ChatGPT Machine MCP
This server bridges ChatGPT Web to a trusted local machine through an OpenAI Secure MCP Tunnel, exposing 37 v2 MCP tools for inspecting and controlling the local environment, filesystem, Git, and processes.
System and environment inspection:
machine_status,system_info,environment_info,disk_info,network_info,list_processes,list_portsAudit and monitoring:
audit_recent,audit_search, redacted operation records, supervisor/watchdog status viachatgpt-local statusFilesystem operations:
read_file,write_file,edit_file,update_file,list_directory,find_files,file_info,image_info,search_codeExternal file acquisition:
save_image_from_urlto download HTTPS images to the machineProcess management:
shell_commandfor short commands,start_process,process_status,read_process_output,process_write,stop_processfor managed background processesPatch application:
apply_patchusing Codex patch format with dry-run supportGit operations:
git_status,git_diff,git_log,git_show,git_branch,git_add,git_commit,git_checkout,git_pushSafety-oriented design: workspace-restricted or unrestricted mode, approval gating, read-only hints, destructive annotations, configurable policy and supervisor deadline
Provides tools for working with Git repositories on the local machine, enabling operations such as repository management, commits, branches, and other Git workflows.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@ChatGPT Machine MCPCheck the git status of my local project and show uncommitted changes."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
ChatGPT Pilot
Give ChatGPT controlled access to your local machine.
ChatGPT Pilot is a local MCP runtime for ChatGPT, Codex, and other MCP clients. It combines machine/coding tools, structured reasoning, reusable skills, persistent Markdown memory, and the ChatGPT tunnel behind one gateway.
The normal user experience is a CLI: set it up once, turn it on, use ChatGPT, turn it off when you are done.
ChatGPT / Codex
│
│ MCP over tunnel or stdio
▼
ChatGPT Pilot
├── Machine & coding tools
├── ThinkForge
├── Skill Hub
└── Memory
│
▼
Your computer / workspaceQuick start
Requirements
Node.js 22+
pnpm 9+ or 10+
Git 2.30+
Python 3.10+ with
ipykernelonly if you want persistenttoolpyPython sessions
Install
git clone https://github.com/JonusNattapong/chatgpt-pilot.git
cd chatgpt-pilot
pnpm install
pnpm buildFirst-time setup
From the repository root:
pnpm pilot setupsetup creates the local Pilot configuration, checks the runtime prerequisites, builds the project, and validates the MCP server.
Turn Pilot on
pnpm pilot startstart is an alias for up. It starts the supervised MCP runtime and ChatGPT tunnel. Starting an already-running local instance is safe: the tunnel lifecycle is designed to be idempotent and will not silently steal a live runtime owned by another checkout.
Check it
pnpm pilot status
pnpm pilot doctorTurn Pilot off
pnpm pilot stopstop is an alias for down and stops the tunnel/watchdog stack.
Restart
pnpm pilot restartThat is the main workflow:
pnpm pilot setup # once
pnpm pilot start # turn on
pnpm pilot status # inspect
pnpm pilot doctor # diagnose
pnpm pilot restart # reload/recover
pnpm pilot stop # turn offThe underlying PowerShell/Bash scripts still exist for development and troubleshooting, but they are implementation details. For normal use, use the Pilot CLI.
Related MCP server: chatgpt-sol-local-bridge
CLI
The built CLI identifies itself as chatgpt-local. Inside this repository, pnpm pilot ... is the convenient entry point.
Command | Alias | Purpose |
| — | Initialize config, preflight, build, and check |
|
| Start Pilot and the tunnel |
|
| Stop Pilot and the tunnel/watchdog |
| — | Rebuild and restart the stack |
| — | Show tunnel, workspace, supervisor, worker, and circuit state |
| — | Run deeper runtime diagnostics |
| — | Build and validate the MCP surface |
| — | Select the active workspace |
| — | Read or change the active workspace |
| — | Show local configuration |
| — | Create local configuration if missing |
| — | Reset local configuration |
| — | List registered remote machines |
| — | Print the version |
Choose a workspace
Pilot can be pointed at the project ChatGPT should work with:
pnpm pilot use D:\Projects\Github\my-project
pnpm pilot statusChanging the configured workspace does not mutate a running worker in place. If status reports restart_required: true, run:
pnpm pilot restartConnect ChatGPT
ChatGPT Web / Desktop
For ChatGPT, Pilot normally runs through the developer tunnel:
pnpm pilot startThe local gateway owns the worker and tunnel lifecycle. Once your MCP connection is configured in ChatGPT, you do not need to manually launch the server process for each session.
Stdio clients
Clients that launch MCP servers directly can use the built server:
{
"mcpServers": {
"chatgpt-pilot": {
"command": "node",
"args": [
"<path-to-repo>/apps/server/dist/index.js",
"--tool-surface", "hybrid",
"--dangerously-open-machine"
]
}
}
}Only use unrestricted machine access when you actually need it. Workspace-scoped access is the safer default.
What Pilot gives ChatGPT
Machine & coding
Pilot exposes bounded, structured primitives instead of forcing the model to do everything through a shell:
filesystem reads, searches, atomic edits, and SHA-256 preconditions
project snapshots and code search
supervised background processes with persistent output offsets
direct argv process execution
Git status, diff, history, verified commits, and controlled publishing
machine, port, disk, network, and runtime diagnostics
persistent Python execution through
toolpy
High-authority operations remain policy/approval gated.
GPT.md context
Pilot has an explicit context chain for ChatGPT-specific working instructions:
runtime/system security # hard guardrail; context files cannot weaken it
↓
~/.pilot/GPT.md # user-global Pilot defaults
↓
<repo>/AGENTS.md # shared repository engineering guidance
↓
<repo>/GPT.md # repository-local ChatGPT/Pilot guidance
↓
current user request # highest task-level intent within guardrailspnpm pilot setup creates ~/.pilot/GPT.md once when it is missing and never overwrites an existing user file. Repository GPT.md files are normal tracked project context; AGENTS.md remains the shared cross-agent engineering contract.
Use context_info to inspect the loaded sources and merged context. Use context_explain with an optional literal query to trace a rule back to its source and effective priority. In workspace-restricted mode, repository context discovery never walks above the configured workspace boundary.
Bounded learning & todos
Pilot can keep a persistent workspace task ledger and learn from verified outcomes without silently rewriting itself:
todo_add / todo_update
↓
execute + verify
↓
learning_observe
↓
learning candidate
├─ memory → threshold → promote / rollback
├─ skill → proposal only
├─ capability → proposal only
└─ gpt → proposal onlytodo_add, todo_list, and todo_update persist under .pilot/todos.json. learning_observe, learning_history, learning_promote, and learning_rollback persist evidence and candidates under .pilot/learning.json. High-confidence reusable memory lessons can be promoted into the existing Memory lessons drawer; Skill, Capability, and GPT changes remain proposals and must use the normal inspected, verified workflow. See docs/learning-loop.md for thresholds, metrics, storage, and guardrails.
Flow
Flow turns individual capabilities into durable DAG runs. Independent ready steps execute concurrently up to a per-run limit (default 4), checkpoints and events persist under .pilot/flow/runs.db, and interrupted running steps become uncertain instead of being retried blindly. File edits are not globally serialized: planners can run independent edit_file steps in parallel and use expected_sha256 for optimistic concurrency so conflicts fail rather than silently overwrite another edit.
Core capabilities: flow_create, flow_get, flow_run, flow_resume, flow_cancel, and flow_events. Flow is mounted inside the same ChatGPT Pilot MCP runtime; it is not a second MCP server or tunnel.
ThinkForge
ThinkForge provides structured reasoning operations for work that benefits from more than a single generation pass:
problem analysis and reframing
inversion and first-principles exploration
cross-domain analogy and biomimicry
mechanism generation
adversarial idea review
synthesis
bounded falsification experiments
Skill Hub
Skill Hub lets ChatGPT discover and load reusable engineering procedures from the local skill registry. It supports search, task routing, ranking, workflow composition, skill reading, synchronization, and aggregate outcome telemetry.
Memory
Pilot includes a human-readable Markdown memory engine under .pilot/memory/. It can maintain chapters, timelines, summaries, topic recall, and specialized memory drawers without requiring a native database.
Hybrid tool surface
The hybrid surface keeps the public MCP connection compact while still giving ChatGPT access to the full capability registry:
ChatGPT
│
├── toolpy
│ └── controlled programmatic access to capabilities
│
└── capability_registry
├── coding
├── think
├── skills
├── memory
└── flowThis lets ChatGPT compose several low-level operations inside one controlled execution rather than spending a separate MCP round trip on every primitive.
Control plane
Pilot can inspect whether its running worker matches the current build:
runtime_info
│
├── fresh ───────────────► continue
│
└── stale
│
▼
capability_diff
│
▼
restart_if_stale
│
▼
runtime_inforuntime_info and capability_diff are read-only. restart_if_stale only restarts on demonstrated staleness. self_update is more privileged: it requires MCP_ALLOW_SELF_UPDATE=1 and refuses unsafe repository states such as a dirty tree, non-main branch, unpushed commits, or divergence.
Remote machines
Pilot can route capabilities to registered remote MCP machines. Selectors can be IDs, names, hostnames, aliases, IP addresses, or host:port values.
pnpm pilot machine list
pnpm pilot machine add devbox 192.168.1.50:8787 --name "Dev Box"
pnpm pilot machine remove devboxRemote calls still pass through the remote machine's own policy, workspace boundary, approvals, and audit controls.
Configuration
Local configuration controls the active workspace, policy, approval mode, and access mode. Runtime flags/environment variables are also available for lower-level launches.
Argument | Environment variable | Default | Purpose |
|
| current directory | Workspace and safe-mode boundary |
|
|
|
|
|
|
| Enable unrestricted machine access |
|
|
|
|
|
|
| Approval enforcement mode |
|
|
| Audit trail path |
|
|
| Maximum per-tool timeout |
Security model
Pilot is powerful by design, so the boundary is explicit:
Workspace isolation — workspace mode confines filesystem operations to the configured root and rejects escaping symlinks.
Approval gates — mutating/high-authority capabilities can require explicit authorization.
Process supervision — long-running processes are tracked and can be inspected or terminated as process trees.
Optimistic concurrency — file mutation tools can require a SHA-256 observed during the preceding read.
Verified Git flow — verification can run before selected changes are committed or published.
Audit trail — machine operations are recorded to NDJSON with sensitive values redacted.
Controlled self-update — autonomous updates fail closed when repository state is unsafe.
--dangerously-open-machine deliberately removes the normal workspace filesystem boundary. Treat it as an administrator/developer mode, not the default installation mode.
Direct tunnel scripts
These are useful when debugging the lifecycle layer itself. Normal users should prefer pnpm pilot ....
Windows
.\scripts\start-tunnel.ps1
.\scripts\status-tunnel.ps1
.\scripts\doctor.ps1
.\scripts\restart-tunnel.ps1
.\scripts\stop-tunnel.ps1Linux / macOS
./scripts/start-tunnel.sh
./scripts/status-tunnel.sh
./scripts/doctor.sh
./scripts/restart-tunnel.sh
./scripts/stop-tunnel.shDevelopment
pnpm build
pnpm typecheck
pnpm test
pnpm verify
pnpm check:hybridRepository layout:
apps/server MCP gateway, CLI, machine/coding runtime, supervisor
packages/thinkforge structured reasoning capabilities
packages/skill-hub local skill registry and routing
packages/memory Markdown memory engine
scripts/ tunnel lifecycle and repository automation
skills/ reusable skill proceduresTroubleshooting
Start with:
pnpm pilot status
pnpm pilot doctorIf the configured workspace differs from the running worker:
pnpm pilot restartIf you are developing Pilot itself and need to validate the complete repository:
pnpm verifyLicense
MIT. See LICENSE.
Available Tools
62 toolsapply_patchDestructive
Add, update, move, or delete files inside the configured workspace using Codex patch format. Run with "dry_run" first when the context lines are uncertain.
| Name | Required | Description | Default |
|---|---|---|---|
| patch | Yes | Patch beginning with *** Begin Patch and ending with *** End Patch. | |
| dry_run | No | Validate and report changes without writing files. | |
| expected_sha256 | No | When supplied, must cover every updated/deleted source path with its read-time SHA-256. |
audit_recentBRead-only
Read recent redacted machine-operation audit records.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnly and non-destructive behavior, lowering the bar for description contribution. The description adds useful context by stating the records are 'redacted' and 'recent', which informs the agent about output content and time scope beyond the structured annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, well-formed sentence that immediately states the action and resource. There is no filler or redundant information, and the description is appropriately compact for a simple read tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is adequate for a straightforward read operation with readOnly annotations, but it lacks parameter semantics and usage guidance. For a one-parameter tool where the parameter is optional and schema-described, this is a minimum viable definition with clear gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description should explain parameter meaning. It does not mention the 'limit' parameter at all, leaving the agent to infer its purpose from the schema's integer range alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('read') and resource ('recent redacted machine-operation audit records'), which clearly identifies the tool's purpose. It does not explicitly distinguish this from the sibling audit_search, but the 'recent' and 'redacted' qualifiers provide meaningful differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance about when to use this tool versus alternatives such as audit_search. There is no mention of what 'recent' means, how far back it reaches, or when a search-style tool would be more appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
audit_searchARead-only
Search recent redacted audit records by text.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| query | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already communicate readOnlyHint=true and destructiveHint=false. The description adds useful behavioral context: records are 'recent' and 'redacted'. However, it does not specify what 'recent' means, how matching works, or what the result shape is.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single seven-word sentence, front-loaded with the verb and resource. Every word contributes meaning and there is no repetition or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The core invocation is clear, and read-only annotations cover safety, but the definition leaves ambiguity around the time window for 'recent', the exact search semantics, and what redacted output contains. No output schema exists to fill these gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. 'By text' clarifies that query is the search text, but the limit parameter is not addressed at all. The schema's min/max constraints help, but the description adds only partial semantic value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Search', the resource 'recent redacted audit records', and the method 'by text'. This distinguishes it from the sibling audit_recent, which likely lists recent records without text search.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies text-based search over recent audit records, but it does not explicitly mention the sibling audit_recent or state when to prefer this tool over listing all recent records. No alternatives or exclusions are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
capability_diffRead-only
Read-only. Compare the live worker tool surface against a fresh probe of the current build. Returns added/removed/changed tool names and fingerprintMatch. A mismatch means the worker serves a stale build.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
context_explainRead-only
Explain where Pilot context came from and, for an optional literal query, show matching lines plus the highest-priority matching context source.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Project directory; defaults to the workspace root. | |
| query | No | Optional literal text to trace to context source lines. |
context_infoRead-only
Load the effective ChatGPT Pilot context chain for a project: user-global ~/.pilot/GPT.md, repository AGENTS.md, and repository GPT.md, with explicit precedence and provenance. Runtime/system security remains non-overridable.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Project directory; defaults to the workspace root. | |
| include_content | No | Include bounded source contents and merged context; defaults to true. | |
| max_bytes_per_source | No | Maximum bytes loaded from each context file; defaults to 65536. |
disk_infoARead-only
Read filesystem capacity and free-space information for a path allowed by the current machine access policy.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Path relative to the workspace root, or an allowed absolute path. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish read-only/non-destructive behavior, and the description adds useful behavioral context: it returns capacity/free-space and enforces the machine access policy on the supplied path. It does not describe error behavior or return formatting, but this is minor for such a simple read tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that front-loads the core behavior and then states the access constraint. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter read-only tool with complete schema coverage and a readOnlyHint annotation, the description is almost sufficient. It would benefit from stating the output shape/units or handling of disallowed paths, but no output schema exists and the core semantics are clear.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema fully documents the path parameter, including relative-to-workspace-root and allowed absolute paths, so schema coverage is 100%. The description only restates that the path must be allowed by policy, adding little parametric meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Read') and names a concrete resource ('filesystem capacity and free-space information'), which clearly distinguishes it from sibling file/system tools like file_info or environment_info. The path scoping is also stated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The purpose implies when to use it—when filesystem capacity/free space for a path is needed—but it does not explicitly state when to prefer this over alternatives or mention any sibling tools. No exclusions or alternative routing are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
edit_fileADestructive
Replace exact text in an existing UTF-8 file. Supply either old_text/new_text or an edits array. Array edits are validated in memory then written atomically, so a failed edit never leaves a partial file.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Path relative to the workspace root, or an allowed absolute path. | |
| edits | No | Transactional sequence of edits; all succeed or none are written. | |
| dry_run | No | Report what would change without writing the file. | |
| new_text | No | Replacement text. | |
| old_text | No | Exact text to find, copied verbatim from read_file output. | |
| replace_all | No | Replace every occurrence; defaults to false. | |
| expected_sha256 | No | Optional SHA-256 returned by a previous read or write. The call fails if the file changed since then. | |
| expected_replacements | No | Require exactly this many occurrences. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the destructiveHint annotation, the description adds valuable behavior: array edits are validated in memory and written atomically, so a failed edit never leaves a partial file. It also clarifies that the file must already exist and be UTF-8 encoded. There is no contradiction with the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences with no filler. The purpose is front-loaded, and the important atomicity caveat is placed immediately after the mode description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an 8-parameter mutation tool, the description is complete enough: it identifies the file scope, conditions, modes, and the key safety behavior. Parameter details are fully covered by the schema, and there is no output schema requiring return-value documentation. A brief comparison with sibling tools would make it fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, providing a strong baseline. The description adds meaning by making the either/or relationship between old_text/new_text and the edits array explicit, and by characterizing the array as transactional, which is not readily apparent from individual schema fields.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear verb and resource: 'Replace exact text in an existing UTF-8 file.' It also conveys the two invocation modes, which helps separate it from broader file tools, though it does not explicitly name sibling alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool ('Replace exact text in an existing UTF-8 file') and explains the two input modes. It does not provide explicit when-not-to-use guidance or compare with overlapping siblings such as update_file or apply_patch.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
environment_infoARead-only
List environment variable names and optionally non-sensitive values. Secret-like variables are always redacted.
| Name | Required | Description | Default |
|---|---|---|---|
| filter | No | Optional variable-name filter. | |
| include_values | No | Include values for non-sensitive variables; defaults to false. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=true and destructiveHint=false, so safety is covered. The description adds meaningful behavior beyond that: secret-like variables are always redacted, and values are only included when explicitly requested for non-sensitive variables.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no filler. The primary action is front-loaded ('List environment variable names'), and the key redaction caveat is included compactly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only tool, the description and schema together cover names, optional values, redaction, and filtering. No output schema exists, but the return concept is clear enough; minor gaps like exact filter matching semantics are acceptable at this complexity level.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so filter and include_values are already documented. The description adds value by clarifying that secret-like variables are redacted even when include_values is true, which is an edge-behavior the schema alone does not fully convey.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: 'List environment variable names' and optionally non-sensitive values. This clearly distinguishes it from sibling tools like system_info or machine_status, and the redaction mention adds precision.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is for inspecting environment variables, but it does not explicitly state when to prefer it over alternatives such as shell_command or when not to use it. No exclusions or alternative routing is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
exec_processDestructive
Execute one binary with an explicit argv vector, without shell parsing or quoting. Prefer this over shell_command for scripts, Git helpers, and structured command invocation.
| Name | Required | Description | Default |
|---|---|---|---|
| env | No | Environment variables merged over the server environment. | |
| args | No | Argument vector passed directly to the executable. | |
| stdin | No | UTF-8 text written to stdin before it is closed. | |
| workdir | No | Working directory; defaults to the workspace. | |
| executable | Yes | Executable name or path. | |
| timeout_ms | No | ||
| expect_exit_code | No | Optional expected exit code. | |
| max_output_bytes | No |
file_infoARead-only
Get file or directory metadata and an optional SHA-256 hash for regular files.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Path relative to the workspace root, or an allowed absolute path. | |
| include_hash | No | Calculate SHA-256 for regular files; defaults to true. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the description only needs to add behavior beyond safety. It does by specifying that the SHA-256 hash is optional and limited to regular files, which is useful for setting expectations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The entire description is one front-loaded sentence with no filler. Every part contributes to understanding the tool's purpose and scope.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description does not explain what metadata fields are returned, which could leave an agent guessing about the response shape. For such a small tool, however, the path and hash parameters are fully covered, so the gap is moderate rather than severe.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already describes all parameters with 100% coverage, including path constraints and the include_hash default. The description's 'optional SHA-256 hash for regular files' mostly restates the schema's include_hash description, adding no significant new meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific action ('Get') and resource ('file or directory metadata'), plus the optional SHA-256 hash. This clearly separates it from content-reading siblings like read_file and listing tools like list_directory.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The metadata-and-hash scope gives a clear context for when the tool is appropriate, while the read-only annotations reinforce safe use. It does not explicitly name sibling alternatives or exclusions, but the intended use is clear for a metadata lookup.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
find_filesARead-only
Find files recursively by glob. Build output and dependency directories such as node_modules, .git, dist, and target are skipped unless "include_ignored" is true.
| Name | Required | Description | Default |
|---|---|---|---|
| glob | No | Glob such as **/*.ts; defaults to **/*. | |
| path | No | Directory to search; defaults to the workspace root. | |
| exclude | No | Extra directory names to skip. | |
| max_depth | No | Maximum recursive directory depth. | |
| max_results | No | Maximum returned paths. | |
| include_hidden | No | Traverse names beginning with a dot; defaults to false. | |
| include_ignored | No | Traverse the default-skipped build and dependency directories. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false. The description adds meaningful behavioral context beyond that: build and dependency directories are skipped by default, and include_ignored re-enables them. This is genuinely useful for predicting tool behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no filler. The primary action is front-loaded, and the important default-skipping behavior is stated immediately and compactly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only search tool with 100% schema coverage, the description captures the essential behavior and default exceptions. It does not describe return value shape or pagination, but the tool's purpose makes the result type reasonably inferable.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so each parameter already has a description. The tool description only references include_ignored, adding little beyond the schema. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description states a specific verb ('Find'), resource ('files'), and method ('recursively by glob'), which clearly differentiates it from sibling tools like list_directory and search_code. The skipping behavior further clarifies what this tool is specialized for.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context: use when you need recursive file discovery by glob pattern, not directory listing or content search. It does not explicitly name alternatives or exclusions, but the recursive-glob framing is enough to infer appropriate usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
git_addADestructive
Stage explicit repository paths using Git directly, without shell interpolation.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Git repository directory; defaults to the workspace. | |
| paths | Yes | Repository paths to stage. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate the operation is destructive/mutating, so the description doesn't need to repeat that. It adds a useful behavioral detail—'without shell interpolation'—but doesn't disclose further effects such as whether the working tree changes or whether staging can be undone. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The entire description is one short, front-loaded sentence. It places the action and object first and adds the distinguishing mechanism at the end without any filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a simple two-parameter tool with a fully described schema, so the description plus schema are largely sufficient. It could mention that this only stages files and does not commit, but that is reasonably inferable from the tool name and sibling git_commit.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description goes beyond the schema by saying paths are 'explicit' and that no shell interpolation is applied, which tells the agent the paths are treated literally and glob patterns won't be expanded.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description starts with a specific verb, 'Stage,' and a precise resource, 'explicit repository paths.' It also distinguishes itself from shell-based alternatives by saying 'using Git directly, without shell interpolation,' making its role clear relative to the shell_command sibling.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'without shell interpolation' signals a clear context: use this when you want to stage paths directly via Git without shell expansion. It doesn't explicitly name alternative tools or state when not to use them, but the contrast with shell_command is implied well enough.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
git_branchARead-only
List local Git branches and optionally remote branches with current/upstream metadata.
| Name | Required | Description | Default |
|---|---|---|---|
| all | No | Include remote branches. | |
| path | No | Git repository directory; defaults to the workspace. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, covering the safety profile. The description adds useful scope information (local vs optional remote) and the presence of current/upstream metadata, but does not describe output format, pagination, or error behavior. This is acceptable given the simple read-only nature of the tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no filler, front-loading the core action and resource. It conveys the important optional behavior ('optionally remote branches') concisely and is easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only listing tool with two optional parameters and no output schema, the description covers the essential behavior and what metadata is returned. The main gap is a precise description of the output format, but the description provides enough for an agent to call the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already covers both parameters fully with descriptions: 'all' means include remote branches, and 'path' defaults to the workspace. The description's phrase 'optionally remote branches' reinforces the 'all' parameter but does not add substantial meaning beyond the schema, so a baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb ('List'), resource ('Git branches'), and scope ('local' and optionally 'remote'), plus the metadata returned ('current/upstream'). This clearly distinguishes it from sibling git tools such as git_log, git_status, or git_diff, which operate on commits or working-tree state.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly conveys when this tool is appropriate: to list branches, including remote ones when requested. It does not explicitly name alternatives or exclusion criteria, but the tool's purpose is unambiguous enough that an agent can select it over the listed git siblings without confusion.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
git_checkoutADestructive
Switch to an existing Git branch, or create and switch to a new branch. Force/discard modes are intentionally not exposed.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Git repository directory; defaults to the workspace. | |
| branch | Yes | ||
| create | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations mark `destructiveHint: true`, and the description adds a specific safety limitation: force/discard modes are intentionally not exposed, so the agent can expect failures rather than destructive overwrites. This is valuable context beyond the generic annotation and does not contradict it.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences, with the core action front-loaded and the safety limitation in a single clause. Every word earns its place; no fluff or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple 3-parameter tool, the description covers the core action and an important behavioral guardrail. It doesn't describe return output or failure modes, but no output schema exists and git checkout behavior is standard. A mention of uncommitted changes would make it fully complete, but it's already largely sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 33% (only `path` is described). The description compensates by naming `branch` as the target and explaining `create` through 'create and switch to a new branch.' It doesn't detail the `create` boolean's default or behavior when false, but it adds meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a clear verb ('Switch') and resource ('Git branch'), explicitly covering two modes: switching to an existing branch and creating a new one. It distinguishes itself from sibling `git_branch` by describing the act of switching. The note about force/discard modes sharpens the scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool (when changing branches) but does not mention alternatives or exclusions. Unlike a stronger definition, it doesn't name a sibling tool or state when not to use it. The only limitation is about force/discard modes, not about choosing between tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
git_commitADestructive
Create a local Git commit from staged changes, optionally staging tracked-file modifications with --all.
| Name | Required | Description | Default |
|---|---|---|---|
| all | No | Stage tracked-file modifications/deletions before committing. | |
| path | No | Git repository directory; defaults to the workspace. | |
| message | Yes | Commit message. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark the tool as write/destructive, and the description adds that the commit is local and only uses staged changes unless --all is used. It does not mention failure modes like missing git identity or 'nothing to commit', but given the annotation coverage, this is acceptable.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single well-structured sentence that front-loads the action and resource, then adds the optional flag behavior. Every word earns its place with no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The core behavior, local scope, and staging precondition are all covered, and the schema provides all parameter details. It does not describe post-commit effects or verification steps, but these are not essential for basic invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters. The description restates the --all behavior but adds no extra semantic meaning beyond what the schema provides, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb ('Create') and resource ('local Git commit') and disambiguously distinguishes the too from siblings like git_push and git_add by specifying that it operates locally and from staged changes. It is fully aligned with the tool's name and purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context: use this when you have staged changes and want a local commit, and it explains the optional --all behavior for staging tracked modifications. It does not explicitly mention alternatives, but the context is strong enough for an agent to select it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
git_commit_verifiedDestructive
Verify the project, stage only explicit paths, and create a local commit. Refuses pre-existing staged changes so unrelated work cannot be committed accidentally.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Git repository directory; defaults to the workspace. | |
| paths | Yes | Explicit repository paths to include. | |
| message | Yes | Commit message. | |
| profile | No | Verification depth; defaults to normal. | |
| timeout_ms | No | Timeout per verification command. | |
| total_timeout_ms | No | Total verification budget across all checks; defaults to timeout_ms. Cleanup may take a bounded grace period. |
git_diffARead-only
Read the Git working-tree or staged diff without running a shell command, optionally limited to specific paths.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Git repository directory; defaults to the workspace. | |
| paths | No | Limit the diff to these repository paths. | |
| staged | No | Read the staged diff instead of the working-tree diff. | |
| max_bytes | No | Maximum diff bytes. | |
| stat_only | No | Return only diff statistics. | |
| context_lines | No | Lines of context around each hunk. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, covering the safety profile. The description adds the implementation detail that no shell command is executed, which is minor but useful. It does not describe output shape, truncation, or size limits, though these are partly reflected in the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One front-loaded sentence with no filler. Every element earns its place: the read behavior, the working-tree/staged distinction, the no-shell-command note, and optional path scoping.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only Git diff tool with well-documented optional parameters and safety annotations, the description is largely complete. It could mention the output format or default behavior when no paths are given, but those are inferable from the tool name and schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema documentation coverage is 100%, so the baseline is 3. The description reinforces the meaning of 'staged' and 'paths' but does not add semantic detail beyond what the input schema already provides for the six parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Read'), a precise resource ('Git working-tree or staged diff'), and an optional scoping behavior ('limited to specific paths'). It clearly identifies this as the diff-reading tool among siblings like git_status and git_show, and conveys that it does not invoke a shell command.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear usage context: it reads working-tree or staged diffs and can be scoped to paths. It implicitly contrasts with shell_command by noting it runs without a shell command, though it does not explicitly describe when to prefer alternative Git tools or shell commands.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
git_logARead-only
Read structured Git commit history without shell interpolation.
| Name | Required | Description | Default |
|---|---|---|---|
| ref | No | Optional revision or branch; defaults to HEAD. | |
| path | No | Git repository directory; defaults to the workspace. | |
| max_count | No | Maximum commits; defaults to 20. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false. The description adds valuable behavioral context with 'without shell interpolation,' signaling that no shell command execution or injection risk is involved. This goes beyond the structured annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no filler. Every word contributes: the action, the resource, the output nature, and the safety-relevant execution detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a low-complexity, read-only tool with fully documented optional parameters, the description is nearly complete. It does not detail the exact structured return fields, and no output schema exists, so a small gap remains; however, 'structured Git commit history' plus schema and annotations covers all essential call-time needs.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with clear descriptions for ref, path, and max_count including defaults. The tool description does not add parameter-specific meaning, but the schema already carries the full burden, so a baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Read structured Git commit history.' This clearly distinguishes it from sibling tools that show diffs, branches, or add/commit changes, and 'structured' indicates the output form.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The intended use is implied as 'read Git commit history,' but the description does not explicitly say when to prefer this over git_show, git_diff, or git_branch, nor does it provide exclusions or alternative routing. It is adequate but leaves usage decisions to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
git_publish_pathsDestructive
Safely publish only selected files. Fetches the remote branch, refuses selected-path drift, copies only those files into an isolated temporary worktree rooted at the remote tip, optionally verifies there, commits, then pushes without changing the caller worktree/index/branch.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Git repository directory; defaults to the workspace. | |
| paths | Yes | Repository-relative files to publish. | |
| branch | No | Branch; defaults to the current branch. | |
| remote | No | Remote name; defaults to origin. | |
| message | Yes | Commit message for the isolated publish commit. | |
| verify_profile | No | Optional project verification profile to run inside the isolated worktree before commit/push. | |
| verify_timeout_ms | No | Verification timeout when verify_profile is supplied. |
git_pushADestructive
Push a Git branch to a remote using Git directly. This is an external mutation and is approval-gated by the developer policy.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Git repository directory; defaults to the workspace. | |
| branch | No | Branch; defaults to the current branch. | |
| remote | No | Remote name; defaults to origin. | |
| set_upstream | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds meaningful behavioral context by noting that this is an 'external mutation' and 'approval-gated by the developer policy', complementing annotations that already indicate readOnlyHint=false, destructiveHint=true, and openWorldHint=true. It does not detail consequences on the remote, but the annotations already cover the destructive profile.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences with the core purpose front-loaded and the policy caveat cleanly separated. There is no filler, redundancy, or unnecessary detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the critical safety context (external mutation, approval gate), and the schema provides defaults for the optional parameters. However, it omits behavior around conflicts, force-pushing, or expected output, leaving some operational details to inference.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description provides no parameter-level information. The schema documents path, branch, and remote, but set_upstream is left undocumented (75% coverage), and the description does nothing to clarify this boolean flag or any parameter interplay.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource ('Push a Git branch to a remote'), which clearly communicates the operation. It also distinguishes itself from sibling Git tools like git_commit and git_checkout by focusing on the push action.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given about when to use this tool versus alternatives or what preconditions must be met. The approval-gating note is a policy warning, not usage direction, and no sibling tool is mentioned as an alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
git_remote_statusRead-only
Read local-vs-remote branch state using structured Git commands. Set refresh=true to fetch the selected branch first so ahead/behind is based on current remote state.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Git repository directory; defaults to the workspace. | |
| branch | No | Branch; defaults to the current branch. | |
| remote | No | Remote name; defaults to origin. | |
| refresh | No | Fetch remote/branch before computing ahead/behind. |
git_showARead-only
Read one Git revision and its patch or statistics with bounded output.
| Name | Required | Description | Default |
|---|---|---|---|
| ref | No | Revision; defaults to HEAD. | |
| path | No | Git repository directory; defaults to the workspace. | |
| max_bytes | No | ||
| stat_only | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds the useful 'bounded output' behavior tied to max_bytes, but it does not disclose details like what happens when max_bytes is exceeded or the exact output format. This is acceptable given the read-only annotations but not especially rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, focused sentence with no filler. The main verb and resource are front-loaded, and every word adds meaning. It is appropriately sized for the tool's complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only tool with four optional parameters and no output schema, the description covers the core invocation context: what is read, what output to expect, and that output is bounded. Minor gaps remain around exact return formatting and truncation behavior, but these are not critical for selecting and invoking the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With only 50% schema description coverage, max_bytes and stat_only lack direct schema documentation. The description partially compensates by indicating 'bounded output' for max_bytes and 'patch or statistics' for stat_only. However, it does not fully explain the behavior or defaults of these parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Read'), a clear resource ('one Git revision'), and the output content ('patch or statistics'). This distinguishes it from sibling tools like git_log, git_diff, and git_status, which handle history listing or comparisons.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is for inspecting a single revision's patch or stats, which gives some context for when to use it. However, it does not explicitly mention alternatives like git_diff for comparing revisions or git_log for browsing history, so routing to the right sibling is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
git_statusARead-only
Read the current Git branch, upstream tracking state, and working-tree status without running a shell command.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Git repository directory; defaults to the workspace. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, openWorldHint=false, and destructiveHint=false, so the safety profile is covered. The description adds a useful behavioral nuance by stating it works without running a shell command, but it does not disclose any additional edge-case behavior or output characteristics beyond that.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that front-loads the action and resource. Every word earns its place, with no fluff or repetition of schema fields.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter read-only tool, the description adequately explains what will be read: branch, upstream tracking state, and working-tree status. Since there is no output schema, a slightly more detailed note about the returned value format would make it fully complete, but the current description is sufficient for an agent to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already documents the only parameter (path) with a full description including the default behavior. The tool description adds no parameter-specific details beyond confirming the repository context, so with 100% schema coverage the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description uses a specific verb ('Read') and names the precise resource: current Git branch, upstream tracking state, and working-tree status. This clearly distinguishes it from sibling tools like git_diff, git_log, and git_branch, while the phrase 'without running a shell command' also separates it from shell_command.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides useful context that this tool is a safe, direct way to inspect repository state rather than invoking a shell command. However, it does not explicitly state when to choose this over sibling tools such as git_branch or git_status alternatives, leaving some routing decisions to the agent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
image_infoARead-only
Inspect a local PNG, JPEG, or WebP image and return dimensions, size, and SHA-256.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Path relative to the workspace root, or an allowed absolute path. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, and the description adds value by specifying exactly what will be returned: dimensions, size, and SHA-256. This makes the tool's behavior predictable without overclaiming. Minor omitted details like error behavior for unsupported formats are not critical given the simple scope.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, tightly constructed sentence states the operation, accepted formats, and expected return values with no filler. Every element earns its place and the key purpose is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only, single-parameter inspection tool, the description plus annotations cover the safety profile and return content. There is no output schema, so the description's mention of returned dimensions, size, and SHA-256 is necessary and sufficient. Slightly more detail about unsupported formats or error handling would push this to 5, but it is already complete enough.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the single path parameter, including workspace-relative and absolute path semantics. The description does not add further parameter detail, but the schema already fully carries that burden, so a baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('Inspect'), the resource ('local PNG, JPEG, or WebP image'), and the outputs ('dimensions, size, and SHA-256'). It also distinguishes this tool from generic siblings like file_info by scoping it to image files and their specific metadata.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage: local image files in supported formats. However, it does not explicitly state when not to use it, such as for non-image files, nor does it mention alternatives like file_info or read_file for other cases. Context is clear but exclusions or sibling routing are absent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
learning_historyRead-only
Inspect bounded learning observations and candidates, including their evidence, target, confidence, and promotion status.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| status | No | ||
| target | No |
learning_observe
Record an evidence-backed task outcome and reusable learning candidates. This never changes Skills, Capabilities, GPT.md, or memory by itself.
| Name | Required | Description | Default |
|---|---|---|---|
| task | Yes | ||
| lessons | No | ||
| outcome | Yes | ||
| summary | No | ||
| todo_id | No | ||
| evidence | No | ||
| skills_used | No |
learning_promote
Promote one evidence-backed learning candidate. Memory lessons are written to the existing lessons drawer; Skill/Capability/GPT targets become proposals only and never silently self-modify Pilot.
| Name | Required | Description | Default |
|---|---|---|---|
| candidate_id | Yes |
learning_rollbackDestructive
Roll back a learning proposal or remove a previously promoted memory lesson. Code, Skills, Capabilities, and GPT.md are never modified by this tool.
| Name | Required | Description | Default |
|---|---|---|---|
| candidate_id | Yes |
list_directoryARead-only
List files, directories, and symlinks with size and modification time, without running a shell command.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Directory path; defaults to the workspace root. | |
| max_entries | No | Maximum returned entries. | |
| include_hidden | No | Include names beginning with a dot; defaults to false. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark this as read-only and non-destructive. The description adds useful behavioral context beyond those annotations by specifying that it returns files, directories, symlinks, size, and modification time, and that it does not execute a shell command. No contradiction with annotations exists.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, tightly worded sentence that front-loads the core action and resource. It includes the most important differentiator ('without running a shell command') without any wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a simple listing tool with fully documented optional parameters and read-only annotations. The description sufficiently covers what the tool returns (files, directories, symlinks, size, modification time) and why it should be used over a shell command, so the agent has enough information to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already provides 100% parameter documentation, covering path, max_entries, and include_hidden with descriptions and defaults. The tool description does not add any additional parameter semantics, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('List') and resource ('files, directories, and symlinks'), and adds distinguishing details like size and modification time. It also explicitly differentiates itself from shell-based approaches, making it easy for an agent to understand what this tool does.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'without running a shell command' gives clear context for when to prefer this tool over shell_command. It doesn't explicitly name other alternatives like find_files, but the listing scope and metadata details make the intended use case clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_portsARead-only
List local TCP/UDP endpoints and owning PIDs, optionally filtered by port, PID, or protocol.
| Name | Required | Description | Default |
|---|---|---|---|
| pid | No | ||
| port | No | ||
| limit | No | ||
| protocol | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds that it targets local endpoints and includes owning PIDs, but it doesn't disclose platform dependencies, potential latency, or output volume controls beyond the limit parameter.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, well-structured sentence that front-loads the core function and immediately mentions the optional filters. There is no redundant wording or filler, making it highly efficient for an agent to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only list tool with no output schema, the description states what is returned (endpoints and PIDs) and the main filtering dimensions. It lacks detail on the meaning of limit and exact output format, but these are minor given the simple nature of the operation and the strong annotations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It does map port, PID, and protocol to 'filtered by', adding meaning beyond raw parameter names, but it omits the limit parameter entirely, leaving its purpose unstated.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('List') with a concrete resource ('local TCP/UDP endpoints and owning PIDs') and names the optional filters. This clearly distinguishes it from siblings like list_processes or network_info without needing to open the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance on when to use this tool versus alternatives such as network_info or list_processes. It states the core action but provides no exclusions or explicit use cases, leaving the agent to infer when this is the right choice.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_processesBRead-only
List operating-system processes with bounded structured results.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum returned processes; defaults to 500. | |
| filter | No | Optional case-insensitive text filter. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safe-read profile is covered. The description adds 'bounded structured results,' which gives some behavioral context about output shape and size limits, but it does not disclose details like exact returned fields, ordering, or whether the process list is a snapshot. There is no contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with no wasted words. It clearly states the action and a key behavioral qualifier, though 'bounded structured results' is a little vague and could have been slightly more specific without harming brevity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list operation with fully documented parameters and safety annotations, the description is mostly sufficient. However, there is no output schema and the description does not specify what fields the returned process objects contain (e.g., PID, name, CPU), which is a meaningful gap for an agent that needs to act on the results.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both 'limit' and 'filter' are already documented with type, bounds, default, and case-insensitivity. The description adds no further parameter-level meaning beyond summarizing the result as bounded, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb ('List'), resource ('operating-system processes'), and a scope modifier ('bounded structured results'), so it is clear what the tool does. It does not explicitly name a sibling to differentiate it from, but the verb and resource are unambiguous enough to separate it from process_status, start_process, and stop_process.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage whenever an agent needs to see current OS processes because of the clear 'List' verb. However, it gives no explicit guidance about when to prefer this over sibling tools like process_status, start_process, or stop_process, and it does not state any exclusions or limitations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
machine_callDestructive
Run one MCP tool on a registered remote machine. This is the high-authority routing path; the remote machine still enforces its own policy, workspace boundary, approvals, and audit log.
| Name | Required | Description | Default |
|---|---|---|---|
| tool | Yes | ||
| machine | Yes | ||
| arguments | No | ||
| timeout_ms | No |
machine_probeRead-only
Check health and latency of one registered remote machine selected by id, name, hostname, alias, IP address, or host:port.
| Name | Required | Description | Default |
|---|---|---|---|
| machine | Yes | ||
| timeout_ms | No |
machine_readRead-only
Run a remote MCP tool only after the gateway verifies that the registered remote tool declares readOnlyHint=true. Mutating or unannotated tools fail closed and must use machine_call instead.
| Name | Required | Description | Default |
|---|---|---|---|
| tool | Yes | ||
| machine | Yes | ||
| arguments | No | ||
| timeout_ms | No |
machines_listRead-only
List registered remote machines. Selectors may be id, name, hostname, alias, IP address, or host:port. This call does not contact remote machines.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
machine_statusRead-only
Return a compact machine/runtime health summary. Request optional sections or detailed=true only when deeper diagnostics are needed.
| Name | Required | Description | Default |
|---|---|---|---|
| include | No | Optional expanded sections. | |
| detailed | No | Include service, platform, dependency, governance, process-history, and tool-surface details. |
machine_toolsRead-only
List and cache tool capabilities exposed by one registered remote machine. Cache entries live for 60 seconds and are replaced when a refreshed capability fingerprint changes.
| Name | Required | Description | Default |
|---|---|---|---|
| machine | Yes | ||
| refresh | No | Bypass the 60-second capability cache. | |
| timeout_ms | No |
network_infoARead-only
Read local network-interface addresses and metadata without making an outbound network request.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, and the description reinforces this by explicitly stating there is no outbound network request. This adds meaningful behavioral context beyond the raw annotations and clarifies the tool's non-intrusive nature.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that is front-loaded with the action and resource, then qualifies the behavior. Every word earns its place, with no redundancy or vague filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameterless read-only tool with strong annotations, the description is complete. It clearly tells the agent what the tool reads and what side effects it avoids, which is sufficient for correct selection and invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so parameter semantics are trivially satisfied. The description does not need to explain parameter meanings, and the schema is fully consistent with a parameterless tool.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Read') and a specific resource ('local network-interface addresses and metadata'), making the tool's purpose unmistakable. It also distinguishes itself from tools like environment_info or system_info by clarifying its network-interface focus.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description signals the intended use case: getting local network-interface information without triggering an outbound request. It does not explicitly name sibling alternatives or exclusion conditions, but the local-scope phrasing gives clear usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
process_statusRead-only
Get the status, runtime, and current output offsets for a managed background process.
| Name | Required | Description | Default |
|---|---|---|---|
| pid | Yes | Process ID returned by start_process. | |
| process_id | No | Opaque processId returned by start_process; detects stale PID references. |
process_waitRead-only
Wait until a managed background process exits or the timeout expires. Returns the exit code and output offsets without requiring repeated process_status calls; a timeout does not stop the process.
| Name | Required | Description | Default |
|---|---|---|---|
| pid | Yes | Process ID returned by start_process. | |
| process_id | No | Opaque processId returned by start_process; detects stale PID references. | |
| timeout_ms | No | Maximum time to wait. Defaults to 30000 ms. | |
| since_stderr | No | ||
| since_stdout | No | ||
| include_output | No | Include a bounded stdout/stderr page with the exit status. | |
| max_output_bytes | No |
process_writeDestructive
Write UTF-8 text to the standard input of a live process started by start_process. Recovered processes remain inspectable after restart but their stdin cannot be reattached.
| Name | Required | Description | Default |
|---|---|---|---|
| end | No | Close standard input after writing; defaults to false. | |
| pid | Yes | Process ID returned by start_process. | |
| input | Yes | UTF-8 text to write to standard input. | |
| process_id | No | Opaque processId returned by start_process; detects stale PID references. |
project_snapshotRead-only
Read a bounded coding-oriented project snapshot in one call: Git status, top-level tree, package/scripts, project type hints, common agent instruction files, and Pilot GPT.md context provenance.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Project directory; defaults to the workspace root. | |
| include | No | Sections to include; defaults to all. | |
| max_tree_entries | No | Maximum top-level entries; defaults to 100. |
read_fileARead-only
Read a UTF-8 text file with line and byte limits. Returns the file SHA-256; pass it back as "expected_sha256" when writing to detect concurrent changes.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Path relative to the workspace root, or an allowed absolute path. | |
| max_bytes | No | Maximum UTF-8 bytes to return. | |
| max_lines | No | Maximum lines to return. | |
| start_line | No | First line to return (1-based). | |
| line_numbers | No | Prefix each returned line with its 1-based number and a tab. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds useful behavioral detail: it returns the file SHA-256 to detect concurrent changes, and it enforces line/byte limits. This goes beyond the annotations without contradicting them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, with the core action front-loaded and the important SHA-256 workflow placed second. Every sentence earns its place; there is no filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only tool with fully documented parameters, the description covers the main return value, the SHA-256, and the concurrency use case. Since there is no output schema, more detail about the exact response format or defaults could be helpful, but the essentials are present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so every parameter is already documented in the schema with meaningful descriptions. The tool description adds no parameter-specific semantics beyond the general mention of line and byte limits, which matches the baseline of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool reads a UTF-8 text file, with specific constraints on line and byte limits. This distinguishes it from sibling tools like file_info or list_directory, which inspect metadata or directory entries rather than file contents.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for when to use this tool: whenever file content needs to be read. It also adds a concrete workflow hint, passing the returned SHA-256 back as expected_sha256 during writes, which helps coordinate with write_file. It does not explicitly name alternatives or exclusion cases, so it stops short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_filesRead-only
Read multiple UTF-8 text files in one bounded call. Each file keeps its own line/byte limits and SHA-256; failures are reported per file so one missing file does not discard the other reads.
| Name | Required | Description | Default |
|---|---|---|---|
| files | Yes | ||
| max_total_bytes | No | Combined returned content budget; defaults to 1 MiB. |
read_process_outputRead-only
Read captured stdout and stderr from a managed background process. Pass the previous "next_stdout_offset" and "next_stderr_offset" values as "since_stdout" and "since_stderr" to receive only new output, and "wait_ms" to block until output arrives or the process exits.
| Name | Required | Description | Default |
|---|---|---|---|
| pid | Yes | Process ID returned by start_process. | |
| wait_ms | No | Wait up to this long for new output or process exit. | |
| process_id | No | Opaque processId returned by start_process; detects stale PID references. | |
| since_stderr | No | Return stderr produced after this offset. | |
| since_stdout | No | Return stdout produced after this offset. |
restart_if_staleDestructive
Bounded mutation. Restarts the worker only when it demonstrably serves a stale build (worker-behind-dist or surface mismatch); no-op with a reason when fresh. Returns immediately; the restart lands seconds later, so poll runtime_info for the new worker. Refuses when unsupervised.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
runtime_execDestructive
Execute model-generated Python in a persistent IPython/Jupyter kernel. Variables, imports, and helper functions survive across calls sharing session_id. Use await tools.(...) or await call(name, args) for MCP capabilities, await describe() for the declared catalog, and result(value) to return structured data. The kernel is an unrestricted control environment, not a sandbox, so this tool is available only with --dangerously-open-machine.
| Name | Required | Description | Default |
|---|---|---|---|
| code | Yes | Python/IPython cell source. Top-level await is supported. Use result(value) for a structured result. | |
| max_calls | No | Maximum MCP capability calls from this cell; defaults to 32. | |
| session_id | No | Persistent kernel namespace. Defaults to default. State survives until reset, idle eviction, worker restart, or timeout termination. | |
| timeout_ms | No | Cell execution limit; defaults to 30000 ms. A timeout terminates the session to guarantee cleanup. | |
| allow_tools | No | Exact MCP capabilities callable from this cell. Defaults to all read-only capabilities. Mutating capabilities must be explicitly declared. | |
| reset_session | No | Terminate any existing kernel for session_id before executing this cell. | |
| max_output_bytes | No | Maximum captured stdout/stderr/display output for this cell; defaults to 1048576. |
runtime_infoRead-only
Read-only control-plane handshake: build commit/HEAD/staleBuild, worker PID/uptime, tunnel ownership, contract fingerprint, capability count, and the last control restart receipt.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
save_image_from_urlADestructive
Download an HTTPS PNG, JPEG, or WebP image to the machine. Blocks local and private hosts, limits redirects and size, and sends no cookies or credentials.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | HTTPS image URL. | |
| path | Yes | Destination image path. | |
| overwrite | No | Allow replacing an existing file; defaults to false. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description goes well beyond the annotations by disclosing specific behavioral safeguards: blocks local/private hosts, limits redirects and size, and sends no cookies or credentials. This gives an agent actionable expectations about network safety and auth behavior that annotations alone do not provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tightly packed sentences with no fluff: the first states the core action, the second lists the key constraints. Everything present earns its place and is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity, the annotations, and full schema coverage, the description is largely complete for an agent to understand the operation and safety profile. It does not describe return values or exact overrite behavior, but those are partially covered by the overwrite parameter and are minor gaps for a download tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already defines url, path, and overwrite. The description adds format context (PNG/JPEG/WebP) but does not materially extend the meaning of the parameters beyond what the schema states. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource—'Download an HTTPS PNG, JPEG, or WebP image to the machine'—making the tool's function unmistakable. It clearly distinguishes this network-download tool from local file tools like read_file or write_file in the sibling list.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when to use the tool: remote HTTPS images, not local or private hosts. It also implies exclusions by stating that credentialed or cookie-dependent URLs will not work. However, it does not explicitly name an alternative tool for those unsupported cases, so it falls short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_codeARead-only
Search file contents and return structured path, line, column, and text matches. Uses ripgrep when installed and falls back to a built-in scanner otherwise. Supports surrounding context lines, a per-file match cap, and a files-only mode for cheap surveys.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | File or directory to search; defaults to the workspace. | |
| globs | No | Include globs such as **/*.ts, or exclude globs prefixed with "!". | |
| literal | No | Treat pattern as literal text instead of a regular expression. | |
| pattern | Yes | Regular expression, or literal text when "literal" is true. | |
| files_only | No | Return only the list of matching file paths. | |
| timeout_ms | No | Search timeout in milliseconds. | |
| max_results | No | Maximum returned matches. | |
| context_lines | No | Lines of surrounding context to include with each match. | |
| case_sensitive | No | Use case-sensitive matching; defaults to true. | |
| max_matches_per_file | No | Stop after this many matches in each file. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so safety is covered. The description adds meaningful behavioral detail beyond annotations: ripgrep fallback to a built-in scanner, support for context lines, per-file cap, and files-only mode. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three concise sentences with no filler. The primary purpose is front-loaded, followed by relevant implementation behavior and a compact feature list. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only search tool with 10 params and no output schema, the description adequately conveys return format, implementation variance, and supported modes. It does not cover error/timeout behavior, but schema documents timeout_ms and max_results, so nothing critical is missing for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with every parameter documented in the input schema. The description mentions a few high-level features (context lines, per-file cap, files-only) but adds no new semantic detail beyond what the schema already provides, so the baseline score applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource ('Search file contents') and defines the structured output (path, line, column, text matches). It is immediately distinguishable from sibling tools like find_files, which searches filenames, and read_file, which reads specific files.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context: search file contents for code-level matches, and the files-only mode is positioned as a 'cheap survey' option. It does not explicitly name alternative tools or state when-not-to-use, but the core use case is unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
self_updateDestructive
Privileged autonomous update: requires MCP_ALLOW_SELF_UPDATE=1. Refuses on dirty tree, non-main branch, unpushed commits, divergence, or fetch failure. Otherwise fast-forward-only pull of origin/main, build, full verification, supervised restart, and a post-restart handshake receipt. Returns before the restart lands; poll runtime_info.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
shell_commandADestructive
Run a shell command inside the configured workspace root and wait for it to finish. Use start_process for anything long-running.
| Name | Required | Description | Default |
|---|---|---|---|
| env | No | Environment variables merged over the server environment. | |
| shell | No | ||
| stdin | No | Text written to the command standard input, which is then closed. | |
| command | Yes | Command to execute. | |
| workdir | No | Absolute path or path relative to the default workspace. | |
| on_timeout | No | Terminate on timeout (default), or keep running as a managed background process. | |
| timeout_ms | No | Timeout in milliseconds. | |
| expect_exit_code | No | Expected exit code; a different result is reported as an error. | |
| max_output_bytes | No | Maximum combined stdout/stderr bytes (1024-4194304). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Adds useful behavioral context beyond the annotations: the command is awaited synchronously, and long-running work should be delegated to start_process. The destructive/open-world/read-only hints are already covered by annotations, so the description doesn't need to restate them, though it doesn't detail output handling or exit code reporting.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences with no wasted words. The main behavior and workspace scope are front-loaded, and the important alternative is named immediately afterward.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 9 parameters and no output schema, the description is adequate but minimal: it defines workspace root and blocking behavior, while return values and output capture are left implicit. Annotations and schema compensate for destructive hints and timeout/exit-code options, but the absence of any return-semantics note leaves a gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema documents 8 of 9 parameters clearly, so description-level parameter explanation is largely unnecessary. The description adds no parameter-specific detail, but with 89% schema coverage the baseline of 3 is appropriate; only the 'shell' parameter lacks a description, and its enum values communicate the choices.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly names the action ('Run a shell command'), the scope ('inside the configured workspace root'), and the blocking behavior ('wait for it to finish'). It also distinguishes itself from the sibling start_process by explicitly recommending that tool for long-running commands.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit routing guidance: use this tool for short commands that finish normally, and 'Use start_process for anything long-running.' This directly addresses the most likely alternative and gives a clear selection condition.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
start_processADestructive
Start a background process inside the configured workspace and return its PID. Poll it with read_process_output.
| Name | Required | Description | Default |
|---|---|---|---|
| env | No | Environment variables merged over the server environment. | |
| shell | No | ||
| command | Yes | Command to run in the background. | |
| workdir | No | Working directory. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false, openWorldHint=true, and destructiveHint=true. The description adds that a PID is returned and that read_process_output should be used to poll output, but it does not elaborate on side effects, workspace constraints, or lifecycle cleanup.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences with no filler. The main action and return value are front-loaded, and the polling note is a concise, valuable addition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description usefully specifies that the tool returns a PID and points to read_process_output for consuming output. It is mostly complete, though it could mention process lifecycle aspects or failure modes, but those are reasonably inferable from the annotations and sibling tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already documents command, env, shell, and workdir with about 75% coverage. The description adds no per-parameter meaning beyond saying the command runs in the background; it correctly stays at the baseline because the schema covers most param semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: 'Start a background process inside the configured workspace' and states the key result, 'return its PID.' It is distinguishable from siblings like shell_command through the explicit 'background process' framing, though it does not name alternatives directly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives a useful follow-up instruction ('Poll it with read_process_output') and the phrase 'background process' implies use for long-running work. However, it does not explicitly explain when to choose this over shell_command, process_status, or stop_process, or mention any exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
stop_processDestructive
Stop a managed background process and its child tree by PID.
| Name | Required | Description | Default |
|---|---|---|---|
| pid | Yes | Process ID returned by start_process. | |
| process_id | No | Opaque processId returned by start_process; detects stale PID references. |
system_infoARead-only
Read operating-system, CPU, memory, uptime, Node.js, and host identity information without invoking a shell.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish read-only and non-destructive behavior. The description adds meaningful extra context by stating that no shell is invoked, which is a useful behavioral guarantee. It does not discuss response format, but for a no-parameter read-only info tool this is a minor omission.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that front-loads the action and lists all relevant data categories without extraneous wording. Every part of the sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no parameters and no input complexity, the description fully covers what the tool does, what data it returns conceptually, and a key safety/behavioral characteristic. Nothing essential is missing for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and schema coverage is effectively 100%, so there is nothing for the description to add about parameter meaning. The baseline of 4 for a zero-parameter tool is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Read') and enumerates exactly what is retrieved: operating-system, CPU, memory, uptime, Node.js, and host identity information. It also distinguishes itself from shell-based tools by explicitly stating it works without invoking a shell, which separates it from siblings like shell_command.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context: use this tool to obtain system-level identity and resource information without shell execution. It does not explicitly name alternatives like environment_info or machine_status, but the phrase 'without invoking a shell' implies a safe, read-only alternative to shell-based commands.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
todo_add
Create a persistent workspace todo in .pilot/todos.json. Todos survive Pilot restarts and can be linked to learning observations.
| Name | Required | Description | Default |
|---|---|---|---|
| tags | No | ||
| title | Yes | ||
| due_at | No | Optional ISO-8601 due date/time. | |
| priority | No | ||
| description | No |
todo_listRead-only
List persistent workspace todos with bounded status, tag, and text filters.
| Name | Required | Description | Default |
|---|---|---|---|
| tag | No | ||
| limit | No | ||
| query | No | ||
| status | No |
todo_update
Update a persistent todo, including status transitions to in_progress, done, or cancelled. Completed todos are retained as history rather than silently deleted.
| Name | Required | Description | Default |
|---|---|---|---|
| id | Yes | ||
| tags | No | ||
| title | No | ||
| due_at | No | ||
| status | No | ||
| priority | No | ||
| description | No |
update_fileADestructive
Replace an inclusive 1-based line range in an existing UTF-8 text file. Line numbers shift after every edit, so read the file again between updates.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Path relative to the workspace root, or an allowed absolute path. | |
| content | Yes | Replacement content; an empty string deletes the selected lines. | |
| end_line | Yes | Last line to replace (inclusive). | |
| start_line | Yes | First line to replace (1-based). | |
| expected_sha256 | No | Optional SHA-256 returned by a previous read or write. The call fails if the file changed since then. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true, and the description adds valuable beyond that: it warns that line numbers shift after every edit and that the target must be an existing UTF-8 text file. This gives the agent important behavioral expectations without contradicting the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no filler: the first states the core action and constraints, the second delivers the critical caveat about line shifts. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive line-range mutation, the description covers the operation, file constraints, and the freshness caveat. The schema covers parameter semantics and the optional SHA check. It does not explain edge cases like start_line > end_line or return values, but these are not essential given the schema and annotations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters thoroughly, including optional expected_sha256. The description adds the line-shift caveat, which is relevant to start_line/end_line usage, but does not provide additional per-parameter detail beyond what the schema offers.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific operation: replacing an inclusive, 1-based line range in an existing UTF-8 text file. This clearly distinguishes it from sibling tools like write_file, which writes whole files, and apply_patch, which applies patches.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description makes clear that the file must already exist and provides an important sequencing rule: read the file again between edits because line numbers shift. It does not explicitly mention alternatives or when not to use this tool, but the context is clear enough for an agent to decide when line-range editing is appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
verify_changesDestructive
Run the detected project verification pipeline with a fast, normal, or strict profile. This executes repository-defined build/test scripts but does not stage or commit files.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Project directory; defaults to the workspace. | |
| profile | No | Verification depth; defaults to normal. | |
| timeout_ms | No | Timeout per verification command. | |
| total_timeout_ms | No | Total verification budget across all checks; defaults to timeout_ms. Cleanup may take a bounded grace period. |
write_fileADestructive
Create a UTF-8 text file, or replace one when "overwrite" is true. Prefer edit_file or update_file for changes to an existing file.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Path relative to the workspace root, or an allowed absolute path. | |
| content | Yes | Complete UTF-8 file content. | |
| overwrite | No | Allow replacing an existing file; defaults to false. | |
| expected_sha256 | No | Optional SHA-256 returned by a previous read or write. The call fails if the file changed since then. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true, but the description adds meaningful behavior beyond that: it specifies UTF-8 encoding, create-or-replace semantics, and the condition under which replacement occurs. This is useful context not present in the annotations, though it does not elaborate on failure modes or the optimistic concurrency check beyond what the schema provides.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tightly written sentences with no filler. The primary purpose is stated first, the conditional behavior second, and the sibling guidance last. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the core semantics and guides tool selection, while annotations cover the safety profile and the schema covers all parameters. Minor gaps remain, such as failure behavior and the concurrency guarantee of expected_sha256, but these are adequately represented in structured fields and are not critical for an agent to invoke the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the schema already documents each parameter including the default of 'overwrite' and the purpose of 'expected_sha256'. The description adds no significant parameter-level detail beyond echoing 'overwrite' and 'content', so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description uses a specific verb ('Create') with a concrete resource ('UTF-8 text file') and clearly states the replace behavior conditional on 'overwrite'. It also distinguishes itself from siblings by directing changes to existing files toward edit_file or update_file. An agent can unambiguously understand this tool's role.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says 'Prefer edit_file or update_file for changes to an existing file', giving clear guidance on when not to use this tool and naming the alternatives. This directly helps an agent choose the right sibling tool without additional inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
33 tool updates
v1.2.1- Changed
apply_patch1 field changed- added
Input schema / properties / expected_sha256Added value: +{ + "additionalProperties": { + "pattern": "^[a-fA-F0-9]{64}$", + "type": "string" + }, + "description": "When supplied, must cover every updated/deleted source path with its read-time SHA-256.", + "type": "object" +}
- Added
capability_diff - Added
context_explain - Added
context_info - Added
exec_process - Added
git_commit_verified - Added
git_publish_paths - Added
git_remote_status - Added
learning_history - Added
learning_observe - Added
learning_promote - Added
learning_rollback - Added
machine_call - Added
machine_probe - Added
machine_read - Changed
machine_status3 fields changed- added
Input schema / properties / detailedAdded value: +{ + "description": "Include service, platform, dependency, governance, process-history, and tool-surface details.", + "type": "boolean" +} - changed
Input schema / properties / include / descriptionPrevious value: -"Optional bootstrap sections."New value: +"Optional expanded sections." - changed
Input schema / properties / include / items / enumPrevious value: -[ - "git", - "project" -]New value: +[ + "git", + "project", + "processes", + "tools" +]
- Added
machine_tools - Added
machines_list - Changed
process_status1 field changed- added
Input schema / properties / process_idAdded value: +{ + "description": "Opaque processId returned by start_process; detects stale PID references.", + "type": "string" +}
- Added
process_wait - Changed
process_write1 field changed- added
Input schema / properties / process_idAdded value: +{ + "description": "Opaque processId returned by start_process; detects stale PID references.", + "type": "string" +}
- Added
project_snapshot - Added
read_files - Changed
read_process_output1 field changed- added
Input schema / properties / process_idAdded value: +{ + "description": "Opaque processId returned by start_process; detects stale PID references.", + "type": "string" +}
- Added
restart_if_stale - Added
runtime_exec - Added
runtime_info - Added
self_update - Changed
stop_process1 field changed- added
Input schema / properties / process_idAdded value: +{ + "description": "Opaque processId returned by start_process; detects stale PID references.", + "type": "string" +}
- Added
todo_add - Added
todo_list - Added
todo_update - Added
verify_changes
35 tool updates
v1.0.0- First observed
apply_patch - First observed
audit_recent - First observed
audit_search - First observed
disk_info - First observed
edit_file - First observed
environment_info - First observed
file_info - First observed
find_files - First observed
git_add - First observed
git_branch - First observed
git_checkout - First observed
git_commit - First observed
git_diff - First observed
git_log - First observed
git_push - First observed
git_show - First observed
git_status - First observed
image_info - First observed
list_directory - First observed
list_ports - First observed
list_processes - First observed
machine_status - First observed
network_info - First observed
process_status - First observed
process_write - First observed
read_file - First observed
read_process_output - First observed
save_image_from_url - First observed
search_code - First observed
shell_command - First observed
start_process - First observed
stop_process - First observed
system_info - First observed
update_file - First observed
write_file
TDQS
Most tools have distinct scopes, but the file-mutation cluster (write_file, edit_file, update_file, apply_patch) creates real overlap, and machine_status/system_info plus list_processes/process_status add ambiguity. The detailed descriptions help, but an agent can still misselect among the four file-writing tools.
The set mixes conventions: verb_noun tools (list_directory, read_file, stop_process), noun_info tools (environment_info, system_info), git_* prefixed tools, and oddities like audit_recent and save_image_from_url. It remains readable, but it is not a single consistent naming pattern.
35 tools is well beyond the 25+ threshold and feels like a kitchen-sink utility server. Several tools are narrow, and the file-writing and git surfaces could be condensed without losing real capability.
The surface covers the file lifecycle, background process lifecycle, shell execution, code search, system inspection, and core Git workflow. Minor gaps exist—such as no direct delete_file and no git fetch/pull—but agents can generally work around them.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Operate Linux, macOS and Windows from your LLM. Every action runs through an auditable allowlist.
MCP connector that lets ChatGPT list, search, and run your Apple Shortcuts via a local Mac agent
Zero-setup MCP gateway securely connecting AI to your tools with authentication and workflows
Related MCP Servers
- FlicenseCqualityCmaintenanceEnables ChatGPT to control a Windows PC remotely via OpenAI Secure MCP Tunnel, executing file operations, PowerShell commands, and system actions through a local MCP server.15-
- AlicenseNot gradedqualityDmaintenanceEnables ChatGPT to securely control a local workstation via an MCP tunnel, exposing 44 tools for file/project editing, git, process supervision, browser automation, and Office document handling across macOS, Linux, and Windows.5MIT
- AlicenseAqualityBmaintenanceEnables ChatGPT web to use local tools like file reading, command execution, and patch application through an MCP server over OpenAI Secure MCP Tunnel.61MIT
- AlicenseAqualityCmaintenanceEnables ChatGPT web to interact with local Windows/WSL shell and code workspaces via an MCP server, providing file access, shell execution, and snapshot-based workspace management with per-command authorization.18MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/JonusNattapong/chatgpt-pilot'
If you have feedback or need assistance with the MCP directory API, please join our Discord server