Agenterm

Overview Schema Source Related Servers Discussions Admin

session_start

Destructive

Start an interactive terminal session on an authorized target device to run shell commands, answer prompts, and collect incremental output.

Instructions

Start a new interactive terminal process on an authorized target device. The command can change files or system state with the target user's permissions. Supply client_id for multi-device tokens; set cwd and env for this new process. timeout_ms defaults to 0 (no timeout), with a maximum of 86400000 (24 hours). Returns session_id and the initial byte cursor 0, not command completion. Repeated calls start separate processes. Use session_read with the last next_cursor to collect incremental output until done=true, session_write to answer prompts (include a newline), and session_stop to cancel. Each token retains up to six sessions, and only the latest 1 MiB of each session's output is retained. Finished history expires after 30 minutes or can be evicted by later sessions; keep the session_id and poll promptly. Server restarts invalidate sessions. For a short non-interactive command with a final stdout/stderr result, use execute_command instead.

Input Schema

Name	Required	Description
`cwd`	No	Working directory on the target device. Each command starts a fresh shell; use cwd for subsequent commands instead of relying on a previous cd.
`env`	No	Environment overrides for this command, merged with the client environment. Values must be strings.
`command`	Yes	Shell command
`client_id`	No	Six lowercase letters or digits from list_clients. Required for multi-device tokens, even when only one device is online; optional for single-device tokens.
`timeout_ms`	No	Execution timeout in milliseconds, up to 86400000 (24 hours). 0 disables the timeout. Default: 60000 for execute_command, 0 for session_start.
`client_token`	Yes	Target client connection token, required with management access (including stdio and no-password mode). Device-scoped bearer access implicitly selects its own token.

Output Schema

Name	Required	Description	Default
`cursor`	Yes	Initial output byte cursor, always 0 for a new session.
`session_id`	Yes	Identifier of the owned session; retain it for subsequent read, write and stop calls.

Schema Changelog

Changes observed during successful MCP inspections.

Changed4 schema fields changedv0.3.1-stdio.2Nov 1, 2026

changedInput schema / properties / client_token / description

Previous value: -"Target client connection token (required when authenticated with the management key)"New value: +"Target client connection token, required with management access (including stdio and no-password mode). Device-scoped bearer access implicitly selects its own token."

changedOutput schema / additionalProperties
```
Previous value: -trueNew value: +false
```

addedOutput schema / properties

Added value: +{
+  "cursor": {
+    "description": "Initial output byte cursor, always 0 for a new session.",
+    "type": "integer"
+  },
+  "session_id": {
+    "description": "Identifier of the owned session; retain it for subsequent read, write and stop calls.",
+    "type": "string"
+  }
+}

addedOutput schema / required

Added value: +[
+  "session_id",
+  "cursor"
+]

First observedv0.3.1-stdio.1Nov 1, 2026

TDQS

A4.4/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already flag destructiveHint=true, openWorldHint=true, and idempotentHint=false, so the safety profile is largely covered, but the description still adds real context: the return is session_id plus cursor 0 rather than command completion, repeated calls fork separate processes, six sessions per token, only the latest 1 MiB retained, 30-minute expiry, and server restarts invalidate sessions. That is substantive beyond annotations, though pagination/streaming mechanics remain implied rather than spelled out.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core action and permission implication, then lifecycle and constraint details in a logical order. Some sentences restate schema-level facts (timeout_ms default/max, cwd/env) that could be trimmed without losing meaning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive, open-world, stateful tool, the description covers lifecycle (read/write/stop), resource limits (six sessions, 1 MiB buffer), expiry, and restart invalidation. With an output schema present, it need not specify return field shapes, so nothing critical is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents command, client_id, cwd, env, timeout_ms, and client_token with the same details the description repeats (multi-device client_id requirement, timeout default of 0 with 24h cap). The description adds only light cross-parameter workflow framing (cwd/env apply to this new process) and does not compensate with anything the schema lacks, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ("Start a new interactive terminal process") plus a scope qualifier ("authorized target device"). The closing sentence explicitly contrasts it with execute_command for non-interactive commands, so an agent can distinguish it from the closest sibling without opening either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly routes the agent across the whole workflow: session_read with next_cursor to collect output until done=true, session_write to answer prompts with a newline, session_stop to cancel, and execute_command for short non-interactive commands. Both the when-to-use and the when-to-use-something-else conditions are stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server