daemon:

{
  "mcpServers": {
    "docker-mcp-server-readonly": {
      "command": "uvx",
      "args": [
        "--from",
        "git+https://github.com/L337-org/docker-mcp.git",
        "docker-mcp-server"
      ],
      "env": {
        "DOCKER_HOST": "tcp://staging-host:2376",
        "DOCKER_TLS_VERIFY": "1",
        "DOCKER_MCP_SERVER_READONLY": "1"
      }
    }
  }
}

Swap DOCKER_MCP_SERVER_READONLY for DOCKER_MCP_SERVER_NO_DESTRUCTIVE to allow create/start/deploy while still making remove_* / prune_* / container_kill impossible. You can also register the same server twice under different names - a full-access entry you enable when needed and a read-only entry for everyday use. With claude mcp (Claude Code), the equivalent is:

claude mcp add docker-mcp-server-readonly \
  --env DOCKER_MCP_SERVER_READONLY=1 \
  -- uvx --from git+https://github.com/L337-org/docker-mcp.git docker-mcp-server

Or don't use a server at all: the l337-docker agent skill

A fair question about any MCP server is whether it needs to be one. This repo answers it in the open: skills/l337-docker/ is a Claude Code agent skill that drives Docker purely through the docker CLI - no server process, no Python, nothing beyond a docker binary (plus jq and curl for a few registry recipes).

It exists to mark the ceiling of the skill approach honestly, so you can judge the trade rather than take our word for it. It is written to be as good as that approach gets: a router plus per-domain references and workflows, every command verified against a real daemon, and its shell snippets executed by CI so they cannot drift. For a single local daemon and everyday work, it may well be all you need - if so, use it.

Where it stops is not coverage but enforcement. The skill's safety rules are instructions in a prompt; the server's are refusals in code:

MCP server

l337-docker skill

Read-only / no-destructive modes

Enforced - the tools are never registered

A written rule the agent is asked to follow

Per-daemon write protection ((ro)/(nd))

Enforced at the call boundary

Not available

Self-termination guard

Enforced

A written rule

Output bounding

Enforced, with a truncated flag

A written rule (--tail, --no-stream)

Multi-daemon targeting

Resolved and pinned at startup

Ambient Docker contexts, which can move mid-session

Requirements

Python ≥3.14, or a container

A docker binary

The distinction matters most where it is easiest to overlook: a rule in a prompt can be skipped under pressure, or talked around by a prompt injection sitting in a container log the agent just read. A tool that was never registered cannot be called at all. So prefer the server for anything pointed at production, or wherever you need a guarantee rather than an instruction - and prefer the skill when the stakes are low and the simplicity is worth more.

MCP_VS_SKILLS.md is the full, honest comparison: measured token cost for both - the skill is far cheaper on an eager-loading client (~140 tokens idle against the server's ~48,500 at full surface, or ~19,200 trimmed to the domains you actually use), while the server is ~2-3x cheaper per task on a lazy-loading one - plus what each genuinely does better and a tool-by-tool coverage map of all 159 tools, 31 prompts and the resources.

To install, download the archive from a release and extract it into your skills directory. It is rooted at l337-docker/, so it lands correctly as-is:

# personal (all projects)
tar -xzf l337-docker-skill-<version>.tar.gz -C ~/.claude/skills
# or per-project, checked into version control
tar -xzf l337-docker-skill-<version>.tar.gz -C .claude/skills

Verify it with the accompanying checksum (sha256sum -c l337-docker-skill-<version>.tar.gz.sha256); the archive is byte-reproducible, so rebuilding from the tag gives the same hash. The skill and the server can coexist - they label the resources they create differently and neither reads the other's.

Security considerations

Connecting this server to an AI agent grants it the same level of access as a local Docker CLI session against the configured daemon. That is broad: the daemon's socket is effectively root-equivalent on the host running it. Treat the agent as a privileged user and weigh the risks below before enabling the server.

  • Use a scoped daemon. Prefer pointing DOCKER_HOST at a daemon dedicated to workloads the agent is allowed to touch (a development VM, a remote sandbox, Docker Desktop, a rootless install) rather than your production socket. The daemon is the trust boundary - there is no per-tool authorization layer.

  • Running as a container. Mounting /var/run/docker.sock into the container grants it the same root-equivalent access to that daemon as the uvx install has - no more, no less, but now explicit in the docker run line. The same scoped-daemon advice applies: prefer mounting a socket for, or pointing DOCKER_HOST at, a daemon the agent is allowed to control. Note that when containerized the file-path tools read and write the container's filesystem, so they can only reach host directories you bind-mount in (see Run as a container). As an accident guard, the destructive container-lifecycle tools (container_remove, container_kill, container_stop, container_restart, container_pause) refuse to act on the server's own container so the agent can't end its own session mid-call; this is convenience, not a security boundary (it's bypassable with DOCKER_MCP_SERVER_ALLOW_SELF_TERMINATE=1, and a human can always recover the container from the host shell), and it does not constrain the many other ways a daemon-privileged agent can affect the host.

  • Privileged containers and host mounts. container_run accepts privileged=True and arbitrary volumes. A privileged container, or one that bind-mounts / from the host, can trivially escape to the host filesystem. Avoid letting the agent set these unless you have reviewed the request. Compose files can declare the same - review the rendered compose_config output before approving compose_up on an unfamiliar project.

  • Pass-through extra_kwargs / updates bypass the visible schema. container_run, container_create, service_create (extra_kwargs) and container_update, service_update (updates) forward an arbitrary dict straight into the Docker SDK. A client that gates on, say, privileged=False in the tool's declared parameters can still be bypassed via extra_kwargs={"privileged": True, "pid_mode": "host"}. These escape hatches are consistent with the "daemon is the trust boundary" model, but any allow/deny policy you build at the MCP-client layer must account for them rather than trusting the named parameters alone.

  • Registry credentials. Many MCP clients log tool calls verbatim, so treat any password or auth_config you pass through a tool as exposed.

    • SDK-backed tools (system_login, image_push, image_registry_data) accept credentials directly and can reuse credentials cached by docker login in ~/.docker/config.json. Prefer running docker login once on the host running this MCP server and leaving the credential parameters unset. (Note: this is the host running the server, not the daemon - relevant when DOCKER_HOST points at a remote daemon.) A credential passed to system_login is cached in the server's memory for the life of the client; system_logout clears that in-memory cache (all registries, or one) without touching ~/.docker/config.json, and system_close / system_reconnect clear it by discarding the client. There is no daemon-side session to end - the Engine's /auth endpoint only validates.

    • HTTPS-backed registry tools (registry_tags, registry_tag_wait, registry_manifest, registry_image_config, hub_tags, hub_repo_info, hub_rate_limit) talk to the registry directly over HTTPS and do NOT read ~/.docker/config.json. The registry_* tools accept username / password for private registries - or, better, read DOCKER_MCP_SERVER_REGISTRY_USERNAME / DOCKER_MCP_SERVER_REGISTRY_PASSWORD from the server's environment so credentials never transit tool arguments (see Configuration); the hub_* tools currently support public Hub repositories only. If passing credentials as arguments, use a per-invocation token with the minimum required scope rather than a long-lived password. When a registry answers with a Bearer auth challenge, the server validates the token realm it points at before sending anything: the scheme must be http/https, plaintext http to a non-local host is rejected, and a public registry is not allowed to redirect the credentialed token request at a private/loopback address (an SSRF guard). A genuinely local dev registry (e.g. localhost:5000) may still use a local realm. Pagination is pinned the same way: a Docker Hub next URL must stay on Hub's own origin, and an OCI Link header's host is discarded in favour of the registry already being queried, so a response body can never redirect this server at a host of its choosing. Redirects themselves are followed across hosts, deliberately - registries answer blob fetches with a redirect to a CDN on another host as normal operation - but the HTTP client strips the Authorization header on any cross-origin redirect, so credentials cannot follow one.

  • Swarm secret material transits tool calls too. Beyond registry credentials, several swarm tools carry secret material through arguments or return values that MCP clients may log: secret_create(data=...) and config_create(data=...) take the payload as an argument, secret_inspect / config_inspect return the stored object, swarm_join(join_token=...) and swarm_unlock(key=...) take cluster join/unlock secrets, and swarm_unlock_key and swarm_join_tokens return cluster credentials (rotation via swarm_update invalidates old tokens) - a manager join token lets its holder join the swarm as a manager (root-equivalent on the cluster). Treat all of these as exposed in any client that records tool traffic, and prefer provisioning swarm secrets and reading join tokens out-of-band on the host rather than through the agent. If an agent never needs to admit nodes, drop the whole surface with DOCKER_MCP_SERVER_DISABLE=swarm (see Configuration).

  • container_exec, compose_exec, and compose_run run arbitrary commands. When any part of the command is derived from agent-controlled input, use an exec-form argv list that does not invoke a shell (e.g. ["python", "-V"]). A list like ["sh", "-c", template] that invokes a shell will interpret shell metacharacters in the untrusted substrings.

  • Container archive paths. container_archive_get and container_archive_put forward the supplied path verbatim to the daemon. The container is the trust boundary - if you do not trust its filesystem, do not assume .. traversal will be rejected.

  • File-path payload tools read and write the server host's filesystem. image_save, container_export (with dest_path), and container_archive_get_to_file write to a dest_path on the host running this MCP server (refusing to overwrite an existing file unless overwrite=True); image_load, image_import, and container_archive_put (with from_file) read a host path; compose_cp copies between a service container and a host path in either direction. image_import(from_url=...) is the one that leaves the host entirely: the daemon fetches the URL the caller named, in the daemon's own network namespace, so it can reach anything that daemon can reach (the same caller-chooses-the-destination footing as image_pull's registry argument). These run as the server's user, so the agent can write any file that user can write and read any file it can read. Prefer the in-band byte tools (capped at 32 MiB) when you don't trust the agent with host filesystem access. DOCKER_MCP_SERVER_READONLY also drops the host-writing tools - but note it is not targeted at them: it registers only read-only tools, so image_load and container_archive_put (and every other mutating/destructive tool) go too. There is no switch that drops just the file-writers.

  • Destructive operations have no built-in confirmation. prune_*, remove_*, container_kill, swarm_leave, compose_down(volumes=True), compose_kill, stack_remove (tears down every service in a stack), buildx_prune (always runs with --force), and buildx_remove execute immediately. These tools carry the destructiveHint annotation, so a client like Claude Code can gate them, and the shipped clean_environment prompt asks the agent to confirm before pruning volumes - but tool calls themselves are not gated by the server. For a hard guarantee, run with DOCKER_MCP_SERVER_NO_DESTRUCTIVE=1 (drops them entirely) or DOCKER_MCP_SERVER_READONLY=1 (see Configuration); for an approval step, configure it at the MCP client.

  • CLI shell-out attack surface. Compose, Stack, Buildx, Scout, and Context tools spawn docker subprocesses on the host running this MCP server. Every invocation passes arguments as a list (no shell, no metacharacter interpretation), resolves the binary via shutil.which, and runs against a scrubbed environment (DOCKER_HOST and related vars only). Positional values (image refs, service / context / builder names, build contexts, bake targets) are additionally rejected if they start with -, so an argument can't be smuggled in as a CLI flag (e.g. a service named --output=...); the one deliberate exception is the trailing command in compose_exec / compose_run, which is meant to be an arbitrary argv. Filesystem paths supplied to compose_* (project_dir, files) are read by the docker CLI on the server host - passing an unfamiliar path can expose any compose file the server's user can read. With no local docker CLI and an ssh:// target those subprocesses run on the remote host instead (above), which shifts two things: the command executes as the remote SSH user with its registry credentials, and the files a command reads are copied to that host's temp directory first - so a buildx_build --secret src= file, or anything else in a staged directory, exists briefly on the remote disk (mode 0700, removed when the call returns; only a dropped connection can leave it behind). Point staging-backed tools at directories you would be content to copy.

  • The daemon set is fixed at startup; pick it deliberately. When DOCKER_HOST / DOCKER_MCP_SERVER_HOSTS are unset, the server's initial SDK connection follows your active Docker context (DOCKER_CONTEXT / currentContext) - the same daemon your docker CLI targets - so if that context points at a remote or production daemon, the agent connects there too. Set DOCKER_MCP_SERVER_HOSTS (or DOCKER_HOST, or select a scoped context) before starting the server to pin the target(s) deliberately; with DOCKER_MCP_SERVER_HOSTS the auto/local endpoints are resolved and pinned at startup, so they can't drift if a context changes later. After startup, context_use only changes the CLI default for subsequent CLI-backed tools; SDK-backed tools keep using the daemon their pooled client connected to. There is no runtime way to introduce or retarget a daemon at an arbitrary endpoint - system_reconnect only rebuilds an already-configured host's client (to recover a wedged connection), it can't point it elsewhere; to add or change a daemon, edit DOCKER_MCP_SERVER_HOSTS and restart. This deliberately closes a trust-expansion vector (an agent can't move the root-equivalent boundary to an unvetted endpoint mid-session). context_create(skip_tls_verify=True) disables TLS verification for a context; use only against trusted local daemons.

  • Per-host read-only is an accident guard, not a security boundary. A host marked (ro) in DOCKER_MCP_SERVER_HOSTS makes mutating/destructive tools refuse to act on it at call time (and, with several hosts, writes require naming the target host explicitly - so the agent can't change the wrong daemon by omission). Like guard_not_self, this is in-process convenience: it constrains the agent through this server's tools, but the daemon itself is still the trust boundary, so for a host the agent must never modify, prefer pointing it at a genuinely read-only or scoped daemon over relying on the marker alone.

  • Per-host non-destructive is the same accident guard, scoped narrower. A host marked (nd) refuses only destructive tool calls (kills, removals, prunes) while reads and ordinary mutations still go through. Like (ro), this is in-process convenience enforced by this server's guard, not a daemon-level boundary.

  • cryptography (a transitive dependency, via mcp -> pyjwt[crypto]) has shipped no x86_64/universal2 macOS wheel since 49.0.0 - confirmed permanent, not transient - so a native install there (uvx, pip, or the .mcpb bundle) resolves to a current version and builds it from source, needing Rust and OpenSSL 3.x. This project briefly tried to avoid that build step with its own cryptography<49 cap scoped to Intel macOS - that cap turned out to hold back every platform, not just the one it named (a platform-scoped upper bound alone doesn't make uv lock fork the resolution), so it silently left everyone on a version within a later high-severity CVE's range (a PKCS#7 EnvelopedData decryption Bleichenbacher oracle). The cap was removed rather than replaced: this project doesn't decrypt PKCS#7 envelopes itself, but a dependency carrying a known-exploitable flaw is not something to ship knowingly just to keep one platform wheel-only. If you'd rather not install a build toolchain, use the container image instead (built centrally on Linux, so it never hits this).

Packages and listings

Channel

Link

PyPI

docker-mcp-server

GHCR (container)

ghcr.io/l337-org/docker-mcp-server

Docker Hub (container)

gavinlucas/docker-mcp-server

Desktop Extension (.mcpb)

GitHub Releases

l337-docker agent skill (.tar.gz)

GitHub Releases

Official MCP Registry

io.github.L337-org/docker-mcp-server

Glama

docker-mcp-server

mcp.so

docker-mcp-server

awesome-mcp-servers

punkpeye/awesome-mcp-servers

Privacy Policy

docker-mcp-server collects no data, sends no telemetry, and has no author-operated backend. It runs locally and talks only to the Docker daemon and container registries you point it at, as part of the operations you request. The full statement is in PRIVACY.md.

Contributing

Contributions are welcome. The project values a tight mapping between the Docker SDK's public surface and the MCP tools we expose. See CONTRIBUTING.md for the project layout, tool conventions, the checklist for adding a new tool module, and local development setup.

Available Tools

165 tools
buildx_bakeA

Build multiple targets defined in a bake file (HCL, JSON, or compose).

Use it for multi-target builds declared in docker-bake.hcl/compose files; for a single Dockerfile target use buildx_build. Does not raise on a non-zero CLI exit (a missing buildx plugin or a timeout still raises) - inspect returncode/stderr in the result.

Args: targets: Bake targets to build (default: the default group) files: Bake file paths (-f, repeatable) set_overrides: Per-target overrides, e.g. ["app.platform=linux/amd64"] push: Push results to the registry load: Load results into the local image store no_cache: Do not use cache when building pull: Always pull a newer base image builder: Override the active builder cwd: Working directory containing the bake file (defaults to the server's cwd; copied to the target host if no local plugin) timeout_seconds: Subprocess timeout (default 1800s)

Returns: dict: {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
cwdNo
loadNo
pullNo
pushNo
filesNo
builderNo
targetsNo
no_cacheNo
set_overridesNo
timeout_secondsNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Over and above the annotations, it discloses a key behavioral twist: non-zero CLI exits do NOT raise, while a missing plugin or timeout DOES raise, and the agent should inspect `returncode`/`stderr`. It also adds the real-world nuance that `cwd` is copied to the target host when no local plugin is present. These are non-obvious behaviors that materially affect how an agent interprets results.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is tightly organized: purpose, usage decision, exception/return behavior, parameter list, and return structure. Each line earns its place; there is no filler or repetition of what the schema already shows without added value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 10-parameter tool with no output schema, this description is thorough: it documents the args array, the return dict shape, default values, and atypical exit behavior. It gives an agent everything needed to invoke it correctly and interpret results confidently.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description carries the full burden for all 10 parameters. It covers each parameter with meaningful prose: `targets` default, `files` manual repeatability, `set_overrides` with an inline example, `cwd` copy behavior, and `timeout_seconds` default. This is excellent compensation for the sparse schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Build multiple targets defined in a bake file (HCL, JSON, or compose).' It also explicitly differentiates from the single-target sibling (`buildx_build`), so an agent can immediately tell which tool is for which job.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly states when to use the tool ('Use it for multi-target builds declared in docker-bake.hcl/compose files') and when not to, directing single Dockerfile targets to `buildx_build`. This is clear, actionable, and leaves little room for misinterpretation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

buildx_buildA

Build an image with BuildKit via docker buildx build.

Replaces the legacy image_build tool when you need any of: multi-platform output (platforms), modern cache export (cache_from/cache_to), SBOM or provenance attestations, build secrets, or multi-stage builds with target. Always runs with --progress=plain so output is captured rather than redrawn on a TTY. With no local buildx plugin and an ssh:// target, the build runs on that host: a local context directory is copied there honouring .dockerignore, as are file, build_contexts and secret paths. Raises ToolInputError in that case for output/cache_to with a filesystem dest=, cache_from with a local src=, or any ssh= - each would resolve on the remote machine, losing the output or silently changing the build. Does not raise on a non-zero CLI exit (a missing buildx plugin or a timeout still raises) - inspect returncode/stderr in the result.

Args: context: Build context: a filesystem path or Git/HTTP URL (verbatim; no ~/glob expansion). The - stdin-tarball form is NOT supported (stdin isn't forwarded - it'd block on the server's own stdin); serve a pre-packed tarball over HTTP instead. Copied to the target host when it names a local directory and there is no local plugin. tags: Image references to apply (-t, repeatable) platforms: Target platforms, e.g. ["linux/amd64", "linux/arm64"] file: Dockerfile path. A relative path resolves against this server's working directory (buildx's own rule), NOT against context - pass e.g. "ctx/Dockerfile" for a Dockerfile inside the context directory "ctx". build_args: Build-time variables (each becomes --build-arg KEY=VALUE) build_contexts: Additional named build contexts (e.g. {"deps": "./vendor"}) labels: Labels to set on the resulting image (each becomes --label KEY=VALUE) annotations: OCI manifest annotations (passed verbatim, repeatable) target: Target build stage to stop at push: Push the result to the registry (mutually exclusive with load) load: Load the result into the local image store (single-platform builds only) output: Custom --output specs (e.g. ["type=tar,dest=out.tar"]). A filesystem dest= is refused when the build has to run on a remote host; dest=- (stdout) is fine. no_cache: Do not use cache when building no_cache_filter: Stage names to exclude from caching pull: Always attempt to pull a newer version of each base image cache_from: Cache import specs, e.g. ["type=registry,ref=user/img:cache"] cache_to: Cache export specs builder: Override the active builder sbom: Shorthand for --attest=type=sbom; pass "true" or a config string provenance: Shorthand for --attest=type=provenance; pass "true", "false", or a config string attest: Custom attestation specs (repeatable) secret: Secret specs (e.g. ["id=npmrc,src=/home/user/.npmrc"] or ["id=npmrc,env=NPM_TOKEN"]). ~ in src= is NOT expanded (by this tool or the CLI) - use an absolute path. ssh: SSH agent socket/key specs (e.g. ["default"], using $SSH_AUTH_SOCK). Refused when the build has to run on a remote host: the socket read would be that host's. timeout_seconds: Subprocess timeout (default 1800s)

Returns: dict: {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
sshNo
fileNo
loadNo
pullNo
pushNo
sbomNo
tagsNo
attestNo
labelsNo
outputNo
secretNo
targetNo
builderNo
contextYes
cache_toNo
no_cacheNo
platformsNo
build_argsNo
cache_fromNo
provenanceNo
annotationsNo
build_contextsNo
no_cache_filterNo
timeout_secondsNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (readOnlyHint=false, destructiveHint=false), the description reveals that it always runs with --progress=plain, copies local context to remote hosts when no local plugin exists, and raises ToolInputError in specific remote scenarios. It also states that non-zero CLI exits do not raise but returncode/stderr should be inspected. This gives the agent a thorough understanding of side effects, error conditions, and edge cases.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but highly structured: a one-line summary, differentiation from the legacy tool, key behavioral notes, and then parameter explanations. Every sentence carries actionable information; there is no fluff or repetition. The use of headings and clear formatting makes the length appropriate for a tool with 24 parameters and complex remote execution semantics.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the tool's purpose, usage, constraints, error behavior, remote execution details, and returns an explicit return format (dict with returncode/stdout/stderr/truncated). It addresses pitfalls (e.g., stdin blocking, path expansion, remote-side resolution) and provides enough detail for an agent to invoke the tool successfully in any scenario. No gaps are apparent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description carries the full burden of documenting all 24 parameters. It provides a detailed Args section with explanations for each parameter, including examples and critical caveats (e.g., context not supporting stdin tarballs, relative Dockerfile path resolution, timeouts). This fully compensates for the empty schema and adds value beyond anything the schema could provide.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a precise action: 'Build an image with BuildKit via docker buildx build.' It then explicitly differentiates itself from the sibling `image_build` tool by listing the specific features it supports (multi-platform, cache export, attestations, secrets, multi-stage). This makes the tool's purpose unmistakable and distinguishes it from alternatives without needing to inspect schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use this tool instead of `image_build` (for multi-platform, cache_from/cache_to, SBOM/provenance, secrets, target). It also explains the behavioral difference when a remote host is involved and lists conditions that raise ToolInputError. Clear guidance on when to use and what to expect, with no ambiguity.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

buildx_createA

Create a new BuildKit builder instance.

Needed when the default docker driver falls short: multi-platform builds and cache export require a docker-container (or kubernetes/remote) builder. Pass use=True to make it the default for later buildx_build calls (else switch with buildx_use); bootstrap=True starts the builder now rather than on first build. Does not raise on a non-zero CLI exit (a missing buildx plugin or a timeout still raises) - inspect returncode/stderr in the result.

Args: name: Name for the new builder (defaults to a generated name) driver: BuildKit driver (e.g. "docker-container", "kubernetes", "remote") driver_opts: Driver-specific options (each becomes --driver-opt KEY=VALUE) use: Set the new builder as the current one bootstrap: Boot the builder immediately platforms: Platforms the builder advertises config: Path to a buildkitd config file (copied to the target host if no local plugin); passed as --buildkitd-config, so this argument needs buildx >= 0.17 node_name: Node name within the builder (for multi-node builders) append: Append a node to an existing builder named name

Returns: dict: {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
useNo
nameNo
appendNo
configNo
driverNo
bootstrapNo
node_nameNo
platformsNo
driver_optsNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the generic annotations by disclosing error semantics: non-zero CLI exits do not raise, but a missing buildx plugin or timeout does, so callers must inspect returncode/stderr. It also clarifies side-effect behaviors like bootstrap timing, use-as-default, config copying, and append semantics.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is structured with a purpose/usage paragraph, an Args list, and a Returns block. It is detailed but every sentence adds functional value; nothing is redundant with the schema, and the most important usage context is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has 9 parameters, no output schema, and sparse annotations, but the description fully compensates: it documents all parameter semantics, return shape, exception behavior, version requirements, and common invocation patterns. An agent has everything needed to call it correctly and interpret the result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description carries the full burden for all 9 parameters, and it succeeds. Every parameter gets a meaningful explanation, including examples like driver values, driver_opts conversion to --driver-opt, the buildx >= 0.17 constraint for config, and the multi-node intent of node_name.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description opens with 'Create a new BuildKit builder instance,' which is a specific verb+resource statement. It further differentiates from siblings by indicating this is the setup step before buildx_build and the counterpart to buildx_use for switching builders.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when it is needed: when the default docker driver falls short for multi-platform builds and cache export. It also gives clear routing guidance: use=True makes it the default for later buildx_build calls, otherwise switch with buildx_use, and bootstrap=True starts the builder immediately.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

buildx_duA
Read-only

Report BuildKit cache disk usage as a list of records.

A large cache can easily generate more output than MAX_CLI_OUTPUT_BYTES; if that happens the captured stdout is truncated and this tool drops the final (partial) record before parsing. For an exhaustive accounting on a busy builder, run docker buildx du --format '{{json .}}' on the host directly. Reclaim the cache with buildx_prune (system_df covers daemon-side disk, not builder cache). Raises RemoteFailureError if the CLI call fails.

Args: builder: Override the active builder

Returns: list: One dict per cache record (parsed from --format '{{json .}}')

ParametersJSON Schema
NameRequiredDescriptionDefault
builderNo

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, but the description adds significant behavioral context: it can drop the final partial record when output exceeds MAX_CLI_OUTPUT_BYTES, and it raises RemoteFailureError on CLI failure. These are not implied by annotations and help an agent anticipate failure modes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core purpose, followed by necessary caveats (truncation), remediation (run on host), and cross-references. Each sentence earns its place, with no redundancy. The Args/Returns block is compact and structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having no output schema, the description specifies the return as a list of dicts parsed from the JSON format. It covers the truncation edge case, error behavior, and the parameter semantics. For a simple read-only reporting tool, this is complete: an agent knows what to expect, when to use alternatives, and how to handle failures.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries full responsibility for the 'builder' parameter. It explains it 'Overrides the active builder', which gives clear meaning beyond the raw name and type. It does not mention the default behavior explicitly, but 'override' implies it uses the active builder if not provided. This is adequate for a single optional parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb 'Report' and a precise resource 'BuildKit cache disk usage as a list of records', and distinguishes itself from related tools by noting system_df covers daemon-side disk and buildx_prune reclaims cache. Clear and unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly names alternatives and when to use them: 'Reclaim the cache with buildx_prune (system_df covers daemon-side disk, not builder cache)' and advises running the CLI on host directly for exhaustive accounting if output is large. Provides clear when-to-use and when-not-to-use context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

buildx_history_inspectA
Read-only

Inspect a single build record by ref, parsed from --format json.

Returns the full record for one build - duration, materials, attestations, error (if any) - for debugging a failed or slow build found via buildx_history_list. Requires buildx >= v0.13. Raises RemoteFailureError if the CLI call fails.

Args: ref: Build record ref. Pass the ref field from buildx_history_list directly - it reports a qualified "//", but history inspect only accepts the bare id, so this reduces it to the id and (unless builder is given) targets the builder named in the ref. Empty/omitted inspects the most recent build; the ^N syntax (e.g. "^0" = latest) is also valid. builder: Builder instance the build ran on (defaults to the one in ref, else active)

Returns: dict: The parsed build record (or {"raw": } if the output isn't a JSON object)

ParametersJSON Schema
NameRequiredDescriptionDefault
refNo
builderNo

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the readOnly/destructive annotations by disclosing JSON parsing, the buildx >= v0.13 requirement, RemoteFailureError, ref normalization from qualified to bare id, and the {'raw': stdout} fallback when output is not a JSON object.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is longer than average but every sentence earns its place: purpose, prerequisites, error behavior, parameter semantics, and return format. It is front-loaded with the core purpose and uses a clear Args/Returns structure.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having no output schema, the description explains the return value as a parsed dict and the raw fallback. It covers prerequisites, failure behavior, parameter semantics, and typical usage context, leaving no essential gap for an agent to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description carries the full parameter burden and does so thoroughly. It explains ref's qualified format, automatic reduction to bare id, builder targeting, default builder selection, and valid syntaxes like '^0'. Builder is also fully described.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: 'Inspect a single build record by ref'. It clearly distinguishes this from buildx_history_list by saying the record is found via that list, and frames the purpose as debugging failed or slow builds.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly describes the intended use case: debugging a failed or slow build located through buildx_history_list. It also gives practical invocation guidance for ref, including empty/omitted behavior and the ^N syntax, but does not explicitly state when to prefer sibling inspect tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

buildx_history_listA
Read-only

List recent build records (BuildKit build history), parsed from --format '{{json .}}'.

Each record is a past build with its ref, name, status, step counts, and timestamps - useful for finding a build to drill into with buildx_history_inspect. Requires buildx >= v0.13 (older versions have no history subcommand and this raises with the CLI's "unknown command" error). Raises RemoteFailureError if the CLI call fails.

Args: builder: Builder instance to read history from (defaults to the active builder)

Returns: list: One dict per build record (ref, name, status, total/completed/cached steps, times)

ParametersJSON Schema
NameRequiredDescriptionDefault
builderNo

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark the operation as read-only and non-destructive; the description adds valuable behavioral context beyond them: the exact CLI format used, the buildx version requirement, and the specific RemoteFailureError raised on CLI failure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose is front-loaded in the first sentence, followed by necessary context (record contents, version requirement, error behavior), then compact Args and Returns sections. Every sentence carries useful information with no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Since there is no output schema, the Returns section usefully describes the list shape and included record fields. It also covers error behavior and the version constraint. The only minor gap is unspecified ordering or result-size limits, but these are unlikely to block correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description compensates by documenting `builder` as 'Builder instance to read history from (defaults to the active builder)'. This adds practical meaning, though the schema's string type vs. 'Builder instance' wording creates minor ambiguity.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Starts with a specific verb and resource: 'List recent build records (BuildKit build history)', plus the exact parsing method via `--format '{{json .}}'`. It also references `buildx_history_inspect` as the natural downstream tool, making its role distinct from that sibling.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Clearly states it is useful for finding a build to drill into with `buildx_history_inspect`, and gives a version prerequisite. It does not explicitly enumerate when to favor alternatives like `buildx_list`, but the intended use case is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

buildx_imagetools_createA

Create a manifest list / OCI image index from existing per-platform tags.

Replaces docker manifest create + docker manifest push - builds the index and pushes it in one operation. Source tags must already be pushed; this only stitches them together. Verify the result with buildx_imagetools_inspect. Does not raise on a non-zero CLI exit (a missing buildx plugin or a timeout still raises) - inspect returncode/stderr in the result.

Args: target: Tag for the new manifest list (-t) sources: Source image references to combine append: Append to the existing manifest at target rather than replacing dry_run: Print the resulting manifest without pushing annotations: OCI annotations (repeatable; passed verbatim) platforms: Filter source platforms when combining descriptor_files: Files to read source descriptors from, instead of refs (copied to the target host if no local plugin) builder: Override the active builder timeout_seconds: Subprocess timeout (default 600s)

Returns: dict: {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
appendNo
targetYes
builderNo
dry_runNo
sourcesYes
platformsNo
annotationsNo
timeout_secondsNo
descriptor_filesNo

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With annotations covering only readOnlyHint=false and destructiveHint=false, the description adds significant behavioral context: it mentions the operation 'builds the index and pushes it in one operation', and importantly discloses that it 'Does not raise on a non-zero CLI exit... inspect returncode/stderr'. It also describes the dry_run flag. This exceeds the bare annotations and informs the agent about side effects and error handling.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is organized into a compact summary, an Args list with one-line explanations, and a Returns section. It is front-loaded with the core purpose and prerequisites. Every sentence adds value—there is no filler, and the structure makes quick scanning easy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given there is no output schema, the description explicitly states the return dict format and fields. It covers error behavior (non-zero exit), parameter nuances, and prerequisites. For a moderate-complexity tool with 9 parameters, this is complete—an agent has all the information needed to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description carries the full burden. It lists all nine parameters with brief but meaningful explanations: target, sources, append, dry_run, annotations, platforms, descriptor_files, builder, and timeout_seconds. For example, it notes annotations are 'passed verbatim' and descriptor_files are 'copied to the target host if no local plugin'. This fully compensates for the lack of schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a precise statement: 'Create a manifest list / OCI image index from existing per-platform tags.' This names the specific operation and resource, and distinguishes it from sibling buildx tools by clarifying it stitches existing tags rather than building or inspecting. It clearly differentiates from `buildx_imagetools_inspect`.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states a clear prerequisite: 'Source tags must already be pushed; this only stitches them together.' It also suggests a verification step with `buildx_imagetools_inspect`. However, it does not explicitly contrast with alternatives like `buildx_build` or `image_push`, so the usage context is clear but lacks an explicit whitelist/blacklist of when not to use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

buildx_imagetools_inspectA
Read-only

Inspect a manifest in a registry without pulling.

Replaces docker manifest inspect. The standalone docker manifest command is in maintenance mode and lacks support for OCI image indexes, attestations, and annotations - buildx imagetools inspect is the path forward and handles both single-platform manifests and multi-platform manifest lists / OCI indexes. Uses the docker CLI's credential store; registry_manifest answers the same question over direct HTTPS with no daemon or plugin. Does not raise on a non-zero CLI exit (a missing buildx plugin or a timeout still raises) - inspect returncode/stderr in the result.

Args: image: Image reference, e.g. "alpine:3.19" or "ghcr.io/org/repo@sha256:..." raw: Return the raw manifest bytes (a JSON document) instead of the human-rendered tree format: Go template format string (mutually exclusive with raw) builder: Override the active builder

Returns: dict: {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}. With raw=True or format="{{json .}}", stdout is a JSON document the caller can parse.

ParametersJSON Schema
NameRequiredDescriptionDefault
rawNo
imageYes
formatNo
builderNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark it read-only/non-destructive, and the description adds important behavioral context: it does not raise on a non-zero CLI exit, but still raises on missing plugin/timeout, and it returns returncode/stderr for the caller to inspect. It also discloses credential-store usage and OCI index support.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose, then moves through alternatives, error behavior, args, and returns. Every section earns its place, and the Args/Returns formatting makes it easy to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only inspect tool, it covers the full call contract: what it does, how it differs from alternatives, all parameters, the return dict shape, and when stdout contains a parseable JSON document. Nothing an agent needs to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the full burden. It explains all four parameters: image with concrete examples, raw with behavior, format with mutual exclusivity, and builder as an override. This is strong compensation for the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Inspect a manifest in a registry without pulling.' It clearly distinguishes itself from docker manifest inspect and registry_manifest, so an agent can tell exactly what this tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly says it replaces docker manifest inspect, explains why, and names registry_manifest as the alternative for direct HTTPS without a daemon or plugin. This gives clear when-to-use and when-to-avoid guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

buildx_inspectA
Read-only

Inspect a builder instance.

Human-readable detail (driver, status, supported platforms) for one builder; buildx_list returns machine-parsed JSON for all builders. Does not raise on a non-zero CLI exit (a missing buildx plugin or a timeout still raises) - inspect returncode/stderr in the result.

Args: name: Builder name (defaults to the active builder) bootstrap: Boot the builder if it isn't already running

Returns: dict: {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}. stdout is human-readable; parse with the agent or call buildx_list for JSON.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameNo
bootstrapNo

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, covering the safety profile. The description adds meaningful behavioral context beyond that: it discloses the tool does not raise on a non-zero CLI exit, while missing plugins or timeouts still raise, and directs the agent to inspect returncode/stderr. This is valuable exception-level transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with purpose, comparative guidance, exception behavior, Args, and Returns sections. It is front-loaded with the core purpose followed by the sibling distinction. Minor redundancy exists, such as mentioning 'human-readable' twice, but the length is justified by the need to compensate for the sparse schema and absent output schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description must explain return values, and it does: it provides the exact dict shape and notes stdout is human-readable. It also covers parameter semantics, error behavior, and when to prefer buildx_list. Nothing needed to call this tool correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the full burden for parameter meaning. It fully documents both parameters: name defaults to the active builder, and bootstrap boots the builder if it isn't running. No parameter is left unexplained.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Inspect a builder instance.' It then clarifies the scope by noting it returns human-readable detail for one builder and explicitly contrasts this with buildx_list, which returns JSON for all builders. This clearly distinguishes it from sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly names buildx_list as the alternative for machine-parsed JSON covering all builders, and states that buildx_inspect is for human-readable detail on one builder. It also advises calling buildx_list when JSON output is needed, giving the agent clear routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

buildx_listA
Read-only

List builder instances.

Machine-parsed view of every builder; use buildx_inspect for one builder's human-readable detail and buildx_use to switch the default. Raises RemoteFailureError if the CLI call fails.

Returns: list: One dict per builder (parsed from --format '{{json .}}'). If the captured stdout was truncated by MAX_CLI_OUTPUT_BYTES the last (likely partial) record is dropped before parsing.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds valuable behavioral detail beyond that: it states that the tool raises RemoteFailureError on CLI failure, specifies the return format ("One dict per builder (parsed from `--format '{{json .}}'`)"), and discloses truncation handling (dropping last partial record if MAX_CLI_OUTPUT_BYTES is exceeded). These are non-obvious traits that materially affect invocation and result interpretation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded: the primary action appears in the first sentence, followed by differentiation, error behavior, and return details. Each sentence carries distinct information without redundancy. The use of a Returns section is clean and keeps the main body concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, read-only list tool, the description is fully complete. It explains the output shape, the error condition, and how truncation is handled. It also points to relevant siblings. There is no missing information an agent would need to invoke or interpret the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema is an empty object (0 parameters), so there is nothing for the description to explain. Per the rubric, the baseline for 0 parameters is 4. The description does not add or need to add parameter semantics since none exist.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a precise statement — "List builder instances" — which is a specific verb+resource pair. It further differentiates from siblings by calling it a "Machine-parsed view of every builder" and explicitly naming `buildx_inspect` (for one builder's human-readable detail) and `buildx_use` (to switch the default). This makes the tool's role unmistakable relative to its siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly directs when to use alternatives: "use `buildx_inspect` for one builder's human-readable detail and `buildx_use` to switch the default." This provides clear context on when this tool is appropriate and when a sibling is preferable, leaving no ambiguity for the agent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

buildx_pruneA
DestructiveIdempotent

Remove BuildKit cache entries.

Destructive: this tool always passes --force because no interactive prompt is available under MCP. Pair with buildx_du first to inventory what would be removed. Does not raise on a non-zero CLI exit (a missing buildx plugin or a timeout still raises) - inspect returncode/stderr in the result.

Args: all: Include internal/frontend images filters: Filter by attributes (e.g. {"until": "24h", "type": "exec.cachemount"}) reserved_space: Amount of disk to always keep (e.g. "10GB") max_used_space: Maximum disk space the cache may use (e.g. "20GB") min_free_space: Target amount of free disk after pruning (e.g. "5GB") builder: Override the active builder timeout_seconds: Subprocess timeout (default 600s)

Returns: dict: {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
allNo
builderNo
filtersNo
max_used_spaceNo
min_free_spaceNo
reserved_spaceNo
timeout_secondsNo

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes well beyond the annotations by revealing that the tool always passes --force, does not raise on non-zero CLI exit (except for missing plugin or timeout), and returns a structured result dict. It also states destructive behavior directly, reinforcing the destructiveHint annotation without contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-organized: critical safety warning first, then execution-behavior caveat, then a compact parameter list with examples, then the return shape. No redundant sentences or filler; every section earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive, complex CLI wrapper with no output schema, the description is complete: it covers all parameters, return values, error behavior, timeout defaults, and a safety recommendation to pair with buildx_du. Nothing needed for correct invocation is left unexplained.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description compensates fully by explaining every parameter: all, filters with an example, reserved_space, max_used_space, min_free_space, builder, and timeout_seconds. This adds real meaning beyond the raw schema types and defaults.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Remove BuildKit cache entries.' It also clearly distinguishes this from related tools like buildx_du by positioning this as the destructive counterpart and by naming the cache-specific scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly advises pairing with buildx_du first to inventory what would be removed, which is strong practical usage guidance. It also warns about the tool's exit-code behavior Rhino so the agent knows to inspect returncode/stderr, but it does not formalize when to choose this tool over image_prune or volume_prune.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

buildx_removeA
Destructive

Remove a builder instance.

Deletes a builder made by buildx_create, including its build cache unless keep_state=True; use buildx_prune to reclaim cache while keeping the builder. Does not raise on a non-zero CLI exit (a missing buildx plugin or a timeout still raises) - inspect returncode/stderr in the result.

Args: name: Builder name to remove (mutually exclusive with all_inactive) all_inactive: Remove every inactive builder keep_state: Keep the BuildKit state volume keep_daemon: Keep the BuildKit daemon process running force: Force removal even if the builder is in use

Returns: dict: {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
nameNo
forceNo
keep_stateNo
keep_daemonNo
all_inactiveNo

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes beyond annotations (readOnlyHint=false, destructiveHint=true) by detailing what is destroyed (build cache), how to preserve it (keep_state=True), and the error-handling behavior (does not raise on non-zero CLI exit but does on missing plugin/timeout). This adds significant context for safe invocation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured and front-loaded with the primary action, but includes slight redundancy (e.g., 'Remove a builder instance' and 'Deletes a builder made by buildx_create'). Nevertheless, every sentence provides necessary detail, and the arg descriptions are efficiently formatted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers all parameters, return format (dict with returncode, stdout, stderr, truncated), error behavior, and relationship to siblings. It is sufficient for an agent to invoke the tool correctly without additional documentation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description fully compensates by explaining each parameter in the 'Args' section: name (mutually exclusive with all_inactive), all_inactive, keep_state, keep_daemon, and force. This adds meaning beyond the raw schema types and defaults.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Remove a builder instance' and specifies it deletes builders made by buildx_create, distinguishing it from buildx_prune (which reclaims cache while keeping the builder). This is a specific verb+resource with explicit differentiation from sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly advises using buildx_prune when wanting to reclaim cache while keeping the builder, providing a clear alternative and condition for selection. It also notes the tool is for builders created by buildx_create, giving context on when this tool is appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

buildx_useA

Select the active builder for subsequent buildx operations.

Without default or global_default the switch applies only to the current CLI session. default persists the choice for the current Docker context; global_default persists across all Docker contexts. Use buildx_list to see available builders and their current status. To avoid switching the global default, pass a specific builder name directly via buildx_build's builder parameter instead. Does not raise on a non-zero CLI exit (a missing buildx plugin or a timeout still raises) - inspect returncode/stderr in the result.

Args: name: Builder name to activate (from buildx_list) default: Persist as default builder for the current Docker context global_default: Persist as default builder across all Docker contexts

Returns: dict: {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes
defaultNo
global_defaultNo

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds meaningful behavioral context beyond the annotations: it discloses that a non-zero CLI exit does not raise, exceptions for missing plugin/timeout still raise, and the agent must inspect returncode/stderr. It also explains the persistence/storage implications of default vs. global_default, which is not inferable from annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is longer than minimum but every section earns its place: opening one-line purpose, scoping semantics, sibling routing, error behavior, and Args/Returns guides. The prose's key points are front-loaded. Minor redundancy exists because the Args section restates persistence semantics already given in the prose, but it serves as a practical quick-reference.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The definition covers the tool's output format, exception behavior, parameter semantics, and relation to siblings, and it explicitly documents the returned dict since there is no output schema. It gives an agent everything required to select and invoke the tool correctly, including which default flags to use and how to handle the result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has 0% description coverage, yet the description's Args section gives each parameter a concrete meaning: name is the builder from buildx_list, default persists for the current Docker context, and global_default persists across all contexts. This fully compensates for the sparse schema and tells the agent the exact behavioral consequences of each flag.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Select the active builder for subsequent buildx operations') and clearly distinguishes itself from siblings by recommending buildx_list for discovery and buildx_build as a direct builder-passing alternative. This resolves ambiguity without needing to inspect other schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly directs the agent to use buildx_list to see available builders and to pass a builder name via buildx_build when a global default switch should be avoided. The scoping rules for session, Docker context, and all contexts are explicitly stated, giving precise when-and-when-not conditions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compose_buildA

Build images for a compose project.

Builds the images declared by the project's build: sections without starting anything - compose_up(build=True) builds and starts in one step. Does not raise on a non-zero CLI exit (a missing compose plugin or a timeout still raises) - inspect returncode/stderr in the result.

Args: project_dir: Dir with the compose file (default: server cwd; copied to the target host if no local plugin) files: Explicit compose file paths (repeatable, -f) project_name: Compose project name override services: Specific services to build (default: all) pull: Always attempt to pull a newer base image no_cache: Do not use cache when building timeout_seconds: Subprocess timeout (default 1800s)

Returns: dict: {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
pullNo
filesNo
no_cacheNo
servicesNo
project_dirNo
project_nameNo
timeout_secondsNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the sparse annotations, the description discloses important runtime behavior: it does not raise on a non-zero CLI exit, but a missing compose plugin or timeout still raises; callers should inspect `returncode`/`stderr`. It also notes that `project_dir` may be copied to the target host when no local plugin exists, which is useful contextual behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well structured: a one-line summary, a differentiation note, a behavior warning, an Args list, and a Returns block. Every sentence adds operational value, and the content is front-loaded with the most important scoping detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, seven optional parameters, and sparse annotations, the description compensates fully: it documents all parameters, specifies the exact return dictionary, and explains failure semantics. Nothing an agent needs to invoke it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries full responsibility for explaining parameters. It does so thoroughly: all seven schema properties are documented with meaning, defaults, and Docker-flag equivalences (e.g., `files` as repeatable `-f`, `services` defaulting to all, `timeout_seconds` defaulting to 1800).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Build images for a compose project.' It further narrows scope to the project's `build:` sections and explicitly contrasts with `compose_up(build=True)`, which also builds. This clearly differentiates the tool from siblings like compose_up and buildx_build.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit when-to guidance: use this tool to build images without starting anything, while `compose_up(build=True)` is named as the alternative for build-and-start in one step. This leaves little ambiguity about how to select between the two closely related compose operations.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compose_configA
Read-only

Render the canonical compose configuration after merges, profiles, and variable substitution.

Use it to validate compose files and see exactly what the CLI will run before compose_up. Does not raise on a non-zero CLI exit (a missing compose plugin or a timeout still raises): on a failed render config may be None - inspect raw.stderr.

Args: project_dir: Dir with the compose file (default: server cwd; copied to the target host if no local plugin) files: Explicit compose file paths (repeatable, -f) project_name: Compose project name override profiles: Profiles to activate before rendering services_only: List service names only (--services) format: Render as YAML (default) or JSON

Returns: dict: {"config": str|dict|None, "raw": }; config is a parsed dict when format="json" and parsing succeeds, otherwise the rendered text from stdout.

ParametersJSON Schema
NameRequiredDescriptionDefault
filesNo
formatNoyaml
profilesNo
project_dirNo
project_nameNo
services_onlyNo

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (readOnlyHint, destructiveHint), the description adds critical behavior: it does not raise on non-zero CLI exit, but does raise on missing plugin or timeout, and warns that config may be None on failure with a pointer to inspect raw.stderr. It also explains the return format when format='json'. These details disclose exactly how the tool behaves in edge cases, enriching beyond the structured annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured: it front-loads the core action, then usage, then error/return behavior, then parameters. Each sentence adds value without redundancy. The argument list is compact yet informative, and the return format is explicitly defined. No filler or repetition exists.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers all essential aspects for correct invocation: purpose, usage context, error handling, parameter semantics, and return structure (including the dict format and how config changes with format). It even notes the target-host copy nuance. Given there is no output schema, this is fully complete for a read-only config tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description fully carries the burden. All 6 parameters are individually described with meaning, defaults, and even CLI flag equivalences (e.g., 'repeatable, `-f`' for files, '`--services`' for services_only). It also notes 'project_dir' is copied to the target host when no local plugin. This adds significant semantic value beyond the raw schema, which only has types and defaults.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a precise verb and object: 'Render the canonical compose configuration after merges, profiles, and variable substitution.' It then states its intended use: 'validate compose files and see exactly what the CLI will run before compose_up.' This clearly differentiates it from sibling compose tools like compose_up (which executes) and compose_ps (which lists services), making the purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly suggests using this tool to validate and preview the configuration before running compose_up, giving a strong context and timing for use. It does not list alternative tools or state when not to use it, but the phrase 'before compose_up' implicitly positions it as the inspection counterpart to the execution tool, which is sufficient for guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compose_cpA

Copy files/folders between a service container and the server host's filesystem.

Exactly one of source/dest is SERVICE:PATH; the other is a path on the host running this MCP server, read/written as the server's user (same host exposure as the file-path archive tools - see SECURITY.md). Copying to stdout (dest="-") is unsupported; use container_archive_get. Does not raise on a non-zero CLI exit (a missing compose plugin or a timeout still raises) - inspect returncode/stderr in the result. With no local compose plugin and an ssh:// target, runs the real docker compose cp on that host instead and relays whichever side of the copy is local over the same SSH connection - every parameter above behaves the same either way, since the actual copy always runs through the real CLI. The one difference: a container->host copy is refused if the local destination already exists, since only this host (not the remote one) knows that. unix:///tcp://+TLS hosts with no local plugin are not covered by this fallback (no shell to run the CLI on) and still raise CapabilityError - use container_archive_put (host to container) or container_archive_get_to_file (container to host) there instead; both talk to the daemon directly and need no local CLI (compose_ps gives you the container name).

Args: source: SERVICE:SRC_PATH or a host path dest: SERVICE:DEST_PATH or a host path (not "-") index: Container index when the service has multiple replicas all_containers: Copy to/from all containers of the service (--all) project_dir: Dir with the compose file (default: server cwd; copied to the target host if no local plugin) files: Explicit compose file paths (repeatable, -f) project_name: Compose project name override timeout_seconds: Subprocess timeout (default 300s)

Returns: dict: {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
destYes
filesNo
indexNo
sourceYes
project_dirNo
project_nameNo
all_containersNo
timeout_secondsNo

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (readOnlyHint=false, destructiveHint=false), the description discloses non-obvious behavioral traits: it does not raise on a non-zero CLI exit but does raise on missing plugin/timeout, it refuses container->host copies when the local destination already exists, and it has a CapabilityError case for unix:///tcp://+TLS hosts. These details go far beyond what the annotations supply and fully characterize the tool's fault model.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but each paragraph carries a distinct load: overview, stdout limitation, error semantics, SSH fallback, unix:///tcp:///cases, parameters, and return form. There is minor redundancy (the 'no local compose plugin' condition appears twice) and the density risks truncation in the UX, but the structure is logical and mostly front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the 8 parameters, no output schema, and no schema-described fields, the description is complete: it writes the return shape (returncode/stdout/stderr/truncated), the error taxonomy (non-zero exit, missing plugin, timeout, CapabilityError), the host-permission exposure, and the remote-host fallback semantics. An agent has everything needed to call it correctly without needing supplementary documentation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has zero parameter descriptions (0% coverage), so the description completely compensates. Each of the eight parameters gets meaningful detail: source/dest format, index for replicas, all_containers semantics, project_dir default and remote-copy behavior, repeatable files, project_name override, and timeout_seconds default. This fully equips the agent to pass correct args without opening the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource: "Copy files/folders between a service container and the server host's filesystem." It also explains the required source/dest format (SERVICE:PATH on exactly one side) and explicitly excludes copying to stdout, which distinguishes it from related tools like container_archive_get and container_archive_put.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description names when to use alternative tools: copying to stdout should use container_archive_get; unix:///tcp://+TLS hosts without a local plugin should use container_archive_put or container_archive_get_to_file. It also explains the SSH fallback behavior and when the tool is not covered, giving the agent clear decision rules for choosing this tool vs. alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compose_downA
Destructive

Stop and remove containers, networks (and optionally volumes) for a compose project.

Inverse of compose_up. Images are kept; named volumes go only with volumes=True (destructive). Use compose_stop to stop without removing anything. Does not raise on a non-zero CLI exit (a missing compose plugin or a timeout still raises) - inspect returncode/stderr in the result.

Args: project_dir: Dir with the compose file (default: server cwd; copied to the target host if no local plugin) files: Explicit compose file paths (repeatable, -f) project_name: Compose project name override volumes: Also remove named volumes declared by the project (destructive) remove_orphans: Remove containers not declared in the compose file timeout_seconds: Subprocess timeout (default 300s)

Returns: dict: {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
filesNo
volumesNo
profilesNo
project_dirNo
project_nameNo
remove_orphansNo
timeout_secondsNo

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the destructiveHint annotation, the description discloses meaningful behaviors: images are kept, named volumes are only removed with volumes=True, non-zero CLI exits do not raise, and missing plugin/timeout conditions still raise. It also tells the agent to inspect returncode/stderr, which is valuable runtime context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-organized and front-loaded: a one-sentence purpose, a short behavioral note, then structured Args and Returns sections. Every sentence adds information without unnecessary padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive compose operation with no output schema, the description provides the return dict shape, subprocess error semantics, and parameter meanings. The only notable gap is the undocumented 'profiles' parameter, which prevents it from being fully complete for all 7 inputs.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the burden of explaining parameters. It explains six of seven parameters with useful detail (project_dir default/copy behavior, repeatable -f files, volumes destructive flag, timeout default). However, the 'profiles' parameter in the schema is not mentioned at all, leaving one parameter undocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific action and resource: 'Stop and remove containers, networks (and optionally volumes) for a compose project.' It also explicitly names itself as the inverse of compose_up, which clearly differentiates it from compose_stop and other compose-related siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly contrasts with compose_stop ('Use compose_stop to stop without removing anything') and states when the destructive volume removal applies (volumes=True). This gives an agent clear routing guidance among related compose lifecycle tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compose_execA

Run a command inside an already-running compose service container (see also container_exec).

Always passes -T (no TTY). Pass an exec-form argv (e.g. ["python", "-V"]); a ["sh", "-c", "..."] form interprets shell metacharacters in untrusted substrings. Does not raise on a non-zero CLI exit (a missing compose plugin or a timeout still raises) - inspect returncode/stderr in the result.

Args: service: Service name from the compose file command: Argv to execute inside the container project_dir: Dir with the compose file (default: server cwd; copied to the target host if no local plugin) files: Explicit compose file paths (repeatable, -f) project_name: Compose project name override index: Container index when the service has multiple replicas workdir: Working directory inside the container user: User to run as inside the container (uid or name) env: Environment variables to set for the exec session timeout_seconds: Subprocess timeout (default 60s)

Returns: dict: {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
envNo
userNo
filesNo
indexNo
commandYes
serviceYes
workdirNo
project_dirNo
project_nameNo
timeout_secondsNo

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes beyond the generic readOnlyHint/destructiveHint annotations by disclosing that -T is always passed, that non-zero CLI exits do not raise exceptions, that exec-form argv avoids shell interpolation, and which failure modes still raise. These are material behavioral details an agent needs to interpret results correctly.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-factored: opening purpose, then critical execution notes, then an Args list, then Returns. Each sentence earns its place—no fluff, no repetition of schema types. The front-matter covers the most important operational caveats before the parameter list.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 10 parameters foreseeable, no schema descriptions, no output schema, and nested object inputs, this description provides all essential context: command form, error behavior, parameter meanings, default values, and return structure. There is no missing information required to invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, so the description must fully compensate. It provides concise, meaningful descriptions for all 10 parameters, including defaults, semantics like 'repeatable, -f', and context such as 'container index when service has multiple replicas'. This gives the agent everything needed to populate each parameter correctly.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: 'Run a command inside an already-running compose service container'. The qualifier 'already-running' distinguishes it from compose_run and container_run, and it explicitly points to the sibling container_exec. This is a precise, unambiguous purpose statement.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides clear context by specifying the target is an already-running compose service, which implies not for stopping containers or non-compose containers. Mentions 'see also container_exec' but does not explicitly state when to choose one over the other. This is clear context without formal exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compose_imagesA
Read-only

List the images used by a compose project's services, parsed from --format json.

Answers "what image and tag does each service container actually run?" - the containers must exist (compose_up first). Use compose_ps for container state and image_list for daemon-wide images. Raises RemoteFailureError if the CLI call fails.

Args: project_dir: Dir with the compose file (default: server cwd; copied to the target host if no local plugin) files: Explicit compose file paths (repeatable, -f) project_name: Compose project name override services: Restrict to these services (default: all)

Returns: list: One dict per container image (service, container, repository, tag, id, size)

ParametersJSON Schema
NameRequiredDescriptionDefault
filesNo
servicesNo
project_dirNo
project_nameNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark it read-only and non-destructive, and the description adds meaningful behavior beyond that: it parses --format json, requires containers to exist, raises RemoteFailureError on CLI failure, and explains project_dir copying behavior on remote hosts. This gives the agent a clear behavioral contract.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured and front-loaded with the core purpose, then uses a compact Args/Returns layout. Every sentence contributes: purpose, usage context, error behavior, parameter semantics, and return shape. There is no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having no output schema, the description covers all essentials: what the tool does, when to use it, prerequisites, failure mode, parameter meanings, and the exact return structure. An agent has everything needed to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must carry parameter meaning. It does so for all four parameters: project_dir default and remote-copy behavior, files as repeatable -f paths, project_name as override, and services as a restriction with default all. This fully compensates for the empty schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'List the images used by a compose project's services.' It also clarifies the exact question the tool answers and explicitly distinguishes itself from compose_ps and image_list, making sibling differentiation immediate.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states when the tool is appropriate, requires containers to exist and compose_up to have been run first, and names alternatives for adjacent concerns: compose_ps for container state and image_list for daemon-wide images. This is explicit when/when-not guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compose_killA
Destructive

Send a signal to a compose project's containers (default SIGKILL).

Immediate, with no grace period - prefer compose_stop for a clean shutdown (stop signal, then kill after a timeout). Does not raise on a non-zero CLI exit (a missing compose plugin or a timeout still raises) - inspect returncode/stderr in the result.

Args: services: Restrict to these services (default: all) signal: Signal to send (default "SIGKILL"; e.g. "SIGTERM", "SIGHUP") remove_orphans: Also remove containers for services not in the compose file project_dir: Dir with the compose file (default: server cwd; copied to the target host if no local plugin) files: Explicit compose file paths (repeatable, -f) project_name: Compose project name override

Returns: dict: {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
filesNo
signalNoSIGKILL
servicesNo
project_dirNo
project_nameNo
remove_orphansNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

While annotations already mark destructiveHint=true, the description adds substantial behavioral context: the immediate kill with no grace period, the non-raising behavior on non-zero CLI exits, the specific exceptions that still raise (missing plugin, timeout), and the project_dir copy-to-host behavior. These traits are not captured by the annotations and are crucial for an agent to predict side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is efficiently structured: purpose in the first line, behavioral caveats in a short second paragraph, then a compact Args list and a Returns line. Every sentence adds information; there is no filler. The front-loading of purpose and the most important caveat ('prefer compose_stop') makes it easy for an agent to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 6 parameters and no output schema, the description is complete. It explains all parameters, return values (dict with returncode/stdout/stderr/truncated), the destructive nature, and the nuanced CLI-exit behavior. Combined with the annotations, an agent has everything necessary to invoke the tool correctly and interpret results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With schema description coverage at 0%, the description fully compensates by documenting all 6 parameters in the Args section. Each parameter gets an explanation beyond the schema's type/default: 'services: Restrict to these services (default: all)', 'signal: Signal to send (default "SIGKILL"; e.g. "SIGTERM", "SIGHUP")', and 'files: Explicit compose file paths (repeatable, `-f`)'. This adds real semantic value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a clear, specific verb phrase: 'Send a signal to a compose project's containers (default SIGKILL).' It explicitly identifies the resource (compose project containers) and the action (send signal), and it differentiates from the sibling compose_stop by noting the default signal and the 'prefer compose_stop' guidance. This leaves no ambiguity about what the tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use this tool ('Immediate, with no grace period') and when to prefer an alternative ('prefer `compose_stop` for a clean shutdown (stop signal, then kill after a timeout)'). It also provides a behavioral guideline for error handling: 'Does not raise on a non-zero CLI exit ... inspect `returncode`/`stderr` in the result.' This is explicit when/when-not guidance with a named sibling.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compose_listA
Read-only

List compose projects known to the daemon (across all directories).

Project-level view (one entry per project); compose_ps lists the containers of a single project. Raises RemoteFailureError if the CLI call fails.

Args: all: Include stopped projects

Returns: list: One dict per project (parsed from --format json)

ParametersJSON Schema
NameRequiredDescriptionDefault
allNo

TDQS

A4.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the description doesn't need to restate safety. It adds that it raises RemoteFailureError on CLI failure, which is useful for error handling, and indicates the output format (parsed from --format json). However, it doesn't detail what happens if the daemon has no projects or how errors beyond RemoteFailure are handled—for a read-only list tool, this is adequate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is brief with no fluff: three sentences cover purpose, differentiation, error behavior, and parameter note. Key info is front-loaded with a clear structure (function, comparison, error, parameter). It earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is complete for a simple list tool: it states what it returns (dict per project), how it behaves (raises error), and how it differs from compose_ps. The single parameter 'all' is explained. No output schema exists, but the Returns section covers it. Minor gap: could mention sorting or ordering, but not essential; scores high but not perfect for a straightforward list operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description adds a brief note for the 'all' parameter: 'Include stopped projects', which directly clarifies its meaning beyond the schema's type/boolean/default. This adds some value, but not extensive detail like default behavior or implications of not setting it. Given the parameter is simple and boolean, this is sufficient.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists compose projects known to the daemon across all directories, with a specific 'project-level view' scope. It also distinguishes itself from compose_ps, which lists containers of a single project, clarifying its unique function among sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly contrasts with compose_ps: use compose_list for project-level visibility, and compose_ps when you need container details of one project. This provides direct guidance on when to use this tool vs. the alternative, leaving no ambiguity.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compose_logsA
Read-only

Fetch a bounded slice of logs from a compose project (never follows).

Bounded and non-following by design, so it always returns promptly. For one container's logs use container_logs; for a swarm service use service_logs. Log text arrives on stdout. Does not raise on a non-zero CLI exit (a missing compose plugin or a timeout still raises) - inspect returncode/stderr in the result.

Args: project_dir: Dir with the compose file (default: server cwd; copied to the target host if no local plugin) files: Explicit compose file paths (repeatable, -f) project_name: Compose project name override services: Restrict to these services (default: all) tail: Lines per container, or the literal "all" (still capped at MAX_CLI_OUTPUT_BYTES) since: Show logs since this timestamp/duration (e.g. "10m", "2024-01-01T00:00:00") until: Show logs before this timestamp/duration timestamps: Include per-line timestamps

Returns: dict: {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
tailNo
filesNo
sinceNo
untilNo
servicesNo
timestampsNo
project_dirNo
project_nameNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint/destructiveHint annotations, the description discloses non-following behavior, promptness, that log text goes to stdout, that a non-zero CLI exit does not raise but must be inspected via returncode/stderr, and that missing plugin or timeout still raises. It also notes project_dir is copied to target host if no local plugin. This is rich behavioral context well beyond annotation hints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured: a brief front-loaded behavioral statement, a clearly separated Args list, and a Returns section. Every sentence adds value—no filler. The Arg explanations are concise but complete, with inline examples where needed. The format is scannable and appropriately sized for an 8-parameter tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has no output schema, the description provides the return format (dict with returncode/stdout/stderr/truncated). It covers error behavior (non-zero CLI exit, missing plugin, timeout), parameter semantics, and usage alternatives. There is no obvious missing information an agent would need to call this tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the full burden. It explains every parameter in the Args section: default behavior for project_dir, repeatable -f for files, override for project_name, restriction semantics for services, tail with 'all' and MAX_CLI_OUTPUT_BYTES cap, since/until with examples, and timestamps flag. This compensates fully for the lack of schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a precise action and resource: 'Fetch a bounded slice of logs from a compose project' and immediately disambiguates from siblings by naming container_logs and service_logs as alternatives. It also states a key scoping trait (never follows), making the tool's purpose unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly tells the agent when to use this tool versus siblings: 'For one container's logs use container_logs; for a swarm service use service_logs.' It also clarifies behavior that affects when it is appropriate (bounded, non-following, always returns promptly), giving the agent clear decision criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compose_pauseA

Pause the containers of a compose project (freezes their processes in place).

Paused containers stop consuming CPU but keep memory, network endpoints, and state; resume with compose_unpause. To actually stop containers (each one's configured stop signal, freeing resources) use compose_stop; to stop and delete them use compose_down. Does not raise on a non-zero CLI exit (a missing compose plugin or a timeout still raises) - inspect returncode/stderr in the result.

Args: services: Restrict to these services (default: all) project_dir: Dir with the compose file (default: server cwd; copied to the target host if no local plugin) files: Explicit compose file paths (repeatable, -f) project_name: Compose project name override

Returns: dict: {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
filesNo
servicesNo
project_dirNo
project_nameNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With only readOnlyHint and destructiveHint annotations (both false), the description carries the burden of behavioral details and does so well. It explains the meaning of pause (CPU stops, memory/network/state retained), and precisely discloses error-handling behavior: non-zero CLI exits do not raise, but a missing plugin or timeout does.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Each section is purposeful: a crisp purpose sentence, a short contrast-and-consequences paragraph, a compact Args list, and a Returns line. The structure is front-loaded with the most important decision (pause vs stop vs down) and the content respects the agent's time.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the tool's behavior, alternatives, error handling, all parameters, and the return dict shape. There is no output schema, so the explicit `Returns: dict...` line is genuinely necessary and sufficient. For a tool of this complexity, an agent has everything needed to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must fully compensate. The Args section provides meaningful context for every parameter: `services` restricts targets, `project_dir` identifies the compose file location and even notes the copy-to-host nuance, `files` supports repeatable `-f` usage, and `project_name` overrides the project name.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource combination ('Pause the containers of a compose project') and immediately clarifies the semantics with 'freezes their processes in place.' It also names the relevant siblings (`compose_unpause`, `compose_stop`, `compose_down`), making it easy to distinguish from nearby tools like `container_pause`.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains exactly when to use this tool: when you want to freeze containers without releasing resources. It explicitly contrasts it with `compose_stop` (stop and free resources) and `compose_down` (stop and delete), and points to `compose_unpause` for resuming, giving clear if-then guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compose_portA
Read-only

Resolve the host binding for a service's container port.

The compose equivalent of docker port: which host address/port a service's private port is published on. published is None when the port isn't published. For non-compose containers read container_inspect's NetworkSettings.Ports instead. Raises RemoteFailureError if the CLI call fails.

Args: service: Service name from the compose file private_port: The container-internal port to look up protocol: "tcp" (default) or "udp" index: Container index when the service has multiple replicas project_dir: Dir with the compose file (default: server cwd; copied to the target host if no local plugin) files: Explicit compose file paths (repeatable, -f) project_name: Compose project name override

Returns: dict: {"service", "private_port", "protocol", "published": "host:port"|None, "host": str|None, "port": int|None, "bindings": list[str]}. published/host/port describe the first binding; bindings lists every line (a port can be published on more than one address, e.g. IPv4 and IPv6).

ParametersJSON Schema
NameRequiredDescriptionDefault
filesNo
indexNo
serviceYes
protocolNotcp
project_dirNo
private_portYes
project_nameNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, and the description adds meaningful behavioral context beyond that: `published` is None when unpublished, `bindings` can contain multiple entries for addresses like IPv4/IPv6, and RemoteFailureError is raised on CLI failure. It also discloses copy-to-host behavior for project_dir, which is not visible in the schema or annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose, then adds a one-line analogy, targeted edge cases, and compact Args/Returns sections. No sentence is wasted, and the structure makes it easy to scan before invoking the tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description supplies a detailed return contract including the returned keys and the distinction between the first binding and the full bindings list. It also mentions the failure exception and parameter defaults, making the tool fully actionable without external lookups.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate fully, and it does. Every parameter has an explanatory line: service, private_port, protocol with default, index, project_dir with default behavior, files with `-f` repeatability, and project_name. This materially helps an agent select and fill parameters correctly.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Resolve the host binding for a service's container port.' It names the Docker equivalent (`docker port`) and states the exact question answered. It also distinguishes itself from `container_inspect` by directing non-compose containers elsewhere, making its scope unambiguous among the large sibling list.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives an explicit alternative and the condition under which to use it: 'For non-compose containers read container_inspect's NetworkSettings.Ports instead.' It also describes the compose-specific context and the fallback/default behavior for project_dir. This gives an agent clear routing instructions without needing to inspect sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compose_psA
Read-only

List containers in a compose project, parsed from --format json.

Container-level view of one project (state, health, publishers); compose_list enumerates projects, and container_list covers non-compose containers. Does not raise on a non-zero CLI exit (a missing compose plugin or a timeout still raises): services comes back empty - inspect raw.stderr.

Args: project_dir: Dir with the compose file (default: server cwd; copied to the target host if no local plugin) files: Explicit compose file paths (repeatable, -f) project_name: Compose project name override services: Restrict output to these services all: Include stopped containers as well

Returns: dict: {"services": list[dict], "raw": }; on non-zero exit services is an empty list and the caller should inspect raw.stderr.

ParametersJSON Schema
NameRequiredDescriptionDefault
allNo
filesNo
servicesNo
project_dirNo
project_nameNo

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already supply readOnlyHint and destructiveHint, but the description adds valuable context: it does not raise on non-zero CLI exits (with exceptions for missing plugin/timeout), and it explains the fallback of inspecting `raw.stderr`. It also notes that `project_dir` is copied to the target host if no local plugin. These behaviors go beyond the annotations and are crucial for correct invocation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-organized and front-loaded with purpose, followed by alternatives, behavior, and parameters. It is somewhat lengthy but every sentence earns its place. The parameter list and return format are explicitly labeled, making it easy to parse. Slight verbosity in the return section could be trimmed, but overall it is compact for the amount of information conveyed.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 5 parameters, no output schema, and no param descriptions in the schema, the description fully compensates: it defines each parameter, states the return dict shape, and covers error handling. It also positions the tool among siblings. Nothing an agent needs to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It does, by explaining each parameter: `project_dir` (default and copy behavior), `files` (repeatable), `project_name` (override), `services` (filter), and `all` (include stopped). This gives agents enough meaning to set each argument correctly without needing a schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource: 'List containers in a compose project, parsed from `--format json`.' It immediately distinguishes itself from siblings by stating that `compose_list` enumerates projects and `container_list` covers non-compose containers, so an agent can pick the right tool without opening other schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use this tool (container-level view of one project) and names the alternatives (`compose_list` for projects, `container_list` for non-compose). It also gives a behavioral note about non-zero exits guiding the agent to inspect `raw.stderr`. This is explicit usage guidance with no ambiguity.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compose_pullA

Pre-fetch images for a compose project's services without starting them.

Use this to stage images before an outage window, to refresh cached images before compose_up, or to verify images are accessible without starting containers. For registry-authenticated pulls ensure the daemon is logged in first with system_login. compose_up --pull always does the same as part of startup; use this tool when you want to separate the pull step. Does not raise on a non-zero CLI exit (a missing compose plugin or a timeout still raises) - inspect returncode/stderr in the result.

Args: project_dir: Dir with the compose file (default: server cwd; copied to the target host if no local plugin) files: Explicit compose file paths (repeatable, -f; overrides auto-discovery) project_name: Override the compose project name services: Pull only these services; omit to pull all ignore_pull_failures: Continue if an individual image pull fails timeout_seconds: Subprocess timeout (default 1800s for large image pulls)

Returns: dict: {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
filesNo
servicesNo
project_dirNo
project_nameNo
timeout_secondsNo
ignore_pull_failuresNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the sparse annotations, the description clearly discloses non-raising behavior on non-zero CLI exits, the specific exceptions that still raise (missing compose plugin or timeout), and instructs the agent to inspect `returncode`/`stderr`. It also documents the return dict structure and notes that images are fetched without starting containers, giving a clear behavioral model.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose, then moves to use cases, exclusions, behavioral caveats, parameter explanations, and return format. Every sentence adds operational value, and the structure makes it easy for an agent to quickly extract invocation requirements without scanning filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description explicitly provides the return dict shape. It covers auth prerequisites, error semantics, parameter defaults, and the relationship to compose_up. For a tool with six parameters and meaningful failure modes, this description is complete enough for an agent to call it correctly and interpret results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Even though the input schema has 0% property descriptions, the description's Args section fully compensates by explaining all six parameters: project_dir, files, project_name, services, ignore_pull_failures, and timeout_seconds, including defaults, repeatability, behavior when omitted, and the target-host copy nuance. This is exactly what the schema lacks.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: "Pre-fetch images for a compose project's services without starting them." It immediately distinguishes itself from compose_up by clarifying the pull-only scope, and reinforces the purpose with concrete intents like staging images and verifying accessibility without starting containers.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit when-to-use scenarios (before outage windows, refreshing cache, verifying access) and names the key alternative: `compose_up --pull always`, explaining that compose_pull should be used when the pull step needs to be separated. It also provides the auth prerequisite with `system_login`, leaving little ambiguity about when this tool is appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compose_restartA

Stop then start services without recreating containers or applying config changes.

Use this to bounce a service (e.g. to pick up a runtime file change or clear an in-memory state). If the compose file has changed (new image, environment, volumes, ports) use compose_up instead - it recreates affected containers to apply the diff. stop_timeout_seconds controls the SIGTERM grace period before Docker sends SIGKILL. Does not raise on a non-zero CLI exit (a missing compose plugin or a timeout still raises) - inspect returncode/stderr in the result.

Args: project_dir: Dir with the compose file (default: server cwd; copied to the target host if no local plugin) files: Explicit compose file paths (repeatable, -f) project_name: Override the compose project name services: Restart only these services; omit to restart all stop_timeout_seconds: Seconds to wait for graceful stop before SIGKILL timeout_seconds: Subprocess timeout (default 300s)

Returns: dict: {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
filesNo
servicesNo
project_dirNo
project_nameNo
timeout_secondsNo
stop_timeout_secondsNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond annotations (which are minimal: destructiveHint false, readOnlyHint false), the description discloses crucial behavior: it does not recreate containers, it passes through non-zero CLI exits without raising (unless missing plugin/timeout), and it copies project_dir to the target host if no local plugin. These are essential for correct invocation and result interpretation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose, then provides usage guidance, behavioral notes, and a structured Args/Returns section. Each sentence earns its place; no filler or redundancy. The layout makes it easy to scan and parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 6 parameters and no output schema, the description covers all necessary operational context: when to use, how to interpret results, exit-code behavior, and parameter defaults. An agent has everything needed to invoke it correctly, including the return dict structure.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description fully compensates by explaining all six parameters with clear semantics: project_dir default and copy behavior, files repeatable -f, project_name override, services subset, stop_timeout_seconds grace period, and timeout_seconds subprocess timeout. Every parameter is meaningfully described.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a precise verb and resource: 'Stop then start services without recreating containers or applying config changes.' This clearly distinguishes it from compose_up and other compose commands, and the phrase 'bounce a service' adds concrete intent.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly instructs when to use this tool ('to pick up a runtime file change or clear an in-memory state') and when not to, directing to `compose_up` if the compose file has changed. Also explains the stop_timeout_seconds behavior and the non-zero exit handling.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compose_runA

Run a one-off command against a compose service.

Always passes -T (no TTY under MCP). Defaults to detached with --rm so the call returns promptly. Unlike compose_exec, this starts a NEW container for the service rather than running inside the existing one. Does not raise on a non-zero CLI exit (a missing compose plugin or a timeout still raises) - inspect returncode/stderr in the result.

Args: service: Service name from the compose file command: Command + args to run (exec-form; no shell unless you invoke one) project_dir: Dir with the compose file (default: server cwd; copied to the target host if no local plugin) files: Explicit compose file paths (repeatable, -f) project_name: Compose project name override detach: Run detached rm: Remove the container after the run no_deps: Don't start linked services workdir: Working directory inside the container user: User to run as inside the container (uid or name) env: Environment variables to set inside the container name: Container name timeout_seconds: Subprocess timeout (default 600s)

Returns: dict: {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
rmNo
envNo
nameNo
userNo
filesNo
detachNo
commandNo
no_depsNo
serviceYes
workdirNo
project_dirNo
project_nameNo
timeout_secondsNo

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses behavior not visible in annotations: it forces -T, defaults to detached with --rm, creates a new container, and does not raise on non-zero exits (only plugin/timeout failures raise). This gives an agent accurate expectations for result handling and side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but well-structured: two behavior paragraphs, a compact Args list, and a Returns line. There is no redundant content or filler, and the most important runtime caveats are front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 13 parameters, no output schema, and several runtime caveats, the description covers invocation, defaults, error behavior, and return structure. The only minor omission is explaining the `truncated` flag semantics, but this is not needed to call the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the Args block compensates by explaining every parameter, including non-obvious semantics: command is exec-form without a shell, project_dir is copied to target host if no local plugin, and timeout_seconds defaults to 600. This materially exceeds the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with 'Run a one-off command against a compose service,' naming a specific verb, resource, and scope. It then distinguishes itself from compose_exec ('starts a NEW container rather than running inside the existing one'), making the tool unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives a clear differentiation from compose_exec, one of the most likely alternatives, and gives concrete runtime conditions ('Always passes -T', 'Defaults to detached with --rm'). It doesn't enumerate every alternative compose subcommand, but the one-off framing plus the explicit contrast is sufficient guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compose_startA

Start existing (stopped) containers of a compose project.

Counterpart to compose_stop: starts existing containers without recreating them. Use compose_up to (re)create containers from the compose file. Does not raise on a non-zero CLI exit (a missing compose plugin or a timeout still raises) - inspect returncode/stderr in the result.

Args: project_dir: Dir with the compose file (default: server cwd; copied to the target host if no local plugin) files: Explicit compose file paths (repeatable, -f) project_name: Compose project name override services: Specific services to start (default: all) timeout_seconds: Subprocess timeout (default 600s)

Returns: dict: {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
filesNo
servicesNo
project_dirNo
project_nameNo
timeout_secondsNo

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only provide readOnlyHint=false and destructiveHint=false, which are minimal. The description adds valuable behavioral context: it does not raise on non-zero CLI exit, but does raise on missing plugin or timeout, and instructs the agent to inspect returncode/stderr. It also notes that project_dir is copied to the target host if no local plugin. This goes beyond the annotations and helps the agent interpret results correctly.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and well-structured: a clear first sentence, a short paragraph distinguishing it from siblings, a note about error behavior, and a bulleted Args list. Every sentence earns its place, and the most important information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 5 optional parameters, no output schema, and minimal annotations, the description covers the key aspects: what it does, when to use it, how it behaves on errors, and what each parameter means. It also documents the return dict shape. The only minor gap is that it doesn't describe what 'truncated' means in the return value, but that is a small omission given the overall completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the full burden for parameter semantics. It provides a one-line explanation for each of the five parameters, including defaults (project_dir defaults to server cwd, timeout_seconds defaults to 600s). This is sufficient for an agent to understand what each parameter does, though it doesn't go into deep detail about formats or edge cases.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Start existing (stopped) containers of a compose project.' It explicitly distinguishes itself from compose_stop and compose_up, making it clear what this tool does and does not do. The first sentence is precise and actionable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly names the counterpart (compose_stop) and the alternative (compose_up), and states the condition for choosing each: 'starts existing containers without recreating them' vs 'use compose_up to (re)create containers from the compose file.' This is exactly the kind of when-to-use guidance an agent needs.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compose_stopA

Stop services in a compose project without removing their containers.

Unlike compose_down, containers/networks/volumes survive - use compose_start to bring them back. Does not raise on a non-zero CLI exit (a missing compose plugin or a timeout still raises) - inspect returncode/stderr in the result.

Args: project_dir: Dir with the compose file (default: server cwd; copied to the target host if no local plugin) files: Explicit compose file paths (repeatable, -f) project_name: Compose project name override services: Specific services to stop (default: all) stop_timeout_seconds: Grace period before SIGKILL (passed as --timeout) timeout_seconds: Subprocess timeout (default 300s)

Returns: dict: {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
filesNo
servicesNo
project_dirNo
project_nameNo
timeout_secondsNo
stop_timeout_secondsNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnlyHint=true and destructiveHint=false. The description adds meaningful behavioral context beyond these: it clarifies that state persists (containers/networks/volumes survive), explains that non-zero CLI exits do NOT raise except for missing plugin/timeouts, and warns that project_dir may be copied to the target host. This contextual detail is valuable and consistent with annotations; no contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is tightly written and well-organized. It starts with a one-sentence purpose, immediately contrasts with siblings, then lists parameters and return value. Every element contributes essential information with no fluff or redundant phrasing. The structure front-loads the most critical decision points (what survives, error handling) before details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's moderate complexity (six parameters, non-standard exit handling), the description covers everything needed for correct invocation: purpose, persistence semantics, error behavior, parameter meanings, and the exact return dictionary format. The sibling set is large, but the description clearly distinguishes this tool from the most similar alternatives (compose_down, compose_start). No missing information is apparent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description provides a full list of all six parameters with clear, human-readable explanations and defaults where applicable (e.g., 'default: server cwd', 'default: all', 'default 300s'). The schema itself has zero property descriptions (0% coverage), so the description completely compensates, leaving no parameter underdocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Stop services in a compose project without removing their containers' – a specific verb, resource, and clear scope. It immediately differentiates from the sibling compose_down by stating what is NOT removed, and explicitly names compose_start as the reverse operation. This leaves no ambiguity about the tool's function.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit guidance on when to use this tool versus alternatives: 'Unlike compose_down, containers/networks/volumes survive - use compose_start to bring them back.' It also explains the non-zero exit behavior and the copying of project_dir when no local plugin exists, giving the agent concrete conditions for invocation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compose_topA
Read-only

Show the running processes of a compose project's containers.

Output is the ps-style process table per service (not JSON); read it from stdout. The per-container equivalent is container_top. Does not raise on a non-zero CLI exit (a missing compose plugin or a timeout still raises) - inspect returncode/stderr in the result.

Args: services: Restrict to these services (default: all) project_dir: Dir with the compose file (default: server cwd; copied to the target host if no local plugin) files: Explicit compose file paths (repeatable, -f) project_name: Compose project name override

Returns: dict: {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
filesNo
servicesNo
project_dirNo
project_nameNo

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations mark this as read-only and non-destructive, and the description adds substantial behavioral detail: output is ps-style text on stdout rather than JSON, non-zero CLI exits do not raise while missing plugin or timeout do, and returncode/stderr should be inspected. This goes well beyond the annotation hints and gives an agent realistic expectations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is structured with a short purpose sentence, a behavioral/error note, and compact Args/Returns sections. Every sentence earns its place: output format, error behavior, parameter meanings, and result shape are all necessary and presented without filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the Returns dict shape is explicitly provided. All optional parameters are explained, output format is identified as non-JSON stdout, and unusual error behavior is disclosed. Nothing essential for invoking compose_top correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must carry the burden for parameters. It defines all four: services restricts scope, project_dir supplies default and a copy-to-host behavior, files are repeatable and map to -f, and project_name is an override. Each parameter gets meaningful semantics beyond the bare schema definitions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Show the running processes of a compose project's containers.' It further distinguishes itself by noting the per-container equivalent is container_top and clarifies the output is a ps-style process table per service, not JSON. This clearly separates it from siblings like compose_ps and container_top.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states clear context: use for compose project containers, with container_top named as the per-container equivalent. It does not enumerate when-not-to-use scenarios or compare against compose_ps, but the project-versus-container distinction gives enough guidance for an agent to select this tool correctly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compose_unpauseA

Unpause the containers of a compose project (resumes paused processes).

Reverse of compose_pause: processes continue from where they were frozen (no restart). compose_start is the counterpart for stopped containers. Does not raise on a non-zero CLI exit (a missing compose plugin or a timeout still raises) - inspect returncode/stderr in the result.

Args: services: Restrict to these services (default: all) project_dir: Dir with the compose file (default: server cwd; copied to the target host if no local plugin) files: Explicit compose file paths (repeatable, -f) project_name: Compose project name override

Returns: dict: {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
filesNo
servicesNo
project_dirNo
project_nameNo

TDQS

A4.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations only indicate that this is not read-only and not destructive; the description adds meaningful behavioral detail: processes continue from where they were frozen without restart, a non-zero CLI exit does not raise an exception, and project_dir may be copied to the target host when no local plugin exists. This goes beyond the annotations and helps the agent predict side effects and error behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured and front-loaded: the core action appears first, followed by sibling distinctions, error behavior, parameter definitions, and return type. Every sentence carries useful information and no filler or redundant restatement is present.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has no required parameters, no output schema, and moderate complexity, the description is complete: it documents all parameters with defaults and behavior, explains return values, distinguishes related tools, and discloses error-handling quirks. There is no missing information an agent would need to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description compensates fully by explaining all four parameters: services restricts to given services (default all), project_dir defaults to server cwd and may be copied to the target host, files accepts repeatable compose file paths via -f, and project_name overrides the project name. This adds meaning the raw schema alone does not convey.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific, unambiguous statement: 'Unpause the containers of a compose project (resumes paused processes).' It also distinguishes the tool from closely related siblings by calling itself the reverse of compose_pause and naming compose_start as the counterpart for stopped containers. An agent can immediately tell what the tool does and how it differs from similar operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly situates this tool relative to alternatives: use it to resume paused containers ('Reverse of compose_pause'), and use compose_start instead when containers are stopped. It also clarifies what does and does not raise an error, telling the agent how to interpret non-zero exits by inspecting returncode/stderr. This gives clear, actionable selection guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compose_upA

Bring up a Docker Compose project, detached.

Always runs detached (-d) so it can't block the server. Use compose_ps to confirm services are running, or wait=True to block until they're healthy. Does not raise on a non-zero CLI exit (a missing compose plugin or a timeout still raises) - inspect returncode/stderr in the result.

Args: project_dir: Dir with the compose file (default: server cwd, copied to the target host if no local plugin; paths verbatim, no shell expansion) files: Explicit compose file paths (repeatable, -f) project_name: Compose project name override services: Specific services to bring up (default: all) build: Build images before starting pull: Pull strategy; omit to use each service's own pull_policy remove_orphans: Remove containers for services not in the compose file wait: Block until services are healthy (adds --wait) timeout_seconds: Subprocess timeout (default 600s)

Returns: dict: {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
pullNo
waitNo
buildNo
filesNo
profilesNo
servicesNo
project_dirNo
project_nameNo
remove_orphansNo
timeout_secondsNo

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses important non-obvious behaviors: it always runs detached, does not raise on a non-zero CLI exit, raises only on missing plugin/timeout, and copies project_dir to the target host when no local plugin exists. These details go well beyond the sparse readOnly/destructive annotations and materially affect how an agent interprets results.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is tightly organized: a one-line purpose, then behavioral caveats, a compact args list, and a return type. Each sentence earns its place, and the most important constraints are front-loaded. No fluff or repetition exists.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers invocation defaults, error semantics, return shape, and path handling, which is strong for a tool with no output schema. The only notable omission is the profiles parameter, so an agent would not know that profiles can be explicitly selected.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description carries the parameter documentation burden and documents nine of the ten parameters with useful default and behavior notes, such as timeout_seconds default 600, wait adding --wait, and pull behavior. However, the profiles parameter present in the input schema is not mentioned at all, which is a real gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a concrete verb-resource pair: 'Bring up a Docker Compose project, detached.' It immediately distinguishes this from compose_stop, compose_ps, and other compose operations with an unambiguous command intent. Even without the title, the tool's purpose is clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit guidance to use compose_ps to confirm services are running, or wait=True to block until healthy. This provides clear situational usage for the common follow-up decision. It does not explicitly compare against compose_start/compose_restart, but the detached-operation context is sufficient for an agent to know when this is appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compose_waitA
Read-only

Block until the named service containers stop, then return their exit codes.

For one-shot / batch services. A long-running service that never exits blocks until timeout_seconds, then the subprocess is killed (TimeoutExpired) - bound it sensibly. Exit codes are on stdout. For a single container use container_wait; for swarm services use service_wait. Does not raise on a non-zero CLI exit (a missing compose plugin or a timeout still raises) - inspect returncode/stderr in the result.

Args: services: One or more services to wait on. At least one is required. project_dir: Dir with the compose file (default: server cwd; copied to the target host if no local plugin) files: Explicit compose file paths (repeatable, -f) project_name: Compose project name override timeout_seconds: Subprocess timeout (default 300s)

Returns: dict: {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
filesNo
servicesYes
project_dirNo
project_nameNo
timeout_secondsNo

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnlyHint=true and destructiveHint=false, so the safety profile is already covered. The description adds valuable behavioral context beyond that: the blocking-until-timeout behavior, the subprocess kill on timeout, the fact that exit codes are on stdout, and the nuanced exception behavior (does not raise on non-zero CLI exit but raises on missing plugin or timeout). This is rich, non-obvious behavior that an agent needs to know. It doesn't describe the full return dict, but the Returns section covers the key fields.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but well-organized: a one-sentence core behavior, a use-case paragraph with warnings and sibling routing, an exception note, and a compact Args list. Every sentence earns its place. The most important behavioral facts (blocking, timeout, exit codes) are front-loaded before the parameter details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a blocking wait tool with 5 parameters and no output schema, the description is complete. It covers the blocking semantics, timeout behavior, exit-code location, exception behavior, parameter meanings, and return dict shape. The sibling routing (container_wait, service_wait) closes the last ambiguity. There is no output schema, so the Returns section is necessary and present. Nothing an agent needs to call this correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate for all five parameters. It does: services (one or more, at least one required), project_dir (default server cwd, copied to target host if no local plugin), files (explicit compose file paths, repeatable -f), project_name (override), timeout_seconds (default 300s). The project_dir note about copying to the target host is genuinely useful context beyond the schema. The only minor gap is that files doesn't mention the default behavior when omitted, but the schema's default:null plus the project_dir note covers the common case.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Block until the named service containers stop, then return their exit codes.' It clearly distinguishes this from sibling tools by naming container_wait and service_wait as alternatives for different scopes. The one-shot/batch use case is stated explicitly, so an agent can tell this apart from compose_stop, compose_run, or container_wait without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit when-to-use guidance: 'For one-shot / batch services' and warns that long-running services block until timeout. It names alternatives directly: 'For a single container use container_wait; for swarm services use service_wait.' It also states when it does not raise (non-zero CLI exit) versus when it does (missing plugin or timeout), which is essential for correct invocation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

config_createA

Create an immutable Swarm config object; requires a swarm manager.

Configs store non-sensitive configuration files (nginx.conf, app.yaml, etc.) and mount them into service containers at a specified path. Unlike secrets, config data is not encrypted at rest - use secret_create for credentials or keys. data is raw bytes; encode strings first (e.g. "my config".encode()). Once created, a config is immutable: to update it, create a new config with a new name and update the service to reference it, then remove the old config with config_remove.

Args: name: Unique config name within the swarm data: Raw bytes content of the config file labels: Labels to set on the config templating: Templating driver config (e.g. {"Name": "golang"} for Go template syntax)

Returns: dict: The created config's full document ({"ID", "Version", "CreatedAt", "Spec", ...})

ParametersJSON Schema
NameRequiredDescriptionDefault
dataYes
nameYes
labelsNo
templatingNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations, the description discloses that configs are immutable, not encrypted at rest, require a swarm manager, and that data must be raw bytes with encoding guidance for strings. This gives an agent clear expectations about the tool's behavior and constraints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and well-structured, front-loading the core purpose before param details and return information. Every sentence adds value, with an example for templating and clear guidance for data encoding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given there is no output schema, the description explicitly documents the return value shape. It also covers usage constraints, alternatives, immutability implications, and all four parameters, leaving little an agent would need to infer.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, yet the description explains every parameter meaningfully: name uniqueness, raw byte content, label assignment, and templating driver config with a concrete example. It compensates fully for the schema's lack of descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it creates an immutable Swarm config object with a specific verb and resource. It distinguishes itself from secret_create by noting configs are not encrypted at rest, and hints at its role of mounting files into service containers.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit guidance: use secret_create for credentials or keys, and explains the update workflow by creating a new config and removing the old one with config_remove. It also states the prerequisite that a swarm manager is required.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

config_inspectA
Read-only

Get a swarm config's full inspect payload by id or name.

Requires a swarm manager. Unlike a secret, a config's payload IS readable after creation: Spec.Data in the result holds the base64-encoded contents. Use config_list to enumerate configs; use this to read one config's contents and metadata.

Returns: dict: The config's full document (ID, CreatedAt, UpdatedAt, Spec{Name, Labels, Data base64})

ParametersJSON Schema
NameRequiredDescriptionDefault
id_or_nameYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark this as read-only, and the description adds valuable behavioral context: config payloads remain readable and are base64-encoded in Spec.Data. This goes beyond the annotations and warns the agent about an unusual security-relevant behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description front-loads the core action in the first sentence, then adds only high-value context: the prerequisite, the comparison to secrets, the input form, and the return shape. Every sentence earns its place with no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description adequately describes the return document fields. The single parameter's semantics are explained, the required environment is stated, and the alternative listing tool is named. Nothing needed for correct invocation is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema only provides a bare string parameter, but the description clarifies that id_or_name accepts either a config ID or name. It also tells the agent how to discover valid values via config_list, fully compensating for the 0% schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource: 'Get a swarm config's full inspect payload by id or name.' It clearly differentiates itself from config_list (enumerate vs read one) and from secrets, making its purpose unambiguous among many sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use this tool: after enumerating with config_list, and when the full payload is needed. It also notes the requirement for a swarm manager and contrasts configs with secrets, helping the agent choose correctly among similar inspect tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

config_listA
Read-only

List swarm configs; requires a swarm manager.

Unlike secrets, config attrs include the actual config data (Spec.Data, base64-encoded) since configs are not treated as sensitive. Valid filter keys: id, name, names, label (key or key=value). Fetch a single config by id/name with config_inspect.

Args: filters: Narrow the list; omit to return every config

Returns: list: One full config document ({"ID", "Spec", ...}) per config

ParametersJSON Schema
NameRequiredDescriptionDefault
filtersNo

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false. The description adds behavioral context beyond that: configs are not treated as sensitive so Spec.Data is included base64-encoded, and the output is a list of full config documents. This covers the meaningful behavior for a read-only list operation, though it omits error/pagination details that are less critical here.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and well-structured: a one-line core statement, a differentiating note, a filter-keys sentence, then clean Args/Returns sections. Every sentence adds value, and the most critical information (what it lists, prerequisite, and alternative) is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only list tool with one optional parameter and no output schema, the description covers scope, prerequisite, filtering options, return format, and the sibling for single-config access. Nothing an agent needs to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema's only parameter (filters) has zero description coverage, so the description carries the burden. It compensates by explaining the parameter's purpose ('Narrow the list; omit to return every config') and enumerating valid filter keys (id, name, names, label with key or key=value), which is meaningfully more than the schema's bare object type.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource ('List swarm configs') and states the prerequisite ('requires a swarm manager'). It distinguishes this tool from secret_list (configs include actual data, not treated as sensitive) and from config_inspect (single config by id/name), making sibling differentiation clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-to-use guidance: the swarm manager prerequisite, valid filter keys, the option to omit filters to return everything, and the alternative tool for fetching a single config by id/name (config_inspect). An agent can decide correctly without opening the schema.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

config_removeA
Destructive

Remove a swarm config.

Requires a swarm manager, and fails while any service still references the config - update or remove those services first. The last step of the rotation flow described in config_create.

Returns: bool: True after removal

ParametersJSON Schema
NameRequiredDescriptionDefault
id_or_nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark destructiveHint=true, but the description adds valuable behavioral context: the failure mode when services reference the config, the manager requirement, and the return value (bool: True after removal). This goes beyond what annotations provide, disclosing operational constraints and outcomes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and front-loaded with the core action. The 'Returns:' line is slightly redundant given the output schema exists, but it is not excessive. The structure is clear with prerequisites and context presented early, making it easy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has only one parameter and an output schema, the description covers the essential operational details: prerequisites (swarm manager), failure condition (services referencing config), and its role in the rotation flow. It is sufficient for an agent to invoke it correctly. The reference to config_create provides workflow context. Minor gaps like the exact format of id_or_name are not critical.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. However, it does not explain the 'id_or_name' parameter beyond the obvious name. It does not specify that it is the config's identifier or how it should be formatted. The parameter name is self-explanatory, but the description adds no additional semantic clarity, leaving the agent to infer from the parameter name alone.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Remove') and the resource ('a swarm config'), distinguishing it from related config tools like config_create and config_list. It even references the rotation flow, linking it to config_create. This is specific and unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit usage conditions: requires a swarm manager, and fails if any service still references the config, advising to update/remove those services first. It also places the tool as the last step of a rotation flow described in config_create. This gives clear context for when to use it, though it doesn't explicitly mention alternatives or when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_archive_getA
Read-only

Retrieve a file or directory from a container as a tar archive, returned in band.

In-band bytes are capped (default 32 MiB) because MCP base64-encodes them; container_archive_get_to_file streams to a host path instead.

Args: path: Path inside the container max_bytes: Abort with ToolInputError if the archive exceeds this many bytes (defaults to 32 MiB)

Returns: dict: Mapping with archive (bytes) and stat (dict) keys

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes
max_bytesNo
id_or_nameYes

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already provide readOnlyHint=true and destructiveHint=false, and the description adds meaningful behavioral context: the in-band size cap, the MCP base64 encoding rationale, the ToolInputError abort condition, and the return shape. It doesn't fully describe the contents of the `stat` dict, which is a minor transparency gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The structure is scannable: purpose first, then explanation of why in-band is limited, then Args and Returns. The default 32 MiB is stated twice (once in the prose and once in the Args block), but the overall length is still reasonable and the extra explanation earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema present, the description appropriately documents the return keys (`archive` and `stat`) and explains the error cap behavior and the size constraint. The main completeness gap is again the undocumented required `id_or_name` parameter, so it falls just short of fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The Args block gives useful semantics for `path` and `max_bytes`, including the default and error behavior. However, schema_description_coverage is 0% and the required `id_or_name` parameter is missing from the Args section entirely, leaving the parameter documentation incomplete.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening sentence uses a specific verb and resource ('Retrieve a file or directory from a container as a tar archive') and clearly communicates the in-band return mode. It also differentiates this tool from its sibling `container_archive_get_to_file` by explicitly noting the streaming alternative.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives practical guidance on choosing between this tool and `container_archive_get_to_file`: it explains that in-band bytes are capped to a default of 32 MiB and that the sibling streams to a host path instead. It stops short of an explicit 'use X when Y, do not use when Z' structure, so not a 5, but the usage context is clearly present.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_archive_get_to_fileA

Retrieve a file or directory from a container as a tar archive written to a file on the server host.

File-writing variant of container_archive_get - prefer it for anything large, since in-band bytes are base64-encoded by MCP. For the whole filesystem use container_export. Streams straight to disk (no in-band byte cap). The file is written by the server's user; ~ is expanded and an existing file is refused unless overwrite=True.

Args: path: Path inside the container dest_path: Destination path on the server host for the tarball overwrite: Replace dest_path if it already exists

Returns: dict: {"path": , "bytes_written": int, "stat": dict}

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes
dest_pathYes
overwriteNo
id_or_nameYes

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations, the description discloses key behaviors: it streams straight to disk with no in-band byte cap, the file is written by the server's user, `~` is expanded, and existing files are refused unless `overwrite=True`. These details are not available from annotations or schema and materially affect invocation and error handling.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded, with the core purpose and variant distinction first, followed by inline argument definitions and a return structure. Each sentence adds useful information without filler or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Even without an output schema, the description provides the return structure, destination handling details, overwrite behavior, and comparison to relevant siblings. This is complete enough for an agent to invoke the tool correctly in most situations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description compensates for most parameters by explaining `path`, `dest_path`, and `overwrite` semantics. It omits an explanation of `id_or_name`, though the schema marks it required and its meaning is inferable from the tool name. The return shape is also usefully described, but the missing parameter note prevents a perfect score.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action—retrieve a file or directory from a container as a tar archive written to a host file—with a clear destination. It also explicitly distinguishes itself from the sibling `container_archive_get` as the file-writing variant, so an agent can select it correctly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit usage guidance: prefer this over `container_archive_get` for large payloads because in-band bytes are base64-encoded, and use `container_export` for the whole filesystem. This directly addresses when to choose this tool over alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_archive_putA

Upload a tar archive to a path inside a container, from in-band bytes or a file on the server host.

Inverse of container_archive_get: the archive is extracted at path inside the container. Pass exactly one of data (tar bytes in band) or from_file (a path on the server host, streamed straight to the daemon - preferred for large archives, since in-band bytes are base64-encoded by MCP). from_file is read by the server's user; ~ is expanded.

Args: path: Destination path inside the container (must already exist) data: Tar archive bytes; exactly one of data/from_file from_file: Path on the server host to the tar archive to upload; exactly one of data/from_file

Returns: bool: True if the upload succeeded

ParametersJSON Schema
NameRequiredDescriptionDefault
dataNo
pathYes
from_fileNo
id_or_nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Description adds meaningful transparent behavior beyond annotations: inversion relationship, base64 encoding of in-band bytes, server-user reading of from_file, and ~ expansion. It omits overwrite semantics on extraction but disclosures are strong.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded purpose, compact and organized into a lead paragraph followed by Args/Returns sections. Every sentence carries information; only a small redundancy between the prose and the Args list.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Adequate for the tool's complexity: covers purpose, extraction at path, input options, and return type bool. Minor gaps such as overwrite at destination and effects of partial extraction remain but are not critical.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description fully compensates by explaining the meaning of path, data, and from_file and their mutual exclusivity. only id_or_name lacks explanation, but it is inferable from container context.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Upload a tar archive to a path inside a container'), names the inverse operation (container_archive_get), and makes the extraction semantics clear. The tool is immediately distinguishable from all siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly names the inverse tool and the mutually exclusive data vs from_file options, and recommends from_file for large archives due to MCP base64 encoding. The requirement that path must already exist is also stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_commitA

Snapshot a container's current filesystem state as a new image.

Useful for capturing a debugging state or saving manual changes made inside a container. For repeatable builds use image_build with a Dockerfile instead; publish the result with image_tag + image_push. The container is paused by default during the snapshot to ensure filesystem consistency - set pause=False only if the container cannot be paused. changes accepts Dockerfile instructions to apply on top of the snapshot, e.g. ["CMD ["python", "app.py"]", "ENV FOO=bar"].

Args: id_or_name: Container id or name to snapshot repository: Repository name for the new image, e.g. "myorg/myimage" tag: Tag for the new image (default: "latest") message: Commit message stored in the image metadata author: Author string stored in the image metadata pause: Pause the container during commit for consistency changes: Dockerfile instructions (CMD, ENV, EXPOSE, etc.) to apply to the image conf: Additional image configuration overrides as a dict

Returns: dict: The new image's full inspect payload (Id is the new image id)

ParametersJSON Schema
NameRequiredDescriptionDefault
tagNo
confNo
pauseNo
authorNo
changesNo
messageNo
id_or_nameYes
repositoryNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Without useful annotation detail (readOnlyHint=false and destructiveHint=false are generic), the description carries the behavioral burden. It discloses a key runtime behavior: 'The container is paused by default during the snapshot to ensure filesystem consistency.' It also explains the effect of changes ('Dockerfile instructions to apply on top of the snapshot') and the return value ('full inspect payload (Id is the new image id)'). This is transparency beyond any structured field.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with a one-sentence summary, then supplies usage context, an alternative, behavioral notes, and a structured Args/Returns section. Every sentence adds information; there is no fluff or repetition of schema defaults except where it adds clarity (e.g., tag default). It is appropriately sized for a tool with 8 parameters.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite no output schema and no schema-level parameter descriptions, the description covers the full contract: what it does, when to use it, which sibling to use instead, all 8 parameters with meanings and examples, a critical default behavior (pause), and the return payload. An agent has enough information to call this tool correctly without inspecting further.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description fully compensates. Every parameter is explained: id_or_name ('Container id or name to snapshot'), repository ('Repository name for the new image, e.g. "myorg/myimage"'), tag (default 'latest'), message, author, pause, changes (with Dockerfile instruction examples), and conf ('Additional image configuration overrides as a dict'). The changes example is especially valuable: '["CMD ["python", "app.py"]", "ENV FOO=bar"]'.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a precise action: 'Snapshot a container's current filesystem state as a new image.' This states the verb (snapshot), resource (container filesystem), and result (new image). It also distinguishes itself from the sibling image_build by saying 'For repeatable builds use image_build with a Dockerfile instead,' making the tool's unique role clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage context is explicit: 'Useful for capturing a debugging state or saving manual changes made inside a container.' It then gives an explicit alternative and routing: 'For repeatable builds use image_build with a Dockerfile instead; publish the result with image_tag + image_push.' It even provides behavioral guidance on the pause parameter: 'set pause=False only if the container cannot be paused.' This tells the agent exactly when to use this tool versus the sibling build/publish tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_createA

Create a container from an image without starting it.

Use this when you need to configure a container (with extra_kwargs) before its first start, or want creation and start as separate observable steps. For the common case of create-then-start-immediately use container_run instead - it does both in one call. Start the created container with container_start. Common extra_kwargs keys: name (str), environment (list of "KEY=VAL" or dict), ports (dict, e.g. {"80/tcp": 8080}), volumes (dict, e.g. {"/host/path": {"bind": "/container/path", "mode": "rw"}}), labels (dict). For anything else docker-py's ContainerCollection.create accepts, call docs_lookup(section="containers") rather than guessing a key name.

Args: image: Image to create the container from, e.g. "nginx:alpine" command: Override the image's default command; string or list of strings extra_kwargs: Additional docker-py ContainerCollection.create keyword arguments

Returns: dict: The created container's full inspect payload (not yet running)

ParametersJSON Schema
NameRequiredDescriptionDefault
imageYes
commandNo
extra_kwargsNo

TDQS

A4.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description clearly states the container is created but not started, and that the return value is the full inspect payload 'not yet running'. It also directs agents to docs_lookup for unsupported extra_kwargs instead of guessing. With only minimal annotations, this carries the burden well, though it could mention side effects like image pulling or permissions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but well-structured and every clause earns its place. The first sentence delivers the core purpose; usage guidance comes next; parameter examples and fallback lookup instructions are structured clearly. Given the zero-coverage schema, this verbosity is justified.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the required parameter, optional parameters, common extra_kwargs formats, expected return value, and points to docs_lookup for unknown options. Since there is no output schema, the return description is sufficient. This is complete enough for an agent to use the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description fully compensates: image gets a concrete example, command gets type clarification, and extra_kwargs gets a detailed list of common keys with exact value shapes (e.g., ports, volumes, and environment formats). This gives agents enough detail to call the tool without guessing.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource ('Create a container from an image without starting it') and immediately distinguishes this tool from container_run and container_start. This makes the tool's identity clear even among a large sibling list.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says when to use container_create (configuring with extra_kwargs before first start, or wanting separate observable steps), when not to (common create-then-start should use container_run), and what to do next (use container_start). This is explicit, actionable guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_diffA
Read-only

List filesystem changes a container has made relative to its image.

Use it to audit what a container wrote before container_commit or container_archive_get, or to debug unexpected writes. Only the writable container layer is compared - files in volumes and bind mounts never show up.

Returns: list: Dicts of {"Path", "Kind"}; Kind 0=modified, 1=added, 2=deleted

ParametersJSON Schema
NameRequiredDescriptionDefault
id_or_nameYes

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false. The description adds valuable behavioral details beyond that: it limits comparison to the writable container layer, excludes volumes/bind mounts, and defines the return structure (list of {'Path','Kind'} with Kind meanings). These are meaningful clarifications that help the agent anticipate results and limitations, without contradicting annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is exceptionally concise: a clear lead sentence, two practical usage sentences, and a compact return-format note. Every sentence earns its place, with no redundancy or filler. The most critical information (what it lists and its scope) is front-loaded, and the return format is presented in a scannable block. This is model clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only tool with one parameter and no output schema, the description covers everything necessary: purpose, usage guidance, behavioral scope (writable layer only), and the exact output format. It also implicitly handles edge cases (volumes/bind mounts) and gives enough context to decide when to use it. There is no gap that would prevent an agent from correctly invoking it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has 0% description coverage for the single parameter 'id_or_name', and the description does not explicitly explain it. However, the parameter's meaning is self-evident from the tool's name and context (a container identifier). The description focuses on behavior and return format, and while it does not add explicit parameter semantics, the triviality of 'id_or_name' makes this an acceptable baseline. A 3 is fair because the description could have clarified acceptable formats (e.g., name vs. ID) but does not.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb-resource pair: 'List filesystem changes a container has made relative to its image.' It clearly defines the tool's output (the diff) and its scope (writable layer only). This is distinct from sibling tools like container_inspect or container_commit, and the description's explicit boundary (volumes/bind mounts excluded) further sharpens its purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives concrete use cases: 'audit what a container wrote before container_commit or container_archive_get, or to debug unexpected writes.' It also warns that files in volumes and bind mounts never appear, which implicitly tells the agent when this tool is not appropriate. It does not name alternative tools explicitly, but the guidance is clear and actionable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_execA

Run a command inside a running container (for a compose service, prefer compose_exec).

Security: when any element of cmd is agent-controlled, use an exec-form argv list that does not invoke a shell (e.g. ["python", "-V"], ["ls", path]). A string cmd, or a shell form like ["sh", "-c", template], interprets shell metacharacters in the untrusted parts.

Args: cmd: Command to execute (prefer exec-form argv, no shell, when any element is agent-controlled) tty: Allocate a pseudo-TTY privileged: Run with extended privileges user: User to run the command as detach: Detach from the exec environment: Environment variables, as {"KEY": "value"} or a list of "KEY=value" strings workdir: Working directory inside the container demux: Return stdout and stderr separately

Returns: dict: {"exit_code", "output"}; output is combined stdout+stderr, or a [stdout, stderr] pair with demux=True

ParametersJSON Schema
NameRequiredDescriptionDefault
cmdYes
ttyNo
userNo
demuxNo
stdinNo
detachNo
stderrNo
stdoutNo
workdirNo
id_or_nameYes
privilegedNo
environmentNo

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the sparse annotations, the description discloses that shell metacharacters in agent-controlled `cmd` are interpreted and instructs callers to use exec-form argv. It also discloses the return format and the difference between combined and demuxed output, which is valuable behavioral context an agent would not otherwise know.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core action and alternative, and the Args/Returns sections are structured as compact one-liners. The exec-form security guidance appears twice—once in the security paragraph and again in the `cmd` arg comment—which is slightly redundant but not bloated.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 12-parameter tool with no output schema and sparse annotations, the description covers the essential invocation details: the target container, alternative tool, security constraints, parameter meanings, and return shape. It is not fully complete because `id_or_name`, `stdin`/`stdout`/`stderr`, and side effects of `detach`/`privileged` are not elaborated, but it provides enough for correct use in most cases.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description compensates well by explaining `cmd`, `environment`, `demux`, and other flags in compact terms. However, it omits the required `id_or_name` and does not explain the semantics of `stdin`, `stdout`, or `stderr`, leaving a few parameters underdocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening line 'Run a command inside a running container' states a specific verb, resource, and precondition. The parenthetical 'for a compose service, prefer `compose_exec`' explicitly distinguishes it from the closest sibling, so an agent can tell it apart without opening other tool definitions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives an explicit routing rule: for compose services, prefer `compose_exec`, which tells the agent when not to use this tool. It also provides security-driven guidance on choosing exec-form argv versus a shell string, giving clear context for safe invocation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_exportA

Export a container's filesystem as a tar archive: to a file on the server host, or in band.

The tar is a flat filesystem snapshot with no image metadata or layers - use image_save for an archive that image_load can restore, and container_archive_get for a single file or directory. With dest_path the archive streams straight to disk (no byte cap), so it handles large containers - the file is written by the server's user, ~ is expanded, and an existing file is refused unless overwrite=True. Without dest_path the tar bytes are returned in band, capped at max_bytes (default 32 MiB) because MCP base64-encodes them - a fallback for when no writable host path exists (e.g. a containerized server without a bind mount).

Args: dest_path: Destination path on the server host; omit to return the bytes in band overwrite: Replace dest_path if it already exists max_bytes: In-band mode: abort with ToolInputError beyond this many bytes (default 32 MiB)

Returns: bytes | dict: the tar bytes (in band), or {"path": , "bytes_written": int}

ParametersJSON Schema
NameRequiredDescriptionDefault
dest_pathNo
max_bytesNo
overwriteNo
id_or_nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations only provide readOnlyHint=false and destructiveHint=false, so the description carries the behavioral burden. It provides rich detail: the tar is flat with no metadata/layers, dest_path streams to disk with no byte cap, the file is written by the server's user, ~ is expanded, existing files are refused unless overwrite=True, in-band responses are capped at max_bytes because of MCP base64 encoding, and exceeding the cap aborts with ToolInputError. This greatly exceeds what annotations offer.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but well structured: a one-line summary, then sibling differentiation, then mode-specific behavior, then an Args list, then Returns. Every sentence adds operational detail. The front-loaded summary ensures the core purpose is immediately clear despite the length.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with one required parameter aliasable by id/nameable container, the description covers the two modes, the exact arguments, defaults, error behavior, return shape, and limitations. It also explains why the byte cap exists, which is not structurally available elsewhere. The only small gap is the undocumented id_or_name parameter, but this is minor given the rest of the description's completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It documents dest_path, overwrite, and max_bytes with behavior and defaults, which is substantial. However, id_or_name, the single required parameter, does not appear in the Args list. While the parameter name is self-explanatory, the description missed an opportunity to explicitly state it identifies the container by ID or name.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description begins with a precise verb-resource statement: 'Export a container's filesystem as a tar archive' and immediately distinguishes two output modes. It explicitly contrasts this tool with image_save and container_archive_get, so an agent can tell it apart from these siblings without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear when-to-use and when-not-to-use guidance: use image_save when the archive needs to be restored via image_load, use container_archive_get for a single file or directory, and use container_export for a flat filesystem snapshot. It also explains when to use dest_path vs. in-band mode, including the fallback scenario for containerized servers without writable host paths.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_inspectA
Read-only

Return the full inspect detail for a single container.

Use this when you need complete information about one container - config, state, network settings, mounts, environment variables, and resource limits. To enumerate many containers use container_list instead (same payload per container by default; abridged with sparse=True). For just logs or stats use container_logs / container_stats.

Args: id_or_name: Container id (full or short) or name

Returns: dict: Full container inspect attrs (equivalent to docker inspect)

ParametersJSON Schema
NameRequiredDescriptionDefault
id_or_nameYes

TDQS

A4.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so safety is covered. The description adds useful behavioral context by specifying the breadth of returned data (config, state, network, mounts, env vars, resource limits) and noting equivalence to `docker inspect`.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Every sentence earns its place: purpose, usage guidance, parameter semantics, and return type are all covered without redundancy. The most important scoping words ('single container') are front-loaded, and the alternatives are listed compactly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter read-only tool with no output schema, the description gives complete information: how to identify the container, what the response contains, and which sibling tools to use instead. Nothing an agent needs to select or invoke the tool is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema provides only a bare string parameter with 0% coveragecell coverage. The description fully compensates by documenting that `id_or_name` accepts a full id, short id, or name, which is exactly the semantic nuance an agent needs to call the tool correctly.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb-resource pairing: 'Return the full inspect detail for a single container.' It clearly scopes the tool to one container and distinguishes it from enumerating containers or retrieving logs/stats, all in the first sentences.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit when-to-use guidance: 'Use this when you need complete information about one container,' and names alternatives with conditions: 'To enumerate many containers use container_list instead... For just logs or stats use container_logs / container_stats.' No inference is required.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_killA
Destructive

Send a signal to a running container (default SIGKILL - immediate, no graceful shutdown).

Use it to force-kill a container that ignores container_stop, or with signal to poke a process without stopping it (e.g. SIGHUP for a config reload). For a normal shutdown prefer container_stop, which sends the container's configured stop signal first. Fails with a conflict error if the container is not running. When the server runs containerized it refuses to signal its own container.

Args: signal: Signal name or number as a string (e.g. "SIGHUP", "9"); default SIGKILL

Returns: dict: The container's full inspect payload after the signal

ParametersJSON Schema
NameRequiredDescriptionDefault
signalNo
id_or_nameYes

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint=true and readOnlyHint=false, but the description adds substantial context: the default signal, lack of graceful shutdown, conflict error on non-running containers, refusal to signal the server's own container, and the return value (inspect payload). This goes well beyond what annotations provide, with no contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured: purpose first, then usage guidance, edge cases, and finally args and returns. Every sentence serves a purpose; it is detailed without being verbose. The key facts are front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with no output schema, the description covers everything an agent needs: the action, the default signal, edge cases, parameter semantics, and the return format. Combined with the annotations, it is fully self-sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must explain parameters. It does explain 'signal' with examples and default, which is critical. However, 'id_or_name' is not explicitly described, though its name makes its meaning obvious. The description adds value for the signal parameter but could explicitly mention that id_or_name accepts container ID or name.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Send a signal to a running container', clearly differentiating it from container_stop by stating the default SIGKILL and immediate termination. It names the sibling tool container_stop and explains when each is appropriate, leaving no ambiguity about what this tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly tells the agent when to use this tool ('force-kill a container that ignores container_stop') and when not to ('For a normal shutdown prefer container_stop'), and even shows a secondary use case (SIGHUP reload). It also states failure conditions (not running, own container), giving complete guidance for selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_listA
Read-only

List containers on the daemon (running only by default).

Pass all=True to include stopped containers. For a compose project compose_ps groups containers by service; for swarm services use service_ps (tasks may live on other nodes).

Args: all: Show all containers, including stopped ones (default False: running only) since: Only show containers created after this id or name before: Only show containers created before this id or name limit: Maximum number of results filters: Filter by attributes (e.g. status, label) sparse: Skip inspect calls and return less detail ignore_removed: Ignore containers removed during listing; inert when sparse=True, which skips the inspect calls that would fail managed_only: Only return containers created by this MCP server (filters on the docker-mcp-server.managed label); combines with any filters given

Returns: list: One dict per container: full inspect payloads by default (each match is inspected, like container_inspect); sparse=True skips the per-container inspect calls and returns the daemon's abridged list entries instead

ParametersJSON Schema
NameRequiredDescriptionDefault
allNo
limitNo
sinceNo
beforeNo
sparseNo
filtersNo
managed_onlyNo
ignore_removedNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes well beyond the annotations. It discloses that by default each matching container is inspected (like container_inspect), that sparse=True skips those calls, and that ignore_removed is inert when sparse is true. It also clarifies the return format and the conditional behavior of managed_only. No contradiction with annotations (readOnlyHint=true, destructiveHint=false); the description reinforces and enriches the non-destructive nature.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-organized with clear sections for the main purpose, argument explanations, and return value details. It front-loads the core behavior and then addresses parameters in a compact but complete bullet list. Every sentence adds value; despite covering many nuances, it avoids redundancy and stays focused.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 8 parameters, no output schema, and multiple behavioral nuances, the description is comprehensive. It explains all parameters, return shapes (full vs sparse), and specifics like managed_only filtering. It also addresses the edge case of ignore_removed with sparse. The agent has enough information to call the tool correctly in any scenario.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the full burden. It explains all 8 parameters in plain language, including defaults, semantics, and edge cases (e.g., 'ignore_removed is inert when sparse=True'). This fully compensates for the missing schema descriptions and gives the agent precise guidance for each argument.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific verb and resource: 'List containers on the daemon', and immediately clarifies the default scope ('running only'). It also distinguishes itself from sibling tools compose_ps and service_ps by naming them explicitly and describing their different grouping semantics, which is exactly what an agent needs to select the right tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-to-use guidance: 'For a compose project compose_ps groups containers by service; for swarm services use service_ps'. This tells the agent not just what the tool does but also when to choose an alternative. It also gives the default behavior for `all` and explains when each parameter is relevant, leaving no ambiguity about invocation context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_logsA
Read-only

Get the logs of a container: a one-shot snapshot by default, or a bounded live tail with follow=True.

Follow mode returns when limit_lines lines are collected, timeout_seconds elapses, or the container exits, whichever comes first - so the agent can watch live output without blocking forever. limit_lines/timeout_seconds apply only in follow mode; until only in snapshot mode.

Snapshot mode is capped at 32 MiB and raises ToolInputError past it, so a noisy container can't exhaust the server's memory; service_logs caps the same way and lets the caller raise it. Prefer an integer tail, or since, over tail="all" on a long-running container: "all" is safe but will abort on the cap rather than returning a partial answer, and a large result can still exceed the agent's context.

Caveat for ssh:// daemons: docker-py can't cancel an SSH stream, so in follow mode the timeout_seconds watchdog can't interrupt a fully silent container - use the snapshot mode there if you need a hard time bound.

Args: tail: Number of lines from the end, or the literal "all" for everything since: Only return logs created after this unix timestamp until: Only return logs created before this unix timestamp (snapshot mode only) follow: Follow the live log stream instead of returning a snapshot limit_lines: Follow mode: max lines to collect before returning timeout_seconds: Follow mode: max wall-clock seconds before returning what was collected

Returns: str: Decoded log output (up to limit_lines lines in follow mode). Raises ToolInputError in snapshot mode if the logs exceed 32 MiB.

ParametersJSON Schema
NameRequiredDescriptionDefault
tailNo
sinceNo
untilNo
followNo
stderrNo
stdoutNo
id_or_nameYes
timestampsNo
limit_linesNo
timeout_secondsNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds substantial behavioral context beyond annotations: the 32 MiB cap and ToolInputError, follow-mode termination conditions, the SSH daemon caveat about timeout not interrupting silent containers, and the fact that snapshot mode raises rather than returning partial results. This is rich, honest behavioral disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but every sentence earns its place. It front-loads the core purpose and mode distinction, then covers limits, alternatives, caveats, and parameters in a logical order. The parameter list is compact and aligned with the schema. No filler or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 10-parameter tool with no schema descriptions, the description covers all parameters, return values, error behavior, mode-specific semantics, and a platform-specific caveat. The output schema exists and the description explains the return string. Nothing an agent needs to call this correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the full burden for 10 parameters. It explains each parameter's meaning and mode-specific applicability: `tail` accepts integer or 'all', `since`/`until` are timestamps, `follow` switches modes, `limit_lines` and `timeout_seconds` only apply in follow mode, and `until` only in snapshot mode. It also clarifies return behavior and error conditions. This fully compensates for the schema's lack of descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Get the logs of a container', and immediately distinguishes the two modes (snapshot vs follow). It also names the sibling tool `service_logs` and `compose_logs` implicitly by contrast, making it clear this is for individual containers. The scope is precise and an agent can tell it apart from related log tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit when-to-use guidance: snapshot mode for one-shot, follow mode for live tail, and warns against `tail="all"` on long-running containers. It also names `service_logs` as an alternative with a different cap behavior. This is strong routing guidance with exclusions and alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_pauseA

Suspend all processes in a container using the kernel freezer cgroup.

Unlike sending SIGSTOP, the freezer cgroup suspends processes without their being able to observe or intercept the suspension. A paused container keeps its resources (memory, open file descriptors) but consumes no CPU. Resume with container_unpause - container_exec fails against a paused container until it is unpaused.

Returns: dict: The container's full inspect payload after pause (State.Paused true)

ParametersJSON Schema
NameRequiredDescriptionDefault
id_or_nameYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses that a paused container retains resources but consumes no CPU, and that the return payload has State.Paused true. It also notes the exec failure. While annotations are minimal (no readOnly/destructive hints), the description adds functional behavior beyond the schema. It does not contradict annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, front-loads the purpose, and includes a comparison and a warning in a clear structure. Every sentence earns its place without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter tool with no output schema, the description covers the action, the effect on resources, the resume path, a caveat (exec failure), and the return payload. Nothing essential is missing for an agent to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must explain the sole parameter id_or_name. It implicitly refers to the container (e.g., 'the container's full inspect payload'), but never explicitly states that id_or_name is the container ID or name. The meaning is inferable from context but not directly stated, so it adds only marginal semantic value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Suspend') and resource ('container'), and specifies the mechanism ('kernel freezer cgroup'), which clearly differentiates it from sibling tools like container_stop or container_kill. It also contrasts with SIGSTOP, further clarifying its unique purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly explains when to use this tool (to suspend without signal interception), what to avoid (SIGSTOP), and what to do next (resume with container_unpause). It also warns that container_exec fails on a paused container, giving concrete guidance on consequences and alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_pruneA
DestructiveIdempotent

Remove all stopped containers to reclaim disk space.

Only removes containers that are not running - running containers are never affected. Use container_list(all=True) to preview what would be removed before calling this. Valid filter keys: until (RFC3339 timestamp or duration like "24h" - removes containers stopped before that point), label (key or key=value). For a broader cleanup of containers plus unused images, networks, and volumes see the prune_managed prompt.

Args: filters: Narrow which stopped containers to remove; omit to remove all stopped

Returns: dict: {"ContainersDeleted": [...], "SpaceReclaimed": }

ParametersJSON Schema
NameRequiredDescriptionDefault
filtersNo

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already flag the operation as destructive and idempotent, and readOnly is false. The description adds the critical safety boundary that running containers are never affected, the supported filter keys and their formats, and the return shape. It does not discuss failure modes or permissions, but with the annotations the description adds meaningful behavioral context beyond the metadata.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Each sentence earns its place: the primary purpose, the safety guarantee, the preview and alternative routes, the filter semantics, and the return payload. The one-sentence purpose is front-loaded and the rest of the description is compactly organized.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter tool with no output schema, the description is complete: it documents the return shape, filter keys and formats, how to preview, the safety guarantee, and the alternative route. The agent can correctly invoke the tool without additional information.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the full parameter-meaning burden. It succeeds: `filters` is explained as narrowing which stopped containers are removed, the default behavior (omit to remove all) is stated, and the valid keys (`until`, `label`) are described with format and examples. This is far beyond the bare empty object in the input schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: 'Remove all stopped containers to reclaim disk space.' The 'all stopped' scope clearly distinguishes it from singular container removal and from the broader `prune_managed` cleanup route, so an agent can identify the tool's purpose without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides strong usage guidance: use `container_list(all=True)` to preview before calling, and choose `prune_managed` for broader cleanup of containers, images, networks, and volumes. It stops short of explicitly saying when a per-container alternative like `container_remove` would be appropriate, but the all-stopped-container scope and preview instruction cover the primary decision.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_removeA
Destructive

Remove a container, deleting its writable layer.

The image is untouched (image_remove deletes images); named volumes are never removed - volumes=True only covers anonymous ones. A running container is refused unless force=True, which kills it first. When the server runs containerized it refuses to remove its own container.

Args: volumes: Also remove anonymous volumes (the CLI's --volumes); named volumes persist link: Remove the specified link force: Kill a running container before removing it (default False: running is an error)

Returns: bool: True after removal completes

ParametersJSON Schema
NameRequiredDescriptionDefault
linkNo
forceNo
volumesNo
id_or_nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the destructiveHint annotation, the description reveals the writable layer is deleted, images and named volumes are preserved, anonymous volumes are only removed with volumes=True, running containers require force, and self-removal is blocked. It also states the boolean return value, giving a clear behavioral contract.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a summary paragraph, an Args list, and a Returns section. It is slightly redundant, repeating that named volumes persist in both the opening paragraph and the volumes argument, which costs it a point.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive container operation, the description covers the main action, side effects, edge cases, parameter behavior, and return value. Nothing essential is missing for an agent to decide when and how to invoke the tool safely.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has 0% description coverage, so the description compensates well by explaining volumes (anonymous only, named persist), force (kills running container, default false), and link. The only gap is id_or_name, which is not explained beyond its self-descriptive name, so not quite a perfect score.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description starts with a specific verb and resource: "Remove a container, deleting its writable layer." It also disambiguates from image_remove by stating the image is untouched, and clarifies that named volumes are never removed, so an agent knows exactly which object the tool acts on.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit conditions: running containers are refused unless force=True, force kills first, and containerized servers refuse to remove their own container. It also names image_remove as the alternative for deleting images, providing direct when-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_renameA

Rename a container in place; its id, state, and configuration are unchanged.

Use it to free up or claim a container name (names are unique per daemon) - e.g. before starting a replacement under the old name. Fails with a conflict error if the new name is already taken. Not related to image_tag, which names images.

Args: name: The new name; must not be in use by any other container

Returns: dict: The container's full inspect payload after the rename

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes
id_or_nameYes

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=false and destructiveHint=false, so the mutation is disclosed. The description adds valuable behavioral context beyond annotations: the rename is in-place with id/state/configuration unchanged, names are unique per daemon, and it fails with a conflict error if the new name is taken. It does not detail permission requirements or side effects on dependent resources, but for a rename operation the disclosed behavior is solid.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded: the core semantics appear in the first sentence, followed by usage context, a failure condition, and a sibling disambiguation. The Args/Returns sections are minimal and useful. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter mutation with no output schema, the description covers the operation's semantics, uniqueness constraint, failure mode, and return value (full inspect payload). It lacks explicit mention of permissions or what happens to references to the old name, but these are not critical for invoking the tool correctly. The description is complete enough for an agent to select and call it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It explains the `name` parameter ('The new name; must not be in use by any other container') and the overall operation implies `id_or_name` identifies the container to rename. It does not explicitly define `id_or_name` as the current container identifier, but the tool name and context make this inferable. The description adds meaning beyond the bare schema, though a one-line clarification of `id_or_name` would make it complete.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Rename'), a resource ('container'), and the key semantic: 'in place; its id, state, and configuration are unchanged.' It also explicitly distinguishes itself from the sibling `image_tag` ('Not related to `image_tag`, which names images'), so an agent can tell it apart from the most confusable sibling without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit when-to-use context: 'Use it to free up or claim a container name (names are unique per daemon) - e.g. before starting a replacement under the old name.' It also states a failure condition ('Fails with a conflict error if the new name is already taken') and names the alternative it is not (`image_tag`). This is strong routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_restartA

Restart a container: stop then start again in one call.

The container receives its configured stop signal (STOPSIGNAL, default SIGTERM), SIGKILL after stop_timeout_seconds, and is then started. Use container_stop/container_start to do the halves separately. When the server runs containerized it refuses to restart its own container.

Args: stop_timeout_seconds: Seconds between the stop signal and SIGKILL

Returns: dict: The container's full inspect payload after the restart

ParametersJSON Schema
NameRequiredDescriptionDefault
id_or_nameYes
stop_timeout_secondsNo

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes well beyond the annotations by detailing the STOPSIGNAL behavior, default SIGTERM, SIGKILL after stop_timeout_seconds, the subsequent start, and the self-container refusal. These are meaningful behavioral details not present in readOnlyHint or destructiveHint.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core action, then groups behavioral details, the alternative tool, the caveat, and a compact Args/Returns block. Every sentence contributes distinct, useful information with no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter restart operation with no output schema, the description provides the return type, the key timing behavior, and the self-restart limitation. It is only slightly incomplete because the required identifier parameter is not explained and container preconditions are not mentioned.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description gives precise meaning for stop_timeout_seconds: seconds between the stop signal and SIGKILL, which is valuable because schema description coverage is 0%. However, the required id_or_name parameter is not described in the Args section, leaving the agent to infer that it takes a container ID or name from the property name and tool context.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence defines the verb and resource precisely: restart a container by stopping then starting it in one call. It also distinguishes the tool from container_stop/container_start, making its combined behavior clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly directs the agent to use container_stop/container_start when the halves are needed separately. It also flags the important caveat that a containerized server refuses to restart its own container, which is essential for correct tool selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_runA

Run a container from an image (create and start in one call, like docker run).

Use container_create to prepare a container without starting it, or container_exec to run a command in a container that already exists. With detach=False the call blocks until the container exits and returns its output, so long-running images need detach=True. Created containers are stamped with provenance labels.

Args: command: The command to run in the container name: Name to assign to the container detach: Run in the background and return container info environment: Environment variables, as {"KEY": "value"} or a list of "KEY=value" strings ports: Port mappings, e.g. {'2222/tcp': 3333} volumes: Volumes to mount, as {"/host/path": {"bind": "/in/container", "mode": "rw"}} or a list of "host:container:mode" strings network: Name of the network to attach hostname: Hostname for the container user: Username or UID to run as working_dir: Working directory inside the container entrypoint: Entrypoint to override the image default restart_policy: Restart policy, e.g. {'Name': 'on-failure', 'MaximumRetryCount': 3} labels: Labels to set on the container remove: Remove the container when it exits (only with detach=False) auto_remove: Enable auto-removal of the container on daemon side privileged: Give extended privileges to the container tty: Allocate a pseudo-TTY mem_limit: Memory limit: bytes as an int, or a units string ("100000b", "1000k", "128m", "1g") cpu_count: Number of CPUs extra_kwargs: Additional keyword arguments forwarded to ContainerCollection.run (call docs_lookup(section="containers") for the full accepted set)

Returns: dict | str: The container's full inspect payload when detach=True, else stdout/stderr as a string

ParametersJSON Schema
NameRequiredDescriptionDefault
ttyNo
nameNo
userNo
imageYes
portsNo
detachNo
labelsNo
removeNo
commandNo
networkNo
volumesNo
hostnameNo
cpu_countNo
mem_limitNo
entrypointNo
privilegedNo
stdin_openNo
auto_removeNo
environmentNo
working_dirNo
extra_kwargsNo
restart_policyNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations only contain readOnlyHint=false and destructiveHint=false, so the description carries most of the behavioral burden. It adds valuable runtime behavior: blocking/returning output with detach=False, returning inspect payloads with detach=True, and stamping containers with provenance labels. It could mention auth/error conditions but these are not common for a local Docker tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with a one-line purpose, then usage guidance, then a compact Args list, and finally a Returns note. Each parameter gets a single, mostly one-line explanation with examples only for the non-obvious ones. It is long because there are 22 parameters, but it avoids fluff and repetitive phrasing.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity of 22 parameters and nested object types, the description covers most usage scenarios with passable guidance and format examples. It also references docs_lookup for extra_kwargs, which helps discover the full set. It misses two parameters (image, stdin_open) and does not elaborate on error cases, but the overall invocation path is clear.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so this description is the primary source of parameter meaning. It provides concrete formats and examples for environment, ports, volumes, restart_policy, and mem_limit, and explains extra_kwargs. However, it omits the image and stdin_open parameters, which remain undocumented except for the raw schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Run a container from an image (create and start in one call, like `docker run`)', which clearly states the verb, resource, and atomic action. It distinguishes the tool from container_create (prepares without starting) and container_exec (runs in an existing container), so an agent can tell them apart without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly instructs when to use alternatives: 'Use container_create to prepare a container without starting it, or container_exec to run a command in a container that already exists.' It also gives conditionally actionable advice about detach: 'long-running images need detach=True', guiding the choice between blocking and background behavior.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_startA

Start an existing stopped container.

Use this to restart a container that was previously created or stopped without removing it. To create and start a new container in one step use container_run instead. Calling on an already-running container has no effect (the daemon returns 304 and no error is raised). To stop then start a running container use container_restart.

Args: id_or_name: Container id (full or short) or name

Returns: dict: The container's full inspect payload after starting

ParametersJSON Schema
NameRequiredDescriptionDefault
id_or_nameYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (readOnlyHint=false, destructiveHint=false), the description discloses the important idempotency behavior: calling on a running container has no effect and the daemon returns 304 without error. It also states the return payload is the full inspect result.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured and front-loaded: purpose first, usage alternatives second, then Args and Returns. Every sentence provides actionable information with no padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter tool with no output schema, the description covers selection, invocation, edge-case behavior, and return format. An agent has everything needed to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, but the description compensates fully by explaining id_or_name as 'Container id (full or short) or name.' This adds essential meaning the schema alone does not provide.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: 'Start an existing stopped container.' It clearly distinguishes itself from sibling tools by naming container_run and container_restart, so an agent can immediately understand its unique role.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-to-use guidance with alternatives: use container_run for create-and-start, use container_restart for stop-then-start, and notes the idempotent behavior on already-running containers. This fully routes the agent to the correct tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_statsA
Read-only

Get one point-in-time resource-usage snapshot for a container (non-streaming).

Returns the raw engine stats payload; CPU percent must be computed from the delta between cpu_stats and precpu_stats. By default the daemon collects two cycles before answering, which is what fills precpu_stats - so the call takes about a second. one_shot=True returns after a single collection instead, leaving precpu_stats zeroed and CPU percent uncomputable; use it when only memory_stats/pids_stats matter. For a pre-computed human-readable summary prefer the docker-stats://{id_or_name} resource; for a process listing use container_top.

Args: one_shot: Skip the second collection cycle for a faster answer, at the cost of an empty precpu_stats (so no CPU percent); needs daemon API v1.41+

Returns: dict: Engine stats payload (read, cpu_stats, precpu_stats, memory_stats, networks, pids_stats, ...)

ParametersJSON Schema
NameRequiredDescriptionDefault
one_shotNo
id_or_nameYes

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint annotation, the description reveals critical behavioral nuances: the default two-cycle collection and ~1s latency, the impact of one_shot on precpu_stats and CPU computation, and the daemon API v1.41+ requirement. This gives the agent full awareness of side effects and performance, far exceeding the annotation's simple read-only flag.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Every sentence contributes unique information: purpose, return format, CPU delta explanation, timing, one_shot behavior, and alternatives. The Args and Returns sections are cleanly structured and avoid redundancy. The main paragraph is front-loaded with the core purpose and then layers trade-offs and context, making it easy to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no output schema and only two parameters, this description is remarkably complete. It explains how to interpret the raw payload (CPU percent computation), the timing expectation, the one_shot flag's consequences, API version requirements, and directs to alternative tools. An agent has everything needed to call it correctly and interpret results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description compensates well for one_shot, explaining its purpose, impact, and version requirement. The id_or_name parameter is not explicitly described, but its meaning is self-evident from the tool name and context. The description adds semantic value for the non-obvious parameter while relying on naming for the obvious one.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a precise verb-resource pair: 'Get one point-in-time resource-usage snapshot for a container (non-streaming).' It clearly distinguishes this tool from siblings by naming alternatives (container_top for process listing, docker-stats resource for a pre-computed summary) and specifying the non-streaming nature.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Guidance is explicit and actionable. It states when to prefer the docker-stats resource, when to use container_top, and explains the one_shot trade-off for scenarios where only memory/pids matter. This goes beyond a simple 'use for stats' and directly tells the agent when to choose an alternative.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_stopA

Gracefully stop a running container (its configured stop signal, then SIGKILL after a timeout).

Prefer this over container_kill for a clean shutdown: the main process receives the container's stop signal (STOPSIGNAL, default SIGTERM) and has stop_timeout_seconds to exit before the daemon force-kills it. Use container_restart to stop and start again in one call, or container_pause to freeze processes without stopping. When the server runs containerized it refuses to stop its own container.

Args: stop_timeout_seconds: Seconds between the stop signal and SIGKILL

Returns: dict: The container's full inspect payload after the stop (exit code under State.ExitCode)

ParametersJSON Schema
NameRequiredDescriptionDefault
id_or_nameYes
stop_timeout_secondsNo

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only state readOnlyHint=false and destructiveHint=false, so the description carries the behavioral burden. It discloses the stop-signal-then-SIGKILL sequence, STOPSIGNAL default, timeout semantics, and the self-container restriction. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured and front-loaded with the core behavior, followed by sibling guidance, caveats, parameter documentation, and return payload. Every sentence adds useful information with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description appropriately documents the return value as the full inspect payload with exit code location under State.ExitCode. It also covers the shutdown timeout, force-kill behavior, and relevant operational caveat, giving an agent enough context to call the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It fully explains stop_timeout_seconds as the delay between stop signal and SIGKILL. The other parameter, id_or_name, is not described in prose, but its name is self-explanatory and the schema marks it required.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action ('Gracefully stop a running container') and the mechanism (configured stop signal, then SIGKILL after a timeout). It also distinguishes itself from sibling tools like container_kill, container_restart, and container_pause, making selection unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says to prefer this over container_kill for a clean shutdown, and tells the agent when to use container_restart and container_pause instead. It also adds an important constraint: the server refuses to stop its own container when running containerized.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_topA
Read-only

List the processes running inside a container (the daemon runs ps on the host).

Works on any running container without executing anything in it, so it needs no shell or ps binary in the image - unlike container_exec with ps. Use container_stats for resource usage rather than process lists. Fails if the container is not running.

Args: ps_args: Extra ps arguments (e.g. "aux"); default is the daemon's standard ps invocation

Returns: dict: {"Titles": [ps column names], "Processes": [[one row of values per process]]}

ParametersJSON Schema
NameRequiredDescriptionDefault
ps_argsNo
id_or_nameYes

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark the tool as read-only and non-destructive. The description adds valuable behavioral context: the daemon runs `ps` on the host, nothing is executed inside the container, and the call fails on stopped containers. This goes beyond the annotations without contradicting them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded: purpose, usage notes, parameters, and return format are clearly separated. Every sentence contributes meaningful information without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Since there is no output schema, the description explicitly defines the return dict. It covers key behavior, failure condition, dependencies, and usage guidance. The only small gap is the lack of prose explanation for `id_or_name`, which is otherwise implied by the tool name and required flag.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It thoroughly explains `ps_args` including the default, but does not explicitly explain the required `id_or_name` parameter. The parameter name is self-explanatory, but a clear prose description would be expected at this coverage level.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states the specific function: listing processes inside a container, and notes the host-side `ps` mechanism. It also distinguishes itself from `container_exec` and `container_stats`, so an agent can select it without ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-to-use and when-not-to-use guidance: works without executing in the container, requires no shell or `ps` binary, and should be replaced by `container_stats` for resource usage. Also warns that it fails if the container is not running.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_unpauseA

Resume all processes in a paused container (the reverse of container_pause).

Only valid on a paused container - it fails if the container is merely stopped; use container_start for stopped containers. Processes continue from where they were frozen.

Returns: dict: The container's full inspect payload after unpause (State.Paused becomes false)

ParametersJSON Schema
NameRequiredDescriptionDefault
id_or_nameYes

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only indicate readOnlyHint=false and destructiveHint=false. The description adds meaningful behavioral detail: the state precondition, failure mode, that processes resume from where they were frozen, and that State.Paused becomes false in the inspect payload. No contradictions with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is tight and front-loaded: opening sentence states the core action, the second sentence adds the critical precondition and alternative, and the returns section is concise but useful. No filler or redundant restatement.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter, simple state-change operation with no output schema, this is complete: it communicates the action, the required container state, the failure mode, the alternative tool, and the return shape. Nothing essential is missing for an agent to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description never explicitly defines the id_or_name parameter, its accepted formats, or examples. It only references 'a paused container' in passing, leaving the agent to infer that id_or_name is the container identifier. This does not adequately compensate for the missing schema documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Resume all processes in a paused container', and explicitly positions it as the reverse of container_pause. It also distinguishes itself from container_start by clarifying what it is not for.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit when-to-use guidance: 'Only valid on a paused container', states the failure condition ('fails if the container is merely stopped'), and names the alternative ('use container_start for stopped containers'). This fully routes the agent to the correct sibling.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_updateA

Update resource limits on a container without recreating it.

Changes take effect immediately on Linux (cgroups); not all fields are updatable on every platform. Common updates keys: mem_limit (bytes, e.g. 134217728 for 128 MB), memswap_limit (memory+swap in bytes; -1 = unlimited), cpu_shares (relative weight, default 1024), cpu_period / cpu_quota (microseconds for CFS throttling), cpuset_cpus (e.g. "0-1"), restart_policy (dict with Name such as "on-failure"/"always"/"unless-stopped" and optional MaximumRetryCount). To change image, env, or volumes the container must be recreated (container_remove + container_run).

Args: id_or_name: Container id or name to update updates: Resource fields to update; see description for valid keys

Returns: dict: The container's full inspect payload after the update

ParametersJSON Schema
NameRequiredDescriptionDefault
updatesYes
id_or_nameYes

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With only readOnlyHint=false and destructiveHint=false in annotations, the description needs to carry behavioral detail, and it does: changes take effect immediately on Linux (cgroups), not all fields are updatable on every platform, and the update does not recreate the container. It does not contradict annotations. It stops short of describing failure modes or whether the container must be running, so it is strong but not exhaustive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose, followed by a compact platform caveat, a well-grouped update-key reference, and explicit Args/Returns sections. Despite the length needed for a 0% schema, every sentence is informative and logically ordered.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter tool with no output schema, the description covers parameter semantics, return value, platform variability, and the recreate alternative. It is complete enough for correct invocation, though the non-exhaustive 'common updates keys' list leaves the exact full set of update fields to the API rather than the definition.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema provides only names and types with 0% description coverage, so the description compensates by giving the id_or_name meaning and documenting the main updates keys with units, defaults, examples, and the restart_policy dict shape. It loses a point because it frames the key list as 'common' rather than a complete contract for the free-form updates object.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening sentence names a specific action and target ('Update resource limits on a container without recreating it') and the following lines enumerate exactly which fields are in scope. This clearly distinguishes it from container_remove/container_run and other container mutators in the sibling list.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly states when the tool is appropriate (resource-limit updates without recreation) and when it is not: changing image, env, or volumes requires container_remove + container_run. It also warns that updatable fields vary by platform, giving the agent a decision rule rather than leaving it to infer.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_waitA
Read-only

Block until a container reaches a condition: stopped, "healthy", or its logs contain a pattern.

One contract for every mode: never raises on timeout - the result always carries met (condition reached) and timed_out. The stop conditions ("not-running"/"next-exit"/"removed") use the daemon's blocking wait and fill status_code/error (the container's exit info); "healthy" polls the container's HEALTHCHECK every poll_intervals and fills health/status; "log-match" polls recent logs every poll_intervals for pattern and fills matched_line. For a compose project use compose_wait; for swarm services use service_wait.

Health semantics: with no HEALTHCHECK defined, once the container is running the tool returns promptly with health: null and met: false (false = "not confirmed healthy", not "unhealthy" - check health to tell them apart). A container that exits before becoming healthy returns its terminal status and met: false.

Log-match semantics: pattern is matched as a plain substring by default - safe against any input, including adversarial ones. Pass regex=True to match pattern as a regular expression (via re.search) instead; only do this with patterns you trust, since a regex with catastrophic backtracking run against attacker-influenced log content can exhaust CPU (ReDoS). Checks stdout and stderr, most recent lines first within each poll. If the container exits/dies before the pattern ever appears, returns promptly with met=false (not timed_out) - no further logs can arrive, so there's nothing to keep polling for.

Args: until: Condition to wait for: "not-running" (default), "next-exit", "removed", "healthy", or "log-match" (requires pattern) timeout_seconds: Max seconds to wait before returning with timed_out=true poll_interval: "healthy"/"log-match" only: seconds between re-checks (default 2, > 0); capped by the time left so a large value can't push the total wait past the timeout pattern: "log-match" only: substring (or, with regex=True, a regular expression) to look for in the container's logs regex: "log-match" only: treat pattern as a regular expression instead of a plain substring

Returns: dict: {"container", "until", "met", "timed_out", "status_code", "error", "health", "status", "matched_line", "waited_seconds"}; stop modes fill status_code/error, "healthy" fills health ("starting"/"healthy"/"unhealthy", or null with no healthcheck) and status, "log-match" fills matched_line when met and status if the container exited without matching.

ParametersJSON Schema
NameRequiredDescriptionDefault
regexNo
untilNonot-running
patternNo
id_or_nameYes
poll_intervalNo
timeout_secondsNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses a wealth of behavioral details beyond annotations: never raises on timeout, result always carries met/timed_out, health semantics including returning promptly with health:null if no HEALTHCHECK, log-match semantics (plain substring default, ReDoS risk with regex, checks stdout/stderr, early exit if container dies). All this vastly exceeds the readOnlyHint/destructiveHint annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but every section earns its place: overview, per-mode contracts, health semantics, log-match safety warning, Args, and Returns. It is front-loaded with the core purpose and then structured with clear subheadings. No filler or tautology; the length is justified by the tool's complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite no output schema, the description explains the return structure in detail. Combined with full parameter explanations, mode semantics, safety notes, and alternatives routing, nothing an agent needs to call this tool correctly is missing. It is complete for a tool with 6 parameters and three distinct behaviors.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description bears full responsibility for explaining parameters. It does so extensively in the 'Args:' section, covering each parameter (until, timeout_seconds, poll_interval, pattern, regex) with types, defaults, constraints, and mode-specific applicability. This fully compensates for the lack of schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Block') and resource ('a container') with a clear condition ('reaches a condition: stopped, healthy, or its logs contain a pattern'). It distinguishes itself from siblings by explicitly naming compose_wait and service_wait for other scopes. This is precise and unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit guidance on when to use this tool vs alternatives: 'For a compose project use compose_wait; for swarm services use service_wait.' It also explains when to employ each mode (stop conditions vs healthy vs log-match) with conditions for each, leaving no inference required.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

context_createA

Create a new Docker CLI context pointing at a daemon endpoint.

Registers a named endpoint for the CLI; switch with context_use, enumerate with context_list. It does not retarget this server's docker-py client (pinned at startup). Does not raise on a non-zero CLI exit (a missing docker binary or a timeout still raises) - inspect returncode/stderr in the result. It does raise ToolInputError before running anything if docker_host or a TLS path contains a comma, which would inject extra keys (including skip-tls-verify) into the endpoint spec.

Args: name: Name for the new context (must not already exist) docker_host: Daemon URL, e.g. "tcp://10.0.0.5:2376" or "unix:///var/run/docker.sock"; no commas description: Human description shown in context ls tls_ca: Path on the local host to the CA cert (for TLS daemons); no commas tls_cert: Path on the local host to the client cert; no commas tls_key: Path on the local host to the client key; no commas skip_tls_verify: Disable TLS verification (insecure; for testing only). The only way to set it: it cannot be smuggled through docker_host

Returns: dict: {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes
tls_caNo
tls_keyNo
tls_certNo
descriptionNo
docker_hostYes
skip_tls_verifyNo

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses several non-obvious behaviors: it does not retarget the docker-py client, does not raise on a non-zero CLI exit, and raises ToolInputError if docker_host or TLS paths contain a comma that could inject extra keys. With minimal annotations present, this fully carries the burden of behavioral disclosure without contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but every sentence earns its place, front-loaded with the core purpose followed by critical caveats and a clear Args/Returns structure. It manages to communicate all essential operational details without waste.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having no output schema, the description explicitly states the return dict format and covers parameter constraints, error handling, and core behavior. Given the tool's complexity (7 parameters, security-sensitive comma restrictions), the description is complete for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% and the description compensates thoroughly. The Args section documents every parameter, including constraints like 'no commas' on docker_host and TLS paths, and explains the unique role of skip_tls_verify as the only way to set that flag. This adds substantial meaning beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Create a new Docker CLI context pointing at a daemon endpoint,' which is a specific verb+resource statement. It clearly distinguishes creation from siblings like context_use, context_list, and context_remove by focusing on registration of a named endpoint.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explains the relationship to related actions: 'switch with context_use, enumerate with context_list,' and notes the tool does not retarget the server's docker-py client. This gives clear context for when to use it, though it does not explicitly state exclusion criteria or when to avoid using it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

context_inspectA
Read-only

Return the full configuration for a single Docker context.

Full endpoint/TLS detail for one context; context_list gives the one-line summary of all. Raises RemoteFailureError if the CLI call fails.

Args: name: Context name (use the Name field from context_list)

Returns: dict: The parsed docker context inspect entry (keys include "Name" and "Endpoints" with the daemon URL)

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish read-only and non-destructive intent. The description adds useful behavioral detail: it raises RemoteFailureError on CLI failure and returns a parsed dict of the 'docker context inspect' entry, including the daemon URL. This goes beyond what the annotations alone convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded: purpose, differentiation, error behavior, argument meaning, and return shape are each covered in a few short lines. There is minimal redundancy and every sentence contributes to correct invocation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With one simple parameter, no output schema, and read-only annotations, the description supplies all needed context: what the tool returns, key fields in the result, how to obtain the argument value, and what exception may occur. Nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, but the description fully compensates by explaining that 'name' is the context name and explicitly directs the agent to reuse the 'Name' field from 'context_list'. For a single-parameter tool, this is complete and actionable semantic guidance.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: 'Return the full configuration for a single Docker context.' It further distinguishes itself from the sibling 'context_list' by contrasting full endpoint/TLS detail with a one-line summary, so an agent can tell them apart immediately.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly situates this tool as the detailed counterpart to 'context_list' and instructs the agent to source the 'name' argument from the 'Name' field of 'context_list'. It does not state explicit when-not-to-use conditions, but the intended usage context is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

context_listA
Read-only

List Docker CLI contexts known to the host running this MCP server.

Contexts are a CLI concept (stored in the docker config dir) letting one CLI target multiple daemons. This server uses whatever DOCKER_HOST / current-context resolved to at startup, so changing contexts only affects future subprocess-based tools, not the docker-py SDK client. Use context_inspect for one context's full config and context_use to switch. Raises RemoteFailureError if the CLI call fails.

Returns: list: One dict per context, keyed as the CLI emits them - Name, Description, DockerEndpoint and Current, the last being true for the context the CLI would use by default

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark the tool as read-only and non-destructive. The description adds valuable behavioral nuance: the server uses whatever DOCKER_HOST/current-context resolved at startup, so context changes have limited effect on the SDK client. It also discloses the RemoteFailureError condition and the exact output shape, going well beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Every sentence earns its place: the opening states the core action, then the description explains the CLI concept, startup behavior, sibling alternatives, error behavior, and return format. It is front-loaded and structured without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is complete for a zero-parameter read-only tool. It explains the underlying concept, the tool's relationship to the server process, exactly what the return value contains, when to use sibling tools, and the error case. No separate output schema exists, so the description fully compensates.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has zero parameters, so the baseline for this dimension is 4. The description correctly includes no parameter explanations because none are needed; it instead documents the returned dict keys, which is more relevant to output than parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb ('List') and resource ('Docker CLI contexts known to the host running this MCP server'), making the tool's scope immediately clear. It also differentiates from siblings by naming context_inspect and context_use and summarizing their distinct purposes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly routes usage: 'Use context_inspect for one context's full config and context_use to switch.' It also gives important contextual guidance about how changing contexts affects only future subprocess-based tools, not the docker-py SDK client, which informs when this tool's output is relevant.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

context_removeA
Destructive

Remove a Docker CLI context.

Deletes only the CLI's connection metadata - the daemon it pointed at is untouched. The current context needs force=True (or context_use another first). Does not raise on a non-zero CLI exit (a missing docker binary or a timeout still raises) - inspect returncode/stderr in the result.

Args: name: Context name to remove force: Force removal even if the context is the current one

Returns: dict: {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes
forceNo

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only say readOnlyHint=false and destructiveHint=true, but the description adds the key behaviors: the daemon is untouched, current-context removal is guarded, non-zero CLI exits do not raise, and missing docker/timeout still raise. This is rich beyond the annotations and accurately matches them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the one-line purpose, followed by the most important side-effect/edge-case disclosures, then a tidy Args/Returns block. Every sentence carries information an agent needs.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, it supplies the exact return dict shape; with a destructive annotation, it clarifies the real-world scope and error behavior; with a bare schema, it explains both parameters. Nothing needed to call the tool correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% and no descriptions exist in the schema, but the description fully compensates by explaining name as the context to remove and force as the override for the current-context restriction. Even the default behavior of force is inferable from the context.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States the exact operation ('Remove a Docker CLI context') and immediately clarifies the scope: it deletes only CLI connection metadata, not the daemon. This makes it clearly distinguishable from sibling context_* tools like context_use, context_create, and context_list.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives concrete usage context for the tricky case: a current context requires force=True or switching with context_use first. It does not explicitly enumerate when to prefer this over each sibling, but the purpose and the one relevant alternative are clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

context_useA

Set the active Docker context for the CLI on the host running this MCP server.

Note: this does not retarget the long-lived docker-py client - SDK-backed tools keep using the endpoint they connected to at startup. To retarget those, restart the server with a different DOCKER_HOST / DOCKER_CONTEXT. Create contexts with context_create; list them with context_list. Does not raise on a non-zero CLI exit (a missing docker binary or a timeout still raises) - inspect returncode/stderr in the result.

Args: name: Existing context name to set as default

Returns: dict: {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses important non-obvious behaviors beyond what annotations provide: non-zero CLI exits do not raise, a missing docker binary or timeout still raises, and the long-lived docker-py client is unaffected. This lets an agent interpret returncode/stderr correctly and avoid assuming SDK tools are retargeted.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The main purpose is front-loaded, followed by compact caveats and a clear Args/Returns structure. Every sentence contributes operational detail without filler or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter CLI wrapper with no output schema, the description documents the parameter, the return dict, and exception/error behavior, and references relevant sibling tools. Nothing needed to call or evaluate the result is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema only specifies that name is a required string. The description adds that it must be an existing context name and that it becomes the default, which is the key semantic information needed for correct invocation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific action ('Set the active Docker context for the CLI on the host running this MCP server') with a clear resource and scope. It differentiates itself from context_create and context_list by focusing on selecting the default rather than creating or listing contexts. Unambiguous even without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly tells the agent to use context_create to create contexts and context_list to list them. Also warns that SDK-backed tools are not retargeted unless the server is restarted with a different DOCKER_HOST/DOCKER_CONTEXT, giving clear when-to-use vs. when-not-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

docs_lookupA
Read-only

Look up Docker SDK/CLI/registry reference documentation by section.

A tool-callable mirror of the docker-docs:// resources, for clients that can't read MCP resources (e.g. Claude Desktop, Cursor). Always registered regardless of DOCKER_MCP_SERVER_DISABLE - looking something up costs nothing and isn't tied to any single Docker feature area - but an individual section still refuses if the domain it documents is disabled, matching the equivalent docker-docs://{section} resource exactly.

Omit section to list every available section with its source URL (same as docker-docs://contents); pass a section name to fetch that page's content (same as docker-docs://{section}). Most useful before constructing an extra_kwargs-style passthrough dict for a tool like container_run/container_create/service_create (their docstrings only list common keys, not every key docker-py accepts), or before writing Compose/Dockerfile/buildx bake-file syntax, which no tool generates.

Args: section: Section name (from a no-argument call's index); omit to list all sections instead

Returns: str: JSON section index (no section) or that section's raw HTML/Markdown content

ParametersJSON Schema
NameRequiredDescriptionDefault
sectionNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, but the description adds valuable behavioral context: the tool is always registered regardless of DOCKER_MCP_SERVER_DISABLE, it costs nothing, it is not tied to any single Docker feature area, and individual sections still refuse when their documented domain is disabled. It also discloses that the return value is a JSON index or raw HTML/Markdown content. These details go well beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but every sentence earns its place. It front-loads the one-sentence purpose, then explains operational behavior, use-case timing, the parameter semantics, and the return format in a logical order. There is no filler or redundant restatement of the tool name.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-optional-parameter lookup tool, the description covers exactly what the agent needs: how to make both call forms, where section names come from, what each call returns, when the tool is most useful, and how disabled domains behave. The inclusion of return types and the index behavior makes the tool fully callable without additional inference.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema only provides a bare optional string 'section' with no description, so the description carries the full burden. It does this well: omitting section returns the index, passing section fetches that page's content, and valid section names come from a no-argument call's index. This is exactly the semantic help an agent needs and is not present in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening sentence names a specific verb ('Look up'), a precise resource ('Docker SDK/CLI/registry reference documentation'), and a scoping dimension ('by section'). This clearly distinguishes docs_lookup from all operational sibling tools. It is not a tautology and it tells the agent what the tool's domain is immediately.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states when to use the tool concretely: before constructing extra_kwargs-style passthrough dicts for container_run/container_create/service_create and before writing Compose/Dockerfile/buildx bake-file syntax. It also clarifies behavior in edge cases: omit section to list all sections, pass a section to fetch content, and a section refuses if its domain is disabled. This gives the agent explicit decision context for call selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

host_listA
Read-only

List the Docker hosts configured via DOCKER_MCP_SERVER_HOSTS.

With a single host (or the var unset) this is the one resolved daemon; with several it is the set that the host argument selects from. The default entry is the one used when host is omitted; pass a name as the host argument of daemon-backed tools (system_ping(host=...) checks one entry). The docker-mcp://hosts resource mirrors this tool.

Returns: list[dict]: one per host: name; url (resolved daemon URL, null = docker-py platform default); read_only; non_destructive (blocks destructive calls only); tls (whether a per-host cert dir is configured); default (the omitted-host fallback)

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint and destructiveHint annotations, the description discloses useful behavioral detail: actual host resolution behavior when the environment variable is unset, the role of the `default` fallback, and the semantics of returned fields like `non_destructive (blocks destructive calls only)` and `tls`. It also notes the `docker-mcp://hosts` resource mirrors the tool, adding integration context. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose, then adds a dense but purposeful paragraph on host selection and a compact, structured return breakdown. Every sentence earns its place, and the format is easy to scan for an agent deciding whether to call the tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, read-only tool, the description covers the source of hosts, selection semantics, default behavior, field meanings, and integration with host-scoped daemon tools. The return format is documented in enough detail that an agent can correctly interpret results and use them in subsequent calls. Nothing necessary is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

This tool has zero parameters, so the input schema already covers all inputs and the 0-parameter baseline applies. The description adds relevant semantic context by explaining how each returned host `name` maps to the `host` argument used by other tools and what the `default` field means for omitted-host calls. That is valuable context beyond an empty schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'List the Docker hosts configured via DOCKER_MCP_SERVER_HOSTS,' a specific verb plus resource. It further clarifies single-host versus multi-host resolution and the meaning of the `default` entry, making it easy to distinguish from configuration tools like context_list. The purpose is unambiguous and actionable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context for when to use the tool, explaining that its entries are what the `host` argument selects from and that a returned `name` can be passed as the `host` argument to daemon-backed tools, with `system_ping(host=...)` as an explicit example. It does not explicitly state when-not-to-use or name a preferred sibling alternative, but it provides strong routing context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

hub_rate_limitA
Read-only

Report the caller's remaining Docker Hub pull-rate-limit budget.

Sends a HEAD to the ratelimitpreview/test manifest (a HEAD isn't metered as a pull, so the check costs no budget) and reads the RateLimit-Limit / RateLimit-Remaining headers. Call it before a large compose_pull / image_pull to avoid hitting the cap mid-deploy. Credentials raise the limit and switch metering from per-IP to per-account; falls back to DOCKER_MCP_SERVER_REGISTRY_USERNAME / DOCKER_MCP_SERVER_REGISTRY_PASSWORD, does NOT read ~/.docker/config.json. Plans with no limit return no headers - reported as "unlimited": true.

Args: username: Hub username (overrides DOCKER_MCP_SERVER_REGISTRY_USERNAME) password: Hub password/token (overrides DOCKER_MCP_SERVER_REGISTRY_PASSWORD)

Returns: dict: {"authenticated", "limit", "remaining", "window_seconds", "unlimited"}

ParametersJSON Schema
NameRequiredDescriptionDefault
passwordNo
usernameNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark it read-only, and the description adds substantial behavioral detail: it uses an unmetered HEAD request, reads specific headers, describes per-IP vs per-account metering, and explains the unlimited fallback. This goes well beyond the structured annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Every sentence in the description carries distinct, actionable information: purpose, mechanism, usage timing, auth behavior, and return contract. It is dense but well-structured with Args/Returns sections.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, yet the description documents the exact returned dict keys and the 'unlimited' edge case. It also captures auth fallback and costing properties, so nothing an agent needs to invoke it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema leaves both parameters undescribed (0% coverage), but the Args section explains each: username/password override the corresponding environment variables. This fully compensates for the schema gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Report') and a well-defined resource ('remaining Docker Hub pull-rate-limit budget'). This clearly distinguishes it from the many sibling tools, none of which address rate-limit budgets.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly advises calling the tool 'before a large compose_pull / image_pull' to avoid hitting the cap mid-deploy. It also clarifies credential behavior and what it does not read, giving agents clear context for usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

hub_repo_infoA
Read-only

Fetch Docker Hub metadata for a repository.

Public repos only: sends no auth and does NOT read the local Docker credential store; private repos return 404/401. Hub-only metadata (stars, pulls, description) - use registry_tags for tag lists on any OCI registry and hub_tags for Hub tag details.

Args: repository: Hub repository, e.g. "library/alpine" or "myorg/myimage"

Returns: dict: The Hub /v2/repositories// response (description, star_count, pull_count, last_updated, is_private, etc.)

ParametersJSON Schema
NameRequiredDescriptionDefault
repositoryYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint=true and destructiveHint=false annotations, the description discloses important authentication behavior: it sends no auth, avoids reading the local credential store, and explains private repo failure modes. It also clarifies the exact Hub API response shape returned, giving agents a realistic model of the tool's behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is efficiently structured with a one-line purpose, a clear public-only/auth note, an alternative-tools pointer, and compact Args/Returns sections. Every sentence adds useful information, with no filler or repetition of schema fields.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is a single-parameter read-only metadata fetch, and the description covers the parameter format, auth restrictions, failure mode for private repos, and the structure of the return value. There is no output schema, so the description's explicit listing of returned fields closes the only remaining gap. The complete routing guidance to sibling tools finishes the picture.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must carry the parameter documentation burden. It fully compensates by explaining the `repository` parameter and supplying concrete examples ('library/alpine' or 'myorg/myimage'). This is sufficient for an agent to correctly construct the required argument.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Fetch Docker Hub metadata for a repository.' It further distinguishes itself from relevant siblings by explicitly stating that tag lists belong to `registry_tags` and Hub tag details belong to `hub_tags`. This makes the tool's scope immediately clear and separable from alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit usage constraints: public repos only, no auth sent, does not read the local Docker credential store, and private repos return 404/401. It also names the sibling tools to use for tag-related queries, providing clear when-to-use, when-not-to-use, and alternative routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

hub_tagsA
Read-only

List tags on a Docker Hub repository with Hub-specific metadata.

Hits the Hub UI API (hub.docker.com) for richer per-tag data than registry_tags - last pushed date, per-platform sizes, digest. Public repos only: sends no auth and does NOT read ~/.docker/config.json; private repos return 404/401 (use registry_tags against registry-1.docker.io with credentials).

Args: repository: Hub repository, e.g. "library/alpine" or "myorg/myimage" limit: Max tags to return (default 100, >= 1); pagination capped at 50 pages

Returns: dict: {"name": , "tags": [{name, full_size, last_updated, digest, images}, ...], "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
repositoryYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes well beyond the readOnly/destructive annotations by disclosing that no auth is sent, that it does not read `~/.docker/config.json`, and that private repos return 404/401. This gives the agent a concrete model of the tool's external behavior and side effects without contradicting annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with a one-sentence purpose, followed by a compact tradeoff/usage note, and then structured Args and Returns sections. Each sentence earns its place and the structure keeps the reader from search for critical distinctions.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given only 2 parameters and no output schema, the description provides a complete picture: what it does, why it differs from its closest sibling, when it fails, what the arguments mean, and what the return structure looks like. There are no gaps the agent would need to infer.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Although schema coverage is 0%, the description fully compensates with an Args section that explains the `repository` format using examples and constrains `limit` (default 100, >= 1, pagination capped at 50 pages). It adds semantic meaning the JSON schema does not provide.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource ('List tags on a Docker Hub repository') and immediately differentiates itself from the sibling `registry_tags` by noting it offers 'richer per-tag data' via the Hub UI API. This makes the tool's unique identity clear without needing to inspect any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly names the alternative `registry_tags`, specifies when to use it ('private repos'), and states the conditions for using this tool ('Public repos only: sends no auth... private repos return 404/401'). This is model-appropriate routing guidance that directly prevents mis-selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

image_buildA

Build an image from a Dockerfile using the daemon's classic builder.

Use this for simple single-platform builds from a local context. For multi-platform builds, BuildKit cache export/import, or advanced build features prefer buildx_build. path must be a directory accessible on the host running this server (it is the build context sent to the daemon). dockerfile is normally relative to path; omit to use the default Dockerfile.

dockerfile is not confined to the context, despite the usual relative form: docker-py detects an absolute path, or a relative one escaping via .., reads that file from the server host's filesystem and injects its contents into the build. So it can read any file the server user can, like the other host-filesystem parameters (dest_path, from_file), and unlike them it is easy to mistake for a context-relative name. buildx_build's --file resolves differently again (against the CLI's working directory) - see its docstring.

Args: path: Build context directory path on the server host tag: Name and optional tag in "name:tag" format to apply to the built image quiet: Suppress verbose build output (final image id still returned) nocache: Ignore the layer cache and rebuild all layers rm: Remove intermediate containers on success pull: Always pull a newer version of each FROM base image before building forcerm: Remove intermediate containers even on build failure dockerfile: Dockerfile filename relative to path (default: "Dockerfile"); an absolute path or one containing ".." reads that file from the server host instead of the context buildargs: Build-time variables passed as --build-arg; dict of str to str container_limits: Resource limits for the build container, e.g. {"memory": 134217728} shmsize: Size of /dev/shm in bytes for build steps that need shared memory labels: Labels to set on the resulting image (dict of str to str) cache_from: List of image references to use as layer cache sources target: Stop at this named build stage (multi-stage Dockerfiles) network_mode: Network mode for RUN instructions during build (e.g. "host", "none") squash: Squash all new layers into one (experimental; requires daemon flag) extra_hosts: Additional /etc/hosts entries during build; dict of hostname to IP platform: Target platform, e.g. "linux/amd64" (single platform only; use buildx for multi) isolation: Isolation technology, passed to the daemon as given; platform-dependent, so not validated here (Windows documents "default", "process", "hyperv") use_config_proxy: Forward proxy env vars from Docker client config to build

Returns: dict: The built image's full inspect payload (as docker inspect)

ParametersJSON Schema
NameRequiredDescriptionDefault
rmNo
tagNo
pathNo
pullNo
quietNo
labelsNo
squashNo
targetNo
forcermNo
nocacheNo
shmsizeNo
platformNo
buildargsNo
isolationNo
cache_fromNo
dockerfileNo
extra_hostsNo
network_modeNo
container_limitsNo
use_config_proxyNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare readOnlyHint=false and destructiveHint=false. The description adds substantial behavioral detail: it uses the classic builder, describes the dockerfile path resolution quirk (absolute or '..' reads from server host filesystem), and specifies the return value (full inspect payload). This goes far beyond annotations, covering side effects and edge cases.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Despite being long, the description is well-structured: purpose statement first, then usage guidance, then a focused caveat about dockerfile, then a bulleted Args list, and a Returns line. Every sentence earns its place; no filler or redundancy. The front-loading of purpose and routing guidance ensures key information is immediately visible.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 20 parameters, no output schema, and minimal annotations, the description covers everything an agent needs: purpose, routing, parameter semantics, return type, and a security-relevant edge case. Nothing is left ambiguous, and the alternative tool is explicitly referenced. This is a model of completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the entire burden. The Args section explains each of the 20 parameters with clear, non-tautological meaning (e.g., 'rm: Remove intermediate containers on success', 'shmsize: Size of /dev/shm in bytes'), and the special security note about dockerfile adds critical context. This fully compensates for the schema's lack of descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Build an image from a Dockerfile using the daemon's classic builder', which is a specific verb, resource, and implementation detail. It clearly distinguishes itself from buildx_build by explicitly stating it is for simple single-platform builds, so an agent can immediately tell which tool to use.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use this tool ('simple single-platform builds from a local context') and when to prefer the alternative ('multi-platform builds, BuildKit cache export/import, or advanced build features'). It also explains the dockerfile host-filesystem resolution difference vs buildx_build's --file, offering concrete routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

image_historyA
Read-only

Return the layer history of an image.

Useful for auditing what commands built each layer and diagnosing image size. Each entry includes Id (layer digest or "" for imported layers), Created (unix timestamp), CreatedBy (the Dockerfile command that produced the layer, e.g. a RUN or COPY), Size (bytes added by that layer), and Comment. For full image metadata use image_inspect instead.

Args: id_or_name: Image name (with optional tag/digest) or id

Returns: list: Layer history entries, newest first

ParametersJSON Schema
NameRequiredDescriptionDefault
id_or_nameYes

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark this as read-only and non-destructive, so the description adds substantial behavioral detail beyond that: entries are returned newest first, imported layers are marked `<missing>`, `Created` is a unix timestamp, `Size` is bytes added, and the meaning of `CreatedBy`/`Comment` are explained. This gives the agent a clear model of what the call will return.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured and front-loaded: purpose, use cases, return field semantics, and an alternative tool are presented without redundancy. The Args and Returns sections are compact and each sentence adds useful information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With a single parameter and no output schema, the description covers what is needed: what the parameter accepts, what the return value is, the order of entries, and the meaning of each field. It also names the relevant alternative for adjacent use cases, making the tool self-contained for an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema only states that `id_or_name` is a required string with no explanation, so the description compensates by stating it accepts an image name with optional tag/digest or an image id. This is meaningful but could be even stronger with an example or clarification of id versus name resolution.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool 'Return the layer history of an image' and gives concrete use cases (auditing commands, diagnosing image size). It also distinguishes itself from the sibling `image_inspect` by explicitly directing users who need full image metadata elsewhere.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context: use it for auditing layer-building commands and diagnosing size, and explicitly names `image_inspect` as the alternative when full metadata is needed. It does not enumerate exclusions versus all other sibling tools, but it gives enough directional guidance for the main alternative.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

image_importA

Create an image from a flat root-filesystem tarball, like docker import.

Imports a filesystem archive as a new single-layer image with no build history - not the same thing as image_load, which restores a docker save archive complete with its layers, tags and history, so prefer image_load for anything image_save produced. Use this for a rootfs that came from somewhere else: a container_export archive, a distro base tarball, a VM image dump. The result has an empty config - no CMD/ENTRYPOINT/ENV - unless you supply changes, so an imported image is usually not runnable until you set at least a command. Pass exactly one source (from_file, data, from_url or from_image); ToolInputError otherwise. from_url and from_image are fetched by the daemon, from_file/data are read here and uploaded; a from_file path that is not a readable file raises rather than being retried as a URL. Unlike the other image-creating tools this stamps no provenance labels: the Engine's import call accepts no labels field, and changes does not cover LABEL.

Args: repository: Repository name to give the new image, e.g. "myorg/rootfs"; may include a tag (myorg/rootfs:v1), and defaults to :latest when it does not. Omit to import untagged, addressable only by the id in the returned progress (omit it entirely -- a blank string is a ToolInputError, not a shorthand for untagged). A digest reference is refused by the daemon. Required if tag is given tag: Tag to apply, e.g. "v1". Overrides a tag already in repository rather than being ignored, so passing repository="myorg/rootfs:v1" with tag="v2" yields :v2. Requires repository (ToolInputError without it - the daemon would otherwise silently drop the tag and import untagged). Blank is also a ToolInputError, not a shorthand for the default: the daemon would substitute latest without saying so from_file: Path to a rootfs tarball on the server host (~ expanded), read by the server's user; refused if it is not an existing regular file; exactly one source data: Rootfs tarball contents in band (base64-encoded by MCP, so prefer from_file for anything but small archives); exactly one source from_url: URL the daemon fetches the tarball from; exactly one source from_image: Name of an existing image to import from, like a Dockerfile FROM; exactly one source changes: Dockerfile instructions applied to the new image, e.g. ['CMD ["/bin/sh"]']; only CMD, ENTRYPOINT, ENV, EXPOSE, ONBUILD, USER, VOLUME and WORKDIR are supported. Parsed as real Dockerfile syntax, so shell form is wrapped exactly as a Dockerfile would wrap it (CMD /bin/sh is stored as ["/bin/sh","-c","/bin/sh"]) - use the exec form CMD ["/bin/sh"] to store a bare argv

Returns: str: The daemon's raw newline-delimited JSON progress records; the final record carries the new image id as its status

ParametersJSON Schema
NameRequiredDescriptionDefault
tagNo
dataNo
changesNo
from_urlNo
from_fileNo
from_imageNo
repositoryNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With minimal annotations (only readOnlyHint=false and destructiveHint=false), the description carries the full behavioral burden and does so thoroughly. It discloses single-layer/no-history semantics, empty config unless `changes` is supplied, source-fetch differences between daemon and server, ToolInputError edge cases, tag-override behavior, and the absence of provenance labels.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but tightly packed with necessary information for a 7-parameter tool with many edge cases. It is well structured: purpose and sibling differentiation first, then Args, then Returns. Every sentence serves a purpose, and the details are grouped logically rather than dumped randomly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers source selection constraints, defaults, error conditions, tag handling, supported `changes` instructions, and the return format (raw NDJSON progress with the final record containing the image id). Given the tool complexity and zero schema coverage, nothing essential for correct invocation is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must fully compensate, and it does. Every parameter gets meaningful detail: `repository` with tag/untagged semantics, `tag` override behavior, `from_file` path resolution, `data` base64 encoding, `from_url` daemon fetching, `from_image` as Dockerfile FROM, and `changes` with supported instructions and shell-form parsing.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening line states a specific action and resource: 'Create an image from a flat root-filesystem tarball, like `docker import`.' It further disambiguates from `image_load` by explaining exactly what kind of archive each tool handles, so an agent can distinguish this tool from its closest sibling.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly tells when to use this tool versus alternatives: 'prefer image_load for anything image_save produced' and 'Use this for a rootfs that came from somewhere else.' It even enumerates example sources such as a `container_export` archive or distro tarball, leaving no ambiguity about selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

image_inspectA
Read-only

Return the full inspect detail for a single local image.

Includes config (env, entrypoint, exposed ports), size, layer digests (RootFS.Layers), and all tags/digests referencing it (RepoTags/RepoDigests). For a quick overview of many images use image_list instead. For the per-layer build history (which command produced each layer) use image_history. Only inspects images already present locally - for a remote image's manifest without pulling it use image_registry_data or registry_manifest.

Args: id_or_name: Image name (with optional tag/digest) or id

Returns: dict: Full image inspect attrs (equivalent to docker inspect on an image)

ParametersJSON Schema
NameRequiredDescriptionDefault
id_or_nameYes

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The readOnlyHint and destructiveHint annotations already signal safe read-only behavior, and the description adds meaningful behavioral context: it is local-only, does not pull, includes specific fields like config and layer digests, and is equivalent to docker inspect. A small gap is that it doesn't mention error behavior for malformed or absent image IDs, but it covers the most important operational constraints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose and output contents, then quickly pivots to when to use alternatives, then states the local-only constraint and the parameter/returns reference. Each sentence adds necessary information, and the Arg/Returns formatting keeps it scannable without unnecessary filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has one string parameter, no output schema, and annotations already covering read-only safety, the description conveys enough to call and use the tool correctly. It explains the scope, output shape, key distinctions from sibling tools, and the parameter semantics, so all needed contextual information for successful invocation is present.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema only defines `id_or_name` as a string with no description, but the description's Args section explains it as 'Image name (with optional tag/digest) or id.' This is exactly the semantic value the schema lacks. It might benefit from one concrete example, but for a single straightforward parameter it is sufficiently actionable.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a precise statement: 'Return the full inspect detail for a single local image.' It clarifies the object scope (local image), the operation (inspect), and the expected output shape (config, size, layer digests, RepoTags/RepoDigests). This clearly distinguishes it from siblings like image_list, image_history, and image_registry_data.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit usage guidance and alternatives: use image_list for quick overviews of many images, image_history for per-layer build history, and image_registry_data/registry_manifest for remote manifests without pulling. It also states the tool's limitation upfront with 'Only inspects images already present locally,' giving an agent clear routing conditions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

image_listA
Read-only

List images in the daemon's local store.

Local only - for a registry's contents use registry_tags / hub_tags, and image_search to find images on Docker Hub. Dangling (untagged) build leftovers show with filters={"dangling": True}.

Args: repository: Only show images of this repository all: Show intermediate image layers filters: Filter by attributes (label, dangling, before, since, etc.)

Returns: list: One summary dict per image ({"Id", "RepoTags", "RepoDigests", "Created", "Size", "Labels", ...}); use image_inspect for a full inspect payload

ParametersJSON Schema
NameRequiredDescriptionDefault
allNo
filtersNo
repositoryNo

TDQS

A4.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds valuable behavioral context beyond annotations: the local-only scope, dangling image visibility with filters, and the summarized return shape. It also points to image_inspect for richer data, which helps set expectations about the output.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured and front-loaded with the core purpose, then alternatives, parameter details, and return format. Every sentence earns its place, and formatting with Args/Returns sections makes it easy for an agent to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only list tool, the description covers purpose, scope, alternatives, parameter semantics, and return format, plus a pointer to a deeper inspection tool. With readOnlyHint/destructiveHint annotations already covering side effects, nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the full burden of explaining parameters. It provides meaningful explanations for all three parameters: repository limits the repository, all shows intermediate layers, and filters supports attributes like label, dangling, before, and since. This goes well beyond the bare schema types.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'List images in the daemon's local store.' It clearly distinguishes this tool from registry-focused siblings by explicitly noting 'Local only' and naming registry_tags, hub_tags, and image_search as alternatives. This makes the tool's scope unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit when-to-use guidance by contrasting local images with registry contents and Docker Hub searches. It also recommends image_inspect for full payloads, providing a clear routing decision to a sibling tool. This is strong, actionable usage guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

image_loadA

Load an image from a tarball produced by image_save, from in-band bytes or a file on the server host.

Counterpart of image_save; when the image lives in a registry, image_pull is the normal route, and for a flat rootfs archive that is not a docker save bundle use image_import. Pass exactly one of data (tarball bytes in band) or from_file (a path on the server host, streamed straight to the daemon - preferred for anything but small images, since in-band bytes are base64-encoded by MCP). from_file is read by the server's user; ~ is expanded.

Args: data: Tarball contents; exactly one of data/from_file from_file: Path to a tarball produced by docker save / image_save; exactly one of data/from_file

Returns: list: One full inspect payload per loaded image

ParametersJSON Schema
NameRequiredDescriptionDefault
dataNo
from_fileNo

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only indicate readOnlyHint=false and destructiveHint=false, which are minimal. The description compensates by detailing behaviors: from_file is read by the server's user, ~ is expanded, in-band data is base64-encoded, and from_file streams straight to the daemon. It also specifies the return as a list of inspect payloads. This goes beyond the annotations without contradicting them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is appropriately structured with a purpose statement, usage guidance, and a clear Args/Returns section. It front-loads the core function and differentiates from siblings early. There is a minor redundancy in repeating 'exactly one of data/from_file' twice, but it is otherwise efficient and readable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has two mutually exclusive parameters and no output schema, so the description must cover parameter choice, input handling, and return format. It explains the encoding issue, the file streaming, and the return list. It also ties back to image_save and distinguishes from related tools. Nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the full burden. It thoroughly documents both parameters: data is 'Tarball contents' and from_file is 'Path to a tarball produced by docker save / image_save', and emphasizes that exactly one must be provided. This adds complete meaning beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool loads an image from a tarball produced by image_save, specifying the two input modes (data or from_file). It explicitly differentiates from image_pull and image_import, and names the counterpart image_save, making the tool's role unambiguous among siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides explicit guidance on when to use alternatives: 'when the image lives in a registry, image_pull is the normal route' and 'for a flat rootfs archive that is not a docker save bundle use image_import'. It also gives a recommendation between data and from_file, explaining that from_file is preferred for anything but small images due to base64 encoding overhead.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

image_pruneA
DestructiveIdempotent

Remove unused local images to reclaim disk space.

Without filters removes only "dangling" images - untagged layers not referenced by any tag or container. To remove all images not used by any container (including tagged ones) pass filters={"dangling": False}. Valid filter keys: dangling (bool as string "true"/"false"), until (RFC3339 timestamp or duration like "24h"), label (key or key=value). Use system_df first to see how much space is reclaimable.

Args: filters: Narrow which images to remove; omit to remove dangling images only

Returns: dict: {"ImagesDeleted": [...], "SpaceReclaimed": }

ParametersJSON Schema
NameRequiredDescriptionDefault
filtersNo

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already flag destructive and idempotent behavior, but the description adds substantial nuance: the default only removes dangling images, the dangling=false filter expands scope, and valid filter keys and formats are enumerated. This goes well beyond what annotations alone convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is appropriately detailed and front-loaded with the core purpose. There is slight redundancy between the prose explanation and the Args section, but every sentence communicates necessary operational detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description still specifies the return shape. It covers default behavior, filtering options, filter key formats, and a prerequisite check via system_df. An agent has enough information to invoke this tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description carries the full burden for the filters parameter. It explains that omitting filters means dangling-only, and details valid keys (dangling, until, label) with their value formats. This is strong compensation for the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Remove unused local images to reclaim disk space.' It clearly distinguishes from related tools like image_remove and image_prune_builds by focusing on unused local images and pruning semantics.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explains when to use the default behavior versus passing filters, and explicitly recommends using system_df first to assess reclaimable space. It does not name sibling alternatives directly, but the usage context is clear enough for an agent to select this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

image_prune_buildsA
DestructiveIdempotent

Delete the daemon's build cache to reclaim disk space.

Prunes the build cache - a separate Engine resource from the images image_prune removes, so run both to reclaim everything a build leaves behind. Prefer buildx_prune when the build ran on a non-default buildx builder (that builder keeps its own cache, invisible here) or when you need any disk ceiling at all - reserved_space, max_used_space or min_free_space, none of which the docker-py path can send; this tool needs no CLI plugin and works over any transport, including a daemon with no local docker binary. Inventory first with system_df (its BuildCache entry) or buildx_du. Destructive and immediate: later builds must re-run the steps whose cache was removed. Needs Docker API v1.31+; passing either filters or all needs v1.39+ and raises InvalidVersion on an older daemon - omit both to prune with the daemon's own defaults.

Args: filters: Narrow which cache records to remove, e.g. {"until": "24h"} (a duration or timestamp relative to the daemon's clock); also accepts id, parent, type, description, inuse, shared, private; omit to let the daemon prune unused cache all: Remove all types of build cache, not just the unused records

Returns: dict: {"CachesDeleted": [...], "SpaceReclaimed": }

ParametersJSON Schema
NameRequiredDescriptionDefault
allNo
filtersNo

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already include destructiveHint=true and idempotentHint=true. The description reinforces destructive behavior ('Destructive and immediate: later builds must re-run the steps whose cache was removed') and adds critical version constraints (Docker API v1.31+, v1.39+ for filters/all) and the consequence of omitting arguments. It does not explicitly address idempotency, but the annotation covers that; the added context is valuable and non-contradictory.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but tightly organized: a clear purpose statement, then a section on when to use alternatives, then parameter and return details. Every sentence earns its place; the front-loaded purpose is immediately clear. The length is justified by the complexity of the tool (API versions, comparisons, parameter semantics). Slightly verbose but not wasteful.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive, version-sensitive tool with nuanced parameter behavior, the description covers all essentials: API version requirements, error on old daemons, the distinction from sibling tools, return format, and the implications of omitting arguments. An agent can invoke it correctly without external documentation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must fully explain the parameters. It does: the Args section details filters (with example {'until': '24h'}, accepted keys like id, parent, type, description, inuse, shared, private, and the behavior when omitted) and all (removes all types of build cache). This far exceeds the schema's bare types and adds critical semantic meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Delete the daemon's build cache to reclaim disk space', a specific verb-resource pair that clearly states the action and target. It further distinguishes itself from sibling image_prune (removes images) and buildx_prune (for non-default builders), leaving no ambiguity about what this tool does versus its alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly advises when to prefer buildx_prune (non-default builder, disk ceiling needs) and when to use this tool (no CLI plugin, any transport, no local docker binary). It also recommends running both image_prune and this tool for full cleanup, and suggests inventorying with system_df or buildx_du. This gives clear, actionable guidance on tool selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

image_pullA

Pull an image from a registry to the daemon's local store.

Private repositories need credentials - system_login (or docker login on the host) first, or auth_config to authenticate this call alone. Use image_load for tarballs, and registry_manifest / image_registry_data to inspect a remote image without pulling it.

Security: auth_config carries registry credentials, which many MCP clients log verbatim. Prefer docker login on the host so the docker module reuses credentials cached in ~/.docker/config.json, and leave auth_config unset.

Args: tag: The image tag (ignored when all_tags=True) all_tags: Pull all tags from the repository platform: Platform in os/arch format auth_config: Per-call registry credentials under the keys username and password; overrides the cached credential for this pull only

Returns: dict | list: The pulled image's full inspect payload, or one per image if all_tags=True

ParametersJSON Schema
NameRequiredDescriptionDefault
tagNo
all_tagsNo
platformNo
repositoryYes
auth_configNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare readOnlyHint=false and destructiveHint=false; the description adds meaningful behavioral context: pulling writes to the local store, auth_config carries credentials that may be logged verbatim, and tag is ignored when all_tags=True. It also discloses the return shape. This goes well beyond the annotations, though it could further mention side effects like overwriting existing local tags.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a lead action, a security note, an Args list, and a Returns line. Every sentence provides actionable information, and the most important alternative-routing information appears early.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 5-parameter tool with one required parameter and an output schema, the description covers the main action, credential handling, parameter semantics, return value, and alternative tools. Nothing essential is missing for an agent to invoke it correctly and safely.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the full burden. It explains each parameter's behavior: tag being ignored when all_tags=True, all_tags pulling all tags, platform in os/arch format, and auth_config with its credential keys and override scope. This adds substantial meaning beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource: 'Pull an image from a registry to the daemon's local store.' It also distinguishes itself from siblings by explicitly naming image_load for tarballs and registry_manifest/image_registry_data for remote inspection, so an agent can select it correctly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It clearly states when credentials are needed and offers two paths: system_login/docker login for cached credentials, or auth_config for per-call authentication. It explicitly routes to image_load for tarballs and to remote-inspection tools when pulling is not needed, providing both positive and negative usage guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

image_pushA

Push an image or repository to a registry.

The local image must already bear the target name - image_tag it with the registry-qualified repository[:tag] first; a bare name pushes to Docker Hub. Private registries need credentials (system_login, or docker login on the host).

Security: auth_config carries registry credentials, which many MCP clients log verbatim. Prefer docker login on the host so the docker module reuses credentials cached in ~/.docker/config.json, and leave auth_config unset.

Args: auth_config: Registry authentication config

Returns: str: Push output as a string

ParametersJSON Schema
NameRequiredDescriptionDefault
tagNo
repositoryYes
auth_configNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only say readOnlyHint=false and destructiveHint=false, which are minimal. The description adds substantial behavioral context: it requires the image to be pre-tagged, explains how private registries need credentials, and warns that auth_config credentials may be logged verbatim by MCP clients, recommending docker login instead. It also discloses the return type as a string. These go beyond annotations and are highly informative.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured and front-loaded. The first sentence states the purpose, followed by necessary pre-requisites and behavior, then a security note, and finally Args/Returns. Every sentence contributes value—there is no fluff or repetition. It is concise yet comprehensive.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a push tool with three parameters and a simple string output, the description covers all essential aspects: the pre-requisite tagging, behavior for bare names, credential requirements and security caveats, and the return type. It also implies edge cases (private registries) and provides a safe default (docker login). The presence of an output schema for the string return means no further return documentation is needed. This is complete for an agent to call the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema lists three parameters (repository, tag, auth_config) but provides no descriptions. The description compensates partially: it explains the meaning of repository and tag via the 'image_tag it with the registry-qualified repository[:tag]' phrase, and it details auth_config's role and security implications. However, it does not explicitly document the optional tag's default behavior or the exact structure of auth_config. Given 0% schema coverage, the description adds meaningful semantics but leaves some gaps.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Push an image or repository to a registry.' It uses a specific verb (push) and resource (image/repository), and distinguishes itself from siblings like image_pull or image_tag by naming the required pre-requisite (image_tag) and the behavior of bare names. An agent can immediately understand what this tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit when-to-use guidance: it explains the pre-requisite (image_tag the image with the registry-qualified name), notes that a bare name pushes to Docker Hub, and provides alternatives for authentication (system_login or docker login). It also advises to prefer docker login for security, effectively telling the agent when to avoid auth_config. This is explicit and actionable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

image_registry_dataA
Read-only

Get registry data for an image without pulling it, via the daemon's distribution endpoint.

Uses the daemon (and its cached credentials) to resolve the remote descriptor and platform list. For direct registry access without a daemon use registry_manifest.

Security: auth_config carries registry credentials, which many MCP clients log verbatim. Prefer docker login on the host so the docker module reuses credentials cached in ~/.docker/config.json, and leave auth_config unset.

Args: repository: Image reference auth_config: Registry authentication config

Returns: dict: The registry data document {"Descriptor", "Platforms"} - the OCI descriptor and the platforms available for the reference

ParametersJSON Schema
NameRequiredDescriptionDefault
repositoryYes
auth_configNo

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations include readOnlyHint=true and destructiveHint=false, and the description aligns by emphasizing 'without pulling it' and being a read operation. It adds crucial behavioral context: it uses the daemon's cached credentials, making it dependent on daemon state, and highlights a security risk of logging auth_config. This exceeds annotation coverage.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is moderately concise, with the core purpose stated early. It includes a security note and parameter docs, which are useful but slightly verbose. The structure is clean, but the security section could be tightened, though it's not excessive.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a registry meta-data tool with no output schema, the description covers the purpose, mechanism, and security. It explains return values as a dict with Descriptor and Platforms. However, it doesn't mention edge cases like when the daemon is not running or credentials fail, nor does it clarify the exact structure of nested objects. Still, it's fairly complete for its complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% (no descriptions in the schema), so the description must compensate. For `repository`, it says 'Image reference' but adds little beyond the name. For `auth_config`, it explains it as registry credentials and provides context about usage, which is marginally helpful. However, it doesn't clarify the expected format or handling of nested objects, leaving it somewhat vague.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: get registry data for an image without pulling it, via the daemon's distribution endpoint. It contrasts with a sibling tool (registry_manifest) for direct registry access, and mentions resolving the remote descriptor and platform list. This effectively differentiates it from similar registry tools among siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly tells when to use this tool versus the alternative (registry_manifest) and when to avoid it. It says to prefer `docker login` and leave `auth_config` unset for security, and explains the mechanism (daemon's cached credentials). This is strong guidance for decision-making.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

image_removeA
Destructive

Remove a local image by name or id.

Fails without force if the image is tagged by multiple names (untag first with image_tag) or if stopped containers reference it. Running containers always block removal regardless of force. noprune keeps untagged parent layers that would otherwise be removed as a side-effect; leave False unless you need to preserve the parent layers for another purpose.

Args: id_or_name: Image name (with optional tag/digest) or id to remove force: Remove even if referenced by stopped containers or multiple tags noprune: Do not delete untagged intermediate parent layers

Returns: bool: True after removal completes

ParametersJSON Schema
NameRequiredDescriptionDefault
forceNo
nopruneNo
id_or_nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only state destructiveHint=true and readOnlyHint=false. The description goes far beyond that: explains failure modes (multiple tags, stopped containers), the force override, that running containers always block, and the noprune side-effect of preserving parent layers. No contradictions with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with an Args/Returns breakdown and action-oriented opener. It is detail-rich but every sentence adds necessary behavioral info; no filler. Slightly long but appropriately so for a destructive operation with nuanced edge cases.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers all essential context for correct invocation: conditions for failure, force semantics, noprune effects, and return type (bool True). The output schema is simple, and the description aligns with it. An agent has everything needed to know when and how to call, and what side-effects to expect.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has 0% coverage, so the description carries full burden. It explains id_or_name (name with optional tag/digest or id), force (override specific references), and noprune (preserve parent layers). Each parameter is given meaning beyond the schema's bare type/default, completely compensating for missing schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Remove a local image by name or id.' — a specific verb, resource, and input method. It clearly distinguishes removal from sibling operations like image_prune (bulk untagged removal) and image_tag (tagging) by mentioning that untagging is a prerequisite in some cases.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit guidance on when the tool fails without force and instructs to use image_tag first when multiple tags exist. It also notes that running containers always block removal. While it doesn't explicitly contrast with image_prune for bulk cleanup, the conditions given are actionable and enough to decide when to invoke this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

image_saveA

Save an image as a tar archive: to a file on the server host, or in band.

The archive keeps layers, tags, and metadata so image_load can restore it - different from container_export, which flattens one container's filesystem. With dest_path the archive streams straight to disk (no byte cap), so it handles large images - the file is written by the server's user, ~ is expanded, and an existing file is refused unless overwrite=True. Without dest_path the tar bytes are returned in band, capped at max_bytes (default 32 MiB) because MCP base64-encodes them - a fallback for when no writable host path exists (e.g. a containerized server without a bind mount).

Args: dest_path: Destination path on the server host; omit to return the bytes in band named: Whether to retain repository/tag names in the saved archive overwrite: Replace dest_path if it already exists max_bytes: In-band mode: abort with ToolInputError beyond this many bytes (default 32 MiB)

Returns: bytes | dict: the tarball bytes (in band), or {"path": , "bytes_written": int}

ParametersJSON Schema
NameRequiredDescriptionDefault
namedNo
dest_pathNo
max_bytesNo
overwriteNo
id_or_nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses operational behavior well beyond the annotations: `~` expansion, server-user file ownership, refusal of existing files unless `overwrite=True`, absence of a byte cap for `dest_path`, and the `ToolInputError` abort in in-band mode. It also documents the return shape. This fully covers the behavioral surface.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is moderately long but well-structured, with the primary action up front followed by mode-specific behavior and a clean Args block. Minor redundancy exists (e.g., the 32 MiB default is mentioned twice), but every paragraph earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity, the description covers invocation modes, limits, error behavior, output format, and relevant alternatives. The output schema is already present, and the description complements it with the practical context an agent needs to call the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must carry parameter meaning, and it does for `dest_path`, `named`, `overwrite`, and `max_bytes`, including defaults and mode-specific effects. The only gap is `id_or_name`, which is implied by 'an image' but not explicitly documented as the target image identifier.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific action ('Save an image as a tar archive'), identifies the resource ('an image'), and clearly distinguishes the tool from `container_export` by preserving layers, tags, and metadata. It also covers the two operational modes (file vs in-band), making the purpose unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly explains when to use the in-band mode vs `dest_path`, how to handle large images, and why the `max_bytes` fallback exists. It also names the relevant sibling `container_export` and contrasts it directly, so an agent can choose between related tools without guessing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

image_tagA

Tag an image into a repository (add a name to an existing local image).

The image id stays the same and no data is copied - a tag is an alias. Typical flow: tag with the registry-qualified name, then image_push. image_remove on a tag merely untags while other names remain. Tagging over a name that already exists repoints it, without asking.

Args: id_or_name: The source image name or id repository: Target repository name (registry-qualified for pushing, e.g. "ghcr.io/o/r") tag: Tag for the new image (default "latest")

Returns: bool: True if the image was tagged

ParametersJSON Schema
NameRequiredDescriptionDefault
tagNo
id_or_nameYes
repositoryYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only indicate readOnlyHint=false and destructiveHint=false, so the description carries the burden of explaining behavior. It clearly states that the image id stays the same, no data is copied, and tagging over an existing name repoints it without asking. This adds meaningful behavioral context beyond the annotations, though it could mention permission requirements or side effects on other tags.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a clear opening sentence, a concise behavioral note, a typical flow, and a compact Args/Returns section. Every sentence adds value, and the most important information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the operation's purpose, behavior, parameters, and return value. It lacks explicit mention of error conditions or permission requirements, but for a tagging operation with a clear flow and return type, it is largely complete. The output schema exists, so return value details are already structured.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It does: it explains id_or_name as the source image name or id, repository as the target repository name (with registry-qualified example), and tag as the new tag with a default of 'latest'. This adds meaning beyond the bare schema properties.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Tag'), a resource ('an image into a repository'), and clarifies the operation as adding a name to an existing local image. It also distinguishes itself from related operations like image_push and image_remove, making its purpose unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly provides a typical flow ('tag with the registry-qualified name, then image_push') and explains when image_remove is relevant ('merely untags while other names remain'). It also warns about repointing behavior when tagging over an existing name, giving clear guidance on when and how to use this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

network_connectA

Attach a running container to an additional network without restarting it.

Use this to give a container access to services on a network it was not started with. aliases sets extra DNS names for this container within the network (other containers can reach it by those names in addition to its container name). ipv4_address / ipv6_address assign a specific IP on the network; omit to let the driver assign one. links is a legacy feature (deprecated; prefer DNS aliases). Use network_disconnect to undo.

Args: id_or_name: Network id or name to connect the container to container: Container id or name to attach aliases: Additional DNS names for this container within the network links: Legacy container links (deprecated) ipv4_address: Static IPv4 address to assign on this network ipv6_address: Static IPv6 address to assign on this network link_local_ips: Link-local IP addresses to assign driver_opt: Driver-specific endpoint options mac_address: Static MAC address for this endpoint, e.g. "02:42:ac:11:00:04"; per-network rather than per-container, and a driver is free to ignore it

Returns: bool: True after the container is connected

ParametersJSON Schema
NameRequiredDescriptionDefault
linksNo
aliasesNo
containerYes
driver_optNo
id_or_nameYes
mac_addressNo
ipv4_addressNo
ipv6_addressNo
link_local_ipsNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations indicate a mutating but non-destructive operation, and the description adds useful behavioral details: no restart required, links is deprecated, and mac_address is per-network and may be ignored by the driver. These go beyond the annotation-only safety profile.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is longer than average but every section earns its place: a clear lead sentence, a usage rationale, structured parameter explanations, and a return note. It remains scannable and front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the 9-parameter complexity, the presence of an output schema, and annotations covering the mutation/destructive profile, the description provides all the context needed to invoke the tool correctly, including rollback guidance through network_disconnect.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description fully compensates by explaining all 9 parameters, including the meaning of aliases, the deprecation of links, the 'omit to let the driver assign' behavior for IP addresses, and an example for mac_address.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Attach a running container to an additional network without restarting it.' It clearly distinguishes this from related operations by naming network_disconnect as the undo action.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly states when to use the tool ('Use this to give a container access to services on a network it was not started with') and directs the user to network_disconnect to undo. It does not enumerate many alternatives, but the key sibling distinction is present.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

network_createA

Create a network.

The daemon default driver is bridge (single-host); use overlay for swarm-wide networks. Creating a network attaches nothing - connect containers afterwards with network_connect or at start via container_run(network=...). Created networks carry provenance labels. A duplicate name is always rejected, so creating is not idempotent - check network_list first when the network may already exist.

Args: driver: Driver name (daemon default bridge; overlay for swarm scope) options: Driver-specific options dict ipam: IPAM configuration as a dict (engine shape: {"Driver", "Config": [{"Subnet", "Gateway", ...}]}) internal: Restrict external access labels: Labels to set on the network enable_ipv6: Enable IPv6 networking attachable: Allow standalone containers to attach (swarm overlay networks) scope: Network scope; the driver picks a sensible default when omitted ingress: Make this an ingress network for swarm routing-mesh

Returns: dict: The created network's full inspect payload

ParametersJSON Schema
NameRequiredDescriptionDefault
ipamNo
nameYes
scopeNo
driverNo
labelsNo
ingressNo
optionsNo
internalNo
attachableNo
enable_ipv6No

TDQS

A4.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only state readOnlyHint=false and destructiveHint=false, so the description carries the burden. It discloses non-idempotency (duplicate name rejected), provenance labels, and that creation attaches nothing. These are important behavioral traits beyond the annotations, though it doesn't cover permissions or rate limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured: a one-line purpose, then key behavioral notes, then a clear Args list, and a Returns line. Every sentence adds value without redundancy, and the core information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 10 parameters and no output schema, the description covers all parameters, explains the return type, provides usage context, and mentions the idempotency caveat. It is sufficiently complete for an agent to call it correctly without further lookups.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description fully compensates by explaining each parameter in the Args section, including defaults (e.g., bridge default, internal default false), driver options, IPAM dict shape, and scope defaults. This adds meaning well beyond the schema's types and enums.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb and resource ('Create a network') and differentiates it from sibling tools like network_connect and network_list by explaining the attach behavior. It also clarifies driver selection (bridge vs overlay) and the non-idempotent nature, making it unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly says to connect containers afterwards with network_connect or via container_run(network=...), and advises checking network_list first when a duplicate may exist. It also explains when to use overlay vs bridge, giving clear when-to-use guidance and an alternative.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

network_disconnectA

Disconnect a container from a network.

The container keeps running with its other network attachments; only this endpoint is removed (the reverse of network_connect). A network with connected containers cannot be deleted, so disconnect them before network_remove.

Args: container: The container id or name to disconnect force: Force the disconnect; use to clear a stale endpoint (e.g. from a deleted container)

Returns: bool: True after the container is disconnected

ParametersJSON Schema
NameRequiredDescriptionDefault
forceNo
containerYes
id_or_nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds useful behavioral context beyond the annotations: the container keeps running, other network attachments remain, and only this endpoint is removed. It also explains the relationship to network deletion. While annotations indicate this is not read-only, the description clarifies the precise side effect without contradicting them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and well-organized with a clear summary, an args section, and a returns section. It avoids unnecessary filler. However, the Args section is incomplete because it omits id_or_name, which slightly undermines the structural completeness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

While the description covers the core action and key behavioral implications, it fails to document the required id_or_name parameter, leaving the agent unable to correctly formulate a call without external knowledge. The presence of an output schema does not compensate for this missing required parameter explanation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must document all parameters, but it omits the required id_or_name parameter entirely. It explains container and force with meaningful detail, but an agent cannot determine what id_or_name refers to from the description or schema, which is a critical gap for a required argument.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description begins with a concise, specific statement: 'Disconnect a container from a network.' It clearly identifies the action, the resource, and the scope of the operation. It also distinguishes itself from related siblings by being called the reverse of network_connect and a prerequisite for network_remove.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit when-to-use guidance by naming related tools: it is the reverse of network_connect, and it should be used before network_remove because a network with connected containers cannot be deleted. This gives the agent clear routing logic and avoids confusion with adjacent network operations.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

network_inspectA
Read-only

Return the full inspect detail for a single network.

Includes the connected containers (Containers, keyed by container id, with each entry's assigned IP), IPAM config, and driver options. For a quick overview of many networks use network_list instead - its default (non-greedy) response omits the per-network Containers detail for speed.

Returns: dict: Full network inspect attrs (equivalent to docker network inspect)

ParametersJSON Schema
NameRequiredDescriptionDefault
id_or_nameYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations (readOnlyHint=true, destructiveHint=false) already establish that this is a safe, read-only operation. The description adds valuable context about what the response contains (connected containers with IPs, IPAM config, driver options) and its equivalence to `docker network inspect`. It does not introduce any contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is tightly written: a one-sentence purpose, a sentence on response contents, an alternative routing note, and a concise return type line. Every sentence earns its place, and it is front-loaded with the core purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only tool with a single parameter and no output schema, this description fully covers what an agent needs: what it returns, how to invoke it (via identifier), and when to prefer it over a sibling. No critical information is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has zero description coverage; the parameter name 'id_or_name' is self-explanatory but the description does not explicitly elaborate on it. However, the phrase 'single network' implies the parameter identifies the network. This is adequate but does not add extra meaning like format examples or acceptance criteria.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description begins with a specific verb ('Return') and resource ('full inspect detail for a single network'), and explicitly contrasts with network_list ('For a quick overview of many networks use network_list instead'). This clearly distinguishes it from its most similar sibling, making its purpose unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides explicit guidance on when to use this tool versus the alternative: use this for a single network's full detail, and use network_list for a quick overview of many networks. This is a direct, actionable routing instruction.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

network_listA
Read-only

List networks.

Valid filter keys: driver (driver name), label (key or key=value), type ("custom" or "builtin"). names/ids are a separate shorthand for filtering by exact name/id, applied in addition to filters. Set greedy to fetch each network's attrs individually (adds the connected-containers detail that network_inspect returns, at the cost of one extra daemon call per network) - leave it False for a fast summary list.

Args: names: Filter by exact network names ids: Filter by exact network ids filters: Additional server-side filters; see description for valid keys greedy: Fetch extended per-network details (including connected containers) managed_only: Only return networks created by this MCP server (filters on the docker-mcp-server.managed label); combines with any filters given

Returns: list: One dict ({"Id", "Name", "Driver", "Scope", ...}) per network: summary attrs by default, full inspect attrs (adding "Containers") when greedy=True

ParametersJSON Schema
NameRequiredDescriptionDefault
idsNo
namesNo
greedyNo
filtersNo
managed_onlyNo

TDQS

A4.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds meaningful behavioral context: greedy costs one extra daemon call per network, managed_only filters on a specific label, and the return shape changes from summary attrs to full inspect attrs with 'Containers' when greedy=True. This goes beyond the annotations and helps the agent anticipate performance and output differences.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but well-organized: a one-line summary, a paragraph on filters and greedy, a compact Args list, and a Returns line. Every sentence adds information, and the most important usage guidance (filters and greedy) is front-loaded. No filler or repetition of schema defaults.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a list tool with no required parameters and no output schema, the description covers everything an agent needs: filter semantics, performance trade-offs, the managed_only special case, and the return shape. The sibling list is large, but the description's explicit mention of network_inspect and the greedy behavior removes ambiguity. Nothing critical is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the full burden for parameter semantics, and it delivers. It explains the valid filter keys (driver, label, type), the shorthand behavior of names/ids, the greedy trade-off, and the managed_only label filter. It also documents the return format per parameter combination. This fully compensates for the empty schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'List networks' – a specific verb and resource – and then immediately distinguishes the tool's scope by explaining the filter keys and the greedy flag. It clearly differentiates from siblings like network_inspect by stating that greedy adds the connected-containers detail that network_inspect returns. An agent can tell exactly what this tool does and how it relates to nearby tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly explains when to use greedy (fetch extended per-network details) versus leaving it False for a fast summary list, and it names network_inspect as the source of the extra detail. It also documents the valid filter keys and how names/ids interact with filters, giving clear context for choosing this tool and its options. No exclusions are needed because the tool is a straightforward list operation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

network_pruneA
DestructiveIdempotent

Remove networks that have no active container endpoints.

Built-in networks (bridge, host, none) are never removed. Only networks with zero connected containers are eligible. Valid filter keys: until (RFC3339 timestamp or duration - removes networks created before that point), label (key or key=value). Use network_remove to delete one specific network instead.

Args: filters: Narrow which networks to remove; omit to remove all unused custom networks

Returns: dict: {"NetworksDeleted": [...]}

ParametersJSON Schema
NameRequiredDescriptionDefault
filtersNo

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark destructiveHint and idempotentHint. The description adds valuable behavioral context: built-in networks are never removed, only networks with zero connected containers are eligible, and filter semantics. This goes beyond the annotations by clarifying safety and selection criteria, though it doesn't mention permission requirements or rate limits, which are less critical for this tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is efficient and well-structured: it leads with the core purpose, then safety and selection rules, then filters and alternative, then args and return. It's a bit longer than the minimum but every sentence adds value and it's not redundant. Slight room for tightening, but overall very good.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given there is no output schema, the description includes the return format ({"NetworksDeleted": [...]}). It also covers the filter options, the safety exclusions, and the alternative tool. This is complete for an agent to invoke the tool correctly without additional context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has one object parameter with no description (0% coverage). The description fully compensates by explaining the filter keys: 'until' (with format details) and 'label' (key or key=value), and that omitting filters removes all unused custom networks. This gives the agent everything needed to use the parameter correctly.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool removes networks with no active container endpoints, and explicitly differentiates from network_remove which deletes one specific network. It also clarifies the scope (only custom networks, built-ins are exempt), making the purpose unambiguous and distinguishable from siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit when-to-use guidance: it's for pruning unused custom networks, and directly tells the agent to use network_remove for deleting a single specific network. It also explains the optional filters and how omitting them removes all unused custom networks, covering both use cases and alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

network_removeA
Destructive

Remove a single custom network by id or name.

Fails if any container is still attached (disconnect with network_disconnect or stop the containers first). Built-in networks (bridge, host, none) can never be removed and return an error regardless of attachment state. For bulk cleanup of every unused custom network at once use network_prune instead.

Returns: bool: True after removal

ParametersJSON Schema
NameRequiredDescriptionDefault
id_or_nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the destructiveHint annotation, the description adds critical behavioral details: failure when containers are attached, the irreversibility of built-in network removal regardless of attachment state, and the boolean return value. These are meaningful operational traits that an agent needs to predict behavior correctly.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded, stating the core purpose in the first sentence, followed by essential failure conditions and the alternative tool. There is no redundant filler; every sentence adds operational value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter destructive tool with a bool output schema, the description covers purpose, preconditions, failure modes, non-removable networks, and the bulk alternative. Nothing critical is missing for an agent to invoke this tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema only defines id_or_name as a required string with no description. The description compensates by clarifying that this single parameter accepts either an id or a nametemp, and that it refers to a custom network. While it does not elaborate on formats or validation, the key semantic ambiguity is resolved.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence clearly states the verb (remove), the resource (custom network), and the selection method (by id or name). It distinguishes itself from related network operations and explicitly identifies the bulk alternative, network_prune, so an agent can select the correct tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives concrete guidance on when to use this tool versus alternatives: use network_disconnect or stop containers first if any are attached, and use network_prune for bulk cleanup. It also warns that built-in networks can never be removed, giving the agent clear preconditions and exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

node_inspectA
Read-only

Get a swarm node's full inspect payload by id or name.

Must run against a swarm manager. Shows role, availability, status, and manager reachability - use node_list to enumerate nodes first; service_ps(filters={"node": ...}) shows what a service runs on one node.

Args: id_or_name: The node id or hostname (as shown by node_list)

Returns: dict: The node's full document (Spec{Role, Availability}, Status, ManagerStatus for managers)

ParametersJSON Schema
NameRequiredDescriptionDefault
id_or_nameYes

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark this as read-only and non-destructive. The description adds valuable non-annotated context: the swarm manager requirementency, the relevant fields (role, availability, status, manager reachability), and the dict return shape. It does not discuss authentication details, but those are less critical with the read-only annotation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact, front-loaded with the purpose, and every sentence adds signal: system requirement, payload summary, sibling guidance, argument meaning, and return type. No filler or tautology.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter inspect tool with no output schema, this description covers the prerequisite, how to identify the parameter value, what fields the result contains, and even handy sibling relationships. There is no missing information that would prevent an agent from invoking it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema only says id_or_name is a string, but the description explains it accepts 'The node id or hostname (as shown by node_list).' That fully compensates for the 0% schema coverage by defining the parameter meaning and its source, though it stops short of showing an example or specifying short-ID syntax.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a precise verb and object: 'Get a swarm node's full inspect payload by id or name.' It clarifies the resource, the lookup key, and what kind of payload is returned, distinguishing it from broader swarm or listing tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives an explicit prerequisite ('Must run against a swarm manager'), tells the agent to use node_list to discover nodes first, and points to service_ps as the alternative when the goal is to see what a service runs on a node. This is clear routing between sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

node_listA
Read-only

List swarm nodes.

Must run against a swarm manager. The fleet view of membership, role, and state; drill into one node with node_inspect.

Args: filters: Filter by attributes (id, name, membership, role)

Returns: list: One full node document per node (Spec, Status, ManagerStatus for managers)

ParametersJSON Schema
NameRequiredDescriptionDefault
filtersNo

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, covering the safety profile. The description adds useful behavioral context beyond those annotations: it requires a swarm manager and explains the return shape (a list of full node documents with Spec, Status, and ManagerStatus where applicable).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and well structured: a one-line purpose, a prerequisite, a sibling pointer, and clearly labeled Args/Returns. Every sentence adds information; there is no filler or repetition of the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only list operation with a single optional filter parameter and no output schema, the description covers the essential context: manager requirement, filterable attributes, and return shape. It is not exhaustive about filter syntax or error conditions, but it is sufficiently complete for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema only says filters is an object, with 0% description coverage. The description compensates by explaining that filters accepts id, name, membership, and role. It does not specify exact formats or values, but it gives enough semantic grounding to use the parameter sensibly.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with the explicit, specific action 'List swarm nodes' and frames it as the fleet-level view. It also distinguishes itself from node_inspect, stating that node_inspect is for drilling into one node, making the purpose clear relative to siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives a concrete prerequisite ('Must run against a swarm manager') and an explicit routing rule: use this for the fleet view, use node_inspect to drill into one node. This is exactly the kind of when-to-use guidance an agent needs.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

node_removeA
Destructive

Remove a node from the swarm.

A node should normally be drained (node_update with Availability "drain") and have left the swarm first, so its tasks reschedule cleanly. Removing an active/reachable node requires force=True.

Args: id_or_name: The node id or name to remove force: Force removal of an active/reachable node

Returns: bool: True after the node is removed

ParametersJSON Schema
NameRequiredDescriptionDefault
forceNo
id_or_nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations indicate destructiveHint=true, and the description reinforces this by explaining safe removal prerequisites and the force requirement. It adds context about task rescheduling and the necessity of draining, which goes beyond the destructive hint alone. The return type (bool) is also stated.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is efficiently structured: a one-sentence purpose, a short paragraph of prerequisites and conditions, then an Args list. It is front-loaded with the core action and contains no wasted words, though the Args list could be seen as slightly repetitive of the narrative.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive tool, the description covers all essential call information: parameters, prerequisites, force condition, and return type (also present in output schema). It does not mention error handling or side effects beyond task rescheduling, but these are not critical for correct invocation. The presence of an output schema reduces the need to explain return values.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description fully compensates by defining both parameters in the Args section: id_or_name (node id or name) and force (force removal of active nodes). This provides complete semantic meaning that the schema lacks.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear verb and resource: 'Remove a node from the swarm.' This unambiguously distinguishes it from sibling tools like node_update, node_inspect, and node_list. The purpose is specific and immediately understandable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit usage context: nodes should be drained first and have left the swarm, with the consequence that 'tasks reschedule cleanly.' It also specifies the condition for force=True (active/reachable nodes). However, it does not explicitly mention alternatives or when not to use this tool, though it references node_update as a prerequisite.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

node_updateA

Replace a node's spec (availability, name, role, labels).

Replacement, not a merge: spec becomes the node's entire spec, and omitted keys are cleared. Fetch the current spec via node_inspect (its Spec key), modify it, and resubmit the whole dict - e.g. sending just {"Availability": "drain"} would also wipe the node's role and labels.

Args: spec: The complete new node spec (see description - omitted keys are cleared)

Returns: bool: True after the update

ParametersJSON Schema
NameRequiredDescriptionDefault
specYes
id_or_nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes beyond the provided annotations by exposing the crucial non-merge, overwrite behavior: omitted keys are cleared, and it gives a concrete example of how sending just {"Availability": "drain"} wipes role and labels. This is exactly the kind of 'what gets destroyed' context that keeps an agent from making a destructive mistake.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well organized: purpose first, then the critical replacement warning, and then parameters. The example reinforces the warning without excessive padding. It earns high marks, though a slightly tighter back half could ship slightly better.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the essential operational flow (node_inspect + resubmit) and the return value (bool). It does not specify accepted values for id_or_name or preconditions such as cluster mode/manager availability, but for the core task of safely replacing a node spec it is largely complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The spec parameter is well explained: it must be the complete new spec and omitted keys are cleared. However, there is 0% schema description coverage, and the description does not explain the id_or_name parameter beyond the bare name, leaving uncertainty about whether it accepts an ID, a name, or both, or what formats are valid.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose with a specific verb 'Replace' and identifies the resource ('a node's spec') and the relevant fields (availability, name, role, labels). It distinguishes itself naturally from sibling tools like node_inspect and node_remove by focusing on spec replacement.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives actionable usage guidance: fetch the current spec via node_inspect, modify it, and resubmit the entire dict. It also warns not to send a partial spec such as only changing Availability. It does not explicitly name when not to use the tool or alternative tools, but the context provided is strong.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

node_waitA
Read-only

Block until a swarm node's Status.State reaches a target value.

Never raises on timeout - the result always carries met and timed_out. Polls Status.State (one of "unknown"/"down"/"ready"/"disconnected") every poll_intervals. Common uses: until="ready" after a newly joined node, or until="down" while draining a node before removal. Does not track task placement - for "has this drained node's workload fully moved off", inspect the relevant services' tasks directly; no single cheap call spans every service in the swarm, so that check isn't built into this tool. service_wait covers service convergence; node_list shows every node's state at once.

Args: until: Target Status.State to wait for: "ready" (default), "down", "disconnected", "unknown" timeout_seconds: Max seconds to wait before returning with timed_out=true poll_interval: Seconds between re-inspections (default 2, > 0); capped by the time left so a large value can't push the total wait past the timeout

Returns: dict: {"node", "until", "met", "timed_out", "state", "availability", "waited_seconds"}

ParametersJSON Schema
NameRequiredDescriptionDefault
untilNoready
id_or_nameYes
poll_intervalNo
timeout_secondsNo

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint/destructiveHint annotations, it discloses that it never raises on timeout, always returns 'met' and 'timed_out', polls periodically, and caps poll_interval by remaining time. This materially enriches the agent's behavioral model.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core behavior, then covers timeout behavior, use cases, parameters, and return value in an organized way. Each section contributes useful details without unnecessary repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a polling utility with no output schema, the description covers return keys, timeout behavior, usage boundaries, and alternatives. The only notable omission is explicit documentation for the required id_or_name parameter, which keeps it from being fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds defaults, valid enum values, and capping behavior for until, timeout_seconds, and poll_interval, which is valuable since schema coverage is 0%. However, it omits the required id_or_name parameter from the Args section, leaving a clear gap for the one parameter an agent must supply.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb and resource: block until a swarm node's Status.State reaches a target. It also distinguishes itself from sibling tools like service_wait and node_list, so an agent can tell it apart.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides concrete common uses ('until=ready' after join, 'until=down' while draining), explicitly states what it does not track, and names service_wait and node_list as alternatives. This gives clear when-to-use and when-not-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

plugin_configureA

Set runtime configuration options on an installed plugin.

Use plugin_inspect first to see which keys the plugin exposes under Settings.Env; pass those same keys as a plain dict, e.g. {"DEBUG": "1", "SOCKET": "/run/x.sock"}. The plugin must be disabled before reconfiguring - call plugin_disable first if it is currently active, then plugin_enable afterwards to apply the new settings.

Args: name: Plugin name, e.g. "vieux/sshfs:latest" options: Key/value settings to apply, matching the plugin's declared env keys

Returns: bool: True after configuration

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes
optionsYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only indicate readOnlyHint=false and destructiveHint=false, so the description carries the burden of explaining mutating behavior. It does so by stating the plugin must be disabled before reconfiguring and that plugin_enable is needed afterward, which implies a state transition. However, it does not discuss side effects such as whether existing configuration is overwritten or exceptions on invalid keys, so it is solid but not exhaustive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured, starting with the core purpose, then prerequisites, then parameter explanations, and finally the return value. It is slightly verbose but every sentence adds information. Front-loading the purpose and usage makes it efficient, though it could be trimmed without losing clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity—requiring inspection, disable, configure, enable sequence—the description covers all necessary steps, explains both parameters thoroughly, and notes the return type. Even though an output schema exists (bool), the description reinforces it. Nothing essential is missing for an agent to invoke this tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description fully compensates. It explains 'name' with a concrete example ('vieux/sshfs:latest') and 'options' as key/value pairs matching the plugin's declared env keys, including a sample dict. This gives the agent far more meaning than the bare schema (string and object types).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb and resource: 'Set runtime configuration options on an installed plugin.' It is specific and distinguishes from siblings like plugin_inspect (read), plugin_install (install), and plugin_enable/disable (state changes). An agent can immediately grasp what this tool does without ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit guidance on when and how to use the tool: first call plugin_inspect to discover env keys, then disable the plugin if active (via plugin_disable), call this tool, and finally re-enable with plugin_enable. It also clarifies the prerequisite state and the aftermath, leaving no room for incorrect invocation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

plugin_createA

Build a plugin from a local plugin data directory and install it under name.

The counterpart to plugin_install, which pulls an already-published plugin from a registry: use this only for a plugin rootfs you built yourself, and plugin_install for anything on a registry. plugin_data_dir is read on the machine running this server (not on the daemon host), must already contain a config.json manifest and a rootfs directory, and is tarred client-side and posted to the daemon - in a container it must be a bind mount or the path resolves to nothing. The new plugin is created disabled: call plugin_configure for any settings it declares, then plugin_enable to activate it. Raises if the directory is missing or lacks config.json/rootfs, or if name is already installed (remove it first with plugin_remove). Unlike the other create tools, this stamps no provenance labels - the Engine API's plugin-create call accepts none.

Args: name: Local name for the plugin, author/name:tag; the :latest tag is optional and is the default if omitted plugin_data_dir: Path on this server's filesystem to the plugin data directory (containing config.json and rootfs) gzip: Compress the uploaded directory with gzip

Returns: dict: The created plugin's full document ({"Id", "Name", "Enabled", "Settings", "Config"})

ParametersJSON Schema
NameRequiredDescriptionDefault
gzipNo
nameYes
plugin_data_dirYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only state readOnlyHint=false and destructiveHint=false, so the description carries the behavioral burden. It discloses that the new plugin is created disabled, that plugin_data_dir is read on the server rather than the daemon host, that the path must resolve to a bind mount in a container, and that the tool raises on missing directories or already-installed names. This far exceeds what annotations alone convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is substantial but every sentence earns its place: scoping, operational details, failure modes, workflow, argument semantics, and return type. It is front-loaded with the core purpose and structured with Args/Returns sections, making the dense information easy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a three-parameter mutation tool with no output schema, the description covers all required operational context: client-side taring, server-vs-daemon path semantics, bind-mount caveat, disabled-by-default state, error conditions, collision handling, and the exact return document shape. Nothing an agent needs to call this correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description must fully document parameters, and it does: name gets its author/name:tag format plus the optional default :latest tag, plugin_data_dir gets both its filesystem location and required contents, and gzip gets its compression behavior. This adds real meaning beyond the bare schema types.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb-resource pair: 'Build a plugin from a local plugin data directory and install it under name.' It immediately distinguishes this tool from plugin_install by naming the counterpart and the exact condition that selects each, so an agent can tell them apart without inspecting schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage guidance is explicit: use this only for a plugin rootfs you built yourself, and plugin_install for anything on a registry. It also prescribes the follow-up workflow (plugin_configure then plugin_enable), the prerequisite removal of an existing plugin name, and the container bind-mount requirement, leaving no ambiguity about when or how to invoke it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

plugin_disableA

Disable a plugin so it stops intercepting Docker API calls; the plugin remains installed.

A disabled plugin cannot be used by new containers but existing containers that already have it attached are unaffected. Use force=True to disable even if active containers are still using it - this may cause those containers to lose access to plugin-provided resources (e.g. a volume driver). Re-enable with plugin_enable.

Args: force: Disable even if active containers are using the plugin (may disrupt them)

Returns: bool: True after the plugin is disabled

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes
forceNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses that disabling affects only new containers, not existing ones, and warns that force=True may disrupt active containers by losing access to plugin-provided resources. It also clarifies the plugin remains installed, which is important for understanding the tool's side effects beyond the annotations (which only indicate non-read-only and non-destructive hints).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a clear overview, explicit warnings, and a concise Args/Returns breakdown. It is front-loaded with the most critical behavioral information, and every sentence adds value without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with only two parameters and an output schema, the description covers all essential aspects: what the tool does, side effects, parameter semantics, and return value. It is complete enough for an agent to invoke correctly without further documentation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description explains the force parameter's meaning and consequences, which goes beyond the schema's simple boolean default. However, it does not elaborate on the name parameter, but since the name is straightforward and probably a plugin identifier, it is adequately covered by the schema even though schema coverage is 0%.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool disables a plugin so it stops intercepting Docker API calls, and notes the plugin remains installed. It distinguishes from siblings like plugin_remove and plugin_enable by specifying that disabled plugins are still installed and can be re-enabled.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly explains when to use force=True and the consequences of doing so, and mentions re-enabling with plugin_enable. This gives the agent clear guidance on choosing this tool over alternatives and handling edge cases.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

plugin_enableA

Activate an installed plugin so Docker routes relevant API calls through it.

Activates a plugin that is currently disabled - either freshly installed or previously disabled via plugin_disable. If the plugin exposes configuration (check via plugin_inspect), call plugin_configure while it is still disabled before enabling it. timeout_seconds controls how long Docker waits for the plugin process to become healthy; 0 means wait indefinitely.

Args: name: The plugin name to enable timeout_seconds: Seconds to wait for the plugin to become healthy (0 = no timeout)

Returns: bool: True after the plugin is enabled

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes
timeout_secondsNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations lack readOnly/destructive hints (both false), so the description carries the burden of behavioral disclosure. It clearly states the tool activates a plugin, that enabling is a state change, and that timeout_seconds controls health wait with 0 meaning indefinite. It also implies the operation is non-destructive (does not remove or permanently alter, just changes state) and notes the return value is a boolean.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is structured with a clear first sentence stating the action, then additional detail on usage and parameters. It is compact, uses a bulleted Args list, and avoids fluff. Every sentence serves a purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is relatively simple with two parameters and an output schema (bool), so the description covers usage context, parameter meaning, and return type. It lacks information about prerequisites like needing plugin installed (but that is implied by 'installed'), and it doesn't mention error cases, but these are minor given the simplicity and the output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage (no descriptions in the schema properties). The description compensates fully by explaining name as 'the plugin name to enable' and timeout_seconds as 'Seconds to wait for the plugin to become healthy (0 = no timeout)'. This adds meaning beyond the bare type and default.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool activates an installed Docker plugin so Docker routes relevant API calls through it. It differentiates from siblings by mentioning the disabled state and relation to plugin_disable, though it does not explicitly name all sibling alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use it (on disabled plugins), mentions the sibling plugin_configure as a prerequisite if configuration exists, and names plugin_disable as the prior operation that disabled it. It also explains the timeout parameter's behavior, providing clear context for when to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

plugin_inspectA
Read-only

Return the full attrs for a single installed plugin.

Use this to check a plugin's Enabled state before calling plugin_enable / plugin_disable, or to read the config keys it exposes under Settings.Env before calling plugin_configure. For the set of all installed plugins use plugin_list.

Args: name: Plugin name, e.g. "vieux/sshfs:latest"

Returns: dict: The plugin's full document (Id, Name, Enabled, Settings, Config)

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes

TDQS

A4.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds useful context about what the returned document contains (Id, Name, Enabled, Settings, Config) and that it returns a dict. It doesn't disclose pagination or error behavior, but for a read-only inspect tool with annotations, this is adequate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded: the core purpose is in the first sentence, followed by usage guidance, then a minimal Args/Returns section. Every sentence earns its place; no filler or repetition of schema fields.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter read-only inspect tool with annotations covering safety, the description is nearly complete. It explains the return shape and usage context. The only minor gap is that it doesn't describe error cases (e.g., plugin not found), but that's not essential for an agent to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It does: it names the parameter ('name') and gives a concrete example ('vieux/sshfs:latest'), which clarifies the expected format (repo/name:tag). This adds real meaning beyond the bare string type in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Return'), a specific resource ('full attrs for a single installed plugin'), and explicitly distinguishes itself from plugin_list ('For the set of all installed plugins use plugin_list'). It also names sibling tools plugin_enable/plugin_disable/plugin_configure, making its purpose unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit when-to-use guidance: check a plugin's Enabled state before plugin_enable/plugin_disable, or read config keys under Settings.Env before plugin_configure. It also names the alternative for listing all plugins (plugin_list). This is exactly the kind of routing an agent needs.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

plugin_installA

Install a plugin from Docker Hub.

remote is a Docker Hub reference in author/name:tag form, e.g. vieux/sshfs:latest. The daemon handles permission grants non-interactively - call plugin_privileges first to see what host access the plugin is asking for. After installation use plugin_inspect to confirm the plugin's enabled state, then call plugin_enable to activate it if needed, and optionally plugin_configure first if it requires settings. Use plugin_list to list all plugins, or plugin_remove to uninstall.

Args: remote: Docker Hub plugin reference, e.g. "vieux/sshfs:latest" local_name: Alias to refer to the plugin locally; defaults to remote

Returns: dict: The installed plugin's full document ({"Id", "Name", "Enabled", "Settings", "Config"})

ParametersJSON Schema
NameRequiredDescriptionDefault
remoteYes
local_nameNo

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only indicate non-read-only and non-destructive. The description adds valuable behavioral context: the daemon handles permission grants non-interactively, the plugin may not be enabled after install, and the returned document includes state fields. This goes beyond the minimal annotation coverage and helps the agent anticipate installation behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is detailed but every sentence serves a purpose: main action, parameter explanation, workflow guidance, and return type. It is structured with clear Args and Returns sections, though slightly lengthy; however, the length is justified by the workflow complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description explicitly states the return document and its keys. It also covers prerequisites (plugin_privileges), follow-up actions (plugin_inspect, plugin_enable, plugin_configure), and alternatives. An agent has everything needed to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, but the description fully compensates: it explains 'remote' as a Docker Hub reference in author/name:tag form with an example, and 'local_name' as an alias defaulting to remote. Both parameters are meaningfully documented despite the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Install a plugin from Docker Hub') and distinguishes itself from siblings like plugin_create, plugin_inspect, and plugin_privileges by specifying the source (Docker Hub) and the install action. The remote format is illustrated with an example, leaving no ambiguity about what the tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit workflow guidance: call plugin_privileges first to inspect permissions, then plugin_inspect to confirm state, then plugin_enable to activate, optionally plugin_configure for settings, and mentions plugin_list and plugin_remove as alternatives. This clearly tells the agent when to use this tool and what to do before and after.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

plugin_listA
Read-only

List installed engine plugins with their full attrs.

Covers managed engine plugins (volume/network/logging drivers installed via plugin_install)

  • not docker CLI plugins such as compose, buildx, or scout. Use it to find exact plugin names for plugin_inspect/plugin_enable/plugin_disable/plugin_remove; the Enabled key shows each plugin's state.

Returns: list: One full document per installed plugin (Id, Name, Enabled, Settings, Config)

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, covering the safety profile. The description adds useful behavioral context beyond that: it returns one full document per plugin, lists the included fields (Id, Name, Enabled, Settings, Config), and narrows the scope to managed engine plugins. This is solid supplementary disclosure for a read-only list tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core action and then provides targeted disambiguation and return information. It is slightly longer than strictly necessary for a zero-argument tool, but every sentence carries useful information, including the CLI-plugin exclusion and the return fields.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, read-only list tool, the description fully covers what an agent needs: what is listed, what is excluded, how to use the results with sibling tools, and what the returned documents contain. No output schema exists, so the explicit return field list is valuable and sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and the schema coverage is effectively complete with an empty object. The 0-parameter baseline is 4, and the description appropriately spends no space on parameter semantics since there are none to explain.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'List installed engine plugins with their full attrs.' It clearly scopes the tool to managed engine plugins and explicitly excludes docker CLI plugins, distinguishing it from related sibling tools like plugin_inspect, plugin_enable, and plugin_remove while avoiding confusion with compose/buildx/scout tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives concrete use context: use it to find exact plugin names for plugin_inspect/plugin_enable/plugin_disable/plugin_remove, and explains that the Enabled key reveals plugin state. It also states what it does not cover (docker CLI plugins), giving clear when-to-use and when-not-to-use guidance without needing to open sibling schemas.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

plugin_privilegesA
Read-only

Ask the registry which host privileges a not-yet-installed plugin demands.

The review step before plugin_install, which grants these privileges non-interactively (the daemon never prompts) - so this is the only chance to see what a plugin wants before it has it. Worth checking for anything not already trusted: plugins routinely request host mounts, devices, and elevated capabilities, and a granted privilege is host-level access, not container-scoped. Reads the remote plugin from its registry and installs nothing; for the privileges of a plugin already installed, read Config from plugin_inspect instead. Credentials come from system_login, or from ~/.docker/config.json if the host ran docker login. Raises if the reference cannot be resolved in the registry.

Args: remote: Registry plugin reference, author/name:tag; the :latest tag is optional and is the default if omitted

Returns: list: One dict per requested privilege ({"Name", "Description", "Value"}), e.g. Name "mount" with Value ["/data"], or "capabilities" with Value ["CAP_SYS_ADMIN"]; empty if the plugin requests none

ParametersJSON Schema
NameRequiredDescriptionDefault
remoteYes

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations indicate readOnlyHint=true, and the description reinforces the read-only nature ('Reads the remote plugin... installs nothing'), but goes beyond by disclosing the security implications: privileges are host-level access, not container-scoped, and plugins routinely request mounts/devices/capabilities. This is valuable context beyond the annotation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is detailed but well-organized, with a clear opening sentence, contextual explanation, and structured Args/Returns sections. While somewhat long, every sentence adds value, though the security warning could be trimmed slightly without loss. The front-loading sets context effectively.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (single parameter, read-only, no output schema), the description is complete: it explains what it does, when to use it, security implications, parameter format, return format with examples, error cases, and alternatives. An agent has everything needed to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has no description for the 'remote' parameter (0% coverage), so the description must compensate. The description explains the format ('author/name:tag'), the optionality of the tag (defaults to :latest), and that it comes from the registry, providing crucial semantics beyond the bare type string.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: asking the registry for host privileges demanded by a not-yet-installed plugin, and explicitly distinguishes it from plugin_inspect for installed plugins. This is a specific verb+resource combination that differentiates it from siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides excellent usage guidance by placing the tool in the workflow ('review step before plugin_install'), explaining why it's needed (daemon never prompts, so this is the only chance to check), and explicitly directing to use plugin_inspect for installed plugins. It also notes credentials come from system_login or config.json, and mentions error conditions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

plugin_pushA

Push an installed plugin to its registry.

The write-side counterpart to plugin_install (which pulls) and the publish step after plugin_create builds a plugin locally: name must already be the registry-qualified name the plugin is installed under, since - unlike image_push - there is no plugin equivalent of image_tag to rename it first, so create it under the target name. The plugin does not need to be enabled. Credentials come from system_login, or from ~/.docker/config.json if the host ran docker login. Does NOT raise when the registry rejects the push: an authentication or quota failure arrives as a final progress record and is surfaced as the error key, so check that key rather than assuming success. Raises CapabilityError if the installed docker-py is too old to expose the internals below, and reports the daemon's own error if the plugin isn't installed.

Bypasses docker-py's Plugin.push()/APIClient.push_plugin(), which cannot work: both POST to /plugins/{name}/pull, a route the Engine does not define (push is /plugins/{name}/push), so they 404 against any daemon. Bug present since the method was written in 2017 and still in docker-py main; it survives because upstream has no test covering it. This calls the correct endpoint through docker-py's private request helpers, in the manner of system_logout's api._auth_configs reach-in, and fails loudly if those internals change shape.

Caveat for ssh:// daemons: docker-py can't cancel an SSH stream, so the timeout_seconds watchdog can't interrupt a push that stalls with the connection still open - the same limitation container_logs carries in follow mode. The call still returns normally once the registry answers or the stream ends.

Args: name: Installed plugin name to push, [registry/]author/name:tag; :latest if the tag is omitted. A bare author/name pushes to Docker Hub timeout_seconds: Max wall-clock seconds to wait on the push stream before returning what was collected (default 300); raise it for a large plugin over a slow link

Returns: dict: {"name", "progress": [], "truncated": bool, "error": str or None} - error is non-None only when the registry reported a failure

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes
timeout_secondsNo

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes far beyond annotations (which only state readOnlyHint=false and destructiveHint=false). It discloses the non-raising behavior on registry rejection, surfaces CapabilityError for old docker-py, reports daemon errors, explains the docker-py bug and its bypass, and documents the ssh daemon timeout limitation. All these behavioral traits are transparently described.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but every sentence earns its place, covering purpose, exceptions, caveats, parameters, and return. It is front-loaded with the core action. The only minor inefficiency is the extended explanation of the docker-py bug, though it adds value for troubleshooting. Overall well-structured and not padded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 2-parameter tool with no output schema, the description is fully complete. It documents the exact return dict, parameter details, error behaviors, credential requirements, and edge cases (ssh daemons, tag defaulting). An agent has everything it needs to call this tool correctly, including how to interpret the result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has 0% description coverage, so the description must fully explain parameters. It details the `name` format (`[registry/]author/name:tag`, default :latest, bare author/name pushes to Docker Hub) and explains `timeout_seconds` with its default and a hint to raise it for large plugins over slow links. This exceeds compensation and provides actionable semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action: 'Push an installed plugin to its registry.' It distinguishes from sibling tools by naming plugin_install (the pull counterpart) and image_push (where image_tag exists). It also positions itself as the publish step after plugin_create, giving an unambiguous purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit guidance on when to use: as the opposite of plugin_install, and as the publish step after plugin_create. It explains that the name must already be registry-qualified because there's no plugin_tag, and clarifies credential requirements (system_login or docker login) and that the plugin need not be enabled. It also warns about failure reporting (check the error key). These are concrete usage conditions and alternative differentiators.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

plugin_removeA
Destructive

Uninstall an engine plugin from the daemon.

Permanent removal - to deactivate but keep a plugin installed use plugin_disable instead. An enabled plugin must be disabled first unless force=True. Plugin names come from plugin_list.

Args: name: The plugin name (e.g. "vieux/sshfs:latest") force: Remove even if the plugin is enabled

Returns: bool: True after removal

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes
forceNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

While annotations already mark this as destructive and non-read-only, the description adds meaningful behavioral context: removal is permanent, plugin_disable is the non-destructive alternative, and force=True changes the prerequisite behavior. This goes beyond what the annotations alone communicate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and well organized: a one-line purpose, a key usage distinction, a prerequisite note, then structured Args and Returns sections. Every sentence contributes actionable information without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive two-parameter tool with many plugin siblings, this description covers the operation, the alternative, the precondition, the parameter semantics, the source of valid names, and the return type. Nothing an agent needs to select and call this tool correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must carry the parameter documentation. It does: name is explained with a concrete example ('vieux/sshfs:latest'), and force is given a clear behavioral meaning ('Remove even if the plugin is enabled'). The schema only provides types/defaults, so this is genuinely additive.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear verb and resource: 'Uninstall an engine plugin from the daemon.' It also immediately differentiates itself from plugin_disable by labeling the operation 'Permanent removal,' so an agent can distinguish this from the many plugin-related sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly names the alternative tool for a different use case: 'to deactivate but keep a plugin installed use plugin_disable instead.' It also gives the prerequisite that an enabled plugin must be disabled first unless force=True, and tells the agent where valid names come from (plugin_list).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

plugin_upgradeA

Upgrade an installed plugin to a newer version.

The plugin must be disabled first - call plugin_disable before this, then plugin_enable afterwards to bring it back up. remote lets you upgrade to a different reference (e.g. a newer tag) than the plugin's current name; omit it to re-pull the same reference. Existing settings and volumes created by the plugin persist across the upgrade.

Args: name: The plugin name to upgrade remote: Reference to upgrade to, e.g. "vieux/sshfs:next" (default: same as name)

Returns: bool: True after the upgrade completes

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes
remoteNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations, the description reveals that the plugin must be disabled first, that existing settings/volumes persist, and that remote re-pulls vs targets a new reference. This adds real behavioral context and aligns with destructiveHint=false.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core action, followed by a tight workflow paragraph, a compact Args list, and a clear Returns line. Every sentence earns its place without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter tool with an output schema, the description covers prerequisites, sequencing, parameter semantics, persistence behavior, and return type. An agent has everything needed to invoke plugin_upgrade correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the full burden, and it delivers: name is 'The plugin name to upgrade' and remote includes an example reference and default behavior ('default: same as name'). Both parameters are fully explained with useful semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Upgrade an installed plugin to a newer version.' This clearly identifies the operation and distinguishes it from sibling tools like plugin_install, plugin_disable, and plugin_enable by focusing on an already-installed plugin.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit workflow guidance: call plugin_disable before and plugin_enable after, and explains when to omit remote vs use a different reference. It lacks an explicit 'use X instead for a new plugin' exclusion, so it stops short of a full when/when-not statement.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

registry_image_configA
Read-only

Fetch and parse an image's config blob from a registry without pulling.

Answers "what's inside this image?" - env vars, entrypoint/cmd, workdir, exposed ports, user, labels, layer history (what registry_manifest only points at via config.digest). Resolves in up to three hops: manifest -> (if multi-platform) the platform entry's manifest -> the config blob. Fails where that resolves to no config descriptor, which means the reference is a manifest list rather than an image - registry_manifest reads those.

Args: repository: Image/repository ref, e.g. "ghcr.io/org/repo"; :tag/@digest is stripped - pass via reference reference: Tag or digest platform: Platform to select from a multi-platform image, "os/arch[/variant]"; ignored for single-platform images username: Registry username (overrides DOCKER_MCP_SERVER_REGISTRY_USERNAME) password: Registry password/token (overrides DOCKER_MCP_SERVER_REGISTRY_PASSWORD)

Returns: dict: {"name", "registry", "reference", "platform", "config_digest", "config": }; platform is the selected platform (None if single-platform)

ParametersJSON Schema
NameRequiredDescriptionDefault
passwordNo
platformNolinux/amd64
usernameNo
referenceNolatest
repositoryYes

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnlyHint=true and destructiveHint=false, which already establish the safety profile. The description adds significant behavioral context: it explains the three-hop resolution process, the platform selection logic, and the failure mode when no config descriptor exists. It doesn't mention authentication prerequisites, but the username/password parameters are self-explanatory and the overall behavior is well disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is somewhat lengthy but well-structured: it front-loads the main purpose, then expands into resolution details, failure cases, and parameter explanations. Every sentence contributes essential information, though the argument list could be streamlined without losing clarity. The use of paragraphs and a separate Returns section improves readability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (multi-hop resolution, platform selection, failure modes) and the absence of an output schema, the description covers everything needed for correct invocation: it explains the resolution path, the failure condition with an alternative, all parameters, and the exact structure of the return value. No critical information is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description fully compensates by explaining each parameter in detail: repository strips :tag/@digest, reference is the tag or digest, platform selects from multi-platform images (with default), and username/password override environment variables. This is comprehensive and leaves no parameter ambiguous.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states precisely the action (fetch and parse an image's config blob from a registry) and the resource (config blob), and answers the 'what's inside?' question with a list of contents. It explicitly distinguishes itself from registry_manifest by noting that registry_manifest only points to config.digest, making the purpose unmistakable even among many siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly explains when to use this tool: to obtain configuration details without pulling, and how it resolves multi-platform images. It also provides a direct alternative by stating that when the reference is a manifest list rather than an image, registry_manifest reads those, effectively giving a when-not-to-use condition and a named replacement.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

registry_manifestA
Read-only

Fetch a repository's manifest without pulling.

May return a single-platform image manifest or a multi-platform manifest list / OCI image index, depending on what the registry serves for that tag. Talks HTTPS directly - no daemon or CLI needed. Alternatives for the same question: buildx_imagetools_inspect (uses the docker CLI and its credential store) and image_registry_data (asks the daemon).

Args: repository: Image/repository ref, e.g. "ghcr.io/org/repo"; :tag/@digest is stripped - pass via reference reference: Tag or digest username: Registry username (overrides DOCKER_MCP_SERVER_REGISTRY_USERNAME; no config.json) password: Registry password/token (overrides DOCKER_MCP_SERVER_REGISTRY_PASSWORD)

Returns: dict: {"name", "registry", "reference", "media_type", "digest", "manifest": }

ParametersJSON Schema
NameRequiredDescriptionDefault
passwordNo
usernameNo
referenceNolatest
repositoryYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark this as read-only, but the description adds valuable behavioral details: it may return single-platform or multi-platform manifests depending on the registry, it uses HTTPS directly without a daemon, and username/password overrides ignore config.json. No contradiction with annotations; the description enriches the safety profile with operational context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is efficient and well-organized: a clear purpose statement, then a concise behavior note, alternatives, an 'Args' section with each parameter, and a 'Returns' section. No superfluous text; every sentence contributes to understanding. Front-loading the purpose is exemplary.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 4-parameter tool with no output schema, the description is complete. It covers the action, the return structure (dict with name/registry/reference/media_type/digest/manifest), parameter details, and situational context (alternatives). An agent has all necessary information to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description fully compensates. Each parameter (repository, reference, username, password) is explained with examples and default behaviors, including the stripping of tags/digests from repository and the override semantics for credentials. This is far beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Fetch a repository's manifest without pulling.' It clearly distinguishes the tool from siblings by naming alternatives (`buildx_imagetools_inspect`, `image_registry_data`) and highlighting the direct HTTPS approach vs. daemon/CLI. This makes the tool's purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use this tool vs. alternatives: 'Talks HTTPS directly - no daemon or CLI needed' and names the specific alternatives with their trade-offs (CLI/credential store vs. daemon). Also provides guidance on parameter usage, noting that `:tag`/`@digest` is stripped from `repository` and must be passed via `reference`. This is comprehensive.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

registry_tagsA
Read-only

List tags for a repository in an OCI v2 registry without pulling.

Works against Docker Hub, GHCR, ECR, GAR, and any OCI-compliant registry; anonymous if no credentials are passed. Talks directly to the registry over HTTPS and does NOT read ~/.docker/config.json - for private registries prefer the DOCKER_MCP_SERVER_REGISTRY_USERNAME / DOCKER_MCP_SERVER_REGISTRY_PASSWORD env vars (keeps secrets out of tool args, which clients often log). Fetch one tag's manifest with registry_manifest; hub_tags adds Hub-specific tag metadata (sizes, push dates).

Args: repository: Image/repository ref, e.g. "alpine", "ghcr.io/org/repo"; any :tag/@digest is stripped username: Registry username (overrides DOCKER_MCP_SERVER_REGISTRY_USERNAME) password: Registry password/token (overrides DOCKER_MCP_SERVER_REGISTRY_PASSWORD) limit: Max tags to return (default 1000, >= 1); pagination capped at 50 pages

Returns: dict: {"name": , "registry": , "tags": [..], "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
passwordNo
usernameNo
repositoryYes

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is known. The description adds valuable behavioral details: it talks directly over HTTPS, does not read ~/.docker/config.json, and limits pagination to 50 pages. Minor gap: no mention of rate limits or error handling on auth failures, but this is good context beyond annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well-structured with a clear opening sentence, then concise paragraphs for usage, args, and returns. Every sentence carries necessary information, with no fluff or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Provides nearly everything needed to use the tool correctly: authentication, repository format, limits, and return shape. It's slightly incomplete for edge cases like handling of empty tag lists or network errors, but given the complexity and the output schema is absent, it is quite thorough.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must compensate, and it does. It explains each parameter's meaning, defaults, and overrides (e.g., 'username overrides DOCKER_MCP_SERVER_REGISTRY_USERNAME'), and clarifies that repository strips tag/digest suffixes. This goes well beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('List tags for a repository in an OCI v2 registry') and clarifies it does so without pulling. Distinct from siblings like hub_tags and registry_manifest, which are explicitly named.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-to-use guidance: 'if you need tag metadata use hub_tags, if you need a manifest use registry_manifest.' Also gives clear context on authentication methods and which env vars to use for private registries.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

registry_tag_waitA
Read-only

Block until a specific tag appears in a repository (e.g. waiting for a CI push to land).

Never raises on timeout - the result always carries met and timed_out. Polls registry_tags every poll_intervals and checks whether tag is in its result. Works against Docker Hub too (registry_tags' own scope covers it), so there is no separate Hub variant. Unlike every other wait tool, this has no host argument - registry tools talk HTTPS directly to the registry, not a Docker daemon.

Caveat: registry_tags paginates up to 50 pages (or limit tags, whichever comes first); if tag would only appear beyond that window it is never found, even once it exists. Raise limit if you expect a very large tag list.

Args: repository: Image/repository ref, e.g. "alpine", "ghcr.io/org/repo"; any :tag/@digest is stripped tag: The exact tag name to wait for username: Registry username (overrides DOCKER_MCP_SERVER_REGISTRY_USERNAME) password: Registry password/token (overrides DOCKER_MCP_SERVER_REGISTRY_PASSWORD) limit: Max tags to scan per poll (default 1000, >= 1); forwarded to registry_tags timeout_seconds: Max seconds to wait before returning with timed_out=true poll_interval: Seconds between re-checks (default 5, > 0); capped by the time left so a large value can't push the total wait past the timeout

Returns: dict: {"repository", "tag", "met", "timed_out", "waited_seconds"}

ParametersJSON Schema
NameRequiredDescriptionDefault
tagYes
limitNo
passwordNo
usernameNo
repositoryYes
poll_intervalNo
timeout_secondsNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds substantial behavioral context beyond the readOnlyHint and destructiveHint annotations. It discloses that the tool never raises on timeout and always returns `met` and `timed_out`, that it polls `registry_tags` at a configurable interval, and it highlights a critical pagination caveat (up to 50 pages or `limit` tags) that could cause the tag to be missed. This is precisely the kind of operational nuance an agent needs, and it complements the annotations rather than repeating them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but every sentence earns its place. It front-loads the purpose and key behavior, then the caveat, then the parameter list, and finally the return format. The structure is logical and scannable, with no fluff. The length is justified by the complexity of the tool and the need to convey the pagination caveat and parameter details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 7 parameters, 2 required, no output schema, and a non-trivial polling behavior, the description is fully complete. It covers the operational model (polls `registry_tags`), the timeout semantics, the pagination pitfall and its mitigation, the difference from sibling wait tools, and the exact return dict. Nothing an agent needs to invoke it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must carry the full burden of explaining parameters, and it does. The Args section explains every parameter: `repository` includes formatting and stripping behavior, `tag` specifies the exact tag, `username`/`password` override env vars, `limit` is forwarded to `registry_tags`, and `timeout_seconds` and `poll_interval` have defaults and constraints. It adds meaning far beyond the bare schema definitions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Block until a specific tag appears in a repository,' with a concrete example ('waiting for a CI push to land'). It also distinguishes itself from sibling wait tools by explicitly noting the absence of a `host` argument and clarifying that it works against Docker Hub with no separate variant. This makes its purpose unmistakable and differentiates it from the many other wait tools in the sibling list.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit when-to-use guidance (waiting for a CI push) and clearly states when this tool is not applicable: unlike every other wait tool, it has no `host` argument, implying that host-based waits are handled elsewhere. It also notes that Docker Hub is covered, so there is no separate Hub variant, preventing the agent from searching for a non-existent tool. This is explicit differentiation with alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scout_compareA
Read-only

Compare two image references and report the CVE delta.

Exactly one of to, to_env, or to_latest=True must be supplied to identify the comparison target. Use it after a rebuild to check the new image against the old (scout_cves scans a single image). Does not raise on a non-zero CLI exit (a missing scout plugin or a timeout still raises) - inspect raw.stderr. Raises ToolInputError if to names a local directory/archive while the call has to run on a remote ssh:// host (no local scout plugin): the file is not staged, so it would resolve against that host's filesystem instead.

Args: image: The new / candidate image reference to: Compare against this image reference, directory, or archive (a local directory/archive only when the CLI runs on this host - see above) to_env: Compare against an image associated with this Scout environment to_latest: Compare against the latest scan of image only_severity: Filter to these severities (omit for all) ignore_unchanged: Exclude unchanged packages from the diff format: Output format; only "json" (the default) is parsed into result platform: Platform of the image to analyze

Returns: dict: {"format": , "result": , "raw": }

ParametersJSON Schema
NameRequiredDescriptionDefault
toNo
imageYes
formatNojson
to_envNo
platformNo
to_latestNo
only_severityNo
ignore_unchangedNo

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds valuable behavioral context beyond that: it does not raise on non-zero CLI exit, it raises ToolInputError for a remote-host/local-file mismatch, and it explains that only 'json' format is parsed into result. This is meaningful disclosure of edge-case behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a one-line summary, a clear usage paragraph, and a compact Args list. It is longer than minimal, but every sentence earns its place: the one-of constraint, the rebuild use case, the non-zero exit behavior, and the remote-host caveat are all non-obvious and necessary. The Args section is slightly redundant with the schema but adds semantic context.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 8 parameters, no output schema, and 0% schema description coverage, the description covers the critical invocation constraints (one-of target, format parsing, error behavior) and the return shape. It could add a bit more on only_severity/ignore_unchanged semantics, but the schema enums and parameter names carry much of that weight. The return dict is explicitly documented.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It does: it explains the semantic role of image ('new / candidate'), the one-of constraint among to/to_env/to_latest, the meaning of to_latest ('latest scan of image'), and the format behavior ('only json is parsed into result'). It does not detail only_severity or ignore_unchanged, but those are fairly self-explanatory from their names and schema enums.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Compare'), a specific resource ('two image references'), and the output ('report the CVE delta'). It also distinguishes itself from the sibling scout_cves by explicitly noting that scout_cves scans a single image, so an agent can tell them apart.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit when-to-use guidance: 'Use it after a rebuild to check the new image against the old' and names the alternative (scout_cves) with the condition that selects it. It also specifies the exact one-of constraint for to/to_env/to_latest, which is critical for correct invocation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scout_cvesA
Read-only

List vulnerabilities (CVEs) in an image via Docker Scout.

Anonymous scans work for public images; Hub policy enforcement and richer recommendations need docker login on the host that runs the CLI - this server's host, or the target ssh:// host itself when no local scout plugin is installed. Start with scout_quickview for a per-severity summary; scout_sbom inventories packages without vulnerability matching. Does not raise on a non-zero CLI exit (a missing scout plugin or a timeout still raises) - inspect raw.stderr.

Args: image: Image reference (a tag or a digest) only_fixed: Only report CVEs with a fixed version available only_severity: Filter to these severities (omit for all) ignore_base: Exclude CVEs introduced by the base image format: Parsed into result as JSON: "sarif" (default, the standard vulnerability-report schema), "spdx", "gitlab", "sbom". Returned verbatim as text: "packages" (Scout's own default, grouped by package), "markdown". There is no plain "json" for this subcommand platform: Platform of the image to analyze, e.g. "linux/amd64"

Returns: dict: {"format": , "result": , "raw": }

ParametersJSON Schema
NameRequiredDescriptionDefault
imageYes
formatNosarif
platformNo
only_fixedNo
ignore_baseNo
only_severityNo

TDQS

A4.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark readOnlyHint=true and destructiveHint=false. The description adds a meaningful quirk: 'Does not raise on a non-zero CLI exit (a missing scout plugin or a timeout still raises) - inspect raw.stderr.' It also notes anonymous scan limitations, going beyond annotations without contradicting them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but every sentence has a purpose: purpose, auth context, sibling routing, exit behavior, then a clean arg list. It is front-loaded with the core purpose and does not waste words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 6 parameters and no output schema, the description covers the return structure (dict with format/result/raw), auth requirements, exit behavior, and format nuances. Nothing an agent needs to decide or invoke correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description carries full burden for parameter meaning. It explains every parameter: image, only_fixed, only_severity, ignore_base, format (including enum values and JSON vs raw text behavior), and platform. This is far beyond the bare schema and is essential for correct invocation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'List vulnerabilities (CVEs) in an image via Docker Scout' – a specific verb, resource, and domain. It also differentiates from siblings by referencing scout_quickview (summary) and scout_sbom (packages without matching), making the tool's role unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly advises to 'Start with scout_quickview for a per-severity summary' and notes scout_sbom covers packages without vulnerability matching. It also explains when authentication matters, giving clear context on when to use this tool vs alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scout_quickviewA
Read-only

Render a compact summary of an image's CVE posture.

The fastest triage step - counts per severity plus base-image status. Drill into individual findings with scout_cves, which unlike this tool can emit machine-readable JSON; get upgrade suggestions with scout_recommendations. Output is plain text only: docker scout quickview has no output-format option, so result is always the rendered text rather than a parsed document. Does not raise on a non-zero CLI exit (a missing scout plugin or a timeout still raises) - inspect raw.stderr.

Args: platform: Platform of the image to analyze, e.g. "linux/amd64"

Returns: dict: {"result": , "raw": }

ParametersJSON Schema
NameRequiredDescriptionDefault
imageYes
platformNo

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint annotation, the description discloses important runtime behavior: output is always plain text, `result` is never a parsed document, and non-zero CLI exits do not raise while missing plugins or timeouts do. This adds significant context about error handling and return value semantics that the annotations do not provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is tightly organized and front-loads purpose, then usage guidance, output format, error behavior, and arguments. Every sentence contributes practical guidance without redundant fluff or repetition of schema information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the lack of an output schema, the description fully explains the return shape (`result` and `raw`) and the plain-text nature of the output. It also covers error behavioraaaa, platform usage, and how this tool relates to its siblings, making it complete enough for an agent to invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema itself has no parameter descriptions, and the description only documents `platform` with an example ('linux/amd64'). The required `image` parameter is not explicitly explained; it is only implied by the tool's purpose. This partially compensates for the 0% schema coverage but leaves the required parameter underspecified.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Render a compact summary of an image's CVE posture' and clarifies the output scope as 'counts per severity plus base-image status'. It also distinguishes the tool from scout_cves and scout_recommendations, preventing ambiguity between siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly positions this tool as 'the fastest triage step' and directs users to scout_cves for individual findings or machine-readable JSON inaddition, and to scout_recommendations for upgrade suggestions. This gives clear when-to-use and when-not-to-use guidance, including the plain-text-only limitation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scout_recommendationsA
Read-only

Suggest base-image upgrades for an image.

Computed against Docker Scout's catalog; generally needs docker login on the host that runs the CLI (the target ssh:// host itself when no local scout plugin is installed) to return useful results for private or rarely-scanned base images. The natural follow-up to scout_cves when the fix is a newer base image. Output is plain text only: docker scout recommendations has no output-format option, so result is always the rendered text rather than a parsed document. Does not raise on a non-zero CLI exit (a missing scout plugin or a timeout still raises) - inspect raw.stderr.

Args: only_refresh: Only show "refresh" recommendations (same major/minor) only_update: Only show "update" recommendations (newer minor/major) tag: Restrict to suggestions matching this tag pattern platform: Platform of the image to analyze

Returns: dict: {"result": , "raw": }

ParametersJSON Schema
NameRequiredDescriptionDefault
tagNo
imageYes
platformNo
only_updateNo
only_refreshNo

TDQS

A4.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare `readOnlyHint=true` and `destructiveHint=false`, setting a baseline. The description adds useful behavioral context: it explicitly states output is plain text only (no output-format option), which is important for parsing, and it notes the exact error behavior (does not raise on non-zero exit, but raises on missing plugin or timeout, and to inspect `raw.stderr`). This is valuable beyond annotations, but it doesn't cover all potential edge cases (e.g., what happens on network failures).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections (main purpose, context dependency, output format, error behavior, args list, return format), but it is somewhat lengthy and could be slightly more compact. The key information is front-loaded (purpose and follow-up to `scout_cves`), and every sentence adds value, but the args list could be integrated more efficiently.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the essential aspects: purpose, usage context, output format, error behavior, all parameters, and return schema. Since there is no output schema, the description appropriately details the return format. However, it could mention alternative tools beyond `scout_cves` (e.g., `scout_compare`) and provide more detail on when not to use this tool, but given the tool's complexity and absence of output schema, it is largely complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries all parameter information burden. The description explicitly names and explains each parameter (`only_refresh`, `only_update`, `tag`, `platform`) in the Args list, adding semantic meaning (e.g., 'only show refresh recommendations (same major/minor)') that the schema properties alone lack. It does not cover `image` explicitly beyond the main purpose, but that is implied by the function. This compensates well for the lack of schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a precise verb and resource ('Suggest base-image upgrades for an image') and clearly distinguishes it from `scout_cves` by positioning it as the natural follow-up when the fix is a newer base image, effectively differentiating it from its most similar sibling. This goes beyond a generic statement and gives the agent a clear purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states the dependency on `docker login` and the `ssh://` host context, and it names the sibling tool (`scout_cves`) and the condition for use (when the fix is a newer base image). It does not fully enumerate when not to use it or compare to other `scout_*` tools (e.g., `scout_compare`), but the context is clear enough for most cases.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scout_sbomA
Read-only

Generate a Software Bill of Materials (SBOM) for an image.

Package inventory only - scout_cves adds vulnerability matching on top. SBOMs can be large; captured stdout is subject to MAX_CLI_OUTPUT_BYTES and may be truncated for big images. If that's a concern, run docker scout sbom -o file.json ... on the host and load the file separately. Does not raise on a non-zero CLI exit (a missing scout plugin or a timeout still raises) - inspect raw.stderr.

Args: format: "spdx" (default, SPDX JSON), "cyclonedx" (CycloneDX JSON), "json" (Scout's native JSON), or "list" (plain-text package list) platform: Platform of the image to analyze

Returns: dict: {"format", "result", "raw": }. result is a parsed dict when format is "spdx"/"cyclonedx"/"json" and stdout parses cleanly; for "list" or a parse failure it's the raw text.

ParametersJSON Schema
NameRequiredDescriptionDefault
imageYes
formatNospdx
platformNo

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond readOnlyHint/destructiveHint annotations, the description discloses non-obvious behavior: captured stdout may be truncated by MAX_CLI_OUTPUT_BYTES, non-zero CLI exits do not raise (except missing plugin or timeout), and callers must inspect raw.stderr. It also explains the result parsing behavior. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured: purpose, key caveats, args, and return value. Each sentence adds essential information, with no fluff. The most important scoping and truncation caveats come early.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only CLI wrapper with no output schema, the description is complete: it specifies parameters, return shape, parsing behavior, error handling, and truncation risk. It names the relevant sibling (scout_cves) and provides a workaround for large outputs. Nothing critical is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description carries the burden. It adds useful semantics for format (explaining each enum value and the default) and platform ('Platform of the image to analyze'). The required image parameter is not explicitly documented in Args, though it is self-evident from 'for an image.' Minor gap, otherwise strong.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Generate a Software Bill of Materials (SBOM) for an image.' It then clarifies scope ('Package inventory only') and explicitly differentiates from sibling scout_cves, which does vulnerability matching. This makes the tool's purpose immediately distinguishable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states the intended use (package inventory) and names the alternative for vulnerability matching (scout_cves). It also provides operational guidance: when large SBOMs risk truncation, run the command on the host with -o file.json and load separately. This is explicit when/when-not guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

secret_createA

Create a swarm secret; requires a swarm manager.

Write-once: the payload can never be read back through the API (secret_inspect returns metadata only) and cannot be changed later - to rotate, create a new secret and update the consuming services, keeping your own copy of the value. For non-sensitive data that should stay readable, use config_create instead. Created secrets are stamped with provenance labels.

Args: name: Name for the secret (unique within the swarm) data: The secret payload (max 500 KB; must be empty when driver is set) labels: Labels to set on the secret driver: Secret-driver config for values held in an external store

Returns: dict: The created secret's full document (ID and Spec metadata; never the payload)

ParametersJSON Schema
NameRequiredDescriptionDefault
dataYes
nameYes
driverNo
labelsNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnly=false and destructive=false annotations, the description discloses irreversible write-once behavior, the inability to read the payload back through the API, provenance-label stamping, and the data/driver interdependency. This is substantial behavioral context with no contradiction against the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core action and prerequisite, followed by a tight behavioral paragraph and a scannable Args/Returns block. Every sentence adds necessary information; there is no filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema and no parameter descriptions in the schema, the description still covers the return document (ID and metadata, never payload), the swarm-manager prerequisite, rotation workflow, the alternative tool, and all parameter constraints. An agent has everything required to call the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the Args section compensates fully by documenting all four parameters with meaningful constraints: uniqueness of name, 500 KB payload limit, the requirement that data be empty when driver is set, and the external-store semantics of driver. This adds critical meaning the bare schema lacks.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence, 'Create a swarm secret', names a specific verb and resource, matching the tool name exactly. It also explicitly contrasts with `config_create`, a close sibling, so an agent can distinguish the two without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states a hard prerequisite ('requires a swarm manager'), explains the write-once consumption pattern, and explicitly directs users to `config_create` for non-sensitive readable data. This gives clear when-to-use and when-not-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

secret_inspectA
Read-only

Get a swarm secret's metadata by id or name; requires a swarm manager.

The returned attrs never include the secret's actual data (Spec.Data is write-only - the daemon accepts it on secret_create but never returns it back, by design). Use this to check a secret's CreatedAt, Labels, or which driver created it, not to read its contents. To see which services reference it, inspect each service's spec via service_inspect (there is no server-side filter for "services using this secret").

Returns: dict: The secret's full document, excluding the actual secret data

ParametersJSON Schema
NameRequiredDescriptionDefault
id_or_nameYes

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only provide readOnlyHint and destructiveHint, but the description adds critical behavior: Spec.Data is write-only and never returned, so the tool cannot expose secret contents. It also adds the swarm-manager requirement, going well beyond the structured hints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the main purpose, and every additional sentence adds value: data exclusion, intended use cases, and the service_inspect alternative. The Returns block is structured and non-redundant.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given there is no output schema, the description explains the return shape (dict excluding secret data), the access prerequisite, and the tool's limitations. An agent has enough context to invoke it correctly and interpret the result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema provides only a required id_or_name string with no description, so the description carries the burden. It clarifies that the parameter accepts either a secret id or name, which is the essential meaning; a single self-descriptive string parameter needs little more.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Get a swarm secret's metadata by id or name.' It clearly distinguishes the tool from secret_list by focusing on a single secret's metadata and explicitly says it is not for reading contents.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly states the swarm manager prerequisite and gives concrete use cases: checking CreatedAt, Labels, or driver. It also names the alternative for service references: service_inspect, with a clear reason that no server-side filter exists.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

secret_listA
Read-only

List swarm secrets' metadata; requires a swarm manager.

Like secret_inspect, results never include secret data, only metadata (name, id, labels, timestamps). Valid filter keys: id, name, names, label (key or key=value).

Args: filters: Narrow the list; omit to return every secret

Returns: list: One full secret document per secret (data-free)

ParametersJSON Schema
NameRequiredDescriptionDefault
filtersNo

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnlyHint and non-destructive, and the description adds meaningful behavioral context: it guarantees no secret data is ever returned, enumerates the metadata fields, requires a swarm manager, and specifies valid filter keys. This goes beyond the annotations and is especially important for a read-only operation on sensitive data.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a leading purpose, a clarifying note, and labeled Args/Returns sections. It is front-loaded with the most important facts, though 'data-free' is stated twice, which is a minor redundancy. Overall, it is concise and scannable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a list tool with one optional parameter and no output schema, the description covers the purpose, prerequisite, filtering options, return type, and data fields. It omits non-essential details like pagination or error handling, but nothing critical is missing for correct invocation and interpretation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% for the filters parameter and the schema provides no description or structure. The description compensates thoroughly by defining its purpose, the default behavior when omitted, and the exact valid filter keys (id, name, names, label with optional key=value). This gives an agent everything needed to construct filters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'List', the resource 'swarm secrets', and the scope 'metadata' in the first sentence. It distinguishes itself from siblings like secret_inspect by specifying that results never include secret data, only metadata fields (name, id, labels, timestamps). This is a precise and non-tautological purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides a necessary prerequisite ('requires a swarm manager'), lists valid filter keys, and explains the filters parameter default. However, it only references secret_inspect to compare data-free behavior, not explicitly stating when to choose list over inspect or alternate tools; it is implied but not directly stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

secret_removeA
Destructive

Remove a Swarm secret; requires a swarm manager.

Removing a secret does not immediately affect running service tasks - tasks that already have the secret mounted retain access until they are restarted or the service is updated. Use service_list and inspect each service's spec via service_inspect to identify services that mount the secret before removing it (service filters do not support filtering by secret reference).

Args: id_or_name: The secret id or name to remove

Returns: bool: True after removal

ParametersJSON Schema
NameRequiredDescriptionDefault
id_or_nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses a non-obvious behavioral trait: removing a secret does not immediately affect running tasks that already have it mounted. It also notes the return value is a bool. This meaningfully complements the destructiveHint annotation without contradicting it.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and well-organized: an action statement, a behavior warning, a recommended inspection workflow, then Args and Returns sections. Every sentence adds value and there is no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the operation, prerequisite, side effects, pre-removal inspection guidance, parameter meaning, and return type. Combined with the existing annotations, this is fully sufficient for an agent to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema only declares id_or_name as a string, giving no semantic meaning. The description fills that gap by stating it accepts 'The secret id or name to remove', which is exactly what an agent needs to know to supply the parameter correctly.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Remove a Swarm secret', identifying a specific verb and resource. It is clearly distinct from sibling tools like secret_list, secret_inspect, and secret_create because it names the exact operation and object.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly states the prerequisite 'requires a swarm manager' and gives a concrete pre-removal workflow: use service_list and service_inspect to find services mounting the secret, since service filters do not support secret references. This is actionable usage guidance beyond what the schema provides.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

service_createA

Create a Swarm service; requires a swarm manager node.

Use this instead of container_run when you need replicated or global scheduling, rolling updates, or automatic restart across the swarm. Common extra_kwargs keys: name (str), env (list of "KEY=VAL"), mode ({"Replicated": {"Replicas": N}} or {"Global": {}}), networks (list of network names/ids), endpoint_spec ({"Ports": [{"PublishedPort": 80, "TargetPort": 8080}]}), labels (dict), restart_policy ({"Condition": "on-failure", "MaxAttempts": 3}), resources ({"Limits": {"NanoCPUs": 500000000, "MemoryBytes": 134217728}}). For anything else docker-py's ServiceCollection.create accepts, call docs_lookup(section="services") rather than guessing a key name.

Args: image: Image to run service tasks from (e.g. "nginx:alpine") command: Override the image's default command; string or list of strings extra_kwargs: Additional docker-py ServiceCollection.create keyword arguments

Returns: dict: The created service's full document ({"ID", "Version", "Spec", ...})

ParametersJSON Schema
NameRequiredDescriptionDefault
imageYes
commandNo
extra_kwargsNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only indicate non-read-only and non-destructive, but the description adds critical behavioral context: requires a swarm manager node, and details common extra_kwargs keys that shape behavior (replicas, ports, restart policies, etc.). It fully discloses the operation's nature without contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Though lengthy, every sentence adds value: purpose, usage, parameter semantics, and return type. The structure is front-loaded with the primary purpose, followed by practical examples, making it efficient for an agent to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers prerequisites, parameter details, return format, and when to seek further documentation. With no output schema, it still provides a clear return description. No critical information is missing for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has zero description coverage (0%), so the description must compensate. It explains each parameter (image, command, extra_kwargs) with concrete examples and even suggests docs_lookup for unknown keys. This adds substantial meaning beyond the raw schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states the tool creates a Swarm service and names a sibling (container_run) to distinguish itself. It clearly identifies the resource and action, making its purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-to-use guidance ('Use this instead of container_run when...'), lists specific scenarios, and directs users to docs_lookup for anything else. This fully informs an agent when to select this tool over alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

service_inspectA
Read-only

Get a swarm service by id or name.

Must run against a swarm manager. Returns the desired-state spec and rollout status - for the actually-running tasks use service_ps, or the service-tasks://{id_or_name} resource for a computed rollout summary.

Args: insert_defaults: Merge default values into the output

Returns: dict: The full service document ({"ID", "Version", "Spec", "Endpoint", ...}; "UpdateStatus" during a rolling update)

ParametersJSON Schema
NameRequiredDescriptionDefault
id_or_nameYes
insert_defaultsNo

TDQS

A4.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds the swarm-manager requirement and clarifies that the return doc contains desired-state spec while actual task status is elsewhere, but does not disclose rate limits, pagination, or other behavioral nuances, which are secondary for a read-only inspect.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is moderately long but every part earns its place: task, precondition, differentiation, parameter semantics, and return shape. It is front-loaded with the primary purpose and alternative. A minor reduction in the final return list could tighten it, but no extraneous content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the low schema coverage and no output schema, the description provides enough context: a clear return type, key fields, and update-status note. It also covers the operational requirement (swarm manager). The only omitted details are error conditions or authorization requirements, which are unnecessary for a read-only inspect.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must carry parameter semantics. It does: the target is 'by id or name' and insert_defaults is explained as 'Merge default values into the output'. This fully compensates for the schema lacking descriptions, though id_or_name's type is implicit.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states 'Get a swarm service by id or name', naming a specific verb and resource. It also explicitly differentiates from sibling service_ps by clarifying that it returns desired-state spec and rollout status, not actual running tasks, so an agent can select it correctly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states a critical precondition ('Must run against a swarm manager') and explicitly points to service_ps as the alternative for actually-running tasks, plus a computed rollout summary resource. It lacks a comprehensive 'when not to use' list, but the key disambiguation from service_ps is explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

service_listA
Read-only

List swarm services.

Must run against a swarm manager. One entry per service (the desired state); service_ps lists a service's tasks, and stack_services groups services by stack.

Args: filters: Filter by attributes (id, name, label, mode) managed_only: Only return services created by this MCP server (filters on the docker-mcp-server.managed label); combines with any filters given

Returns: list: One full service document ({"ID", "Spec", ...}) per service

ParametersJSON Schema
NameRequiredDescriptionDefault
filtersNo
managed_onlyNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate readOnlyHint=true and destructiveHint=false. The description adds meaningful behavioral context beyond that: the swarm manager requirement, the fact that it returns desired state only, one entry per service, and the managed_only label filtering behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and well-structured with a clear opening line, followed by Args and Returns sections. Every sentence earns its place, and the most important usage constraint is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only list tool with two optional params and no output schema, the description covers prerequisites, result format, and sibling distinctions. An agent has everything needed to invoke this tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the full burden. It explains filters as 'Filter by attributes (id, name, label, mode)' and managed_only as filtering on the docker-mcp-server.managed label, including how it combines with filters. This is far more informative than the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'List swarm services.' It also explicitly differentiates itself from siblings by stating that service_ps lists a service's tasks and stack_services groups services by stack, so an agent can disambiguate without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states the key prerequisite ('Must run against a swarm manager'), and clarifies what the tool returns versus alternatives. This gives an agent clear when-to-use and when-not-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

service_logsA
Read-only

Get a bounded snapshot of a swarm service's logs (never follows).

follow is intentionally not exposed: the stream is joined into one string before returning, so following would block forever and grow unbounded. Collection is capped at max_bytes (ToolInputError if exceeded) so a noisy service can't OOM the server. The default is a bounded tail=200; tail="all" returns the whole buffer, which can be huge on long-running services and exceed the agent's context - prefer an integer, or since, to constrain output. Logs aggregate across all the service's tasks: use swarm_task_logs for one task, container_logs for one container, and the service-logs://{id_or_name} resource for the resource-flavored equivalent of this tool.

Args: details: Show extra details since: Show logs since this Unix timestamp tail: Number of lines from the end, or the literal "all" for everything max_bytes: Abort with ToolInputError if the buffered logs exceed this many bytes (default 32 MiB)

Returns: str: Decoded log output

ParametersJSON Schema
NameRequiredDescriptionDefault
tailNo
sinceNo
stderrNo
stdoutNo
detailsNo
max_bytesNo
id_or_nameYes
timestampsNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Even with readOnlyHint=true, the description adds substantial behavioral context: logs are joined into one string, following would block forever, collection is capped at max_bytes with a ToolInputError, and tail='all' can exceed the agent's context. This goes well beyond the annotations and directly informs safe invocation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core behavior and the most critical constraint. Every sentence carries useful information: the non-following caveat, the returned string shape, the max_bytes safeguard, the tail default and warning, the sibling-tool routing, and parameter summaries. There is no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the key operational hazards, appropriate usage, alternatives, parameter basics, and return type. It is slightly incomplete because the stream selection parameters (stderr, stdout) and timestamps are not described, and id_or_name is only implied. Overall it is strong enough for safe invocation, but not exhaustive given the 0% schema coverage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With schema description coverage at 0%, the description compensates for the most important parameters: details, since, tail, and max_bytes, including the special meaning of tail='all' and the error behavior of max_bytes. However, it omits semantics for stderr, stdout, timestamps, and id_or_name, so the compensation is strong but not complete.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Get a bounded snapshot of a swarm service's logs (never follows).' It clearly distinguishes this tool from nearby siblings by stating that logs aggregate across all tasks and pointing to swarm_task_logs and container_logs for narrower scopes. This is not a vague or tautological purpose statement.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage guidance is explicit and actionable. It warns against following, recommends preferring integer tail values or since over 'all' to avoid huge outputs, and names concrete alternatives for task-level, container-level, and resource-flavored log retrieval. This tells an agent exactly when to use this tool versus its siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

service_psA
Read-only

List a swarm service's tasks (per-replica scheduling units), like docker service ps.

Shows where replicas run and why they fail: each task carries Status (State/Message/ContainerStatus), DesiredState, NodeID, and Slot. Prefer this over container_list for services (tasks may run on other nodes), stack_ps for a whole stack, and the service-tasks://{id_or_name} resource for a computed rollout summary. Requires a swarm manager.

Args: filters: Filter dict; keys: id, name, node, label, desired-state (running|shutdown|accepted)

Returns: list: Task dicts (ID, Slot, NodeID, Status, DesiredState, Spec)

ParametersJSON Schema
NameRequiredDescriptionDefault
filtersNo
id_or_nameYes

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds meaningful behavioral context: tasks carry Status/DesiredState/NodeID/Slot, the tool shows where replicas run and why they fail, and it requires a swarm manager. It does not detail pagination or error behavior, but for a read-only list tool the added context is solid.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded: the core action and analogy come first, then the value proposition, then routing guidance, then a prerequisite, then a brief Args/Returns section. Every sentence earns its place and there is no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only list tool with two parameters and no output schema, the description covers the purpose, the return shape, the filter keys, the prerequisite, and the alternatives. The only minor gap is exact filter value formats and whether filters are combined with AND/OR, but the description is otherwise complete enough for an agent to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It documents the filters dict keys (id, name, node, label, desired-state with allowed values) and the required id_or_name is implied by the tool's purpose. It also describes the return list shape. This goes well beyond the bare schema, though it doesn't give exact filter value formats.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('List'), a specific resource ('a swarm service's tasks'), and clarifies the domain ('per-replica scheduling units') with a Docker CLI analogy. It distinguishes itself from container_list, stack_ps, and the service-tasks resource, so an agent can tell it apart from siblings without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says when to prefer this tool over container_list (services may run on other nodes), stack_ps (whole-stack scope), and the service-tasks resource (computed rollout summary). It also states a prerequisite: requires a swarm manager. This is clear when-to-use guidance with named alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

service_removeA
Destructive

Stop and remove a swarm service.

Requires a swarm manager. Deletes the service definition and shuts down its tasks - no confirmation, no undo. To stop work but keep the definition, service_scale to 0 replicas.

Returns: bool: True after the service is removed

ParametersJSON Schema
NameRequiredDescriptionDefault
id_or_nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark destructiveHint: true, so the description builds on that by adding specifics: 'no confirmation, no undo' and the fact that it deletes the service definition and shuts down tasks. It also notes the manager requirement. This adds meaningful behavioral context beyond the annotations, though it doesn't describe permissions or error cases. A 4 is appropriate given the annotation coverage.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and well-organized: purpose, key requirement and alternative, then return type. Each sentence earns its place with no fluff. The most critical info (destructive action) is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter destructive tool, the description covers the essential operational context: what it does, the prerequisite (swarm manager), the irreversibility, the alternative for non-destructive stopping, and the return value. With an output schema implied by the return description, nothing an agent needs to invoke this correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% and the description does not explain the single parameter id_or_name beyond its name. The name is self-descriptive, but the description fails to compensate for the missing schema documentation. It could have clarified that this accepts either a service ID or name, which is implied but not stated. Since the description must compensate at low coverage and doesn't, a 2 is warranted.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a precise verb and resource: 'Stop and remove a swarm service.' It clearly distinguishes from the sibling service_scale by explicitly naming it as the alternative for stopping without removal. No ambiguity about what this tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-to-use and when-not-to-use guidance. States the requirement of a swarm manager and directly tells the agent to use service_scale to 0 replicas if the definition should be kept. This is a clear decision rule that leaves no inference needed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

service_rollbackA

Roll a swarm service back to its previous spec (the docker service rollback equivalent).

Re-applies the service's PreviousSpec - the spec from before the most recent service_update / service_scale. Raises ToolInputError if the service has no PreviousSpec (it has never been updated, or was already rolled back). The high-level SDK exposes no rollback, so this reads the current version and previous spec via the low-level APIClient and submits them with the low-level update_service API call.

Returns: dict: The daemon response (a dict with a "Warnings" key)

ParametersJSON Schema
NameRequiredDescriptionDefault
id_or_nameYes

TDQS

A4.1/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only provide readOnlyHint=false and destructiveHint=false, meaning the description carries the burden of explaining behavior. It does so well: it discloses that the tool mutates the service by re-applying PreviousSpec, raises ToolInputError when no PreviousSpec exists, uses the low-level API, and returns a dict with a 'Warnings' key.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose and keeps related details in a logical order: behavior, error condition, implementation, return value. The low-level API implementation note is slightly verbose but still informative and does not obscure the essential guidance.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter rollback tool with no output schema, the description covers operation, error behavior, and return shape. The only notable gap is the undocumented id_or_name parameter, but the overall context is sufficient for an agent to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% and the only parameter, id_or_name, has no schema description. The description never explicitly states that id_or_name identifies the target swarm service by ID or name, leaving the agent to infer this from the parameter name and tool name. The description should compensate for the empty schema but does not.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Roll') and resource ('a swarm service back to its previous spec'), and explicitly identifies it as the docker `service rollback` equivalent. It also references service_update/service_scale as the source of PreviousSpec, which distinguishes it from those sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description makes clear this is used after a prior service_update/service_scale and re-applies the PreviousSpec, giving strong contextual guidance. It does not explicitly say 'use this instead of service_update when you want to undo a change,' but the intended usage is clear from the rollback semantics and error condition.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

service_scaleA

Set the desired replica count for a Replicated-mode swarm service.

Only applies to services in Replicated mode; a Global service runs one task per eligible node and has no replica count to set. The swarm scheduler places or removes tasks asynchronously to converge on the new count - this call returns once the update is accepted, not once every task is running. Check progress with service_ps or service_inspect. For any other spec change (image, env, resources) use service_update instead.

Args: replicas: The desired number of running task replicas

Returns: bool: True once the scale request is accepted

ParametersJSON Schema
NameRequiredDescriptionDefault
replicasYes
id_or_nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations indicate readOnlyHint=false and destructiveHint=false, so the description correctly implies a mutating operation without being destructive. It adds crucial behavioral context: the call is asynchronous (returns before tasks are running) and only sets replica count. This goes beyond annotations by explaining the non-blocking nature, though it doesn't mention authentication requirements or error conditions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured: a one-line summary, then a detailed paragraph on scope and behavior, followed by a concise Args and Returns section. Every sentence adds value, with the most critical constraint (mode) front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with only 2 parameters and an output schema (bool), the description is largely complete. It explains the return value and when to use alternatives. The main missing piece is the 'id_or_name' parameter semantics, but given the simplicity might be considered obvious. A strong description overall.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, and the description compensates by explaining the 'replicas' parameter as the desired number of running task replicas. However, the equally important 'id_or_name' parameter is not described, which is a gap given the low schema coverage. The description adds value for 'replicas' but misses 'id_or_name'.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Set' with the resource 'desired replica count for a Replicated-mode swarm service', which is specific and distinct from siblings like service_update. It immediately conveys the primary function without ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit when-to-use guidance: it only applies to Replicated services, not Global; it distinguishes from service_update for other spec changes; and it directs to service_ps/service_inspect for progress checking. This is exemplary for routing the agent to the correct tool and follow-up actions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

service_updateA

Update a swarm service's configuration, or force a redeploy with no spec change.

Pass exactly one of updates (fields to change, same parameters as service_create) or force=True (the docker service update --force equivalent: bumps the ForceUpdate counter so the service's tasks redeploy with an unchanged spec - e.g. to reschedule after a node change or re-pull a mutable tag).

Args: updates: Fields to update on the service; exactly one of updates/force force: Redeploy the service without changing its spec; exactly one of updates/force

Returns: bool: True after the update

ParametersJSON Schema
NameRequiredDescriptionDefault
forceNo
updatesNo
id_or_nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate readOnlyHint=false and destructiveHint=false, so the description does not need to repeat that. It adds useful details like the ForceUpdate counter bump and the return type, but it does not disclose prerequisites, error conditions, or side effects such as rolling update behavior, which would be valuable for a mutation tool. The description carries some burden but is not exhaustive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with an Args and Returns section, and the main purpose is front-loaded. It is concise enough, though it repeats the 'exactly one' constraint twice, which is a minor redundancy. Overall, it is efficient and easy to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a mutation tool with two modes and three parameters, the description covers the essential aspects: what it does, how to specify changes, and the force mode. It points to service_create for field details and declares the return type. Missing details like error handling or permissions are not critical for basic usage, and the output schema exists to clarify returns. It is fairly complete for typical agent invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must explain parameters. It clearly defines `updates` and `force`, including the constraint of exactly one, and references `service_create` for valid fields. The required `id_or_name` is not described but its meaning is obvious from the tool's purpose. The description adds meaning beyond the schema for the optional parameters, though it leaves the field enumeration to another tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states that the tool updates a swarm service's configuration or forces a redeploy, distinguishing it from siblings like service_create, service_scale, and service_rollback. It explicitly names the two operation modes, making the tool's purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly instructs that exactly one of `updates` or `force` must be passed, and explains the use case for force (reschedule after node change, re-pull a mutable tag). It does not explicitly compare with alternatives like service_scale, but the Docker context implies when to use this tool, and the guidance is sufficient for correct invocation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

service_waitA
Read-only

Block until a swarm service's tasks converge, or a rolling update finishes.

One contract for both modes: never raises on timeout - the result always carries met and timed_out. "running" polls task state via the same task-counting logic as service-tasks://{id_or_name} (not the unconfirmed daemon ServiceStatus field) until running tasks reach the desired count (Replicated mode) or every returned task is running (Global mode, which has no fixed target). "update-converged" polls UpdateStatus.State until it reaches a terminal value (completed or rollback_completed); if the service has never been updated (no UpdateStatus at all), returns promptly with met=false - there's nothing to converge to, same as container_wait's no-healthcheck case.

Args: until: Condition to wait for: "running" (default) or "update-converged" replicas: "running" mode only: override the desired replica count (e.g. right after a same-turn service_scale call, before polling reflects the new target) timeout_seconds: Max seconds to wait before returning with timed_out=true poll_interval: Seconds between re-checks (default 2, > 0); capped by the time left so a large value can't push the total wait past the timeout

Returns: dict: {"service", "until", "met", "timed_out", "running_tasks", "desired_tasks", "failed_tasks", "update_state", "waited_seconds"}

ParametersJSON Schema
NameRequiredDescriptionDefault
untilNorunning
replicasNo
id_or_nameYes
poll_intervalNo
timeout_secondsNo

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint/destructiveHint annotations, the description discloses key behavior: it never raises on timeout and always returns met/timed_out, it polls task state using specific task-counting logic rather than the daemon's ServiceStatus field, and it defines per-mode terminal conditions. It even handles the never-updated service case, which is exactly the kind of behavioral nuance an agent needs.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but information-dense, with the core contract front-loaded and every subsequent sentence earning its place. The Args and Returns sections are structured for easy scanning and add essential detail that is absent from the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a polling tool with no output schema and multiple modes, the description is complete: it documents input parameters, return fields, timeout behavior, mode-specific logic, and edge cases. An agent has enough information to invoke the tool correctly and interpret its result in both waiting modes.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the Args section fully compensates: it explains until's two enum values, the replicas override use-case, timeout semantics, and poll_interval's default and time-left cap. Only id_or_name is not explicitly described, but its meaning is clear from the name and required position.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Block until a swarm service's tasks converge, or a rolling update finishes.' It clearly distinguishes the two wait modes ('running' vs 'update-converged') and references the analogous container_wait behavior, making the tool's role unmistakable among a large sibling list.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives strong mode-level guidance: when to use 'running' vs 'update-converged', when the replicas override is needed (right after service_scale), and how poll_interval behaves. It also explains the no-UpdateStatus edge case. It does not explicitly name a sibling tool to prefer instead, but the mode selection guidance is clear and actionable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

stack_deployA

Deploy (or update) a stack to the swarm from one or more Compose files.

Requires the target daemon to be a swarm manager. Re-running with the same name updates the stack in place. Defaults to detach=True (returns once specs are submitted, not on convergence); set detach=False to wait for the rollout (give it a generous timeout_seconds). The swarm analogue of compose_up; watch the rollout with stack_services / stack_ps. Does not raise on a non-zero CLI exit (a missing docker binary or a timeout still raises) - inspect returncode/stderr in the result.

Args: name: Name of the stack to create or update compose_files: One or more Compose file paths (repeated -c; later override earlier). At least one required. with_registry_auth: Send registry credentials to swarm agents (needed for private images) prune: Remove services no longer defined in the Compose file resolve_image: Image-digest resolution; omit for the CLI default ("always") detach: Return immediately after submitting specs (True) vs wait for convergence (False) cwd: Working directory for resolving relative Compose paths (defaults to the server's cwd; copied to the target host if no local docker CLI) timeout_seconds: Subprocess timeout (default 1800s)

Returns: dict: {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
cwdNo
nameYes
pruneNo
detachNo
compose_filesYes
resolve_imageNo
timeout_secondsNo
with_registry_authNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond annotations (readOnlyHint=false, destructiveHint=false), the description discloses important runtime behavior: detach defaults to True, update-in-place semantics, non-zero CLI exits do not raise, missing docker binary or timeout still raise, and the result format. This adds meaningful behavioral context that annotations alone do not convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is detailed but well structured: a clear one-sentence purpose, then prerequisites, behavioral nuances, parameter explanations, and return format. Every sentence adds necessary information; nothing is redundant or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having no output schema, the description explicitly documents the return dict shape. It covers prerequisites, idempotent update behavior, detach timeout guidance, error handling edges, all parameters, and relevant sibling tools for follow-up. Nothing an agent needs to invoke this correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description compensates fully by explaining every parameter in Args: name, compose_files (including later-overrides-earlier), with_registry_auth, prune, resolve_image, detach, cwd, and timeout_seconds. It adds value beyond the raw schema by clarifying defaults, semantics, and interactions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource: 'Deploy (or update) a stack to the swarm from one or more Compose files.' It also clearly positions this tool as the swarm analogue of compose_up, distinguishing it from the compose family and other stack tools without ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly states prerequisites ('Requires the target daemon to be a swarm manager'), idempotent re-run behavior, detach vs. wait semantics, and points to sibling tools for observing rollout progress (stack_services / stack_ps). It also explains exception behavior, giving clear guidance on when this tool is appropriate and how to use it correctly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

stack_listA
Read-only

List the stacks deployed to the swarm, parsed from --format '{{json .}}'.

Requires the target daemon to be a swarm manager. compose_list is the non-swarm equivalent; drill into one stack with stack_services. Raises RemoteFailureError if the CLI call fails.

Returns: list: One dict per stack (name, services count, orchestrator)

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark it read-only and non-destructive, but the description adds valuable behavior beyond that: it parses `--format '{{json .}}'`, raises RemoteFailureError on CLI failure, and documents the return structure. This meaningfully supplements the structured metadata.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Every sentence earns its place: purpose, prerequisite, alternatives, error behavior, and return format are all covered in a compact, well-organized description. No redundant or filler content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given there are no parametersyb and no output schema, the description covers everything needed to call the tool correctly: prerequisites, error behavior, return shape, and relationship to sibling tools. Nothing important is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameterslied, so there are no parameter semantics to clarify. The empty input schema is fully complete, and the description has nothing to add; the baseline of 4 for zero-parameter tools is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States the exact action ('List the stacks deployed to the swarm'), specifies the parsed format, and distinguishes itself from compose_list and stack_services. An agent can immediately understand what this tool does and how it differs from similar siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says it requires the daemon to be a swarm manager, names compose_list as the non-swarm equivalent, and points to stack_services for drilling into one stack. This gives clear when-to-use and when-not-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

stack_psA
Read-only

List the tasks of a stack, parsed from --format '{{json .}}'.

Task-level view across every service in the stack (service_ps covers one service): where each task runs and why it failed. Requires a swarm manager. Raises RemoteFailureError if the CLI call fails.

Args: name: The stack to list tasks for no_trunc: Do not truncate task IDs / errors in the output filters: Filter by attributes, e.g. {"desired-state": "running"}; a list value repeats the filter

Returns: list: One dict per task (id, name, node, image, desired/current state, error)

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes
filtersNo
no_truncNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate readOnlyHint and non-destructive. The description adds value beyond annotations: it discloses the failure mode ('Raises RemoteFailureError if the CLI call fails'), the underlying CLI format (`--format '{{json .}}'`), and the manager requirement. These are behavioral traits not captured by structured fields.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is tightly written, leading with the core action, then providing a brief comparison, and end with an Args/Returns section that maps cleanly to the schema. No redundant or vague phrasing.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only stack-task tool, it covers the action, the alternative, the prerequisite, the failure exception, and the return structure (list of dicts with specific fields). With no output schema, the description fully explains what the agent will receive. This is complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has zero descriptions (coverage 0%), so the description must fully explain parameters. It does so: 'name' is defined as 'The stack to list tasks for', 'no_trunc' explains truncation behavior, and 'filters' includes a concrete example with the list-repeat semantics. All three parameters are meaningfully described.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb+resource: 'List the tasks of a stack'. It also explicitly distinguishes from the sibling `service_ps`, noting this covers every service in the stack versus one. The purpose is unambiguous and differentiated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It names the alternative tool (`service_ps` covers one service) and gives the exact condition to choose this one ('Task-level view across every service in the stack'). It also states a prerequisite ('Requires a swarm manager'), giving clear context for when to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

stack_removeA
Destructive

Remove one or more stacks from the swarm (tears down their services, networks, and secrets).

Destructive: this stops and deletes every service in the named stack(s) - the reverse of stack_deploy and the swarm analogue of compose_down. Defaults to detach=True so the call returns once removal is requested rather than waiting for teardown. Does not raise on a non-zero CLI exit (a missing docker binary or a timeout still raises) - inspect returncode/stderr in the result.

Args: names: One or more stack names to remove. At least one is required. detach: Return immediately (True) vs wait for the stack(s) to be fully removed (False) timeout_seconds: Subprocess timeout (default 300s)

Returns: dict: {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
namesYes
detachNo
timeout_secondsNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark destructiveHint=truechers. The description goes well beyond that by specifying exactly what is torn down, that it does not raise on non-zero CLI exits, that missing binaries/timeouts still raise, and that detach defaults to True. This gives an agent accurate expectations for side effects and error behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Information is front-loaded: the main purpose appears first, destructive consequences second, and behavioral caveats follow immediately. The Args and Returns sections are compact, and every sentence provides operational value without repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's destructiveness, no output schema, and 0% schema parameter coverage, the description is highly complete. It covers what happens, when the call returns, non-raising behavior, expected return shape, and defaults for every parameter. An agent has enough information to decide, invoke, and interpret the result correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has 0% description coverage, so the description fully compensates with an Args section explaining all three parameters: names (required, one or more), detach (immediate return vs wait), and timeout_seconds (subprocess default 300s). It adds behavioral meaning the raw schema types and defaults lack.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states the action ('Remove one or more stacks') and the resource ('from the swarm'), then defines the scope of destructive teardown ('services, networks, and secrets'). It differentiates from siblings by naming stack_deploy as its reverse and compose_down as its swarm analogue.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly identifies this as the inverse of stack_deploy and the swarm counterpart to compose_down, giving an agent direct routing across sibling tools. It also describes its destructive nature and default detach behavior, so an agent knows when this tool is appropriate versus the alternative deployment tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

stack_servicesA
Read-only

List the services of a stack, parsed from --format '{{json .}}'.

Service-level rollup (replicas ready per service); use stack_ps for individual tasks and service_inspect for one service's full spec. Requires a swarm manager. Raises RemoteFailureError if the CLI call fails.

Args: name: The stack to list services for filters: Filter by attributes, e.g. {"name": "web"}; a list value repeats the filter

Returns: list: One dict per service (id, name, mode, replicas, image, ports)

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes
filtersNo

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds meaningful behavioral context: the tool parses CLI output from a specific format, performs a service-level rollup, requires a swarm manager, and raises RemoteFailureError on CLI failure. It does not describe pagination or rate limits, but for a read-only list tool this is strong disclosure beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded: the core action and parsing detail come first, followed by routing guidance, prerequisites, error behavior, and parameter docs. Every sentence earns its place; there is no filler or repetition of the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 2-parameter read-only tool with no output schema, the description covers the action, parsing source, rollup semantics, sibling routing, prerequisite, error behavior, and both parameters. The return shape is described ('One dict per service (id, name, mode, replicas, image, ports)'), which compensates for the missing output schema. The only minor omission is not detailing how filters combine or whether they are AND/OR, but that is a small gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It does: 'name: The stack to list services for' and 'filters: Filter by attributes, e.g. {"name": "web"}; a list value repeats the filter.' This adds real meaning beyond the bare schema types, especially the list-value repetition behavior for filters. The only minor gap is not enumerating all possible filter attributes, but the example and repetition rule are sufficient for correct invocation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('List'), a resource ('services of a stack'), and a parsing detail ('from `--format '{{json .}}'`'). It also distinguishes itself from stack_ps and service_inspect, which are the closest siblings. An agent can tell exactly what this tool does and what it does not do.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says when to use this tool ('Service-level rollup') and names the alternatives for other needs: 'use stack_ps for individual tasks and service_inspect for one service's full spec.' It also states a prerequisite ('Requires a swarm manager') and an error condition ('Raises RemoteFailureError if the CLI call fails'). This is complete routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

swarm_initA

Initialize a new swarm, making this Engine its first manager node.

Fails if the Engine is already part of a swarm - call swarm_leave first to reset it. advertise_addr only needs setting when the host has multiple network interfaces or is behind NAT (otherwise it is auto-detected); it must be reachable by every other node that will join. To add more nodes afterwards, retrieve join tokens with swarm_join_tokens and call swarm_join on each one. Set autolock_managers=True to require the unlock key (swarm_unlock_key) on every manager restart - store that key securely immediately, since it is only shown once autolock is enabled.

Args: name: Name for the swarm cluster itself, not for the node running init advertise_addr: Externally reachable address advertised to other nodes listen_addr: Listen address used for inter-manager communication force_new_cluster: Force a new single-node cluster from this node's current state (disaster recovery when a majority of managers is lost) default_addr_pool: IP address pools for swarm overlay networks subnet_size: Subnet size for the IP pool data_path_addr: Address to use for data path traffic data_path_port: Port number for data path traffic labels: Labels to set on the swarm autolock_managers: Require the unlock key after every manager restart log_driver: Default log driver configuration

Returns: str: The node id of the newly created swarm manager

ParametersJSON Schema
NameRequiredDescriptionDefault
nameNo
labelsNo
log_driverNo
listen_addrNo0.0.0.0:2377
subnet_sizeNo
advertise_addrNo
data_path_addrNo
data_path_portNo
autolock_managersNo
default_addr_poolNo
force_new_clusterNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only provide readOnlyHint=false and destructiveHint=false, so the description carries the full burden. It discloses key behaviors: the operation may fail (already in a swarm), certain parameters are conditionally required, autolock_managers triggers the need to store the unlock key immediately, and force_new_cluster is for disaster recovery. This goes well beyond annotations and helps the agent anticipate side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured: a clear first sentence, followed by a concise paragraph of usage notes and edge cases, then a clean Args list that is easy to scan. Every sentence adds value; no fluff or repetition. It is appropriately sized for the complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the operation's complexity, 11 parameters, no schema descriptions, and an output schema that only specifies a string return, the description covers critical aspects: failure conditions, conditional parameters, security implications, and disaster recovery. It leaves no major gaps for the agent to guess.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Amid 11 parameters with 0% schema coverage, the description explains the semantics of many: name is for the cluster not the node, advertise_addr is externally reachable and only needed in specific conditions, force_new_cluster is for disaster recovery, and autolock_managers requires immediate key storage. This meaningfully compensates for the lack of schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Initialize' and resource 'new swarm', and explains that this Engine becomes the first manager node. It distinguishes this from related operations like swarm_join, swarm_leave, and swarm_join_tokens, and the overall context is unambiguous even among many siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit when-to-use guidance: it notes failure if already part of a swarm and directs calling swarm_leave first, explains when to set advertise_addr (multi-homed or NAT), and gives a complete workflow for adding nodes via swarm_join_tokens and swarm_join. This is detailed and actionable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

swarm_inspectA
Read-only

Inspect the swarm this daemon belongs to (id, spec, join-token config, CA info).

Works on a manager node only. Cluster-level configuration - for per-node state use node_list; for the tokens new nodes need, swarm_join_tokens.

Returns: dict: The swarm's attrs, as returned by the daemon's swarm inspect endpoint

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the description need not repeat safety. It adds meaningful behavioral context beyond annotations: the manager-node prerequisite impossible to infer from schema. It also clarifies scope (cluster-level vs per-node) and return format, though it does not describe error behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences plus a clear return declaration. The purpose is front-loaded, the manager-only constraint follows immediately, and the sibling alternatives each have a one-line rationale. No redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only, zero-parameter inspect tool, this description supplies everything necessary to call it correctly: what it inspects, the operational prerequisite, the relationship to nearby tools, and the return type. The output schema is absent but the description adequately characterizes the return as the daemon's swarm attrs.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters)Skip, so the schema already fully documents parameter needs. The description adds relevant detail about what data is returned (id, spec, join-token config, CA info) without needing to explain parameter syntax. Baseline 4 is appropriate for a param-less tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Inspect the swarm'), lists the key data areas (id, spec, join-token config, CA info), and explicitly contrasts with node_list and swarm_join_tokens. This clearly distinguishes it from closely related sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-to-use context ('Works on a manager node only') and names two specific alternatives with conditions: node_list for per-node state)Skip and swarm_join_tokens for new node tokens. This gives the agent clear decision criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

swarm_joinA

Join this Engine to an existing swarm as a worker or manager.

Fails if the Engine is already part of a swarm. Whether this node joins as a worker or a manager is determined entirely by which token is passed - join_token must be one of the two tokens from swarm_join_tokens, called against any existing manager. advertise_addr only needs setting when this host has multiple network interfaces or is behind NAT (otherwise it is auto-detected from the interface used to reach remote_addrs); it must be reachable by every other node in the swarm.

Args: remote_addrs: Address(es) of existing swarm managers to connect to join_token: The worker or manager join token (from swarm_join_tokens) - determines the role this node joins as listen_addr: Listen address for inter-manager communication advertise_addr: Externally reachable address advertised to other nodes data_path_addr: Address to use for data path traffic

Returns: bool: True after the engine joins the swarm

ParametersJSON Schema
NameRequiredDescriptionDefault
join_tokenYes
listen_addrNo0.0.0.0:2377
remote_addrsYes
advertise_addrNo
data_path_addrNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only provide readOnlyHint=false and destructiveHint=false, which don't cover the join behavior. The description compensates by explaining the failure case (already in a swarm), the role determination, and the reachability requirement for advertise_addr. It also mentions the exact source of join tokens, which is important context beyond the annotations. The return type (bool) is disclosed in the description.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a clear opening statement, followed by behavioral notes and a parameter list. It is not overly long and each sentence adds value. The parameter list is formatted clearly, though it might be slightly verbose for some agents.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is complete for an agent to call the tool correctly: it explains the required parameters' purposes, the optional parameters' default behavior, and the failure condition. It also explains the role determination logic, which is crucial. The output is simple (bool) and is described. Given the tool's moderate complexity, the description covers all necessary aspects.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description is the only source of parameter meaning. It provides detailed semantics for all parameters: remote_addrs (managers to connect to), join_token (determines role), listen_addr (inter-manager communication), advertise_addr (externally reachable), and data_path_addr (data traffic). This fully compensates for the schema's lack of descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (join the Engine) and the target (an existing swarm), and explicitly distinguishes role determination (worker vs manager) based on the token. This differentiates it from sibling tools like swarm_init and swarm_join_tokens.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains when the tool is used (joining an existing swarm) and provides a clear exclusion (fails if already part of a swarm). It also gives guidance for the advertise_addr parameter, noting when it needs to be set, which helps an agent decide whether to include optional parameters. However, it doesn't explicitly mention alternatives like swarm_init for creating a new swarm.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

swarm_join_tokensA
Read-only

Return the swarm's worker and manager join tokens.

These are the tokens a new node passes to swarm_join - without one, swarm_join cannot be called, so this closes the init -> join loop. The tokens are secret bearer credentials (anyone holding the manager token can join as a manager); treat the result as sensitive and avoid logging it. Reads swarm.attrs["JoinTokens"] after a reload, so it always reflects the current tokens.

Returns: dict: {"Worker": , "Manager": }

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Even with readOnlyHint=true and destructiveHint=false already provided, the description adds valuable behavioral context: the tokens are secret bearer credentials, should be treated as sensitive and not logged, and the tool reads swarm.attrs after a reload to always reflect current tokens. This goes well beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded with the core purpose, then supplies essential security and implementation details without fluff. Every sentence adds meaningful information for the agent.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With zero parametersholistically, no output schema, and annotations covering safety, the description is complete: it states what is returned, why the tokens matter, how to treat them, and that the value is freshly reloaded. An agent has everything needed to call and interpret this tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters)Skip, so the schema already covers everything. The description does not need to explain parameters; it instead documents the return format, which is helpful. Baseline 4 is appropriate for a zero-parameter tool that adds no conflicting or extraneous parameter information.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description opens with a clear, specific action-resource pairing: 'Return the swarm's worker and manager join tokens'. This distinguishes it from sibling tools like swarm_inspect and swarm_unlock_key by naming exactly which data it returns.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly contextualizes when to use the tool: it closes the init -> join loop and explains that swarm_join cannot be called without one of these tokens. It does not explicitly list exclusions or alternative sibling tools, but the usage context is strong enough for an agent to select it appropriately.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

swarm_leaveA
Destructive

Leave the current swarm.

The daemon's service tasks are rescheduled to the remaining nodes. A manager refuses to leave without force=True, since leaving can break raft quorum. The departed node lingers as "down" in node_list until a manager runs node_remove.

Args: force: Force leave even if the node is a manager

Returns: bool: True after leaving the swarm

ParametersJSON Schema
NameRequiredDescriptionDefault
forceNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the destructiveHint and readOnlyHint annotations, the description reveals key behavioral details: service tasks are rescheduled, managers refuse without force due to raft quorum risk, and the departed node remains 'down' until node_remove is invoked. These details materially help an agent anticipate consequences.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core action, then adds dense, relevant behavioral details. The Args and Returns sections are clean and non-redundant, and every sentence earns its place by explaining consequences or parameter behavior.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the operation, the force parameter, manager-specific behavior, quorum risk, service rescheduling, and post-leave node state. There is nothing an agent needs to correctly call this tool and anticipate its effects that is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description carries the full burden for the force parameter. It explains both the semantic meaning ('Force leave even if the node is a manager') and the behavioral consequence of leaving force=False, making the single parameter fully actionable.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Leave the current swarm,' which is a specific verb+resource statement that immediately distinguishes this tool from swarm_init, swarm_join, swarm_update, and swarm_inspect. It also clarifies the scope of the operation, so an agent can tell exactly what the tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context for when the tool is used and the special condition for managers (force=True), but it does not explicitly state when to prefer this tool over alternatives or mention sibling tools. Usage is implied rather than explicitly contrasted with swarm_join or swarm_update.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

swarm_task_inspectA
Read-only

Inspect a single swarm task, like docker inspect --type task.

For when you already hold a task reference -- from a swarm_task_list or service_ps row, a service event, or an error message -- and want just that task. swarm_task_list returns the same document for every task, so prefer it when scanning; this is the single-object fetch. To reach the container behind a running task, read Status.ContainerStatus.ContainerID and pass it to container_inspect / container_logs -- but note the container may be on another node, where those tools cannot see it, and service_logs aggregates across tasks instead; swarm_task_logs reads that one task's output wherever it landed. Read-only. Requires a swarm manager; reports the daemon's own error if the task does not exist, if a prefix matches more than one task, or if this node is not a manager.

Args: id_or_name: The task id, an unambiguous id prefix, or the task's full name -- which is the container-name form <service>.<slot>.<taskid> (<service>.<nodeid>.<taskid> for a global service), NOT the shorter <service>.<slot> that docker service ps prints in its NAME column, which does not resolve. The daemon tries full id, then full name, then prefix, and rejects an ambiguous prefix rather than picking a match

Returns: dict: Full task inspect payload, as docker inspect --type task. Carries no name field of its own; compose one from ServiceID/Slot if you need it

ParametersJSON Schema
NameRequiredDescriptionDefault
id_or_nameYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already set readOnlyHint=true and destructiveHint=false, and the description reinforces this with 'Read-only'. It goes further by disclosing the daemon's resolution order (full id, full name, prefix), rejection of ambiguous prefixes, error raising for missing tasks or non-manager nodes, and the fact that the returned payload has no name field. This adds substantial behavioral context beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but every sentence adds value: purpose, usage context, sibling alternatives, caveats, error behavior, parameter format, and return value are all covered without fluff. It is front-loaded with the core purpose and then branches into supporting details in a logical order.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter read-only tool with no output schema, the description is complete. It explains the return payload, how to derive a missing name field, how to reach the underlying container, and under what conditions sibling tools will fail. An agent has everything needed to decide when to invoke this tool and how to process its result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema provides only a bare string for id_or_name with 0% description coverage, so the description must fully compensate. It does, explaining that the argument can be an id, an unambiguous prefix, or a full name, with the exact name format, the pitfall of the shorter `docker service ps` name, and the daemon's matching behavior. This is thorough and actionable.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Inspect a single swarm task, like docker inspect --type task', a specific verb and resource, and immediately contrasts itself with swarm_task_list by clarifying this is the single-object fetch. It also tells the agent exactly where a task reference can come from, making the purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly states when to use this tool ('when you already hold a task reference ... and want just that task') and when not to ('prefer it when scanning' with swarm_task_list). It also provides clear routing to container_inspect, container_logs, service_logs, and swarm_task_logs, including caveats about node visibility. This is exemplary usage guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

swarm_task_listA
Read-only

List tasks across the whole swarm, like docker service ps with no service to scope it.

The cluster-wide view of what is actually scheduled. service_ps covers one service and stack_ps one stack, so answering "what is failing anywhere" or "what is running on this node" through those means looping over every service; this is one call, and swarm_task_logs reads what a failing one printed. Filter by node for a node's workload (the CLI's docker node ps), desired-state to separate what should be running from what is shutting down, or service for a single service -- for which service_ps is the simpler call. Each task carries its full Spec, including the ContainerSpec (image, command, env), so this returns much more per task than the service-tasks://{id_or_name} resource's computed rollout summary. Read-only. Requires a swarm manager: on any other node the daemon refuses, and its refusal is what comes back.

Args: filters: Filter dict; keys: id, name, service, node, label, desired-state (running|shutdown|accepted); omit for every task in the cluster

Returns: list: One full task document per task (ID, ServiceID, NodeID, Slot, Spec, Status, DesiredState), the same shape service_ps returns

ParametersJSON Schema
NameRequiredDescriptionDefault
filtersNo

TDQS

A4.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already signal read-only/non-destructive, and the description reinforces that with 'Read-only.' It then adds valuable behavioral detail: the call requires a swarm manager, non-managers get the daemon's refusal, and each result carries the full Spec/ContainerSpec. It could go further with pagination or result-volume caveats, but annotations already lower that burden.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with a clear one-line summary and then a well-ordered set of differentiations, use cases, and caveats. Every sentence contributes useful information; there is no filler and no redundant repetition of input-schema content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Even without a schema-description coverage or output schema, the description states the return shape (`ID`, `ServiceID`, `NodeID`, `Slot`, `Spec`, `Status`, `DesiredState`), the filter behavior, the supported keys/enums, and the manager prerequisite. This is enough for an agent to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema-description coverage, the description carries all burden for the single parameter. It compensates thoroughly: it documents the `filters` dict, lists valid keys (`id`, `name`, `service`, `node`, `label`, `desired-state`), gives allowed desired-state values, and explains that omitting the filter returns every task.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb, resource, and scope: 'List tasks across the whole swarm'. It immediately distinguishes itself from `service_ps` and `stack_ps`, so an agent can tell what this tool covers without inspecting the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit when-to-use guidance for whole-cluster questions, tells the agent when `service_ps` is the simpler alternative, and points to `swarm_task_logs` for reading a failing task's output. The filter documentation also maps to CLI equivalents like `docker node ps`.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

swarm_task_logsA
Read-only

Get a bounded snapshot of one swarm task's logs (never follows).

The per-replica counterpart to service_logs, which interleaves every task in the service: use this to read the replica that actually failed, found with swarm_task_list or service_ps. container_logs is no substitute on a multi-node swarm - the task's container lives on whichever node the scheduler placed it on, and this server talks to one daemon.

As with service_logs, follow is not exposed (the stream is joined into one string before returning, so following would never finish) and collection is capped at max_bytes. The Engine offers no until bound here, unlike container_logs, so narrow with since or an integer tail.

docker-py has no task collection and no APIClient.task_logs, so this drives its private request helpers against the published GET /tasks/{id}/logs, raising CapabilityError if those internals move. Drop the reach-in if docker-py grows a public method.

Args: id_or_name: The task id, an unambiguous id prefix, or its full <service>.<slot>.<taskid> name; see swarm_task_inspect for how the daemon resolves these and which name forms do not work since: Show logs since this Unix timestamp tail: Number of lines from the end, or the literal "all" for everything max_bytes: Abort with ToolInputError if the buffered logs exceed this many bytes (default 32 MiB)

Returns: str: Decoded log output

ParametersJSON Schema
NameRequiredDescriptionDefault
tailNo
sinceNo
stderrNo
stdoutNo
detailsNo
max_bytesNo
id_or_nameYes
timestampsNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (readOnlyHint=true, destructiveHint=false), the description discloses key behavioral traits: it never follows, the stream is joined into one string, collection is capped at max_bytes, it raises CapabilityError if internals move, and ToolInputError if max_bytes is exceeded. This is rich, useful transparency well beyond the structured annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is thorough but not bloated: it front-loads the core action and uses clear paragraphs for usage context, limitations, and parameter details. Each section earns its place. It could be tightened, but the structure is logical and the length is justified given the tool's complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present (returns str), the description sufficiently covers what the agent needs: error conditions, id resolution, and parameter semantics. It references sibling tools for further context. For a tool with 8 parameters, it is complete enough to invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It explains id_or_name (with resolution via swarm_task_inspect), since, tail, and max_bytes, but omits stderr, stdout, details, and timestamps. While those booleans are somewhat self-explanatory, the description does not fully cover all 8 parameters. It adds value for the key ones but leaves some gaps.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource: 'Get a bounded snapshot of one swarm task's logs (never follows).' It clearly distinguishes itself from service_logs (per-replica vs interleaved) and container_logs (multi-node limitation), so an agent knows exactly what this tool does and how it differs from siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit when-to-use guidance: 'use this to read the replica that actually failed, found with swarm_task_list or service_ps.' It also tells when not to use alternatives: 'container_logs is no substitute on a multi-node swarm' and contrasts with service_logs. This provides clear routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

swarm_unlockA

Unlock a manager node that is locked after restart due to autolock being enabled.

When autolock is enabled (via swarm_init or swarm_update), manager nodes require the unlock key after every restart before they can rejoin the swarm and resume scheduling. Must be called on the locked manager node directly. Retrieve the current unlock key with swarm_unlock_key from any unlocked manager - store it securely when enabling autolock. A locked node cannot serve API requests and cannot return its own key while locked; other unlocked managers in the swarm can still serve the key. Once unlocked the manager resumes automatically.

Args: key: The swarm unlock key (from swarm_unlock_key)

Returns: bool: True after the swarm is unlocked

ParametersJSON Schema
NameRequiredDescriptionDefault
keyYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Discloses important behavioral details beyond annotations: the locked node's inability to serve API requests or return its own key, the ability of other unlocked managers to provide the key, and the automatic resumption after unlock. This adds concrete context that annotations (readOnlyHint=false, destructiveHint=false) do not convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured, starting with the purpose, then usage constraints, then parameter explanation, and finally return value. Every sentence contributes essential information without redundancy, making it efficient and front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter tool with an output schema, the description covers all necessary aspects: what it does, when to use it, how to get the key, where to call it, and its return behavior. The output schema already specifies 'bool', so the description's mention of 'True after the swarm is unlocked' is sufficient and complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With schema description coverage at 0%, the description fully compensates by explaining the key parameter: 'The swarm unlock key (from swarm_unlock_key)'. It adds meaning by linking to the source tool and clarifying the parameter's role, far exceeding the bare schema definition.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb (unlock), the resource (a manager node), and the specific context (locked after restart due to autolock). It differentiates from sibling tools like swarm_unlock_key by focusing on the action of unlocking rather than retrieving the key.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit usage guidance: must be called on the locked manager node directly, and instructs to retrieve the unlock key with swarm_unlock_key from an unlocked manager. It also explains the constraint that a locked node cannot serve API requests, which helps the agent choose the correct node and alternative for key retrieval.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

swarm_unlock_keyA
Read-only

Return the swarm's current unlock key.

The key only serves a purpose when autolock is enabled (see swarm_init's / swarm_update's autolock_managers / rotate_manager_unlock_key). Must be called against an unlocked manager - a locked manager cannot serve API requests, including this one. Feed the result's key to swarm_unlock to unlock a manager after restart. Treat the key as a sensitive credential.

Returns: dict: {"UnlockKey": }

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover readOnlyHint and destructiveHint, so the bar is lower. The description adds genuinely useful behavioral context: the key is only meaningful with autolock, this call cannot succeed against a locked manager, and the key should be treated as a sensitive credential. These are non-obvious facts not inferable from the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded: one sentence states the core purpose, a few sentences add essential context without fluff, and the return format is clearly separated. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Since there is no output schema, the manual return-type documentation is essential and present. The description also covers prerequisites, related tools, and security handling, making it fully sufficient for a zero-parameter read-only tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and the schema is empty, so there is nothing to document. The description appropriately focuses on the return value instead, matching the baseline for a 0-parameter tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: "Return the swarm's current unlock key." It distinguishes itself from related tools like swarm_unlock by framing the key's purpose in the autolock lifecycle, and the tool name alone is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly states when the key matters (autolock enabled), the precondition for calling it (must be against an unlocked manager), and how the result should be used (fed to swarm_unlock). It also warns that a locked manager cannot serve this request, giving the agent a clear when-not-to-use condition.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

swarm_updateA

Update swarm-wide settings: the single home for join-token rotation and cluster spec changes.

Must be called on a swarm manager node. Token rotation invalidates the old join token immediately - nodes that have not yet joined using the old token must use the new one. Existing joined nodes are unaffected. Use swarm_join_tokens to retrieve the new tokens after rotation. Rotating the unlock key requires all managers to be re-unlocked on restart with the new key; retrieve it immediately via swarm_unlock_key. Rotation and updates are independent and may be combined in one call; swarm_init sets these same fields when the swarm is first created, and swarm_inspect reads the current values back.

The Engine replaces the whole cluster spec on every update, so this reads the current spec first and resubmits it, merging updates over it - omitting updates therefore changes nothing but the requested rotation.

Args: rotate_worker_token: Issue a new worker join token, invalidating the current one rotate_manager_token: Issue a new manager join token, invalidating the current one rotate_manager_unlock_key: Issue a new autolock unlock key for manager restart updates: Engine SwarmSpec fields to change, merged over the current spec one top-level key at a time, so a named block is replaced whole rather than field by field: keys are "Name", "Labels", "Orchestration", "Raft", "Dispatcher", "CAConfig", "EncryptionConfig" and "TaskDefaults", e.g. {"EncryptionConfig": {"AutoLockManagers": True}} to turn manager autolock on. Read the current blocks from swarm_inspect

Returns: bool: True after the update completes

ParametersJSON Schema
NameRequiredDescriptionDefault
updatesNo
rotate_worker_tokenNo
rotate_manager_tokenNo
rotate_manager_unlock_keyNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses key behavioral consequences beyond the annotations: old join tokens invalidate immediately, existing joined nodes are unaffected, unlock-key rotation forces re-unlock on restart, and the Engine replaces the whole cluster spec by reading the current spec and merging updates. This goes well beyond the sparse annotations, and no contradiction exists.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but information-dense: every sentence covers a distinct fact such as purpose, prerequisite, consequences, merge behavior, parameter meanings, and return type. It is front-loaded with the purpose and organized with Args/Returns sections, making it easy to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex, zero-required-parameter mutation tool with no schema descriptions, the description covers prerequisites, side effects, merge semantics, all parameter meanings, related retrieval tools, and return type. Nothing an agent needs to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, but the Args section fully documents every parameter: each rotation flag is described with its invalidation effect, and updates explains merge semantics, enumerates allowed top-level keys, and gives a concrete example. This fully compensates for the bare input schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Update swarm-wide settings: the single home for join-token rotation and cluster spec changes,' naming a specific verb, resource, and scope. It also positions the tool relative to swarm_init, swarm_inspect, swarm_join_tokens, and swarm_unlock_key, so an agent can distinguish it from sibling swarm tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states the prerequisite 'Must be called on a swarm manager node' and gives explicit routing: use swarm_join_tokens to fetch new tokens, swarm_unlock_key for the unlock key, swarm_init for initial creation, and swarm_inspect to read current values. It also explains when rotation and updates can be combined and that omitting updates changes nothing but rotation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

system_closeA

Close and drop pooled Docker client connection(s); each is rebuilt lazily on next use.

Use this to force a stale or errored connection to be discarded. Prefer system_reconnect when you want to immediately re-establish the connection rather than wait for the next tool call to trigger a lazy rebuild. With host omitted every pooled client is closed (unlike other tools, where omitting it means the default host). Closing clients does not affect running containers.

Returns: bool: True once closed

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only provide readOnlyHint=false and destructiveHint=false, which are minimal. The description adds meaningful behavioral context: connections are rebuilt lazily, closing does not affect running containers, and omitting host closes every pooled client. It does not detail error behavior or side effects beyond that, but the key behavioral traits are disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded: the core action and lazy-rebuild behavior appear in the first sentence, followed by usage guidance, a critical scoping note, and a safety reassurance. Every sentence earns its place without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter tool with an output schema, the description covers the action, the trigger for use, the alternative, the host-omission scope, and the non-effect on containers. Nothing an agent needs to decide whether to call it or to predict its effect is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has zero parameters, so there is no parameter documentation burden. The description still explains the host-omission semantics ('With host omitted every pooled client is closed'), which is valuable given the tool has no schema parameters to carry that meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Close and drop pooled Docker client connection(s)') and resource ('pooled Docker client connection(s)'), and explicitly distinguishes its behavior from system_reconnect. It also clarifies the lazy rebuild behavior, making the tool's purpose unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says when to use this tool ('force a stale or errored connection to be discarded') and when to prefer the alternative ('Prefer system_reconnect when you want to immediately re-establish the connection'). It also notes the host-omission behavior differs from other tools, which is critical usage guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

system_dfA
Read-only

Summarize Docker disk usage: layer storage plus per-object sizes for images, containers, volumes, build cache.

Equivalent to docker system df. Use it to find what to reclaim before image_prune / container_prune / volume_prune / buildx_prune; use system_info for daemon config and counts rather than sizes. The reply enumerates every object on the daemon, so expect a large payload on busy hosts.

Returns: dict: {"LayersSize", "Images", "Containers", "Volumes", "BuildCache"} with per-object size fields

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, covering the safety profile. The description adds a behavioral warning about large payloads on busy hosts and specifies the output structure (dict with given keys), which is useful beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is efficiently written: a clear first sentence defines the purpose, followed by usage guidance and a warning, and a compact 'Returns' section. It's not overly verbose, though the Returns section could be integrated more tightly; still, every sentence contributes value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only, no-parameter tool with no output schema, the description fully covers what the agent needs: what it does, when to use it, what it returns (including the dict keys). Nothing essential is missing for a correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the schema is trivially complete (100% coverage). The description doesn't need to explain parameters; the baseline of 4 applies because there is nothing to document, and the description adds no parameter-related information but it's not required.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Summarize Docker disk usage' and enumerates the object types covered. It clearly distinguishes from system_info (config/counts vs sizes) and ties to pruning tools, so an agent can tell it apart from siblings without ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says when to use this tool: 'Use it to find what to reclaim before image_prune / container_prune / volume_prune / buildx_prune' and gives the alternative for daemon config: 'use system_info for daemon config and counts rather than sizes.' This is unambiguous routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

system_eventsA
Read-only

Stream real-time events from the Docker server, bounded by limit events or timeout_seconds.

Returns when limit events are collected or timeout_seconds elapses, whichever comes first (limit caps memory; timeout_seconds caps how long the call blocks - without it a quiet daemon would block indefinitely, since the stream only yields on an actual event).

Caveat for ssh:// daemons: docker-py can't cancel an SSH stream, so the timeout_seconds watchdog can't interrupt a fully idle stream - bound with until/limit (or a non-SSH endpoint).

"Wait for the next matching event" idiom: pass limit=1 with filters narrowed to what you care about (e.g. {"type": "container", "event": "health_status"}) and a generous timeout_seconds. This blocks until that one event arrives (or the timeout elapses, returning an empty list) instead of re-polling a snapshot on a timer - there's no separate wait tool for this since the filtering this call already does covers it.

Args: since: Show events created since this timestamp until: Show events created until this timestamp filters: Filters to apply to the event stream limit: Max events to return timeout_seconds: Max wall-clock seconds before returning what was collected

Returns: list: A list of decoded event dicts (length <= limit)

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
sinceNo
untilNo
filtersNo
timeout_secondsNo

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare readOnlyHint and destructiveHint, but the description adds substantial behavioral detail: it blocks until limit or timeout, returns what was collected, can block indefinitely without timeout, and documents the SSH cancellation limitation. This is exactly the kind of operational nuance that helps an agent avoid misuse.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Although longer than most descriptions, every sentence adds unique operational value: bounding behavior, SSH caveat, wait idiom, and parameter descriptions. The structure is front-loaded with core behavior and ends with a compact Args/Returns section, with no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers return shape, edge cases, blocking behavior, and the SSH caveat, which is strong for a stream tool with no output schema. The only minor gap is that timestamp formats for since/until and the exact filter schema are not specified, but the provided example and defaults make invocation practical.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description carries full responsibility for parameter meaning, and it succeeds. Each parameter gets a concise one-line explanation, and filters are illustrated with a concrete example to show how to wait for a specific event.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Stream real-time events from the Docker server', immediately distinguishing it from snapshot-style siblings like system_info and system_version. It also clarifies the bounded nature of the stream, leaving no doubt about what the tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly explains when to use this tool, including a 'wait for next matching event' idiom with limit and filters, and states that no separate wait tool exists because filtering already covers it. It also gives a concrete caveat for ssh:// daemons and recommends bound parameters, which is strong usage guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

system_infoA
Read-only

Return system-wide Docker information, like docker info.

Daemon runtime state: container/image counts, storage and logging drivers, swarm role, and daemon warnings. Use system_version for version/API level and system_df for disk usage.

Returns: dict: {"Containers", "Images", "Driver", "ServerVersion", "Swarm", "Warnings", ...}

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is clear. The description adds behavioral context by enumerating daemon runtime state such as container/image counts, drivers, swarm role, and warnings, and indicates the return is a dict with representative keys. It does not fully detail all possible values, but it provides solid context beyond annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded: a one-line functional summary, a succinct scope statement, and a minimal return-shape note. Every sentence contributes value with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, read-only system info tool, the description is complete: it explains what the tool returns, what kind of state it covers, and how it relates to sibling tools. The absence of an output schema is compensated by the dict key listing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so there is no parameter semantics burden. The description appropriately focuses on the return value, listing expected keys, which is useful given there is no output schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource: 'Return system-wide Docker information, like `docker info`.' It clearly defines the tool's scope and distinguishes it from siblings by naming system_version and system_df as alternatives for different concerns.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit routing guidance is provided: 'Use `system_version` for version/API level and `system_df` for disk usage.' This tells the agent when to use this tool versus alternatives, leaving little to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

system_loginA

Authenticate with a Docker registry.

Security: the password is sent as a tool argument, which many MCP clients log verbatim. Prefer running docker login once on the host so the docker module reuses the credentials cached in ~/.docker/config.json, and avoid calling this tool from an agent loop. Credentials let image_pull / image_push reach private repositories; system_logout clears them.

Args: username: Registry username password: Registry password or token email: Registry account email registry: URL to the registry (defaults to Docker Hub) reauth: Force re-authentication even if valid credentials exist dockercfg_path: Path to a custom dockercfg file

Returns: dict: The login response: {"Status"} always; "IdentityToken" only when the registry issues one

ParametersJSON Schema
NameRequiredDescriptionDefault
emailNo
reauthNo
passwordYes
registryNo
usernameYes
dockercfg_pathNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the sparse annotations, the description discloses that the password is sent as a tool argument and may be logged verbatim by MCP clients. It also reveals where credentials are cached (`~/.docker/config.json`), how they are reused, and that `system_logout` clears them. No annotation contradiction exists.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with purpose, followed by critical security guidance, then parameters and return values. Every sentence is informative and earns its place, and nothing is repeated from the annotations or schema in a way that bloats the text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given zero schema-level parameter descriptions and no output schema, the description is unusually complete: it explains safety, side effects, parameter defaults, and the exact return shape. Edge-case failure modes are not described, but enough context is present for correct selection and invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema provides 0% description coverage, so the description carries the full parameter burden. It explains every parameter: username, password-or-token, email, registry defaulting to Docker Hub, `reauth` force behavior, and the custom dockercfg path. This adds real meaning beyond the raw schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Authenticate with a Docker registry.' It also explains what the credentials unlock (`image_pull` / `image_push`) and names `system_logout` as the tool that clears them, which distinguishes it from the sibling set.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly tells the agent when NOT to call this tool: prefer host-side `docker login` and avoid calling it from an agent loop. It also gives when it is needed, namely reaching private repositories through `image_pull` / `image_push`, and names the sibling that reverses the action (`system_logout`). This is strong usage guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

system_logoutA

Clear cached registry credentials from this server's in-memory Docker client.

docker-py / the Engine have no true logout: system_login validates against the registry (the daemon's /auth is stateless) and caches credentials in-process. This drops that in-memory cache; it does NOT contact the daemon or touch the host's ~/.docker/config.json. With no registry, clears every cached credential; pass one to clear just that entry (key must match system_login; Docker Hub is cached under "docker.io"). system_close/system_reconnect also clear it by discarding the client.

Reaches into a private docker-py attribute (api._auth_configs); degrades to clearing nothing if that internal shape changes.

Args: registry: Registry key to clear, or None to clear every cached credential

Returns: dict: {"cleared": []}

ParametersJSON Schema
NameRequiredDescriptionDefault
registryNo

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations are minimal (readOnlyHint=false, destructiveHint=false), and the description discloses that it drops an in-memory cache, does not affect persistent state, and relies on a private docker-py attribute with a defined fallback behavior if internals change. This goes well beyond the annotations and provides honest side-effect disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is fairly long but well-structured with a clear main purpose, explanatory paragraphs, and an Args/Returns format. Every sentence adds value, and the key information is front-loaded, though some sentences could be tightened without losing meaning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description explicitly documents the return as a dict with a 'cleared' list of removed keys. It covers edge cases (no registry, key mismatch, internal attribute changes) and the tool's non-contact with the daemon/host config, making it complete for an agent to call correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema only specifies 'registry' with type string and default null, with no description coverage. The description's Args section explains the meaning of the parameter, the None case (clear all), and the key matching requirement (including Docker Hub's 'docker.io' key). This fully compensates for the schema's lack of detail.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the verb 'clear' and the resource 'cached registry credentials' from the in-memory Docker client, and explicitly contrasts with system_login and alternative clearing methods. This makes it unambiguous and distinct from siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states what the tool does and what it does not do (does not contact the daemon or touch config.json), and mentions that system_close/system_reconnect also clear the cache. However, it does not explicitly say when to prefer this tool over those alternatives, though the functional difference implies it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

system_pingA
Read-only

Check that the Docker server is responsive.

The cheapest daemon health check. A failure here usually means connection config rather than daemon load - system_reconnect rebuilds a wedged client, host_list shows the configured endpoints. For daemon details use system_version / system_info.

Returns: bool: True if the daemon responded successfully

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds useful behavioral context: it is a lightweight check, failure typically indicates connection configuration issues, and it returns a boolean indicating daemon responsiveness. This goes beyond the annotations without contradicting them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well-structured: a one-line core purpose, a short contextual paragraph with routing guidance, and a clear return-value note. Every sentence adds value, and the most important information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, read-only tool with an output schema, the description is complete. It explains what the tool checks, how to interpret failures, which sibling tools to use instead when appropriate, and what the return value means. No needed information is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, and the schema description coverage is 100%, so there is no parameter detail needed. The baseline for zero-parameter tools is 4, and the description correctly makes no misleading parameter claims.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Check that the Docker server is responsive.' It also labels itself as 'the cheapest daemon health check' and explicitly contrasts with system_version/system_info, making it easy to distinguish from related siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear when-to-use context: it is the cheapest health check, and a failure usually indicates connection config rather than daemon load. It names alternatives directly, such as system_reconnect for wedged clients, host_list for configured endpoints, and system_version/system_info for daemon details.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

system_reconnectA

Rebuild a pooled Docker client from its configured endpoint, to recover a wedged connection.

Validates the rebuilt client before swapping in (and only then closes the old one), so a failed rebuild leaves the working client in place. Rebuilds the default host's client when host is omitted. It CANNOT retarget to a different daemon - to add or change a daemon, edit DOCKER_MCP_SERVER_HOSTS and restart. system_close closes pooled clients without rebuilding; host_list shows the configured endpoints.

Returns: dict: the rebuilt host's version info (same shape as system_version), confirming connectivity

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond annotations (readOnlyHint false, destructiveHint false), the description discloses the validation-before-swap behavior, that the old client is only closed on success, and that it cannot retarget daemons. It also specifies the return shape. This provides substantial behavioral context not present in annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is detailed but efficient, with purpose front-loaded and limitations/alternatives clearly separated. It is longer than strictly necessary but every sentence adds value. No fluff or repetition. The only minor issue is the misleading host mention, which slightly disrupts clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter tool with no output schema, the description covers purpose, behavior, limitations, alternatives, and return shape. It lacks error handling details but that is not critical here. The only gap is the inconsistent host reference, which introduces confusion rather than completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has zero parameters, so baseline is 4. However, the description mentions 'when host is omitted', implying a host parameter that does not exist in the schema. This is misleading and could cause an agent to attempt passing a host argument. The description actively adds incorrect parameter information, so a 2 is warranted.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action (rebuild a pooled Docker client) with a clear purpose (recover a wedged connection) and resource. It distinguishes itself from siblings by explicitly naming system_close (closes without rebuilding) and host_list (shows endpoints), making the tool's scope unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly states when to use (recover wedged connection) and when not to (cannot retarget to different daemon, edit config and restart instead). It names alternatives (system_close, host_list) and clarifies what they do differently. This leaves no inference needed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

system_versionA
Read-only

Return Docker server version information.

Engine version, API level, and per-component versions - the first thing to check for feature availability. system_info reports runtime state (counts, drivers, swarm role) instead.

Returns: dict: {"Version", "ApiVersion", "MinAPIVersion", "Os", "Arch", "Components", ...}

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds meaningful behavioral context by documenting the return type and key fields, and by framing the tool's role relative to system state inspection. It does not contradict the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded with the primary action, followed by a brief usage context and a clearly formatted return summary. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter read-only tool with no output schema, the description fully covers what the agent needs: what it returns, how it differs from `system_info`, and an indication of when to invoke it. Nothing critical is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters)Skip? The description correctly avoids adding parameter details where none existما.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource ('Return Docker server version information') and immediately distinguishes itself from the closely related sibling `system_info`. Listing explicit return fields removes ambiguity about what the tool provides.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly states when to use this tool ('first thing to check for feature availability') and names the alternative (`system_info`) with what that alternative reports instead. This gives clear routing guidance with no need for the agent to infer.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

tool_listA
Read-only

List this server's registered tools as compact rows, filtered by domain, category or keyword.

A tool-callable mirror of docker-mcp://tool-catalog for clients that can't read MCP resources (e.g. Claude Desktop, Cursor), and the only way to ask what no per-tool description search can express: which tools are destructive, which accept a host, what this server actually registered. Use it to brief on an unfamiliar area (domain="buildx" returns one line per tool rather than ~13 full definitions), to check blast radius (category="destructive"), or to establish that nothing matches - matched: 0 is a definitive negative, which a client's fuzzy search cannot give. Covers this server's own surface; docs_lookup covers external Docker reference documentation. Rows are summaries, not definitions - fetch a tool's own definition for its parameters. Read-only, never raises on a query matching nothing, and always registered even when DOCKER_MCP_SERVER_DISABLE drops every domain. A tool dropped by a switch or a disabled domain is absent rather than flagged; hidden_by_configuration reports how many each domain hides.

Args: domain: Exact domain name (see any result's domains key); omit for every domain category: Exact category; omit for all three keyword: Case-insensitive substring over tool names, summaries and parameter names

Returns: dict: {"matched": int, "tools": [{"name", "domain", "category", "summary"}], "domains": {domain: count}, "no_domain": int, "hidden_by_configuration": {domain: count}, "switches", "filters"}. Every domains key is a value domain accepts; no_domain counts the domain-less tools, whose rows carry domain: null and which no domain value selects.

ParametersJSON Schema
NameRequiredDescriptionDefault
domainNo
keywordNo
categoryNo

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds valuable behavioral context beyond that: it is read-only, never raises on a query matching nothing, is always registered even when DOCKER_MCP_SERVER_DISABLE drops every domain, and explains that dropped tools are absent rather than flagged, with hidden_by_configuration reporting counts. It also discloses the return shape. The only minor gap is that it doesn't explicitly state rate limits or auth requirements, but those are not relevant for a local read-only listing tool. This is strong behavioral disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but well-organized: it opens with the core purpose, then explains the tool's unique value, then gives usage scenarios, then parameter semantics, then return format. Every sentence earns its place, and the most important information (what it lists and how it filters) is front-loaded. It is longer than a typical description, but the length is justified by the tool's role as a cross-cutting query surface. A small deduction for the return-format section being somewhat verbose, but it is still efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only listing tool with no output schema, the description is complete: it explains what the tool returns (matched count, tools array with fields, domains map, no_domain count, hidden_by_configuration, switches, filters), how to use each parameter, when to use it vs alternatives, and its behavioral guarantees. An agent has everything needed to call it correctly and interpret the result. The absence of an output schema is fully compensated by the detailed return description.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the full burden of explaining parameters. It does this well: domain is 'exact domain name (see any result's domains key); omit for every domain', category is 'exact category; omit for all three', and keyword is 'case-insensitive substring over tool names, summaries and parameter names'. It also explains the enum values for category implicitly by referencing the three categories. The only slight gap is that it doesn't enumerate the exact category enum values in the description, but the schema already provides them, and the description adds the semantics of omission. This is strong compensation for the 0% schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('List') and resource ('this server's registered tools'), and immediately distinguishes itself from sibling tools like docs_lookup and from per-tool definitions. It also explains what makes it unique: it is the only way to ask cross-cutting questions like which tools are destructive or accept a host. This is a clear, specific purpose that an agent can act on.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit when-to-use guidance: use it to brief on an unfamiliar area, check blast radius, or establish a definitive negative (matched: 0). It also names the alternative (docs_lookup) and explains the boundary: this tool covers the server's own surface, while docs_lookup covers external Docker reference documentation. It even notes when not to use it: rows are summaries, so fetch a tool's own definition for parameters. This is exemplary usage guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

volume_createA

Create a volume managed by Docker.

Named volumes persist after their containers stop or are removed; use them for databases, uploads, or any data that must outlive a container. Anonymous volumes (no name) are only removed automatically when the container was started with --rm or removed with docker rm -v; otherwise they accumulate and must be pruned manually. Common driver_opts for the default local driver: bind-mount an existing host path with {"type": "none", "device": "/host/path", "o": "bind"}, or mount an NFS share with {"type": "nfs", "device": "server:/export", "o": "addr=server,rw"}. Third-party drivers (e.g. rexray, convoy) accept their own option keys. List existing volumes with volume_list; reclaim unused ones with volume_prune. Created volumes are stamped with provenance labels.

Args: name: Volume name; auto-generated if omitted (creates an anonymous volume) driver: Volume driver to use (default: "local") driver_opts: Driver-specific options dict labels: Labels to set on the volume

Returns: dict: The created volume's full document (keys include Name, Driver, Mountpoint, CreatedAt, Labels, Options, Scope)

ParametersJSON Schema
NameRequiredDescriptionDefault
nameNo
driverNo
labelsNo
driver_optsNo

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond annotations, the description reveals important behaviors: anonymous volumes accumulate unless containers use --rm or are removed with -v, and created volumes are stamped with provenance labels. This gives an agent crucial operational context beyond simple creation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but every section contributes: usage context, lifecycle warnings, driver_opts examples, argument list, and return shape. The Args/Returns structure is easy to scan and front-loads the most important decisions.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description compensates by stating the returned dict and keys. It covers all four parameters, provides examples for the most complex one, and addresses lifecycle and cleanup concerns. Nothing critical for invoking the tool is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With schema description coverage at 0%, the description carries the param documentation burden. It adds real value for name (auto-generated anonymous volume) and driver_opts (with concrete local-driver examples), but driver and labels get only minimal elaboration beyond their names.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description opens with a specific verb and resource ('Create a volume managed by Docker') and immediately clarifies the key distinction between named and anonymous volumes. It also implicitly differentiates from volume_list, volume_prune, and volume_remove by naming them later.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly tells when to use volumes ('for databases, uploads, or any data that must outlive a container') and explains the lifecycle of anonymous volumes. It names sibling tools for listing (volume_list) and reclaiming (volume_prune), giving clear routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

volume_inspectA
Read-only

Get a volume's full inspect payload by name.

Use it after volume_list to see a volume's on-disk location, driver, and labels - e.g. before a backup or volume_remove. Volumes are addressed purely by name; they have no separate id.

Args: name: The volume name (volumes have no ids)

Returns: dict: The volume's full document (keys include Name, Driver, Mountpoint, CreatedAt, Labels, Options, Scope)

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark readOnlyHint=true and destructiveHint=false, so safety is covered. The description adds useful behavioral context: volumes are addressed purely by name with no separate id, and the return payload includes fields like Mountpoint, Driver, and Labels, which helps an agent understand what the tool reveals.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the purpose, then gives workflow context and compact Args/Returns details. The 'volumes have no ids' point appears twice, which is mildly redundant, but the overall length is appropriate and every section contributes useful information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter, read-only inspect tool, the description covers when to use it, how the volume is addressed, and what the return payload contains. Since there is no output schema, listing the expected keys is especially valuable, and nothing an agent needs to call this tool correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema only defines name as a required string. The description compensates for the 0% schema coverage by explaining that volumes have no ids and are addressed purely by name, which is meaningful semantic detail. It repeats this point in both the prose and the Args section, but the clarification is valuable.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening sentence states a specific verb and resource: 'Get a volume's full inspect payload by name.' It clearly differentiates from volume_list by emphasizing a full inspect payload, and the workflow hint reinforces this distinction.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly recommends using it after volume_list and before operations like backup or volume_remove, giving clear context. It does not explicitly list when not to use it, but the workflow guidance is sufficient for an agent to understand its role among siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

volume_listA
Read-only

List volumes.

Volumes are addressed by name only - feed a Name to volume_inspect for detail or volume_remove / volume_prune to clean up. filters={"dangling": True} finds volumes that no container references.

Args: filters: Filter by attributes (e.g. dangling, name, label) managed_only: Only return volumes created by this MCP server (filters on the docker-mcp-server.managed label); combines with any filters given

Returns: list: One volume document ({"Name", "Driver", "Mountpoint", ...}) per volume

ParametersJSON Schema
NameRequiredDescriptionDefault
filtersNo
managed_onlyNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish readOnly=true and destructive=false, and the description adds meaningful behavior beyond that: return shape per volume, filter semantics with a dangling example, and the managed_only label behavior. No behavioral surprises are left hidden.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose, then gives routing guidance, parameter details, and return shape in compact labeled sections. Every sentence adds useful information with no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list tool with two optional parameters and no output schema, the description covers purpose, usage, parameter semantics, and return format. An agent has enough to call it correctly and interpret results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description carries the full burden for parameters. It documents filters with an example and attribute hints, and managed_only with precise label behavior and composition with filters. Both parameters are fully explained.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description begins with a specific verb and resource ('List volumes'), and clarifies its scope by pointing to sibling tools: volume_inspect for detail and volume_remove/volume_prune for cleanup. This distinguishes it clearly from nearby volume operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly tells the agent that volumes are addressed by name, directs volume_inspect to detail and volume_remove/volume_prune to cleanup, and gives a concrete filters example for dangling volumes. This is actionable when-to-use guidance with alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

volume_pruneA
DestructiveIdempotent

Remove volumes not referenced by any container, running or stopped.

A volume used by even one stopped container is not "unused" and survives the prune - remove the container first (or use container_prune, then this) to reclaim its volumes. Valid filter keys: label (key or key=value), all ("true" as a string - without it only anonymous volumes are eligible, matching docker volume prune's default). Use volume_list first to see what currently exists.

Args: filters: Narrow which unused volumes to remove; omit to remove all anonymous ones

Returns: dict: {"VolumesDeleted": [...], "SpaceReclaimed": }

ParametersJSON Schema
NameRequiredDescriptionDefault
filtersNo

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark this as destructive, but the description adds critical behavioral nuance: volumes used by stopped containers survive, the default only targets anonymous volumes, and the filter keys and string form of 'all' are explicitly documented. This goes well beyond the annotation flags and prevents dangerous misunderstandings.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Every sentence in the description adds necessary information: core semantics, edge-case behavior, workflow suggestion, filter details, and return type. The structure separates narrative explanation from args/returns, making it scannable without padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter tool with no output schema, the description fully specifies behaviors, filter usage, return format, and prerequisite steps. It even names sibling tools (container_prune, volume_list) to help with workflow composition. No critical information is missing for an agent to correctly invoke this tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema provides only a bare 'filters' object with zero description coverage FAQs. The description compensates thoroughly by explaining that filters narrow which unused volumes are removed, that omitting it removes all anonymous volumes, and by enumerating valid filter keys (label and all) with their expected value types. This is essential, non-redundant semantic detail.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states that volume_prune removes volumes not referenced by any container, and specifies that this includes both running and stopped containers. It distinguishes the prune semantics from a targeted volume removal (volume_remove) by focusing on unreferenced volumes rather than named ones.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit workflow context: remove containers first or use container_prune then this tool, and recommends using volume_list to see current volumes. It could explicitly state 'use volume_remove to remove a specific named volume' as an alternative, but the guidance provided clearly helps an agent decide when to use this prune.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

volume_removeA
Destructive

Remove a single volume by name.

Fails if any container, running or stopped, still references the volume - remove or recreate those containers first, or pass force=True to remove it anyway (the containers keep their reference but lose the underlying data). For bulk cleanup of volumes with no container references at all, use volume_prune instead.

Args: name: Volume name to remove force: Remove even if a container still references the volume

Returns: bool: True after removal

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes
forceNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the destructiveHint annotation, the description explains the failure condition, the consequence of force=True (containers keep references but lose underlying data), and the prerequisite action. This gives the agent an accurate mental model of side effects without relying solely on annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact, logically ordered from high-level behavior to failure handling to parameter docs, and every sentence contributes. The Args/Returns section is a clear structural aid for an AI agent needing quick extraction.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present and annotations already marking write/destructive behavior, the description adds the only contextual gaps: volume-contaminant failure, force semantics, data-loss risk, and routing to volume_prune. There is no missing information needed to call the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must fully compensate. It does: name is 'volume name to remove' and force is 'remove even if a container still references the volume,' adding behavioral meaning that a bare boolean schema field would not convey.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific action ('remove a single volume by name') and resource, and explicitly distinguishes itself from volume_prune by noting the single-volume scope. The name alone is no good, but the opening sentence removes any doubt about what is being removed.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a clear when-to-use/when-not-to-use rule: use for a single volume and use volume_prune for bulk cleanup of unreferenced volumes. It also states the prerequisite explicitly: remove or recreate referencing containers first, or pass force=True, which makes the choice behavior obvious.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 9 tool updatesv2.2.6
    • Changedcontainer_run1 field changed
      • changedInput schema / $defs / RestartPolicy / description
        Previous value: -"Restart policy for container_run, mirroring the `docker` module's expected dict shape."New value: +"Restart policy for container_run, mirroring the `docker` module's expected dict shape.\n\nAttributes:\n    Name: the policy name the docker module expects.\n    MaximumRetryCount: how many restarts to attempt, where the policy uses one."
    • Changedcontainer_stats1 field changed
      • addedInput schema / properties / one_shot
        Added value: +{
        +  "default": false,
        +  "type": "boolean"
        +}
    • Changedimage_prune_builds1 field changed
      • removedInput schema / properties / keep_storage
        Removed value: -{
        -  "default": null,
        -  "type": "integer"
        -}
    • Changedimage_pull1 field changed
      • addedInput schema / properties / auth_config
        Added value: +{
        +  "default": null,
        +  "type": "object"
        +}
    • Changedimage_tag1 field changed
      • removedInput schema / properties / force
        Removed value: -{
        -  "default": false,
        -  "type": "boolean"
        -}
    • Changednetwork_connect1 field changed
      • addedInput schema / properties / mac_address
        Added value: +{
        +  "default": null,
        +  "type": "string"
        +}
    • Changednetwork_create1 field changed
      • removedInput schema / properties / check_duplicate
        Removed value: -{
        -  "default": null,
        -  "type": "boolean"
        -}
    • Addedswarm_task_logs
    • Changedswarm_update1 field changed
      • addedInput schema / properties / updates
        Added value: +{
        +  "default": null,
        +  "type": "object"
        +}
  2. 14 tool updatesv2.2.5
    • Changedcompose_config1 field changed
      • addedInput schema / properties / format / enum
        Added value: +[
        +  "yaml",
        +  "json"
        +]
    • Changedcompose_up1 field changed
      • addedInput schema / properties / pull / enum
        Added value: +[
        +  "always",
        +  "missing",
        +  "never"
        +]
    • Addedimage_import
    • Changednetwork_create1 field changed
      • addedInput schema / properties / scope / enum
        Added value: +[
        +  "local",
        +  "global",
        +  "swarm"
        +]
    • Addedplugin_privileges
    • Changedscout_compare2 fields changed
      • addedInput schema / properties / format / enum
        Added value: +[
        +  "json",
        +  "markdown",
        +  "text"
        +]
      • addedInput schema / properties / only_severity / items / enum
        Added value: +[
        +  "critical",
        +  "high",
        +  "medium",
        +  "low",
        +  "unspecified"
        +]
    • Changedscout_cves3 fields changed
      • changedInput schema / properties / format / default
        Previous value: -"json"New value: +"sarif"
      • addedInput schema / properties / format / enum
        Added value: +[
        +  "packages",
        +  "sarif",
        +  "spdx",
        +  "gitlab",
        +  "markdown",
        +  "sbom"
        +]
      • addedInput schema / properties / only_severity / items / enum
        Added value: +[
        +  "critical",
        +  "high",
        +  "medium",
        +  "low",
        +  "unspecified"
        +]
    • Changedscout_quickview1 field changed
      • removedInput schema / properties / format
        Removed value: -{
        -  "default": "json",
        -  "type": "string"
        -}
    • Changedscout_recommendations1 field changed
      • removedInput schema / properties / format
        Removed value: -{
        -  "default": "json",
        -  "type": "string"
        -}
    • Changedscout_sbom1 field changed
      • addedInput schema / properties / format / enum
        Added value: +[
        +  "list",
        +  "json",
        +  "spdx",
        +  "cyclonedx"
        +]
    • Changedstack_deploy1 field changed
      • addedInput schema / properties / resolve_image / enum
        Added value: +[
        +  "always",
        +  "changed",
        +  "never"
        +]
    • Addedswarm_task_inspect
    • Addedswarm_task_list
    • Addedtool_list
  3. 3 tool updates
    • Addedimage_prune_builds
    • Addedplugin_create
    • Addedplugin_push
  4. 6 tool updatesv2.2.1
    • Addedbuildx_prune
    • Addedplugin_disable
    • Addedvolume_inspect
    • Addedvolume_list
    • Addedvolume_prune
    • Addedvolume_remove
  5. 16 tool updatesv2.1.4
    • Addedbuildx_bake
    • Addedbuildx_build
    • Addedbuildx_du
    • Addedbuildx_history_inspect
    • Addedbuildx_history_list
    • Addedbuildx_imagetools_create
    • Addedbuildx_imagetools_inspect
    • Addedbuildx_inspect
    • Addedbuildx_list
    • Addedcompose_port
    • Addedcompose_wait
    • Removedplugin_disable
    • Removedvolume_inspect
    • Removedvolume_list
    • Removedvolume_prune
    • Removedvolume_remove
  6. 12 tool updatesv2.1.4
    • Removedbuildx_bake
    • Removedbuildx_build
    • Removedbuildx_du
    • Removedbuildx_history_inspect
    • Removedbuildx_history_list
    • Removedbuildx_imagetools_create
    • Removedbuildx_imagetools_inspect
    • Removedbuildx_inspect
    • Removedbuildx_list
    • Removedbuildx_prune
    • Removedcompose_port
    • Removedcompose_wait
  7. 5 tool updatesv2.0.1
    • Changedcontainer_wait3 fields changed
      • addedInput schema / properties / pattern
        Added value: +{
        +  "default": null,
        +  "type": "string"
        +}
      • addedInput schema / properties / regex
        Added value: +{
        +  "default": false,
        +  "type": "boolean"
        +}
      • changedInput schema / properties / until / enum
        Previous value: -[
        -  "not-running",
        -  "next-exit",
        -  "removed",
        -  "healthy"
        -]New value: +[
        +  "not-running",
        +  "next-exit",
        +  "removed",
        +  "healthy",
        +  "log-match"
        +]
    • Addeddocs_lookup
    • Addednode_wait
    • Addedregistry_tag_wait
    • Addedservice_wait
  8. 225 tool updatesv2.0.0
    • Removedbuild_image
    • Addedbuildx_history_list
    • Removedbuildx_history_ls
    • Changedbuildx_imagetools_create2 fields changed
      • addedInput schema / properties / descriptor_files
        Added value: +{
        +  "default": null,
        +  "items": {
        +    "type": "string"
        +  },
        +  "type": "array"
        +}
      • removedInput schema / properties / files
        Removed value: -{
        -  "default": null,
        -  "items": {
        -    "type": "string"
        -  },
        -  "type": "array"
        -}
    • Addedbuildx_list
    • Removedbuildx_ls
    • Changedbuildx_prune3 fields changed
      • removedInput schema / properties / filter
        Removed value: -{
        -  "default": null,
        -  "type": "object"
        -}
      • addedInput schema / properties / filters
        Added value: +{
        +  "default": null,
        +  "type": "object"
        +}
      • removedInput schema / properties / keep_storage
        Removed value: -{
        -  "default": null,
        -  "type": "string"
        -}
    • Addedbuildx_remove
    • Removedbuildx_rm
    • Removedclose
    • Removedcommit_container
    • Addedcompose_list
    • Changedcompose_logs2 fields changed
      • addedInput schema / properties / tail / anyOf
        Added value: +[
        +  {
        +    "type": "integer"
        +  },
        +  {
        +    "const": "all",
        +    "type": "string"
        +  }
        +]
      • removedInput schema / properties / tail / type
        Removed value: -"integer"
    • Removedcompose_ls
    • Addedconfig_create
    • Addedconfig_inspect
    • Addedconfig_list
    • Addedconfig_remove
    • Removedconfigure_plugin
    • Removedconnect_network
    • Addedcontainer_archive_get
    • Addedcontainer_archive_get_to_file
    • Addedcontainer_archive_put
    • Addedcontainer_commit
    • Addedcontainer_create
    • Addedcontainer_exec
    • Addedcontainer_export
    • Addedcontainer_inspect
    • Addedcontainer_kill
    • Addedcontainer_list
    • Changedcontainer_logs4 fields changed
      • addedInput schema / properties / follow
        Added value: +{
        +  "default": false,
        +  "type": "boolean"
        +}
      • addedInput schema / properties / limit_lines
        Added value: +{
        +  "default": 200,
        +  "type": "integer"
        +}
      • changedInput schema / properties / tail / default
        Previous value: -"all"New value: +200
      • addedInput schema / properties / timeout_seconds
        Added value: +{
        +  "default": 30,
        +  "type": "number"
        +}
    • Addedcontainer_pause
    • Addedcontainer_prune
    • Addedcontainer_remove
    • Addedcontainer_rename
    • Addedcontainer_restart
    • Addedcontainer_run
    • Addedcontainer_start
    • Addedcontainer_stop
    • Addedcontainer_unpause
    • Addedcontainer_update
    • Addedcontainer_wait
    • Addedcontext_list
    • Removedcontext_ls
    • Addedcontext_remove
    • Removedcontext_rm
    • Removedcreate_config
    • Removedcreate_container
    • Removedcreate_network
    • Removedcreate_secret
    • Removedcreate_service
    • Removedcreate_volume
    • Removeddf
    • Removeddisable_plugin
    • Removeddisconnect_network
    • Removedenable_plugin
    • Removedevents
    • Removedexec_in_container
    • Removedexport_container
    • Removedexport_container_to_file
    • Removedfollow_container_logs
    • Removedforce_update_service
    • Removedget_config
    • Removedget_container
    • Removedget_container_archive
    • Removedget_container_archive_to_file
    • Removedget_image
    • Removedget_network
    • Removedget_node
    • Removedget_plugin
    • Removedget_registry_data
    • Removedget_secret
    • Removedget_service
    • Removedget_swarm_join_tokens
    • Removedget_swarm_unlock_key
    • Removedget_volume
    • Addedhost_list
    • Removedhub_list_tags
    • Addedhub_tags
    • Addedimage_build
    • Changedimage_history3 fields changed
      • addedInput schema / properties / id_or_name
        Added value: +{
        +  "type": "string"
        +}
      • removedInput schema / properties / name
        Removed value: -{
        -  "type": "string"
        -}
      • changedInput schema / required
        Previous value: -[
        -  "name"
        -]New value: +[
        +  "id_or_name"
        +]
    • Addedimage_inspect
    • Addedimage_list
    • Addedimage_load
    • Addedimage_prune
    • Addedimage_pull
    • Addedimage_push
    • Addedimage_registry_data
    • Addedimage_remove
    • Addedimage_save
    • Addedimage_search
    • Addedimage_tag
    • Removedinfo
    • Removedinit_swarm
    • Removedinstall_plugin
    • Removedjoin_swarm
    • Removedkill_container
    • Removedleave_swarm
    • Removedlist_configs
    • Removedlist_containers
    • Removedlist_hosts
    • Removedlist_images
    • Removedlist_networks
    • Removedlist_nodes
    • Removedlist_plugins
    • Removedlist_secrets
    • Removedlist_services
    • Removedlist_volumes
    • Removedload_image
    • Removedload_image_from_file
    • Removedlogin
    • Removedlogout
    • Addednetwork_connect
    • Addednetwork_create
    • Addednetwork_disconnect
    • Addednetwork_inspect
    • Addednetwork_list
    • Addednetwork_prune
    • Addednetwork_remove
    • Addednode_inspect
    • Addednode_list
    • Addednode_remove
    • Addednode_update
    • Removedpause_container
    • Removedping
    • Addedplugin_configure
    • Addedplugin_disable
    • Addedplugin_enable
    • Addedplugin_inspect
    • Addedplugin_install
    • Addedplugin_list
    • Addedplugin_remove
    • Addedplugin_upgrade
    • Removedprune_containers
    • Removedprune_images
    • Removedprune_networks
    • Removedprune_volumes
    • Removedpull_image
    • Removedpush_image
    • Removedpush_plugin
    • Removedput_container_archive
    • Removedput_container_archive_from_file
    • Removedreconnect
    • Removedregistry_get_config
    • Addedregistry_image_config
    • Removedregistry_inspect_manifest
    • Removedregistry_list_tags
    • Addedregistry_manifest
    • Addedregistry_tags
    • Removedreload_swarm
    • Removedremove_config
    • Removedremove_container
    • Removedremove_image
    • Removedremove_network
    • Removedremove_node
    • Removedremove_plugin
    • Removedremove_secret
    • Removedremove_service
    • Removedremove_volume
    • Removedrename_container
    • Removedresize_container
    • Removedrestart_container
    • Removedrollback_service
    • Removedrotate_swarm_join_token
    • Removedrun_container
    • Removedsave_image
    • Removedsave_image_to_file
    • Removedscale_service
    • Removedsearch_images
    • Addedsecret_create
    • Addedsecret_inspect
    • Addedsecret_list
    • Addedsecret_remove
    • Addedservice_create
    • Addedservice_inspect
    • Addedservice_list
    • Changedservice_logs4 fields changed
      • addedInput schema / properties / id_or_name
        Added value: +{
        +  "type": "string"
        +}
      • removedInput schema / properties / service_id
        Removed value: -{
        -  "type": "string"
        -}
      • changedInput schema / properties / tail / default
        Previous value: -"all"New value: +200
      • changedInput schema / required
        Previous value: -[
        -  "service_id"
        -]New value: +[
        +  "id_or_name"
        +]
    • Addedservice_ps
    • Addedservice_remove
    • Addedservice_rollback
    • Addedservice_scale
    • Removedservice_tasks
    • Addedservice_update
    • Changedstack_deploy3 fields changed
      • addedInput schema / properties / name
        Added value: +{
        +  "type": "string"
        +}
      • removedInput schema / properties / stack_name
        Removed value: -{
        -  "type": "string"
        -}
      • changedInput schema / required
        Previous value: -[
        -  "stack_name",
        -  "compose_files"
        -]New value: +[
        +  "name",
        +  "compose_files"
        +]
    • Addedstack_list
    • Removedstack_ls
    • Changedstack_ps5 fields changed
      • removedInput schema / properties / filters / items
        Removed value: -{
        -  "type": "string"
        -}
      • changedInput schema / properties / filters / type
        Previous value: -"array"New value: +"object"
      • addedInput schema / properties / name
        Added value: +{
        +  "type": "string"
        +}
      • removedInput schema / properties / stack_name
        Removed value: -{
        -  "type": "string"
        -}
      • changedInput schema / required
        Previous value: -[
        -  "stack_name"
        -]New value: +[
        +  "name"
        +]
    • Addedstack_remove
    • Removedstack_rm
    • Changedstack_services5 fields changed
      • removedInput schema / properties / filters / items
        Removed value: -{
        -  "type": "string"
        -}
      • changedInput schema / properties / filters / type
        Previous value: -"array"New value: +"object"
      • addedInput schema / properties / name
        Added value: +{
        +  "type": "string"
        +}
      • removedInput schema / properties / stack_name
        Removed value: -{
        -  "type": "string"
        -}
      • changedInput schema / required
        Previous value: -[
        -  "stack_name"
        -]New value: +[
        +  "name"
        +]
    • Removedstart_container
    • Removedstop_container
    • Addedswarm_init
    • Addedswarm_inspect
    • Addedswarm_join
    • Addedswarm_join_tokens
    • Addedswarm_leave
    • Addedswarm_unlock
    • Addedswarm_unlock_key
    • Addedswarm_update
    • Addedsystem_close
    • Addedsystem_df
    • Addedsystem_events
    • Addedsystem_info
    • Addedsystem_login
    • Addedsystem_logout
    • Addedsystem_ping
    • Addedsystem_reconnect
    • Addedsystem_version
    • Removedtag_image
    • Removedunlock_swarm
    • Removedunpause_container
    • Removedupdate_container
    • Removedupdate_node
    • Removedupdate_service
    • Removedupdate_swarm
    • Removedupgrade_plugin
    • Removedversion
    • Addedvolume_create
    • Addedvolume_inspect
    • Addedvolume_list
    • Addedvolume_prune
    • Addedvolume_remove
    • Removedwait_container
    • Removedwait_for_container_healthy
  9. 162 tool updatesv1.9.0
    • First observedbuild_image
    • First observedbuildx_bake
    • First observedbuildx_build
    • First observedbuildx_create
    • First observedbuildx_du
    • First observedbuildx_history_inspect
    • First observedbuildx_history_ls
    • First observedbuildx_imagetools_create
    • First observedbuildx_imagetools_inspect
    • First observedbuildx_inspect
    • First observedbuildx_ls
    • First observedbuildx_prune
    • First observedbuildx_rm
    • First observedbuildx_use
    • First observedclose
    • First observedcommit_container
    • First observedcompose_build
    • First observedcompose_config
    • First observedcompose_cp
    • First observedcompose_down
    • First observedcompose_exec
    • First observedcompose_images
    • First observedcompose_kill
    • First observedcompose_logs
    • First observedcompose_ls
    • First observedcompose_pause
    • First observedcompose_port
    • First observedcompose_ps
    • First observedcompose_pull
    • First observedcompose_restart
    • First observedcompose_run
    • First observedcompose_start
    • First observedcompose_stop
    • First observedcompose_top
    • First observedcompose_unpause
    • First observedcompose_up
    • First observedcompose_wait
    • First observedconfigure_plugin
    • First observedconnect_network
    • First observedcontainer_diff
    • First observedcontainer_logs
    • First observedcontainer_stats
    • First observedcontainer_top
    • First observedcontext_create
    • First observedcontext_inspect
    • First observedcontext_ls
    • First observedcontext_rm
    • First observedcontext_use
    • First observedcreate_config
    • First observedcreate_container
    • First observedcreate_network
    • First observedcreate_secret
    • First observedcreate_service
    • First observedcreate_volume
    • First observeddf
    • First observeddisable_plugin
    • First observeddisconnect_network
    • First observedenable_plugin
    • First observedevents
    • First observedexec_in_container
    • First observedexport_container
    • First observedexport_container_to_file
    • First observedfollow_container_logs
    • First observedforce_update_service
    • First observedget_config
    • First observedget_container
    • First observedget_container_archive
    • First observedget_container_archive_to_file
    • First observedget_image
    • First observedget_network
    • First observedget_node
    • First observedget_plugin
    • First observedget_registry_data
    • First observedget_secret
    • First observedget_service
    • First observedget_swarm_join_tokens
    • First observedget_swarm_unlock_key
    • First observedget_volume
    • First observedhub_list_tags
    • First observedhub_rate_limit
    • First observedhub_repo_info
    • First observedimage_history
    • First observedinfo
    • First observedinit_swarm
    • First observedinstall_plugin
    • First observedjoin_swarm
    • First observedkill_container
    • First observedleave_swarm
    • First observedlist_configs
    • First observedlist_containers
    • First observedlist_hosts
    • First observedlist_images
    • First observedlist_networks
    • First observedlist_nodes
    • First observedlist_plugins
    • First observedlist_secrets
    • First observedlist_services
    • First observedlist_volumes
    • First observedload_image
    • First observedload_image_from_file
    • First observedlogin
    • First observedlogout
    • First observedpause_container
    • First observedping
    • First observedprune_containers
    • First observedprune_images
    • First observedprune_networks
    • First observedprune_volumes
    • First observedpull_image
    • First observedpush_image
    • First observedpush_plugin
    • First observedput_container_archive
    • First observedput_container_archive_from_file
    • First observedreconnect
    • First observedregistry_get_config
    • First observedregistry_inspect_manifest
    • First observedregistry_list_tags
    • First observedreload_swarm
    • First observedremove_config
    • First observedremove_container
    • First observedremove_image
    • First observedremove_network
    • First observedremove_node
    • First observedremove_plugin
    • First observedremove_secret
    • First observedremove_service
    • First observedremove_volume
    • First observedrename_container
    • First observedresize_container
    • First observedrestart_container
    • First observedrollback_service
    • First observedrotate_swarm_join_token
    • First observedrun_container
    • First observedsave_image
    • First observedsave_image_to_file
    • First observedscale_service
    • First observedscout_compare
    • First observedscout_cves
    • First observedscout_quickview
    • First observedscout_recommendations
    • First observedscout_sbom
    • First observedsearch_images
    • First observedservice_logs
    • First observedservice_tasks
    • First observedstack_deploy
    • First observedstack_ls
    • First observedstack_ps
    • First observedstack_rm
    • First observedstack_services
    • First observedstart_container
    • First observedstop_container
    • First observedtag_image
    • First observedunlock_swarm
    • First observedunpause_container
    • First observedupdate_container
    • First observedupdate_node
    • First observedupdate_service
    • First observedupdate_swarm
    • First observedupgrade_plugin
    • First observedversion
    • First observedwait_container
    • First observedwait_for_container_healthy

TDQS

A4.2/5.0

Scored across 165 tools

Disambiguation3/5

Most tools target a distinct resource+action (container_*, image_*, network_*, volume_*), but at 165 tools there are several genuinely overlapping-purpose families: four log tools, three registry/manifest inspection tools, two tag-listing tools (registry_tags vs hub_tags), and five wait tools. The descriptions are exemplary at cross-referencing siblings and stating each tool's exact scope, which compensates substantially, but an agent can still realistically misselect within the registry and log clusters.

Naming Consistency4/5

The dominant `domain_action` snake_case pattern is applied consistently across ~17 domains (container_run, image_remove, volume_prune, service_scale, secret_create, buildx_build, registry_tags). Minor deviations are mostly CLI-faithful (`compose_cp`, `compose_ps`, `swarm_init`, `image_tag`) plus noun-style scout_*/hub_*/registry_manifest, which are predictable rather than chaotic.

Tool Count2/5

165 tools is far beyond any reasonable agent surface — roughly three times the rubric's 'extreme mismatch' threshold. The scope is genuinely broad (Docker engine + compose + swarm + buildx + registries + scout) and the set is well-organized, but the container_*/compose_*/service_* triads triple near-identical operations and the server even ships meta-tools (tool_list, docs_lookup) to help agents navigate its own size.

Completeness5/5

This is effectively the entire Docker CLI surface: full lifecycle coverage for containers, images, networks, volumes, compose, swarm/services/stacks, secrets, configs, plugins, buildx, registries, and Scout — each with create/read/update/delete or equivalent. The only gaps are trivial (no standalone container_port or docker attach) and each has a documented workaround via container_inspect, so workflows have no dead ends.

Maintenance

ActivityActive
ResponsivenessSlow

Related MCP Connectors

Related MCP Servers