Tunnel Manager
Tunnel Manager is an MCP server and agent for managing SSH host inventories, remote operations, and fleet-wide administration.
Manage host aliases: add, get, list, remove, load, and save SSH inventory hosts.
Run single-host SSH actions: execute commands, send/receive files, check SSH, test key auth, set up passwordless access, copy SSH config, rotate keys, and remove host keys.
Perform bulk inventory operations across YAML host groups: configure key auth, bootstrap mesh access, run commands with preview/single-host targeting, copy configs, rotate keys, and transfer files.
Track operation lifecycle: start operations, check progress, cancel, view metrics, and list sessions.
Gather remote system intelligence: host info, service discovery, log analysis, and network topology.
Perform advanced file operations on remote hosts: recursive copy/move/delete/list/chmod/chown, content search, watch, diff compare, and backup.
Run security checks: security audits, compliance checks, vulnerability scans, and access-control audits.
Ingest managed SSH inventory into an epistemic knowledge graph.
Expose tools through MCP with dynamic tool filtering, auth/entitlement controls, telemetry, and optional agent/web UI runtime.
Provides native OpenTelemetry exports for telemetry and tracing, allowing observability integration with OpenTelemetry-compatible backends.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Tunnel Manageradd host 'dev-server' with IP 192.168.1.10"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Tunnel Manager
CLI or API | MCP | Agent
Documentation — Installation, deployment, usage across the API, CLI, and MCP and agent interfaces are maintained in the official documentation.
Related MCP server: mcp-ssh
Overview
Tunnel Manager is a production-grade Agent and Model Context Protocol (MCP) server designed to interface directly with Create SSH Tunnels to the operator's remote hosts and host as an MCP Server for Agentic AI!.
Key Features
Consolidated Action-Routed MCP Tools: Minimizes token overhead and eliminates tool bloat in LLM contexts by grouping methods into optimized, togglable tool modules.
Enterprise-Grade Security: Complete support for Eunomia policies, OIDC token delegation, and granular execution context tracking.
Integrated Graph Agent: Built-in Pydantic AI agent supporting the Agent Control Protocol (ACP) and standard Web interfaces (AG-UI).
Native Telemetry & Tracing: Out-of-the-box OpenTelemetry exports and native Langfuse tracing.
CLI or API
This agent wraps the Create SSH Tunnels to the operator's remote hosts and host as an MCP Server for Agentic AI! API. The operator can interact with it programmatically or via its integrated execution entrypoints.
Detailed instructions on how to use the underlying API wrappers, extended schema bindings, and developer SDK references are maintained in docs/index.md.
MCP
This server use dynamic Action-Routed tools to optimize token overhead and maximize IDE compatibility.
Available MCP Tools
Auto-generated from the live MCP server — do not edit by hand.
Condensed action-routed tools (MCP_TOOL_MODE=condensed)
MCP Tool | Toggle Env Var | Description |
|
| Advanced file operations on remote hosts. |
|
| Manage the local host alias inventory. |
|
| Bulk inventory operations against YAML host groups. |
|
| Operation lifecycle and session management. |
|
| Single-host SSH operations with shared connection params. |
|
| Security scanning and compliance. |
|
| Remote system intelligence via SSH. |
|
| List the managed SSH inventory and push it into the epistemic-graph KG. |
Verbose 1:1 API-mapped tools (MCP_TOOL_MODE=verbose or both)
MCP Tool | Toggle Env Var | Description |
|
| Invoke the add_host operation. |
|
| Get a host config by alias, denying an alias the caller isn't entitled to. |
|
| List the host aliases the CALLER is entitled to, secrets redacted. |
|
| Invoke the load_inventory operation. |
|
| Invoke the remove_host operation. |
|
| Invoke the save_inventory operation. |
8 action-routed tool(s) · 6 verbose 1:1 tool(s). Each is enabled unless its <DOMAIN>TOOL toggle is set false; MCP_TOOL_MODE selects the surface (intent default — the six verb-tools, granular set loaded on demand · condensed action-routed · verbose 1:1 · both). Auto-generated — do not edit.
Detailed tool schemas, parameter shapes, and validation constraints are preserved in docs/usage.md.
Dynamic Tool Selection & Visibility
This MCP server supports dynamic toolset selection and visibility filtering at runtime. This allows the operator to restrict the set of exposed tools to prevent blowing up the LLM's context window.
The operator can configure tool filtering via multiple input channels:
CLI Arguments: Pass
--toolsor--toolsets(or their disabled counterparts--disabled-toolsand--disabled-toolsets) during startup.Environment Variables: Define standard environment variables:
MCP_ENABLED_TOOLS/MCP_DISABLED_TOOLSMCP_ENABLED_TAGS/MCP_DISABLED_TAGS
HTTP SSE Request Headers: Pass custom headers during transport initialization:
x-mcp-enabled-tools/x-mcp-disabled-toolsx-mcp-enabled-tags/x-mcp-disabled-tags
HTTP SSE Request Query Parameters: Append query parameters directly to the operator's transport connection URL:
?tools=tool1,tool2?tags=tag1
When query strings or parameters are supplied, an LLM-free Knowledge Graph resolution layer (using DynamicToolOrchestrator) matches query intents against known tool tags, names, or descriptions, with safe fallback and automated 24-hour background cache refreshing.
MCP Configuration Examples
Install the connector-focused
[mcp]extra. Examples usetunnel-manager[mcp]to add FastMCP / FastAPI throughscion-sdk[mcp]; the required Agent Utilities core still carriesepistemic-graph[full]. The[agent-runtime]extra additionally enables model orchestration.
stdio Transport (local IDEs — Cursor, Claude Desktop, VS Code)
{
"mcpServers": {
"tunnel-manager-mcp": {
"command": "uvx",
"args": [
"--from",
"tunnel-manager[mcp]",
"tunnel-manager-mcp"
],
"env": {
"MCP_TOOL_MODE": "intent",
"FILETOOL": "True",
"HOSTTOOL": "True",
"INGESTTOOL": "True",
"INVENTORYTOOL": "True",
"OPERATIONSTOOL": "True",
"REMOTETOOL": "True",
"SECURITYTOOL": "True",
"SYSTEMTOOL": "True",
"TUNNEL_IDENTITY_FILE": "~/.ssh/id_ed25519",
"TUNNEL_INVENTORY_GROUP": "all",
"TUNNEL_KG_INGEST": "true",
"TUNNEL_KNOWN_HOSTS": "~/.ssh/known_hosts",
"TUNNEL_MANAGER_HEALTH_AGGREGATE_S": "3600",
"TUNNEL_MANAGER_HEALTH_INGEST": "true",
"TUNNEL_MANAGER_HOSTS": "node-a,node-b,node-c,node-d",
"TUNNEL_MAX_THREADS": "6",
"TUNNEL_PARALLEL": "False",
"TUNNEL_REMOTE_PORT": "22"
}
}
}
}Runtime references require an alias-aware launcher such as Arbora. Other launchers must omit those entries and inject the resolved values through their own runtime secret boundary.
Streamable-HTTP Transport (networked / production)
{
"mcpServers": {
"tunnel-manager-mcp": {
"command": "uvx",
"args": [
"--from",
"tunnel-manager[mcp]",
"tunnel-manager-mcp",
"--transport",
"streamable-http",
"--port",
"8000"
],
"env": {
"TRANSPORT": "streamable-http",
"HOST": "127.0.0.1",
"PORT": "8000",
"MCP_TOOL_MODE": "intent",
"FILETOOL": "True",
"HOSTTOOL": "True",
"INGESTTOOL": "True",
"INVENTORYTOOL": "True",
"OPERATIONSTOOL": "True",
"REMOTETOOL": "True",
"SECURITYTOOL": "True",
"SYSTEMTOOL": "True",
"TUNNEL_IDENTITY_FILE": "~/.ssh/id_ed25519",
"TUNNEL_INVENTORY_GROUP": "all",
"TUNNEL_KG_INGEST": "true",
"TUNNEL_KNOWN_HOSTS": "~/.ssh/known_hosts",
"TUNNEL_MANAGER_HEALTH_AGGREGATE_S": "3600",
"TUNNEL_MANAGER_HEALTH_INGEST": "true",
"TUNNEL_MANAGER_HOSTS": "node-a,node-b,node-c,node-d",
"TUNNEL_MAX_THREADS": "6",
"TUNNEL_PARALLEL": "False",
"TUNNEL_REMOTE_PORT": "22"
}
}
}
}Alternatively, connect to a pre-deployed Streamable-HTTP instance by url:
{
"mcpServers": {
"tunnel-manager-mcp": {
"url": "http://localhost:8000/tunnel-manager-mcp/mcp"
}
}
}Run a reviewed container image as a least-privilege stdio child (no listener or published port):
docker run -i --rm \
--read-only \
--cap-drop=ALL \
--security-opt=no-new-privileges \
--pids-limit=256 \
--tmpfs /tmp:rw,noexec,nosuid,nodev,size=64m \
-e TRANSPORT=stdio \
-e MCP_TOOL_MODE=intent \
-e FILETOOL=True \
-e HOSTTOOL=True \
-e INGESTTOOL=True \
-e INVENTORYTOOL=True \
-e OPERATIONSTOOL=True \
-e REMOTETOOL=True \
-e SECURITYTOOL=True \
-e SYSTEMTOOL=True \
-e TUNNEL_IDENTITY_FILE=~/.ssh/id_ed25519 \
-e TUNNEL_INVENTORY_GROUP=all \
-e TUNNEL_KG_INGEST=true \
-e TUNNEL_KNOWN_HOSTS=~/.ssh/known_hosts \
-e TUNNEL_MANAGER_HEALTH_AGGREGATE_S=3600 \
-e TUNNEL_MANAGER_HEALTH_INGEST=true \
-e TUNNEL_MANAGER_HOSTS=node-a,node-b,node-c,node-d \
-e TUNNEL_MAX_THREADS=6 \
-e TUNNEL_PARALLEL=False \
-e TUNNEL_REMOTE_PORT=22 \
registry.example.invalid/tunnel-manager@sha256:<digest> tunnel-manager-mcpFor containerized network HTTP, supply an authenticated TLS ingress (or
direct server TLS), exact MCP_ALLOWED_HOSTS, and an exact trusted-proxy
CIDR policy through the operator-owned deployment profile. The generator
does not emit an unauthenticated non-loopback listener.
Identity and host entitlements
Over stdio, and over HTTP started with --auth-type none (for example behind
arbora), every caller is the trusted local actor and reaches every inventory
alias. With auth configured, a caller reaches only the aliases its roles or
groups grant (ssh:<alias>, ssh:* or admin). A refusal names its cause:
anonymous caller, unauthenticated, no tenant, or not entitled to ssh:<alias>.
See scion-sdk's connector servers: caller identity.
Auto-generated from the code-read env surface (MCP_TOOL_MODE + package vars) — do not edit.
Additional Deployment Options
tunnel-manager can run as a local stdio process or container, or behind a remote
network boundary. The
Deployment guide carries
the detailed transport contract.
Local container — launch a reviewed immutable image as a least-privilege stdio child with no listener or published port.
Remote URL — connect through an operator-supplied authenticated HTTPS ingress. Keep its URL, outbound identity references, trust profile, and exact
MCP_ALLOWED_HOSTSinAgentConfig.
Inventory
tunnel-manager works from a single shared YAML inventory that maps short host
aliases (e.g. edge-node) to their SSH connection details. Every ecosystem surface reads
the same file — the HostManager API, the tunnel-manager CLI, the MCP server,
container-manager-mcp (its cm_* host aliases), and the ssh-bootstrap skill — so
the operator define the operator's fleet once.
Location —
~/.config/scion-sdk/inventory.yml(.ymlpreferred). A legacyinventory.yamlat the same path is still read when no.ymlexists, so existing installs keep working. Override withTUNNEL_INVENTORY.Manage it with the
inventorysubcommand:tunnel-manager inventory init # write a commented inventory.yml template (--force to overwrite) tunnel-manager inventory doctor # validate hosts/groups; --fix migrates legacy .yaml -> .yml tunnel-manager inventory show # print the resolved path + host/group summary
Full schema, every host field, the copy-paste template, and override options live in the Inventory guide.
Environment Variables
Package environment variables
Variable | Example | Description |
|
| |
|
| |
|
| options: stdio, streamable-http, sse |
|
| |
|
| |
| secret-injected | |
| secret-injected | |
|
| |
|
| options: none, embedded, remote |
|
| |
|
| |
|
| |
|
| |
|
| |
| — | default remote host (e.g. 198.51.100.10) |
|
| default SSH port |
| — | default SSH username |
| — | env://, vault://, secret://, or sqlite:// reference |
|
| independently verified server host keys |
| — | path to an SSH certificate file |
| — | SSH ProxyCommand for jump-host/bastion connections |
| — | path to the inventory file (defaults to XDG config path) |
|
| inventory host group to target |
|
| run host operations in parallel |
|
| max worker threads when TUNNEL_PARALLEL=True |
|
| |
|
| |
|
| |
|
| |
|
| |
| — | base config dir (defaults to ~/.config) for inventory resolution |
|
| Grouped condensed-surface toggles, one per register__tools registrar. |
|
| |
|
| |
|
| |
|
| |
|
| |
|
| |
|
| KG-ingest tools (list the SSH inventory into epistemic-graph) |
|
| default-on best-effort inventory ingest on |
|
| default-on best-effort network-signal trend ingestion |
|
| window (s) over which samples distill to ONE :HealthTrend node/host/signal |
|
| comma-separated inventory aliases to probe/derive over (default: full inventory) |
| — | best-effort webhook for network-anomaly notifications |
Inherited scion-sdk variables (apply to every connector)
Variable | Example | Description |
|
| Tool surface: |
| — | Comma-separated tool allow-list |
| — | Comma-separated tool deny-list |
| — | Comma-separated tag allow-list |
| — | Comma-separated tag deny-list |
| — | Outbound MCP child auth: |
| — | OIDC client id (service-account auth) |
|
| Runtime secret reference for the OIDC service account |
| — | HTTP Basic username ( |
|
| Runtime secret reference for HTTP Basic auth ( |
|
| URL of the MCP server the agent connects to |
|
| LLM provider for the agent |
|
| Model id for the agent |
|
| Serve the AG-UI web interface |
44 package + 14 inherited variable(s). Auto-generated from .env.example + the shared scion-sdk set — do not edit.
Every variable the server reads, grouped by purpose. See .env.example
for a copy-paste starting point.
SSH connection & credentials
Variable | Description | Default |
| Path to the SSH private key |
|
| SSH username | — |
|
| — |
| Independently checked SSH server-key trust store |
|
| Path to an SSH certificate | — |
| Default remote host | — |
| Default remote SSH port |
|
| SSH | — |
Inventory & parallelism
Variable | Description | Default |
| Path to the shared inventory ( |
|
| Default inventory host group | — |
| Run bulk operations in parallel | — |
| Max concurrent SSH worker threads | — |
| Base config dir used to resolve the inventory |
|
MCP server / transport
Variable | Description | Default |
|
|
|
| Bind host (HTTP transports) |
|
| Bind port (HTTP transports) |
|
| Tool surface: |
|
| Comma-separated tool allow/deny list | — |
| Comma-separated tag allow/deny list | — |
| Verbose logging |
|
| Unbuffered stdout (recommended in containers) |
|
Tool toggles
Each action-routed tool can be disabled individually via its toggle env var (set to false).
The full list is in the Available MCP Tools table above
(HOSTTOOL, REMOTETOOL, INVENTORYTOOL, OPERATIONSTOOL,
SYSTEMTOOL, FILETOOL, SECURITYTOOL).
Telemetry & governance
Variable | Description | Default |
| Enable OpenTelemetry export |
|
| OTLP collector endpoint | — |
| OTLP auth keys | — |
| OTLP protocol (e.g. | — |
| Authorization mode: |
|
| Embedded policy file |
|
| Remote Eunomia server URL | — |
Agent runtime (full [agent] runtime only)
Variable | Description | Default |
| URL of the MCP server the agent connects to |
|
| LLM provider (e.g. |
|
| Model id (e.g. |
|
| Serve the AG-UI web interface |
|
Agent
This repository features a fully integrated Pydantic AI Graph Agent. It communicates over the Agent Control Protocol (ACP) and interacts smoothly with the Agent Web UI (AG-UI) and Terminal interface.
Running the Agent CLI
To start the interactive command-line agent:
# Set credentials
export TUNNEL_IDENTITY_FILE="your_value"
export DEBUG="your_value"
export PYTHONUNBUFFERED="your_value"
# Run the agent server
tunnel-manager-agent --provider openai --model-id gpt-4oDocker Compose Orchestration
The following docker/agent.compose.yml configures the Agent, Web UI, and Terminal Interface together:
version: '3.8'
services:
tunnel-manager-mcp:
image: example/tunnel-manager:mcp
container_name: tunnel-manager-mcp
hostname: tunnel-manager-mcp
restart: always
env_file:
- ../.env
environment:
- PYTHONUNBUFFERED=1
- HOST=0.0.0.0
- PORT=8000
- TRANSPORT=streamable-http
ports:
- "8000:8000"
healthcheck:
test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')"]
interval: 30s
timeout: 10s
retries: 3
start_period: 10s
logging:
driver: json-file
options:
max-size: "10m"
max-file: "3"
tunnel-manager-agent:
image: example/tunnel-manager@sha256:<digest>
container_name: tunnel-manager-agent
hostname: tunnel-manager-agent
restart: always
depends_on:
- tunnel-manager-mcp
env_file:
- ../.env
command: [ "tunnel-manager-agent" ]
environment:
- PYTHONUNBUFFERED=1
- HOST=0.0.0.0
- PORT=9002
- MCP_URL=http://tunnel-manager-mcp:8000/mcp
- PROVIDER=${PROVIDER:-openai}
- MODEL_ID=${MODEL_ID:-gpt-4o}
- ENABLE_WEB_UI=True
- ENABLE_OTEL=True
ports:
- "9002:9002"
healthcheck:
test: ["CMD", "python3", "-c", "import urllib.request; urllib.request.urlopen('http://localhost:9002/health')"]
interval: 30s
timeout: 10s
retries: 3
start_period: 10s
logging:
driver: json-file
options:
max-size: "10m"
max-file: "3"
Detailed graph node architecture explanations, custom skill configurations, and agentic trace guides are available in docs/deployment.md.
Security & Governance
Built directly upon the enterprise-ready scion-sdk core, standard security parameters are fully supported:
Access Control & Policy Enforcement
Eunomia Policies: Fine-grained, policy-driven tool authorization. Supports
none, localembedded(mcp_policies.json), or centralizedremotemodes.OIDC Token Delegation: Compliant with RFC 8693 token exchange for flowing authenticating user credentials from Web UI / ACP → Agent → MCP.
Scoped Credentials: Execution context runs restricted to the specific caller identity.
Runtime Security Grid
Feature | Feature | Enablement |
Tool Guard | Sensitivity inspection with human-in-the-loop validation | Enabled by default |
Prompt Injection Defense | Input scanning, repetition monitoring, and recursive loop blocks | Enabled by default |
Context Safety Guard | Stuck-loop detectors and contextual overflow preemptive alerts | Enabled by default |
Installation
Pick the extra that matches what the operator want to run:
Extra | Installs | Use when |
| Connector-focused MCP server ( | The operator only run the MCP server (smallest install / image) |
| Agent runtime ( | The operator run the integrated agent |
| Everything ( | Development / both surfaces |
# Connector-focused MCP server (includes the shared graph engine)
uv pip install "tunnel-manager[mcp]"
# Agent runtime (adds model orchestration to the shared graph engine)
uv pip install "tunnel-manager[agent]"
# Everything (development)
uv pip install "tunnel-manager[all]" # or: python -m pip install "tunnel-manager[all]"Container images (:mcp vs :agent)
One multi-stage docker/Dockerfile builds two right-sized images, selected by --target:
Image tag | Build target | Contents | Entrypoint |
|
|
|
|
|
|
|
|
docker build --target mcp -t example/tunnel-manager:mcp docker/ # connector-focused MCP server
docker build --target agent -t example/tunnel-manager:agent-local docker/ # agent runtimedocker/mcp.compose.yml runs the connector-focused :mcp server; docker/agent.compose.yml runs the
agent (immutable agent digest) with a co-located :mcp sidecar.
Knowledge-graph database (epistemic-graph)
Both [mcp] and [agent] carry the epistemic-graph engine through the required
Agent Utilities core dependency (epistemic-graph[full]). The [mcp] extra keeps
the server connector-focused; [agent] also enables model orchestration. Local
deployments can use the bundled engine. For production or shared state, run
epistemic-graph as a dedicated database service and configure the runtime to use it.
Deployment recipes (single-node + Raft HA), connection configuration, and architecture
diagrams are documented in the
epistemic-graph deployment guide.
Documentation
The complete documentation is published as the official documentation site and is the recommended reference for installation, deployment, and day-to-day operation.
Page | Contents |
pip, source, extras, prebuilt Docker image | |
the shared | |
run the MCP and agent servers, Compose, Caddy + Technitium, env config | |
the MCP tools, the | |
ecosystem role, distributed SSH swarm scaling, MCP configuration | |
certificate, proxy and cross-OS connection model | |
concept registry ( |
AGENTS.md is the canonical contributor/agent guidance.
Maintainers
Maintained by the project contributor team. Package metadata intentionally uses a role address rather than personal identity.
Contribute
Contributions are welcome! Please ensure code quality by running local checks before submitting pull requests:
Format code using
ruff format .Lint code using
ruff check .Validate type-safety with
mypy .Run test suites using
pytest
Deploy with scion-sdk-deployment
Provision this package with the consolidated scion-sdk-deployment
workflow. It selects an installed-package, editable-source, or immutable-container
path; records only runtime secret and TLS-profile references in AgentConfig; and
runs doctor, registration, policy, observability, and rollback gates. Ask your agent
to "deploy tunnel-manager with scion-sdk-deployment".
Install mode | Command |
Installed package |
|
Editable source |
|
Immutable container | deploy |
The repository embeds no deployment profile, credential value, certificate path, or
environment-specific endpoint. Supply those at runtime through AgentConfig and the
configured secret provider.
Governed capability contract
This package ships a compact canonical skill surface with specialist procedures
kept as referenced workflows. The current MCP tools, skill metadata,
connector_manifest.yml, ontology, mappings, shapes, fixtures, migrations,
tool-schema fingerprints, and certification metadata form one versioned
capability contract. Validate them together; do not rely on stale tool names or
historical per-task skill wrappers.
Runtime endpoints, credentials, certificate trust, tenant identity, retention, and observability policy are deployment inputs and are never packaged values. See Configuration, trust, and privacy before enabling a network transport, connector ingestion, Arbora delegation, or trace export.
Available Tools
41 toolstm_file_backupBackupC
Backup (tm_files). Advanced file operations on remote hosts.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | Permission mode (recursive_ops/chmod). | 755 |
| group | No | Group (recursive_ops/chown). | |
| host1 | No | First host (diff_compare). | |
| host2 | No | Second host (diff_compare). | |
| owner | No | Owner (recursive_ops/chown). | |
| source | No | Source path (recursive_ops). | |
| pattern | No | Search pattern (content_search). | |
| duration | No | Monitor duration secs (watch). | |
| username | No | SSH username. | |
| file_path | No | File path to compare (diff_compare). | |
| operation | No | Operation type: copy, move, delete, list, chmod, chown (recursive_ops). | |
| recursive | No | Recursive search (content_search). | |
| backup_dest | No | Backup destination (backup). | |
| compression | No | Enable compression (backup). | |
| destination | No | Destination path (recursive_ops/copy/move). | |
| incremental | No | Incremental backup (backup). | |
| max_results | No | Max results (content_search). | |
| remote_host | No | Remote host. | |
| watch_paths | No | Paths to monitor (watch). | |
| backup_paths | No | Paths to backup (backup). | |
| password_ref | No | Runtime secret reference for the SSH password. | |
| search_paths | No | Directories to search (content_search). | |
| identity_file | No | SSH identity file path. | |
| case_sensitive | No | Case-sensitive (content_search). |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly=false, openWorld=true, idempotent=false, destructive=false, so the safety profile is covered. The description adds nothing beyond that: it does not say whether a backup overwrites existing archives, where it runs, whether it requires credentials, or how long it may take on large trees.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is very short, but the second sentence is generic filler that adds no usable information, and the useful signal (that this backs up files) is not expanded at all. Brevity here is under-specification rather than efficiency.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
A complex, 24-parameter, open-world mutation tool with no required params and no output explanation needed (output schema exists) still requires the description to state what gets backed up, from where, to where, and under what auth — none of which is present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the 24 parameters are documented individually and the baseline is 3. However, the description does nothing to disambiguate the mixed-operation parameter set (backup_paths, backup_dest, compression, incremental vs. content_search/watch/diff params) — a real missed opportunity given how confusing the schema is.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The title/name is restated ("Backup (tm_files)") and the only elaboration, "Advanced file operations on remote hosts," describes the whole tm_file_* family rather than this tool. An agent cannot tell from this text how backup differs from tm_file_recursive_ops or tm_remote_send_file.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use statement, no mention of alternatives such as tm_remote_send_file for a one-off transfer, and no stated prerequisites (SSH connectivity, remote_host/username requirements). The agent must infer everything from the name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tm_file_content_searchContent SearchCRead-onlyIdempotent
Content search (tm_files). Advanced file operations on remote hosts.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | Permission mode (recursive_ops/chmod). | 755 |
| group | No | Group (recursive_ops/chown). | |
| host1 | No | First host (diff_compare). | |
| host2 | No | Second host (diff_compare). | |
| owner | No | Owner (recursive_ops/chown). | |
| source | No | Source path (recursive_ops). | |
| pattern | No | Search pattern (content_search). | |
| duration | No | Monitor duration secs (watch). | |
| username | No | SSH username. | |
| file_path | No | File path to compare (diff_compare). | |
| operation | No | Operation type: copy, move, delete, list, chmod, chown (recursive_ops). | |
| recursive | No | Recursive search (content_search). | |
| backup_dest | No | Backup destination (backup). | |
| compression | No | Enable compression (backup). | |
| destination | No | Destination path (recursive_ops/copy/move). | |
| incremental | No | Incremental backup (backup). | |
| max_results | No | Max results (content_search). | |
| remote_host | No | Remote host. | |
| watch_paths | No | Paths to monitor (watch). | |
| backup_paths | No | Paths to backup (backup). | |
| password_ref | No | Runtime secret reference for the SSH password. | |
| search_paths | No | Directories to search (content_search). | |
| identity_file | No | SSH identity file path. | |
| case_sensitive | No | Case-sensitive (content_search). |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, openWorldHint=true, and destructiveHint=false. The description adds only the vague notion of 'advanced file operations on remote hosts' and does not disclose authentication needs, parameter scoping, or which operations the tool actually performs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The definition is short and front-loads 'Content search,' but the second sentence is generic and arguably misleading given the tool's focused name. It is concise, but at the cost of useful specificity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a complex 24-parameter tool with zero required parameters, many parameters belonging to unrelated operations, and no description of SSH/auth expectations. An output schema exists, so return values need not be explained, but the description still does not provide enough context to call the tool confidently.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema itself documents every parameter. The description adds no parameter semantics, and it does not clarify why a content-search tool exposes parameters for backup, diff, watch, and recursive file operations.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description identifies content search in parentheses and mentions remote hosts, but it immediately broadens to 'Advanced file operations,' which is vague and does not distinguish this tool from adjacent file-operation siblings such as tm_file_recursive_ops, tm_file_watch, tm_file_diff_compare, and tm_file_backup.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit guidance on when to use this tool versus alternatives, no prerequisites, and no exclusions. The name implies content search, but the description never says how that differs from the other file-system siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tm_file_diff_compareDiff CompareCRead-onlyIdempotent
Diff compare (tm_files). Advanced file operations on remote hosts.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | Permission mode (recursive_ops/chmod). | 755 |
| group | No | Group (recursive_ops/chown). | |
| host1 | No | First host (diff_compare). | |
| host2 | No | Second host (diff_compare). | |
| owner | No | Owner (recursive_ops/chown). | |
| source | No | Source path (recursive_ops). | |
| pattern | No | Search pattern (content_search). | |
| duration | No | Monitor duration secs (watch). | |
| username | No | SSH username. | |
| file_path | No | File path to compare (diff_compare). | |
| operation | No | Operation type: copy, move, delete, list, chmod, chown (recursive_ops). | |
| recursive | No | Recursive search (content_search). | |
| backup_dest | No | Backup destination (backup). | |
| compression | No | Enable compression (backup). | |
| destination | No | Destination path (recursive_ops/copy/move). | |
| incremental | No | Incremental backup (backup). | |
| max_results | No | Max results (content_search). | |
| remote_host | No | Remote host. | |
| watch_paths | No | Paths to monitor (watch). | |
| backup_paths | No | Paths to backup (backup). | |
| password_ref | No | Runtime secret reference for the SSH password. | |
| search_paths | No | Directories to search (content_search). | |
| identity_file | No | SSH identity file path. | |
| case_sensitive | No | Case-sensitive (content_search). |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false and openWorldHint=true, so the safety profile is covered. The description adds nothing beyond that – no mention of SSH auth requirements (username, identity_file, password_ref), no disclosure of what a diff returns or how hosts are reached. "Advanced file operations" is loose enough to imply mutation, which sits awkwardly against readOnlyHint=true, though it never explicitly claims a write.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, so it is not bloated, but the second sentence earns nothing and actively dilutes the diff-compare focus. Front-loading is fine; the content is the problem, not the length.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 24 optional parameters drawn from six different operations and no required fields, the agent needs the description to say which subset applies to diff compare and what the comparison result looks like. An output schema and annotations exist, which relieves some burden, but the description still leaves the core calling pattern unexplained.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all 24 parameters and the baseline is 3. The description's only gesture toward parameters is "remote hosts," which hints at host1/host2 but adds no real semantics. Notably it does not disambiguate the union schema – an agent must infer from the schema's own parentheticals that only host1, host2, and file_path matter here.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
"Diff compare (tm_files)" simply restates the tool name, and the follow-on "Advanced file operations on remote hosts" is a vague catch-all that gives no specific verb+resource beyond the title. It never says what is compared (host1 vs host2, or file_path across hosts), so an agent learns nothing it didn't already get from the name.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance at all, despite a dense sibling set (tm_file_recursive_ops, tm_file_content_search, tm_file_watch, tm_file_backup) that all share this same 24-parameter union schema. Nothing tells the agent to pick this tool for host-to-host diffing rather than the other tm_file_* tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tm_file_recursive_opsRecursive OpsC
Recursive ops (tm_files). Advanced file operations on remote hosts.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | Permission mode (recursive_ops/chmod). | 755 |
| group | No | Group (recursive_ops/chown). | |
| host1 | No | First host (diff_compare). | |
| host2 | No | Second host (diff_compare). | |
| owner | No | Owner (recursive_ops/chown). | |
| source | No | Source path (recursive_ops). | |
| pattern | No | Search pattern (content_search). | |
| duration | No | Monitor duration secs (watch). | |
| username | No | SSH username. | |
| file_path | No | File path to compare (diff_compare). | |
| operation | No | Operation type: copy, move, delete, list, chmod, chown (recursive_ops). | |
| recursive | No | Recursive search (content_search). | |
| backup_dest | No | Backup destination (backup). | |
| compression | No | Enable compression (backup). | |
| destination | No | Destination path (recursive_ops/copy/move). | |
| incremental | No | Incremental backup (backup). | |
| max_results | No | Max results (content_search). | |
| remote_host | No | Remote host. | |
| watch_paths | No | Paths to monitor (watch). | |
| backup_paths | No | Paths to backup (backup). | |
| password_ref | No | Runtime secret reference for the SSH password. | |
| search_paths | No | Directories to search (content_search). | |
| identity_file | No | SSH identity file path. | |
| case_sensitive | No | Case-sensitive (content_search). |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false, openWorldHint=true, idempotentHint=false, destructiveHint=false, so the safety profile is partly covered. The description adds nothing beyond that: it doesn't say the operations run over SSH, that credentials come from username/identity_file/password_ref, or that some operations (delete, move) mutate or remove remote files. Given destructive operations are reachable, silence on irreversibility is a real gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The two fragments are short but not concise in the useful sense: for a 24-parameter, multi-operation surface there is no structure, no grouping by operation, and no front-loaded statement of the primary mode. It is under-specification rather than economy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 24-parameter tool that multiplexes copy/move/delete/list/chmod/chown plus search, backup, diff, and watch parameters, two sentences of boilerplate leave an agent without the information needed to call it correctly. The output schema covers return values, but the selection logic across operations is entirely absent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3; each parameter is already tagged in the schema with the sub-operation it belongs to (recursive_ops, content_search, backup, diff_compare, watch). The description adds no meaning on top of that, notably not explaining that 'operation' is the discriminator that determines which of the 24 parameters matter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
"Recursive ops (tm_files). Advanced file operations on remote hosts." mostly restates the tool name and title; "advanced file operations" names no specific verb or resource scope. An agent cannot tell from this whether the tool copies, deletes, chmods, or backs up, and cannot distinguish it from siblings such as tm_file_backup or tm_file_content_search, which the schema itself shows are folded in here.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no prerequisites, and no mention of any alternative tool. With a dozen siblings covering file search, backup, diff, watch, and remote file transfer, the description offers no basis for routing a request to this tool rather than those.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tm_file_watchWatchC
Watch (tm_files). Advanced file operations on remote hosts.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | Permission mode (recursive_ops/chmod). | 755 |
| group | No | Group (recursive_ops/chown). | |
| host1 | No | First host (diff_compare). | |
| host2 | No | Second host (diff_compare). | |
| owner | No | Owner (recursive_ops/chown). | |
| source | No | Source path (recursive_ops). | |
| pattern | No | Search pattern (content_search). | |
| duration | No | Monitor duration secs (watch). | |
| username | No | SSH username. | |
| file_path | No | File path to compare (diff_compare). | |
| operation | No | Operation type: copy, move, delete, list, chmod, chown (recursive_ops). | |
| recursive | No | Recursive search (content_search). | |
| backup_dest | No | Backup destination (backup). | |
| compression | No | Enable compression (backup). | |
| destination | No | Destination path (recursive_ops/copy/move). | |
| incremental | No | Incremental backup (backup). | |
| max_results | No | Max results (content_search). | |
| remote_host | No | Remote host. | |
| watch_paths | No | Paths to monitor (watch). | |
| backup_paths | No | Paths to backup (backup). | |
| password_ref | No | Runtime secret reference for the SSH password. | |
| search_paths | No | Directories to search (content_search). | |
| identity_file | No | SSH identity file path. | |
| case_sensitive | No | Case-sensitive (content_search). |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already state readOnlyHint=false, idempotentHint=false, openWorldHint=true, so the safety profile is partly covered, but the description adds nothing: it doesn't explain that watching monitors paths for a duration, what triggers a result, whether the session blocks, or what credentials are needed (username/identity_file/password_ref in the schema go unmentioned).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is short and front-loaded, but the second sentence ("Advanced file operations on remote hosts") is filler that doesn't earn its place and arguably mischaracterizes a watching tool as a general file-operations tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
A 24-parameter tool with an output schema and openWorld/destructive annotations needs the description to at least explain the watch behavior and scope; instead it supplies one tautology and one generic clause, leaving an agent unable to tell what this call actually does.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds no meaning, and given the schema is a 24-parameter union spanning watch/recursive_ops/backup/diff/search, guidance on which parameters apply to Watch (watch_paths, duration, remote_host) would have been highly valuable.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
"Watch (tm_files)" essentially restates the tool name and title, and "Advanced file operations on remote hosts" is a vague generic phrase that describes the whole tm_file_* family, not this tool. Nothing distinguishes watching files from siblings like tm_file_diff_compare, tm_file_backup, or tm_file_content_search.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No indication of when to use Watch instead of the many sibling file tools, no prerequisites, and no exclusions. The only implied context is the generic "remote hosts," which applies equally to every sibling.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tm_inventory_configure_key_authConfigure Key AuthC
Configure key auth (tm_inventory). Bulk inventory operations against YAML host groups.
| Name | Required | Description | Default |
|---|---|---|---|
| cfg | No | Local SSH config path (copy_ssh_config). | |
| cmd | No | Shell command (run_command). | |
| key | No | Shared key path (configure_key_auth). | /app/.ssh/id_ed25519 |
| host | No | run_command only. Optional single-host alias to target instead of the whole 'group' fan-out — the safe way to reach ONE inventory host (e.g. 'gb10') without running against 'homelab'. Resolved and authorized through the same alias store tm_remote/tm_hosts use, so the two are one source of truth: an unknown or unauthorized alias is rejected outright, never silently skipped. Takes precedence over 'group' when set. | |
| group | No | Target group. | all |
| lpath | No | Local file path (send_file). | |
| rpath | No | Remote file path (send_file/receive_file). | |
| key_pfx | No | Prefix for new keys (rotate_key). | /root/.ssh/id_ |
| preview | No | run_command only. If true, resolve the exact target host(s) for 'host'/'group' and return them in 'resolved_hosts' WITHOUT running 'cmd' — lets a caller verify scope before executing for real (no surprise fan-out). The real (non-preview) response also always includes 'resolved_hosts' for the same reason. | |
| rmt_cfg | No | Remote config path (copy_ssh_config). | /root/.ssh/config |
| timeout | No | Command timeout in seconds. | |
| key_type | No | Key type: rsa or ed25519. | ed25519 |
| parallel | No | Run parallel. | |
| inventory | No | YAML inventory path (default: $XDG_CONFIG_HOME/agent-connectors/inventory.yaml). | /root/.config/agent-connectors/inventory.yml |
| max_threads | No | Max threads. | |
| lpath_prefix | No | Local dir prefix (receive_file). |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations declare readOnlyHint=false, openWorldHint=true, idempotentHint=false, and destructiveHint=false, but the description adds nothing to them: it never states that SSH keys are written to files or hosts, that a target group is contacted over the network, whether existing keys are overwritten, or what authorization is needed. Its second sentence even broadens the claimed scope to 'bulk inventory operations', which is a different behavior from key auth.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is only two short sentences, so it has no verbosity problem. However, the second sentence is generic family boilerplate that conflicts with the operation name, so it does not earn its place and actively misdirects rather than front-loading useful scope.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 16-parameter, multi-mode tool that writes SSH keys into an inventory, two sentences are far too thin. The output schema exists, so return values need not be explained, but the description still omits which parameter selects which operation and what the tool actually changes on disk or across hosts.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the schema's parameter text (notably for 'host' and 'preview') is far richer than the description, so the baseline of 3 applies. The description adds nothing about parameter semantics and does not explain the multi-operation dispatch that its 16 flat parameters imply.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The first sentence, "Configure key auth (tm_inventory)," simply restates the tool name and title. The second sentence, "Bulk inventory operations against YAML host groups," describes the whole inventory tool family rather than this key-auth operation, and it conflicts with the name; it does not distinguish this tool from siblings such as tm_inventory_rotate_key, tm_inventory_copy_ssh_config, tm_remote_setup_passwordless, or tm_remote_test_key_auth.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description contains no when-to-use guidance, no prerequisites, and no named alternative. Nothing tells the agent why it would pick this over tm_remote_test_key_auth or tm_remote_setup_passwordless, and it never explains that the 16 parameters are mode-selecting (key vs cmd vs cfg vs lpath), so an agent cannot infer what to call from the text.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tm_inventory_copy_ssh_configCopy Ssh ConfigC
Copy ssh config (tm_inventory). Bulk inventory operations against YAML host groups.
| Name | Required | Description | Default |
|---|---|---|---|
| cfg | No | Local SSH config path (copy_ssh_config). | |
| cmd | No | Shell command (run_command). | |
| key | No | Shared key path (configure_key_auth). | /app/.ssh/id_ed25519 |
| host | No | run_command only. Optional single-host alias to target instead of the whole 'group' fan-out — the safe way to reach ONE inventory host (e.g. 'gb10') without running against 'homelab'. Resolved and authorized through the same alias store tm_remote/tm_hosts use, so the two are one source of truth: an unknown or unauthorized alias is rejected outright, never silently skipped. Takes precedence over 'group' when set. | |
| group | No | Target group. | all |
| lpath | No | Local file path (send_file). | |
| rpath | No | Remote file path (send_file/receive_file). | |
| key_pfx | No | Prefix for new keys (rotate_key). | /root/.ssh/id_ |
| preview | No | run_command only. If true, resolve the exact target host(s) for 'host'/'group' and return them in 'resolved_hosts' WITHOUT running 'cmd' — lets a caller verify scope before executing for real (no surprise fan-out). The real (non-preview) response also always includes 'resolved_hosts' for the same reason. | |
| rmt_cfg | No | Remote config path (copy_ssh_config). | /root/.ssh/config |
| timeout | No | Command timeout in seconds. | |
| key_type | No | Key type: rsa or ed25519. | ed25519 |
| parallel | No | Run parallel. | |
| inventory | No | YAML inventory path (default: $XDG_CONFIG_HOME/agent-connectors/inventory.yaml). | /root/.config/agent-connectors/inventory.yml |
| max_threads | No | Max threads. | |
| lpath_prefix | No | Local dir prefix (receive_file). |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false, idempotentHint=false, destructiveHint=false and openWorldHint=true, so the safety profile is partly covered. The description adds nothing beyond that: it does not say that copying a config overwrites rmt_cfg, whether an existing remote config is backed up, whether auth/prerequisites are required, or how failures across a host group are handled. For a mutation tool with a non-idempotent flag, that is a real gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is short and front-loaded, so there is no bloat. But the second sentence does not earn its place: it restates the inventory family theme without adding scope, direction, or constraints. Being terse here is under-specification rather than effective conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained. Still, for a 16-parameter mutation tool in a family of look-alike siblings, the description omits the copy direction, which parameters actually apply, and the group fan-out semantics. An agent cannot reliably invoke this from the description alone.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3 and the schema carries the parameter burden. The description contributes nothing to disambiguate the 16 shared parameters, several of which belong to other tools (cmd, lpath, key_pfx), so it neither adds meaning nor compensates for the ambiguity an agent faces when picking cfg vs rmt_cfg.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The first sentence names a specific verb and resource ("Copy ssh config"), which is better than a tautology. However, it does not distinguish this tool from the direct sibling tm_remote_copy_ssh_config, and it never says whether the copy goes local-to-remote or remote-to-local. The second sentence ("Bulk inventory operations against YAML host groups") is generic family boilerplate rather than a scope statement for this specific tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance and no named alternative, even though tm_remote_copy_ssh_config is an obvious sibling that an agent must choose between. The phrase "Bulk inventory operations against YAML host groups" hints at the group-based scenario but never states it as a selection criterion or gives a when-not.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tm_inventory_mesh_bootstrapMesh BootstrapC
Mesh bootstrap (tm_inventory). Bulk inventory operations against YAML host groups.
| Name | Required | Description | Default |
|---|---|---|---|
| cfg | No | Local SSH config path (copy_ssh_config). | |
| cmd | No | Shell command (run_command). | |
| key | No | Shared key path (configure_key_auth). | /app/.ssh/id_ed25519 |
| host | No | run_command only. Optional single-host alias to target instead of the whole 'group' fan-out — the safe way to reach ONE inventory host (e.g. 'gb10') without running against 'homelab'. Resolved and authorized through the same alias store tm_remote/tm_hosts use, so the two are one source of truth: an unknown or unauthorized alias is rejected outright, never silently skipped. Takes precedence over 'group' when set. | |
| group | No | Target group. | all |
| lpath | No | Local file path (send_file). | |
| rpath | No | Remote file path (send_file/receive_file). | |
| key_pfx | No | Prefix for new keys (rotate_key). | /root/.ssh/id_ |
| preview | No | run_command only. If true, resolve the exact target host(s) for 'host'/'group' and return them in 'resolved_hosts' WITHOUT running 'cmd' — lets a caller verify scope before executing for real (no surprise fan-out). The real (non-preview) response also always includes 'resolved_hosts' for the same reason. | |
| rmt_cfg | No | Remote config path (copy_ssh_config). | /root/.ssh/config |
| timeout | No | Command timeout in seconds. | |
| key_type | No | Key type: rsa or ed25519. | ed25519 |
| parallel | No | Run parallel. | |
| inventory | No | YAML inventory path (default: $XDG_CONFIG_HOME/agent-connectors/inventory.yaml). | /root/.config/agent-connectors/inventory.yml |
| max_threads | No | Max threads. | |
| lpath_prefix | No | Local dir prefix (receive_file). |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint=false, destructiveHint=false, idempotentHint=false, and openWorldHint=true, so the description still needs to explain what actually mutates. It does not: nothing indicates that setting 'key_pfx' creates new keypairs (rotate_key), that 'cfg'/'rmt_cfg' rewrite remote SSH config, or that 'preview' is the only safe dry-run. The schema carries this information, not the description.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no filler and no buried content, so it is efficient in form. But 'appropriately sized' is not met: a 16-parameter, six-mode dispatch tool compressed to one sentence of noun phrase leaves the reader less informed than the name plus schema alone.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, but the description still omits the operation-selection logic, the fan-out scope, and the fact that multiple behaviors live behind one entry point. For a zero-required-parameter tool where the caller must set the right combination to get a given operation, that is a material gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all 16 parameters, including host precedence, preview semantics, and resolved_hosts. The description adds no parameter meaning at all – not even which parameter selects which operation – so it sits at the baseline for fully documented schemas.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description says 'Bulk inventory operations against YAML host groups', which is a vague restatement of the name rather than a specific verb+resource. The tool actually dispatches six distinct operations (run_command, send_file, receive_file, copy_ssh_config, rotate_key, configure_key_auth), but none of them are named, so an agent cannot tell what this does apart from tm_inventory_run_command or tm_inventory_send_file.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use, when-not-to-use, or alternative is mentioned, even though the sibling list contains single-operation counterparts for every capability this tool bundles. The only implicit hint is the word 'bulk', which hints at fan-out scope but does not give the agent any rule for choosing this tool over a sibling.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tm_inventory_receive_fileReceive FileC
Receive file (tm_inventory). Bulk inventory operations against YAML host groups.
| Name | Required | Description | Default |
|---|---|---|---|
| cfg | No | Local SSH config path (copy_ssh_config). | |
| cmd | No | Shell command (run_command). | |
| key | No | Shared key path (configure_key_auth). | /app/.ssh/id_ed25519 |
| host | No | run_command only. Optional single-host alias to target instead of the whole 'group' fan-out — the safe way to reach ONE inventory host (e.g. 'gb10') without running against 'homelab'. Resolved and authorized through the same alias store tm_remote/tm_hosts use, so the two are one source of truth: an unknown or unauthorized alias is rejected outright, never silently skipped. Takes precedence over 'group' when set. | |
| group | No | Target group. | all |
| lpath | No | Local file path (send_file). | |
| rpath | No | Remote file path (send_file/receive_file). | |
| key_pfx | No | Prefix for new keys (rotate_key). | /root/.ssh/id_ |
| preview | No | run_command only. If true, resolve the exact target host(s) for 'host'/'group' and return them in 'resolved_hosts' WITHOUT running 'cmd' — lets a caller verify scope before executing for real (no surprise fan-out). The real (non-preview) response also always includes 'resolved_hosts' for the same reason. | |
| rmt_cfg | No | Remote config path (copy_ssh_config). | /root/.ssh/config |
| timeout | No | Command timeout in seconds. | |
| key_type | No | Key type: rsa or ed25519. | ed25519 |
| parallel | No | Run parallel. | |
| inventory | No | YAML inventory path (default: $XDG_CONFIG_HOME/agent-connectors/inventory.yaml). | /root/.config/agent-connectors/inventory.yml |
| max_threads | No | Max threads. | |
| lpath_prefix | No | Local dir prefix (receive_file). |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations declare readOnlyHint=false, destructiveHint=false, idempotentHint=false and openWorldHint=true, so the agent already knows this is a non-idempotent, non-destructive outward-facing operation. The description adds nothing: it does not say whether existing local files are overwritten, how fan-out across the group is handled, what happens on partial failure, or how parallel/max_threads affect behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short and front-loaded, so it is not bloated, but the second sentence is boilerplate shared with the whole tm_inventory family and carries no tool-specific information. It is concise without being informative.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 16-parameter file-transfer tool with no required parameters, no enum constraints, and a schema salted with run_command-only options, the description needed to say at minimum which parameters govern a receive_file call and what the source/target semantics are. It supplies none of that; even the existence of an output schema does not compensate for the missing operational contract.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the 16 parameters are documented in the schema itself and the baseline of 3 applies. The description contributes no additional parameter meaning, and notably several schema entries (host, preview, cmd) are scoped to "run_command only", leaving the agent to infer which of the 16 knobs actually matter for a receive-file call.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description restates the tool name ("Receive file") and adds only a generic family tagline, "Bulk inventory operations against YAML host groups." It never says receive a file from which inventory host(s) to where locally, nor how this differs from the sibling tm_remote_receive_file or from tm_inventory_send_file. An agent can guess the general area but not the specific operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no exclusion, and no mention of alternatives such as tm_remote_receive_file (single host) or tm_inventory_send_file (opposite direction). With 38 sibling tools in the same listing, the absence of any routing signal is a real gap.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tm_inventory_rotate_keyRotate KeyCDestructiveIdempotent
Rotate key (tm_inventory). Bulk inventory operations against YAML host groups.
| Name | Required | Description | Default |
|---|---|---|---|
| cfg | No | Local SSH config path (copy_ssh_config). | |
| cmd | No | Shell command (run_command). | |
| key | No | Shared key path (configure_key_auth). | /app/.ssh/id_ed25519 |
| host | No | run_command only. Optional single-host alias to target instead of the whole 'group' fan-out — the safe way to reach ONE inventory host (e.g. 'gb10') without running against 'homelab'. Resolved and authorized through the same alias store tm_remote/tm_hosts use, so the two are one source of truth: an unknown or unauthorized alias is rejected outright, never silently skipped. Takes precedence over 'group' when set. | |
| group | No | Target group. | all |
| lpath | No | Local file path (send_file). | |
| rpath | No | Remote file path (send_file/receive_file). | |
| key_pfx | No | Prefix for new keys (rotate_key). | /root/.ssh/id_ |
| preview | No | run_command only. If true, resolve the exact target host(s) for 'host'/'group' and return them in 'resolved_hosts' WITHOUT running 'cmd' — lets a caller verify scope before executing for real (no surprise fan-out). The real (non-preview) response also always includes 'resolved_hosts' for the same reason. | |
| rmt_cfg | No | Remote config path (copy_ssh_config). | /root/.ssh/config |
| timeout | No | Command timeout in seconds. | |
| key_type | No | Key type: rsa or ed25519. | ed25519 |
| parallel | No | Run parallel. | |
| inventory | No | YAML inventory path (default: $XDG_CONFIG_HOME/agent-connectors/inventory.yaml). | /root/.config/agent-connectors/inventory.yml |
| max_threads | No | Max threads. | |
| lpath_prefix | No | Local dir prefix (receive_file). |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true, idempotentHint=true and openWorldHint=true, so the description is not required to establish the safety profile. It nonetheless adds nothing beyond them: it never says whether old keys are replaced or preserved, whether authorized_keys/config entries are rewritten, whether backups exist, or how failure mid-fan-out is handled — all material for a destructive key-rotation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The text is short, but brevity here reflects under-specification rather than economy. The second sentence does not earn its place — it is a vague, potentially misleading scope statement that occupies half of the definition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema and rich annotations exist, which relieves the description of return-value and safety explanation, but a 16-parameter destructive operation still needs the rotation flow described (target group resolution, new key generation, replacement semantics). The description supplies none of that, leaving the agent to infer behavior entirely from parameter names.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% across all 16 parameters, so the schema fully documents them and the correct baseline is 3. The description itself contributes no additional parameter meaning; notably it never indicates which of the 16 parameters actually drive rotation (key_pfx, key_type, group, inventory) versus the many borrowed from sibling operations.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The title and first two words restate the tool name ('Rotate key'), adding no distinguishing detail. The trailing sentence, 'Bulk inventory operations against YAML host groups,' is a generic scope claim that could equally describe tm_inventory_run_command, tm_inventory_send_file or tm_inventory_copy_ssh_config, and it obscures rather than clarifies what rotation does.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no statement of when to use this over tm_remote_rotate_key or the other tm_inventory_* siblings, and no prerequisites (existing key auth, inventory reachability) or exclusions. The only hint of usage comes incidentally from the schema text of 'key_pfx', not from the description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tm_inventory_run_commandRun CommandC
Run command (tm_inventory). Bulk inventory operations against YAML host groups.
| Name | Required | Description | Default |
|---|---|---|---|
| cfg | No | Local SSH config path (copy_ssh_config). | |
| cmd | No | Shell command (run_command). | |
| key | No | Shared key path (configure_key_auth). | /app/.ssh/id_ed25519 |
| host | No | run_command only. Optional single-host alias to target instead of the whole 'group' fan-out — the safe way to reach ONE inventory host (e.g. 'gb10') without running against 'homelab'. Resolved and authorized through the same alias store tm_remote/tm_hosts use, so the two are one source of truth: an unknown or unauthorized alias is rejected outright, never silently skipped. Takes precedence over 'group' when set. | |
| group | No | Target group. | all |
| lpath | No | Local file path (send_file). | |
| rpath | No | Remote file path (send_file/receive_file). | |
| key_pfx | No | Prefix for new keys (rotate_key). | /root/.ssh/id_ |
| preview | No | run_command only. If true, resolve the exact target host(s) for 'host'/'group' and return them in 'resolved_hosts' WITHOUT running 'cmd' — lets a caller verify scope before executing for real (no surprise fan-out). The real (non-preview) response also always includes 'resolved_hosts' for the same reason. | |
| rmt_cfg | No | Remote config path (copy_ssh_config). | /root/.ssh/config |
| timeout | No | Command timeout in seconds. | |
| key_type | No | Key type: rsa or ed25519. | ed25519 |
| parallel | No | Run parallel. | |
| inventory | No | YAML inventory path (default: $XDG_CONFIG_HOME/agent-connectors/inventory.yaml). | /root/.config/agent-connectors/inventory.yml |
| max_threads | No | Max threads. | |
| lpath_prefix | No | Local dir prefix (receive_file). |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false, openWorldHint=true and non-idempotent, which tells the agent this mutates remote state. The description adds nothing beyond that: no mention of fan-out blast radius, no warning that cmd is arbitrary shell, no reference to preview/scope verification, and no timeout behavior — all of which are the key risks for this tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences with the name restated first, so it is front-loaded and wastes few words. However, the only content sentence ("Bulk inventory operations against YAML host groups") is vague enough that brevity tips into under-specification.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 16-parameter tool that executes arbitrary shell commands across many hosts, the description says nothing about the single-host vs group targeting model, the preview safety path, or the risk of unintended fan-out. An output schema and rich parameter docs exist, but they don't substitute for a warning about what this tool actually does at scale.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the schema itself is unusually rich (host vs group precedence, preview semantics, timeout, parallel/max_threads are all documented inline). The description adds no parameter meaning at all, so the baseline 3 for high coverage applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The verb+resource is present ("Run command"), and "against YAML host groups" hints at the fan-out scope that distinguishes it from tm_remote_run_command. But "Bulk inventory operations" is vague and doesn't say the tool executes a shell command over SSH across a group of hosts, so the agent must infer the actual behavior.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Nothing says when to use this instead of tm_remote_run_command or the other tm_inventory_* siblings. The word "bulk" implies the fan-out case, but there are no explicit conditions, prerequisites, or exclusions given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tm_inventory_send_fileSend FileC
Send file (tm_inventory). Bulk inventory operations against YAML host groups.
| Name | Required | Description | Default |
|---|---|---|---|
| cfg | No | Local SSH config path (copy_ssh_config). | |
| cmd | No | Shell command (run_command). | |
| key | No | Shared key path (configure_key_auth). | /app/.ssh/id_ed25519 |
| host | No | run_command only. Optional single-host alias to target instead of the whole 'group' fan-out — the safe way to reach ONE inventory host (e.g. 'gb10') without running against 'homelab'. Resolved and authorized through the same alias store tm_remote/tm_hosts use, so the two are one source of truth: an unknown or unauthorized alias is rejected outright, never silently skipped. Takes precedence over 'group' when set. | |
| group | No | Target group. | all |
| lpath | No | Local file path (send_file). | |
| rpath | No | Remote file path (send_file/receive_file). | |
| key_pfx | No | Prefix for new keys (rotate_key). | /root/.ssh/id_ |
| preview | No | run_command only. If true, resolve the exact target host(s) for 'host'/'group' and return them in 'resolved_hosts' WITHOUT running 'cmd' — lets a caller verify scope before executing for real (no surprise fan-out). The real (non-preview) response also always includes 'resolved_hosts' for the same reason. | |
| rmt_cfg | No | Remote config path (copy_ssh_config). | /root/.ssh/config |
| timeout | No | Command timeout in seconds. | |
| key_type | No | Key type: rsa or ed25519. | ed25519 |
| parallel | No | Run parallel. | |
| inventory | No | YAML inventory path (default: $XDG_CONFIG_HOME/agent-connectors/inventory.yaml). | /root/.config/agent-connectors/inventory.yml |
| max_threads | No | Max threads. | |
| lpath_prefix | No | Local dir prefix (receive_file). |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false, openWorldHint=true, idempotentHint=false, and destructiveHint=false, so the safety profile is partly covered. The description adds no behavioral context such as whether files are overwritten, what permissions are required, or how the inventory fan-out affects execution.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is only two short sentences and front-loads the action 'Send file'. The second sentence is generic but does provide inventory scope context, and there is no wasted filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a 16-parameter, open-world, non-idempotent inventory operation with many siblings, and the description gives almost no operational context. The schema and annotations cover structure and safety hints, but the description does not explain usage, alternatives, or file-transfer behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all 16 parameters are documented in the input schema. The description adds no parameter-level meaning beyond what the schema already provides, which matches the baseline of 3 when the schema carries parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description repeats the tool name/title with 'Send file (tm_inventory)' and adds a broad phrase about bulk inventory operations against YAML host groups. It does not clarify what sending a file entails, such as copying a local path to remote hosts selected from inventory, and it does not distinguish this from sibling tm_remote_send_file.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit guidance on when to use this tool versus tm_remote_send_file or tm_inventory_receive_file. The phrase 'Bulk inventory operations against YAML host groups' hints at inventory scope, but no conditions, exclusions, or alternatives are stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tm_operation_cancelCancelCDestructiveIdempotent
Cancel (tm_operations). Operation lifecycle and session management.
| Name | Required | Description | Default |
|---|---|---|---|
| details | No | Additional details (start). | |
| total_steps | No | Total steps (start). | |
| operation_id | No | Operation ID (get_progress/cancel/get_metrics). | |
| operation_type | No | Type of operation (start). |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and idempotentHint=true, so an agent knows cancelling has side effects and is repeatable. The description adds nothing beyond that — it does not state that cancellation is irreversible, what happens to in-flight work, or whether partial results are discarded, which are the questions an agent actually has for a destructive lifecycle call.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is short, but the second sentence does no work — it is a taxonomy label rather than an actionable statement, and the only informative token ("Cancel") is diluted by it. Length is not the problem; the filler is.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a destructive, open-world lifecycle mutation with nested details, an output schema, and four optional-defaulted parameters. For that complexity, the description omits the target selection, the effect of cancellation, and how it relates to the other tm_operation_* tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all four parameters are documented in the schema (notably operation_id for get_progress/cancel/get_metrics). The description adds no extra meaning, such as which parameter actually selects the operation to cancel, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The fragment "Cancel (tm_operations)" names a verb and the resource family, so an agent can guess it terminates an operation. But the second sentence, "Operation lifecycle and session management," is a category label that could describe start, get_progress, or get_metrics equally, so it does not distinguish this tool from its closest siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to cancel versus when to check progress (tm_operation_get_progress) or start a new operation (tm_operation_start). No prerequisites, no mention that an operation_id must identify the target, and nothing about what happens to already-completed steps.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tm_operation_get_metricsGet MetricsCRead-onlyIdempotent
Get metrics (tm_operations). Operation lifecycle and session management.
| Name | Required | Description | Default |
|---|---|---|---|
| details | No | Additional details (start). | |
| total_steps | No | Total steps (start). | |
| operation_id | No | Operation ID (get_progress/cancel/get_metrics). | |
| operation_type | No | Type of operation (start). |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false and openWorldHint=true, so the safety profile is fully covered by structured data. The description adds nothing on top of that: no indication of what metric families come back, whether results are aggregated per operation or across sessions, or whether any auth/scope applies.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is short and front-loaded, but the second fragment ("Operation lifecycle and session management") does not earn its place because it conveys no actionable information about this tool. Brevity here comes from under-specification rather than disciplined editing.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return-value explanation is not required, but the tool takes a nested free-form details object plus an operation_id with no indication of expected shape or defaults being empty. For a metrics-lookup tool sitting among several operation-lifecycle siblings, the description leaves too much for the agent to infer.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all four parameters (including the note that operation_id is shared with get_progress/cancel), which sets the baseline at 3. The description contributes no additional meaning about how operation_id, operation_type, total_steps or the nested details object affect the metrics returned.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
"Get metrics (tm_operations)" mostly restates the tool name and title, and the follow-up "Operation lifecycle and session management" reads as a category label rather than a statement of what is being retrieved. It never says whose metrics, at what granularity, or how this differs from tm_operation_get_progress, so an agent cannot distinguish the two from the description alone.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance or exclusion. The sibling set contains an obvious alternative (tm_operation_get_progress) and a session lister (tm_operation_list_sessions), but the description offers nothing about which one to pick or what prerequisite (a valid operation_id) is needed first.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tm_operation_get_progressGet ProgressCRead-onlyIdempotent
Get progress (tm_operations). Operation lifecycle and session management.
| Name | Required | Description | Default |
|---|---|---|---|
| details | No | Additional details (start). | |
| total_steps | No | Total steps (start). | |
| operation_id | No | Operation ID (get_progress/cancel/get_metrics). | |
| operation_type | No | Type of operation (start). |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint=false, so the safety profile is covered. The description adds nothing beyond that: it doesn't explain what happens with the empty default operation_id, whether an unknown operation yields an error or empty result, or what the progress payload represents.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is short and front-loaded, but the second sentence ('Operation lifecycle and session management') is generic filler that earns no place—it neither scopes the tool nor routes to an alternative.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values needn't be explained, and annotations cover the read-only safety profile. Still, for a read tool with an ambiguous empty-default operation_id and several start-oriented parameters, the description leaves real gaps about invocation correctness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the four parameters are documented structurally, which sets the baseline at 3. However, the description does not clarify the confusing presence of start-only parameters (operation_type, total_steps, details) in a get-progress schema, so it adds no value over the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The verb+resource ('Get progress') is identifiable, and the parenthetical 'tm_operations' names the domain. But 'Operation lifecycle and session management' is vague filler that doesn't say what progress data is actually retrieved, and it doesn't distinguish this tool from siblings like tm_operation_get_metrics or tm_operation_list_sessions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to call this versus tm_operation_get_metrics or tm_operation_list_sessions, nor any prerequisite such as needing a valid operation_id from tm_operation_start. The agent must infer usage entirely from the tool name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tm_operation_list_sessionsList SessionsCRead-onlyIdempotent
List sessions (tm_operations). Operation lifecycle and session management.
| Name | Required | Description | Default |
|---|---|---|---|
| details | No | Additional details (start). | |
| total_steps | No | Total steps (start). | |
| operation_id | No | Operation ID (get_progress/cancel/get_metrics). | |
| operation_type | No | Type of operation (start). |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, openWorldHint, and destructiveHint=false, so the safety profile is covered. The description adds nothing behavioral beyond that – no mention of scope, filtering, pagination, or what a "session" contains – so it contributes no value on top of the structured metadata.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is short and front-loaded with the verb and resource, but the second sentence ("Operation lifecycle and session management") is filler that adds ambiguity rather than information, so not every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists and annotations are rich, so return values and safety needn't be explained. However, the description never clarifies what a "session" is in this system or how listing differs from the operation lifecycle tools, leaving a real gap for an agent deciding whether to call it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so all four parameters are documented in the schema, which sets the baseline at 3. The description adds no parameter meaning (e.g., which params actually apply to a list operation versus start/get_progress), so it neither helps nor compensates.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
"List sessions (tm_operations)" gives a clear verb and resource, but the follow-up "Operation lifecycle and session management" is vague and actually describes the operation family rather than this tool, leaving it poorly distinguished from siblings like tm_operation_get_progress or tm_operation_start.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No indication of when to list sessions versus using the other tm_operation_* tools, and no prerequisites or context for choosing this tool over sibling alternatives are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tm_operation_startStartC
Start (tm_operations). Operation lifecycle and session management.
| Name | Required | Description | Default |
|---|---|---|---|
| details | No | Additional details (start). | |
| total_steps | No | Total steps (start). | |
| operation_id | No | Operation ID (get_progress/cancel/get_metrics). | |
| operation_type | No | Type of operation (start). |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already state readOnlyHint=false, idempotentHint=false, openWorldHint=true, and destructiveHint=false. The description adds no behavioral context such as whether starting creates persistent state, requires permissions, emits side effects, or how sessions relate to operations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is very short and front-loads 'Start,' but the second fragment is a vague category label rather than useful structure. It avoids fluff but is under-specified for an operation-start tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Although an output schema exists and annotations cover safety hints, the description does not explain what starting an operation does, how session state is affected, or how this tool fits the lifecycle. For a non-idempotent, open-world mutation, this leaves important context missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the schema documents all four parameters, so the baseline is 3. The description itself adds no parameter meaning beyond the schema, particularly for operation_type, total_steps, and details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The name and title already say 'Start'; the description repeats that and adds only the broad category 'Operation lifecycle and session management.' It does not specify what is being started, what an operation represents, or how this differs from siblings like get_progress or cancel.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no explicit guidance on when to use this tool versus sibling operation tools, nor any prerequisites or when-not-to-use conditions. 'Operation lifecycle and session management' is too vague to route an agent among start, get_progress, cancel, get_metrics, or list_sessions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tm_remote_check_sshCheck SshCRead-onlyIdempotent
Check ssh (tm_remote). Single-host SSH operations with shared connection params.
| Name | Required | Description | Default |
|---|---|---|---|
| cfg | No | SSH config path; unset uses ~/.ssh/config. | |
| cmd | No | Shell command (run_command). | |
| key | No | Key path (test_key_auth/setup_passwordless). | |
| host | No | Inventory alias, or a raw hostname with an explicit user. | |
| lcfg | No | Local SSH config (copy_ssh_config). | |
| port | No | Port; unset uses the inventory alias, else 22. | |
| rcfg | No | Remote SSH config (copy_ssh_config). | /root/.ssh/config |
| user | No | Username; unset uses the inventory alias. | |
| lpath | No | Local file path (send_file/receive_file). | |
| proxy | No | Teleport proxy; unset uses the alias. | |
| rpath | No | Remote file path (send_file/receive_file). | |
| confirm | No | Confirm a destructive action (remove_host_key) without elicitation. | |
| id_file | No | Private key path; unset uses the alias. | |
| new_key | No | New private key path (rotate_key). | |
| timeout | No | Command timeout in seconds. | |
| key_type | No | Key type: rsa or ed25519 (setup_passwordless/rotate_key). | ed25519 |
| certificate | No | Teleport certificate; unset uses the alias. | |
| known_hosts | No | Known hosts path (remove_host_key). | /root/.ssh/known_hosts |
| password_ref | No | Runtime secret reference for the SSH password; unset uses the alias. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false, idempotentHint=true, and openWorldHint=true, so the description need not repeat safety metadata. However, it adds almost no behavioral context: it does not clarify whether this is a diagnostic check, a command runner, a file-transfer helper, or a multiplexed operation surface, despite schema fields for run_command, send_file/receive_file, rotate_key, and remove_host_key.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short and front-loaded, but the first sentence mostly repeats the tool name and the second is a generic phrase. It is concise without being informative, so it earns a middling score rather than high marks.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 19 parameters, many operation-specific fields, no required params, and a rich sibling set, the description is far too sparse to orient an agent. An output schema exists, so return values need not be explained, but the description should at least clarify the tool's operational scope and relationship to the more specific SSH siblings.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with all 19 parameters documented in the schema, so the description does not need to explain individual parameters. The description adds only the general notion of 'shared connection params' and provides no additional meaning beyond the schema, which meets the baseline for high-coverage schemas.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description largely restates the name and title: 'Check ssh (tm_remote)' plus the vague phrase 'Single-host SSH operations with shared connection params.' It does not specify what 'check' actually does or distinguish this tool from the many specific SSH siblings such as tm_remote_run_command, tm_remote_send_file, or tm_remote_rotate_key.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus any of the sibling SSH tools. The phrase 'Single-host SSH operations' implies broad usage but gives no exclusions, prerequisites, or alternative-routing advice despite an extensive sibling list.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tm_remote_copy_ssh_configCopy Ssh ConfigC
Copy ssh config (tm_remote). Single-host SSH operations with shared connection params.
| Name | Required | Description | Default |
|---|---|---|---|
| cfg | No | SSH config path; unset uses ~/.ssh/config. | |
| cmd | No | Shell command (run_command). | |
| key | No | Key path (test_key_auth/setup_passwordless). | |
| host | No | Inventory alias, or a raw hostname with an explicit user. | |
| lcfg | No | Local SSH config (copy_ssh_config). | |
| port | No | Port; unset uses the inventory alias, else 22. | |
| rcfg | No | Remote SSH config (copy_ssh_config). | /root/.ssh/config |
| user | No | Username; unset uses the inventory alias. | |
| lpath | No | Local file path (send_file/receive_file). | |
| proxy | No | Teleport proxy; unset uses the alias. | |
| rpath | No | Remote file path (send_file/receive_file). | |
| confirm | No | Confirm a destructive action (remove_host_key) without elicitation. | |
| id_file | No | Private key path; unset uses the alias. | |
| new_key | No | New private key path (rotate_key). | |
| timeout | No | Command timeout in seconds. | |
| key_type | No | Key type: rsa or ed25519 (setup_passwordless/rotate_key). | ed25519 |
| certificate | No | Teleport certificate; unset uses the alias. | |
| known_hosts | No | Known hosts path (remove_host_key). | /root/.ssh/known_hosts |
| password_ref | No | Runtime secret reference for the SSH password; unset uses the alias. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false, destructiveHint=false, idempotentHint=false, and openWorldHint=true, so the safety profile is partly known. The description adds no behavioral context such as whether the remote SSH config is overwritten, what permissions are required, or what happens on failure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short and front-loads the action, which is good. The second sentence is somewhat generic filler, but it does not bloat the description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given a 19-parameter schema and a mutating copy operation, the description is too sparse to be complete. It does not clarify which shared params are relevant to copy_ssh_config, how it differs from the inventory variant, or what the operation modifies; an output schema helps with return values but not with invocation context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all 19 parameters are documented in the schema itself. The description only mentions 'shared connection params' without adding meaning to any specific parameter, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The first sentence states a specific verb and resource ('Copy ssh config') and scopes it with '(tm_remote)', so the basic operation is clear. However, the second sentence is generic and does not distinguish this tool from tm_inventory_copy_ssh_config or explain that the 19-param schema is a shared parameter set rather than a multi-operation tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to use this tool versus tm_inventory_copy_ssh_config or the other tm_remote_* siblings. The phrase 'Single-host SSH operations' hints at a single-host scope but never states the alternative (inventory-wide copy) or any prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tm_remote_receive_fileReceive FileC
Receive file (tm_remote). Single-host SSH operations with shared connection params.
| Name | Required | Description | Default |
|---|---|---|---|
| cfg | No | SSH config path; unset uses ~/.ssh/config. | |
| cmd | No | Shell command (run_command). | |
| key | No | Key path (test_key_auth/setup_passwordless). | |
| host | No | Inventory alias, or a raw hostname with an explicit user. | |
| lcfg | No | Local SSH config (copy_ssh_config). | |
| port | No | Port; unset uses the inventory alias, else 22. | |
| rcfg | No | Remote SSH config (copy_ssh_config). | /root/.ssh/config |
| user | No | Username; unset uses the inventory alias. | |
| lpath | No | Local file path (send_file/receive_file). | |
| proxy | No | Teleport proxy; unset uses the alias. | |
| rpath | No | Remote file path (send_file/receive_file). | |
| confirm | No | Confirm a destructive action (remove_host_key) without elicitation. | |
| id_file | No | Private key path; unset uses the alias. | |
| new_key | No | New private key path (rotate_key). | |
| timeout | No | Command timeout in seconds. | |
| key_type | No | Key type: rsa or ed25519 (setup_passwordless/rotate_key). | ed25519 |
| certificate | No | Teleport certificate; unset uses the alias. | |
| known_hosts | No | Known hosts path (remove_host_key). | /root/.ssh/known_hosts |
| password_ref | No | Runtime secret reference for the SSH password; unset uses the alias. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false, idempotentHint=false, destructiveHint=false, openWorldHint=true, so the safety profile is covered. The description adds nothing beyond that — it doesn't say whether an existing local file is overwritten (a non-idempotent write to disk), how partial transfers behave, or that credentials come from the shared SSH params. For a non-idempotent file write, an overwrite/clobber note would be the key context an agent needs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Short and front-loaded, so it reads easily. But the second sentence is generic family boilerplate that doesn't earn its place in a tool-specific definition, and the space it occupies would have been better used on direction of transfer or overwrite behavior.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Nineteen parameters, no required fields, and an output schema mean the description should at minimum orient the agent: set rpath as source and lpath as destination, host as target, and warn that the local file may be overwritten. None of that is present, and direction of the transfer — the single most decision-relevant fact — is unstated. The schema fills the parameter gaps, but the core operational semantics are missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so lpath/rpath/host/user/port etc. are already documented in the schema, making 3 the baseline. The description's only parameter-adjacent claim — 'shared connection params' — doesn't add format, defaults, or constraints beyond the schema. It also doesn't point the agent at lpath/rpath as the operative parameters for this tool.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
"Receive file (tm_remote)" essentially restates the tool name and title without saying which direction data flows (remote→local download vs. local→remote upload). The second sentence, "Single-host SSH operations with shared connection params," is generic scope boilerplate that applies to the whole tm_remote family, not this tool. With tm_remote_send_file as a sibling, this leaves the agent to infer the direction of transfer.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance at all: nothing distinguishes this from tm_remote_send_file or tm_inventory_receive_file, and no prerequisites (reachable host, existing key, target path writability) are stated. The only framing is generic 'single-host SSH operations' coverage which applies to every sibling.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tm_remote_remove_host_keyRemove Host KeyCDestructiveIdempotent
Remove host key (tm_remote). Single-host SSH operations with shared connection params.
| Name | Required | Description | Default |
|---|---|---|---|
| cfg | No | SSH config path; unset uses ~/.ssh/config. | |
| cmd | No | Shell command (run_command). | |
| key | No | Key path (test_key_auth/setup_passwordless). | |
| host | No | Inventory alias, or a raw hostname with an explicit user. | |
| lcfg | No | Local SSH config (copy_ssh_config). | |
| port | No | Port; unset uses the inventory alias, else 22. | |
| rcfg | No | Remote SSH config (copy_ssh_config). | /root/.ssh/config |
| user | No | Username; unset uses the inventory alias. | |
| lpath | No | Local file path (send_file/receive_file). | |
| proxy | No | Teleport proxy; unset uses the alias. | |
| rpath | No | Remote file path (send_file/receive_file). | |
| confirm | No | Confirm a destructive action (remove_host_key) without elicitation. | |
| id_file | No | Private key path; unset uses the alias. | |
| new_key | No | New private key path (rotate_key). | |
| timeout | No | Command timeout in seconds. | |
| key_type | No | Key type: rsa or ed25519 (setup_passwordless/rotate_key). | ed25519 |
| certificate | No | Teleport certificate; unset uses the alias. | |
| known_hosts | No | Known hosts path (remove_host_key). | /root/.ssh/known_hosts |
| password_ref | No | Runtime secret reference for the SSH password; unset uses the alias. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already declare destructiveHint=true, idempotentHint=true, and openWorldHint=true, so the safety profile is covered. The description adds no further behavioral context such as which known_hosts file is affected, whether confirmation is required, or what exactly gets removed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short and front-loads the action: 'Remove host key (tm_remote).' The second sentence is somewhat generic boilerplate, but the overall structure is efficient and wastes little space.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive tool with 19 parameters, the description is too thin. Even though annotations and schema are rich, it does not mention the host-key storage target, the confirm behavior, or how host selection relates to the operation, leaving important context to the schema alone.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all 19 parameters are documented in the schema itself. The description only mentions 'shared connection params' and adds no extra parameter meaning beyond what the schema already provides, which matches the baseline of 3 for high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Remove host key,' so the action is immediately clear. It identifies the tm_remote module but does not differentiate from siblings such as tm_remote_rotate_key or tm_remote_check_ssh, which is why it falls short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives no explicit guidance on when to use this tool versus alternatives like rotate_key or check_ssh. The phrase 'Single-host SSH operations with shared connection params' implies context but does not tell the agent when removal is appropriate or what prerequisites exist.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tm_remote_rotate_keyRotate KeyCDestructiveIdempotent
Rotate key (tm_remote). Single-host SSH operations with shared connection params.
| Name | Required | Description | Default |
|---|---|---|---|
| cfg | No | SSH config path; unset uses ~/.ssh/config. | |
| cmd | No | Shell command (run_command). | |
| key | No | Key path (test_key_auth/setup_passwordless). | |
| host | No | Inventory alias, or a raw hostname with an explicit user. | |
| lcfg | No | Local SSH config (copy_ssh_config). | |
| port | No | Port; unset uses the inventory alias, else 22. | |
| rcfg | No | Remote SSH config (copy_ssh_config). | /root/.ssh/config |
| user | No | Username; unset uses the inventory alias. | |
| lpath | No | Local file path (send_file/receive_file). | |
| proxy | No | Teleport proxy; unset uses the alias. | |
| rpath | No | Remote file path (send_file/receive_file). | |
| confirm | No | Confirm a destructive action (remove_host_key) without elicitation. | |
| id_file | No | Private key path; unset uses the alias. | |
| new_key | No | New private key path (rotate_key). | |
| timeout | No | Command timeout in seconds. | |
| key_type | No | Key type: rsa or ed25519 (setup_passwordless/rotate_key). | ed25519 |
| certificate | No | Teleport certificate; unset uses the alias. | |
| known_hosts | No | Known hosts path (remove_host_key). | /root/.ssh/known_hosts |
| password_ref | No | Runtime secret reference for the SSH password; unset uses the alias. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true, idempotentHint=true and openWorldHint=true, so the safety profile is covered structurally. The description adds nothing beyond that: it never says whether the old key is replaced or backed up, whether confirm is needed, or what happens on failure. For a destructive mutation, that is a real gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, no padding, and the operation name is front-loaded. But the second sentence is generic boilerplate about shared connection params and earns little of its space.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 19 parameters, most of which belong to other operations in this shared-param group, the description gives no help identifying the handful relevant to rotation (host, new_key, key_type, port, user). An output schema exists, so return values needn't be covered, but the parameter scoping gap is significant for a destructive tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and each parameter already carries its own note (e.g., "New private key path (rotate_key)", key_type values). Baseline 3 applies – the description adds no syntax, defaults, or interaction rules beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
"Rotate key" names a verb and resource, but leaves the object ambiguous: which key (SSH private key on the remote host?), and what rotation entails. The parenthetical "(tm_remote)" scopes it to single-host operation, which faintly separates it from tm_inventory_rotate_key, but nothing explicitly distinguishes the two.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
"Single-host SSH operations" implies the condition for choosing this over the inventory variant, but the agent must infer that. There is no explicit when-to-use, when-not, or prerequisite statement (e.g., that the remote must already be reachable and key-auth configured).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tm_remote_run_commandRun CommandC
Run command (tm_remote). Single-host SSH operations with shared connection params.
| Name | Required | Description | Default |
|---|---|---|---|
| cfg | No | SSH config path; unset uses ~/.ssh/config. | |
| cmd | No | Shell command (run_command). | |
| key | No | Key path (test_key_auth/setup_passwordless). | |
| host | No | Inventory alias, or a raw hostname with an explicit user. | |
| lcfg | No | Local SSH config (copy_ssh_config). | |
| port | No | Port; unset uses the inventory alias, else 22. | |
| rcfg | No | Remote SSH config (copy_ssh_config). | /root/.ssh/config |
| user | No | Username; unset uses the inventory alias. | |
| lpath | No | Local file path (send_file/receive_file). | |
| proxy | No | Teleport proxy; unset uses the alias. | |
| rpath | No | Remote file path (send_file/receive_file). | |
| confirm | No | Confirm a destructive action (remove_host_key) without elicitation. | |
| id_file | No | Private key path; unset uses the alias. | |
| new_key | No | New private key path (rotate_key). | |
| timeout | No | Command timeout in seconds. | |
| key_type | No | Key type: rsa or ed25519 (setup_passwordless/rotate_key). | ed25519 |
| certificate | No | Teleport certificate; unset uses the alias. | |
| known_hosts | No | Known hosts path (remove_host_key). | /root/.ssh/known_hosts |
| password_ref | No | Runtime secret reference for the SSH password; unset uses the alias. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false, destructiveHint=false, openWorldHint=true, and idempotentHint=false, so the safety profile is covered. The description adds only the vague phrase 'shared connection params' and says nothing about execution side effects, privilege level, timeout behavior, or what happens when the remote command fails.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short, front-loaded sentences with zero filler. It is efficient, though the terseness is a shortfall captured under contextual completeness rather than a structure problem.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a 19-parameter tool where only a handful apply to command execution; the description never says which, so an agent must reverse-engineer intent from per-param 'used by X' notes. Output schema and annotations cover returns and safety, but the core question of which params matter for this call is left unanswered.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so every one of the 19 parameters is documented inline and the baseline is 3. The description does not identify which parameters (cmd, host, timeout) actually drive a run_command call, so it adds no meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource (run a shell command over SSH) and scopes it to a single host, which implicitly contrasts with the bulk tm_inventory_run_command sibling. It stops short of naming that sibling explicitly, so the differentiation is inferable rather than stated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this versus tm_inventory_run_command, tm_remote_check_ssh, or the send/receive_file siblings. 'Single-host' is the only routing hint, and it is never framed as a selection criterion.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tm_remote_send_fileSend FileC
Send file (tm_remote). Single-host SSH operations with shared connection params.
| Name | Required | Description | Default |
|---|---|---|---|
| cfg | No | SSH config path; unset uses ~/.ssh/config. | |
| cmd | No | Shell command (run_command). | |
| key | No | Key path (test_key_auth/setup_passwordless). | |
| host | No | Inventory alias, or a raw hostname with an explicit user. | |
| lcfg | No | Local SSH config (copy_ssh_config). | |
| port | No | Port; unset uses the inventory alias, else 22. | |
| rcfg | No | Remote SSH config (copy_ssh_config). | /root/.ssh/config |
| user | No | Username; unset uses the inventory alias. | |
| lpath | No | Local file path (send_file/receive_file). | |
| proxy | No | Teleport proxy; unset uses the alias. | |
| rpath | No | Remote file path (send_file/receive_file). | |
| confirm | No | Confirm a destructive action (remove_host_key) without elicitation. | |
| id_file | No | Private key path; unset uses the alias. | |
| new_key | No | New private key path (rotate_key). | |
| timeout | No | Command timeout in seconds. | |
| key_type | No | Key type: rsa or ed25519 (setup_passwordless/rotate_key). | ed25519 |
| certificate | No | Teleport certificate; unset uses the alias. | |
| known_hosts | No | Known hosts path (remove_host_key). | /root/.ssh/known_hosts |
| password_ref | No | Runtime secret reference for the SSH password; unset uses the alias. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already disclose readOnlyHint=false, destructiveHint=false, openWorldHint=true, and idempotentHint=false, so the safety profile is partly covered. The description adds almost no behavioral context beyond calling it a 'send file' operation—nothing about overwrite behavior, required permissions, authentication, or transfer semantics. For a file-transfer mutation, this is a meaningful gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short fragments with no filler, and the key verb-resource pairing is front-loaded. It is not padded, though the terseness contributes to the completeness gaps elsewhere.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 19 parameters, an output schema, and the complexity of SSH file transfer, the description is far too thin. Even with rich schema and annotations, an agent needs at least minimal context on direction, overwrite behavior, or how this differs from receive_file and inventory-based send operations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all 19 parameters are documented in the schema and the description need not repeat them. The description contributes no additional parameter meaning beyond the shared-connection-params phrase, which is appropriate for a baseline 3 when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear verb and resource ('Send file') and vaguely situates it in 'single-host SSH operations,' which hints at scope. However, it does not distinguish this tool from close siblings like tm_remote_receive_file or tm_inventory_send_file, and the parenthetical '(tm_remote)' mostly repeats the name prefix rather than adding meaning. Purpose is identifiable but under-specified.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus the many file-transfer siblings, nor any prerequisites, directionality, or exclusions. The phrase 'Single-host SSH operations with shared connection params' describes the family, not a decision criterion for invoking this specific tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tm_remote_setup_passwordlessSetup PasswordlessC
Setup passwordless (tm_remote). Single-host SSH operations with shared connection params.
| Name | Required | Description | Default |
|---|---|---|---|
| cfg | No | SSH config path; unset uses ~/.ssh/config. | |
| cmd | No | Shell command (run_command). | |
| key | No | Key path (test_key_auth/setup_passwordless). | |
| host | No | Inventory alias, or a raw hostname with an explicit user. | |
| lcfg | No | Local SSH config (copy_ssh_config). | |
| port | No | Port; unset uses the inventory alias, else 22. | |
| rcfg | No | Remote SSH config (copy_ssh_config). | /root/.ssh/config |
| user | No | Username; unset uses the inventory alias. | |
| lpath | No | Local file path (send_file/receive_file). | |
| proxy | No | Teleport proxy; unset uses the alias. | |
| rpath | No | Remote file path (send_file/receive_file). | |
| confirm | No | Confirm a destructive action (remove_host_key) without elicitation. | |
| id_file | No | Private key path; unset uses the alias. | |
| new_key | No | New private key path (rotate_key). | |
| timeout | No | Command timeout in seconds. | |
| key_type | No | Key type: rsa or ed25519 (setup_passwordless/rotate_key). | ed25519 |
| certificate | No | Teleport certificate; unset uses the alias. | |
| known_hosts | No | Known hosts path (remove_host_key). | /root/.ssh/known_hosts |
| password_ref | No | Runtime secret reference for the SSH password; unset uses the alias. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only declare readOnly=false, openWorld=true, idempotent=false, destructive=false. The description does not disclose what is mutated on the remote (authorized_keys), that password_ref may be required for the initial password auth, whether re-running is safe, or that it touches the network. For a 19-parameter mutation tool, the burden shifts to the description and it does not carry it. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is short and front-loaded, but the second sentence is generic boilerplate about the tm_remote family rather than insight about this tool, so a sentence that could clarify behavior instead dilutes the definition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 19 optional parameters, a mutating operation, and a long list of closely-related siblings, the description should explain the core flow and the role of the shared connection params. It doesn't. An output schema exists, so return values need not be covered, but the operational story is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all 19 parameters are documented in-schema, which sets the baseline at 3. The description adds no meaning beyond those fields, but it is not required to given full coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description restates the name ("Setup passwordless") and adds only a scope tag, "(tm_remote)", plus "Single-host SSH operations with shared connection params." The single-host qualifier weakly separates it from the tm_inventory_* siblings, but it never says what the tool actually does (generate a keypair, install the public key in the remote's authorized_keys) or how it differs from tm_remote_test_key_auth or tm_inventory_configure_key_auth.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
"Single-host" implies a scope, but there is no explicit when-to-use, no prerequisite (e.g. an existing SSH password in password_ref), and no named alternative to choose instead for multi-host or verification workflows among the many sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tm_remote_test_key_authTest Key AuthCRead-onlyIdempotent
Test key auth (tm_remote). Single-host SSH operations with shared connection params.
| Name | Required | Description | Default |
|---|---|---|---|
| cfg | No | SSH config path; unset uses ~/.ssh/config. | |
| cmd | No | Shell command (run_command). | |
| key | No | Key path (test_key_auth/setup_passwordless). | |
| host | No | Inventory alias, or a raw hostname with an explicit user. | |
| lcfg | No | Local SSH config (copy_ssh_config). | |
| port | No | Port; unset uses the inventory alias, else 22. | |
| rcfg | No | Remote SSH config (copy_ssh_config). | /root/.ssh/config |
| user | No | Username; unset uses the inventory alias. | |
| lpath | No | Local file path (send_file/receive_file). | |
| proxy | No | Teleport proxy; unset uses the alias. | |
| rpath | No | Remote file path (send_file/receive_file). | |
| confirm | No | Confirm a destructive action (remove_host_key) without elicitation. | |
| id_file | No | Private key path; unset uses the alias. | |
| new_key | No | New private key path (rotate_key). | |
| timeout | No | Command timeout in seconds. | |
| key_type | No | Key type: rsa or ed25519 (setup_passwordless/rotate_key). | ed25519 |
| certificate | No | Teleport certificate; unset uses the alias. | |
| known_hosts | No | Known hosts path (remove_host_key). | /root/.ssh/known_hosts |
| password_ref | No | Runtime secret reference for the SSH password; unset uses the alias. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true and destructiveHint=false, so safety is covered. The description adds nothing beyond that: it doesn't say what a failing auth result looks like, whether any remote state is touched, whether credentials are read from disk, or how long the probe may take. "Shared connection params" hints at the schema but conveys no behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is short, but the second sentence does not earn its place: it describes the input schema generically instead of telling the agent what the tool does or when to call it. Brevity without front-loaded substance.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a 19-parameter tool with a large sibling family, and the description leaves the agent unable to tell which parameters are relevant or how this differs from adjacent SSH tools. The output schema exists, so return values needn't be explained, but purpose and usage gaps remain large for a tool of this complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and each parameter's description tags which operation it belongs to (e.g. "Key path (test_key_auth/setup_passwordless)", "New private key path (rotate_key)"), so the schema does the disambiguating work. The description contributes only the vague phrase "shared connection params" and does not clarify which of the 19 parameters actually matter here.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
"Test key auth" restates the tool name and title almost verbatim, adding essentially no verb/resource specificity. "Single-host SSH operations with shared connection params" describes the schema shape rather than the action, and gives no way to distinguish this from siblings like tm_remote_check_ssh or tm_inventory_configure_key_auth.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use or when-not guidance. The agent is not told whether this is a pre-flight probe before setup_passwordless, a post-change verification, or how it differs from check_ssh. Nothing is stated or even implied beyond the name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tm_security_access_control_auditAccess Control AuditCRead-onlyIdempotent
Access control audit (tm_security). Security scanning and compliance.
| Name | Required | Description | Default |
|---|---|---|---|
| scope | No | Security areas to audit (security_audit). | |
| standard | No | Compliance standard: cis_benchmark, pci_dss, hipaa (compliance_check). | cis_benchmark |
| username | No | SSH username. | |
| scan_type | No | Scan type: basic, package, config (vulnerability_scan). | basic |
| remote_host | Yes | Remote host to audit. | |
| password_ref | No | Runtime secret reference for the SSH password. | |
| identity_file | No | SSH identity file path. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false, and openWorldHint=true, so the safety profile is fully covered elsewhere. The description adds nothing new: it does not mention SSH authentication requirements, what the audit returns, or that it reaches out to remote_host.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is short and front-loaded, so it satisfies the conciseness test, but the brevity comes at the cost of under-specification rather than tight information density.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 7-parameter remote-host audit with SSH credentials (password_ref, identity_file) and an output schema, the description should say what happens on the remote host and what result is returned. It leaves all of that to the schema and annotations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and every parameter has its own description including defaults and allowed values, so the schema carries the full burden. The description contributes zero parameter meaning, which is the baseline-3 case when coverage is high.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description paraphrases the title: 'Access control audit (tm_security). Security scanning and compliance.' It names no verb-specific scope and never distinguishes this tool from close siblings like tm_security_security_audit, tm_security_compliance_check, or tm_security_vulnerability_scan, which the schema parameters (scope, standard, scan_type) hint this tool subsumes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no conditions for choosing between this tool and the three sibling security tools, and no statement of prerequisites. An agent would have to guess based on the name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tm_security_compliance_checkCompliance CheckCRead-onlyIdempotent
Compliance check (tm_security). Security scanning and compliance.
| Name | Required | Description | Default |
|---|---|---|---|
| scope | No | Security areas to audit (security_audit). | |
| standard | No | Compliance standard: cis_benchmark, pci_dss, hipaa (compliance_check). | cis_benchmark |
| username | No | SSH username. | |
| scan_type | No | Scan type: basic, package, config (vulnerability_scan). | basic |
| remote_host | Yes | Remote host to audit. | |
| password_ref | No | Runtime secret reference for the SSH password. | |
| identity_file | No | SSH identity file path. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, openWorldHint=true, idempotentHint=true, and destructiveHint=false. The description adds no behavioral context such as SSH/auth requirements, remote-host implications, or how scope/standard/scan_type alter the check. With annotations covering safety, this is a modest gap but still under-informative.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is very short, but the brevity reflects under-specification rather than efficient communication. The two clauses do not front-load meaningful distinguishing information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With seven parameters, an output schema, and several closely related security siblings, the description should clarify the tool's role and relationship to alternatives. It does not, leaving an agent to rely entirely on schema field names and annotations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all seven parameters are documented in the schema, including the enum-like values for scope, standard, and scan_type. The description adds no parameter meaning beyond the schema, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description largely restates the name and title: 'Compliance check (tm_security). Security scanning and compliance.' It does not specify what is checked or how it differs from sibling tools like tm_security_security_audit, tm_security_vulnerability_scan, or tm_security_access_control_audit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus the many sibling security/audit tools or remote-host tools. An agent is left to infer that this is an umbrella check covering audit, compliance, and vulnerability scan parameters.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tm_security_security_auditSecurity AuditCRead-onlyIdempotent
Security audit (tm_security). Security scanning and compliance.
| Name | Required | Description | Default |
|---|---|---|---|
| scope | No | Security areas to audit (security_audit). | |
| standard | No | Compliance standard: cis_benchmark, pci_dss, hipaa (compliance_check). | cis_benchmark |
| username | No | SSH username. | |
| scan_type | No | Scan type: basic, package, config (vulnerability_scan). | basic |
| remote_host | Yes | Remote host to audit. | |
| password_ref | No | Runtime secret reference for the SSH password. | |
| identity_file | No | SSH identity file path. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false, and openWorldHint=true, and the description adds nothing on top of that. It omits behaviorally significant facts: this tool connects to a remote host over SSH with credentials, and the audit is composed of scan/compliance phases selected by its parameters. No contradiction with annotations, but no added disclosure either.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is short, but the brevity is not earned: the second sentence is filler that adds no information, and the parenthetical "(tm_security)" is namespace noise. Brevity here reflects under-specification rather than efficient front-loading.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with seven parameters that includes SSH username, identity file, and password reference — i.e., it authenticates to and acts on a remote host — the description says nothing about credential handling, required connectivity, or that the audit's breadth is driven by scope/standard/scan_type. An output schema exists, so return values need not be explained, but the invocation context is essentially undocumented.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so every one of the seven parameters is documented in the schema itself, including the scope, standard, and scan_type enumerations. The description contributes no additional meaning (e.g., that scope/standard/scan_type select which sub-audits run), so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description restates the tool name ("Security audit") and appends a vague restatement, "Security scanning and compliance," which does not say what operation is actually performed. It fails to distinguish this tool from close siblings tm_security_compliance_check, tm_security_vulnerability_scan, and tm_security_access_control_audit, which appear to be the specialized components this tool bundles.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no prerequisites, and no alternatives named. With three near-identical security siblings in the tool list, the absence of any routing guidance ("use this for a combined audit; use *_compliance_check for standard-only checks") is a real gap.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tm_security_vulnerability_scanVulnerability ScanCRead-onlyIdempotent
Vulnerability scan (tm_security). Security scanning and compliance.
| Name | Required | Description | Default |
|---|---|---|---|
| scope | No | Security areas to audit (security_audit). | |
| standard | No | Compliance standard: cis_benchmark, pci_dss, hipaa (compliance_check). | cis_benchmark |
| username | No | SSH username. | |
| scan_type | No | Scan type: basic, package, config (vulnerability_scan). | basic |
| remote_host | Yes | Remote host to audit. | |
| password_ref | No | Runtime secret reference for the SSH password. | |
| identity_file | No | SSH identity file path. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, openWorld and non-destructive, so the safety profile is covered. The description adds nothing beyond that: it never mentions that scanning requires SSH credentials (username/password_ref/identity_file), that it reaches out to a remote host, or how long a scan may take.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is short and front-loaded, but the second sentence ("Security scanning and compliance") is pure filler that neither scopes the tool nor routes the agent. Brevity here comes at the cost of under-specification rather than efficiency.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Although an output schema and rich annotations exist, the description leaves a critical ambiguity unresolved: this tool's schema overlaps audit and compliance functionality, and sibling tools exist for exactly those purposes. An agent cannot decide from the description alone when this scan is the right call.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% with 7 well-documented parameters, including enumerated value hints for scan_type and standard. The description contributes no additional parameter semantics, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description only restates the name and title ("Vulnerability scan") and appends a generic category label ("Security scanning and compliance"). It never distinguishes this tool from close siblings such as tm_security_security_audit or tm_security_compliance_check, both of which are even named inside this tool's own parameter descriptions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this scan versus the audit/compliance siblings, no prerequisites, and no exclusions. Worse, the word "compliance" points toward tm_security_compliance_check without clarifying that this tool performs an SSH-based vulnerability scan instead.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tm_system_analyze_logsAnalyze LogsCRead-onlyIdempotent
Analyze logs (tm_system). Remote system intelligence via SSH.
| Name | Required | Description | Default |
|---|---|---|---|
| patterns | No | Search patterns (analyze_logs). | |
| username | No | SSH username. | |
| log_paths | No | Log file paths (analyze_logs). | |
| remote_host | Yes | Remote host. | |
| password_ref | No | Runtime secret reference for the SSH password. | |
| identity_file | No | SSH identity file path. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, openWorldHint=true, and destructiveHint=false, so the safety profile is covered. The description only adds 'via SSH', which hints at remote authentication, but it doesn't explain what the analysis actually does, how much data is read, or any SSH credential expectations beyond what the schema already says.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very short and front-loaded, with no wasted words. But it is under-specified rather than effectively concise: two sentence fragments carry almost no actionable detail about analysis behavior.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a remote log-analysis tool with six parameters, including patterns, log_paths, and SSH auth options, and an output schema. The description leaves the core behavior unexplained: what kind of analysis is performed, how patterns and log_paths interact, and what the output represents. Even with a rich schema and output schema, an agent needs more context to invoke this confidently versus alternatives.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all six parameters are documented in the schema itself. The description adds no parameter-level meaning beyond what the schema provides, which is the baseline 3 when schema coverage is high.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a verb (Analyze) and resource (logs) plus a transport (SSH), so the basic purpose is identifiable. However, 'analyze' is vague and 'Remote system intelligence' is generic, so it doesn't distinguish this from siblings like tm_file_content_search or tm_remote_run_command, which could also read remote logs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given about when to use this tool versus alternatives, nor when not to use it. Nothing tells the agent whether this is for pattern matching in log files, aggregate analysis, or something else, so selection among the many remote/file/system siblings is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tm_system_discover_servicesDiscover ServicesCRead-onlyIdempotent
Discover services (tm_system). Remote system intelligence via SSH.
| Name | Required | Description | Default |
|---|---|---|---|
| patterns | No | Search patterns (analyze_logs). | |
| username | No | SSH username. | |
| log_paths | No | Log file paths (analyze_logs). | |
| remote_host | Yes | Remote host. | |
| password_ref | No | Runtime secret reference for the SSH password. | |
| identity_file | No | SSH identity file path. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already declare readOnlyHint=true, openWorldHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description adds only that access is over SSH, without explaining credential expectations, discovery scope, or what happens with the seemingly unrelated patterns and log_paths parameters.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is only two short sentences with no filler, and the tool identity is front-loaded. The second sentence is vague but still brief and relevant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Although an output schema exists, this is a remote, credential-bearing tool with six parameters and ambiguous fields such as patterns and log_paths. The description does not provide enough context about authentication, scope, or how those parameters relate to service discovery.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the six parameters are documented in the schema and the baseline is 3. However, the description adds no meaning beyond the schema, and the schema itself includes confusing hints like "Search patterns (analyze_logs)" that the description does not clarify.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description largely restates the name and title ("Discover services"), adding only a generic qualifier, "Remote system intelligence via SSH." It does not define what kinds of services are discovered or distinguish the tool from close siblings such as tm_system_get_info or tm_system_network_topology.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives. It does not mention prerequisites, credential requirements, or any conditions under which another sibling tool would be more appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tm_system_get_infoGet InfoCRead-onlyIdempotent
Get info (tm_system). Remote system intelligence via SSH.
| Name | Required | Description | Default |
|---|---|---|---|
| patterns | No | Search patterns (analyze_logs). | |
| username | No | SSH username. | |
| log_paths | No | Log file paths (analyze_logs). | |
| remote_host | Yes | Remote host. | |
| password_ref | No | Runtime secret reference for the SSH password. | |
| identity_file | No | SSH identity file path. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already declare that this is a read-only, idempotent, non-destructive, open-world operation. The description adds only that it works over SSH, which is modest context beyond the annotations, but it does not clarify what remote system information is collected or any authentication/rate constraints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short, but it is under-specified rather than efficient. Two fragments provide little actionable information and do not front-load the tool's actual scope or distinction from siblings.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Although an output schema exists and the input schema is fully documented, the description is too vague for an agent to understand what 'system info' means relative to sibling tools. It does not clarify the remote-information scope or when this generic operation is preferable to more specific system-analysis tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all six parameters, including SSH credentials and log-related fields. The description adds no parameter-specific meaning beyond what the schema provides, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description says only 'Get info (tm_system)' plus 'Remote system intelligence via SSH', which largely restates the tool name and title without specifying what information is retrieved. It does not distinguish this from sibling system tools such as tm_system_discover_services, tm_system_analyze_logs, or tm_system_network_topology.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool instead of alternatives, no prerequisites, and no exclusions. The mention of SSH is a mechanism, not usage guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tm_system_network_topologyNetwork TopologyC
Network topology (tm_system). Remote system intelligence via SSH.
| Name | Required | Description | Default |
|---|---|---|---|
| patterns | No | Search patterns (analyze_logs). | |
| username | No | SSH username. | |
| log_paths | No | Log file paths (analyze_logs). | |
| remote_host | Yes | Remote host. | |
| password_ref | No | Runtime secret reference for the SSH password. | |
| identity_file | No | SSH identity file path. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations state readOnlyHint=false, openWorldHint=true, and idempotentHint=false, but the description does not explain what side effects or remote changes are possible, what topology data is gathered, or why a topology call is not read-only. 'Remote system intelligence via SSH' is too vague to add behavioral context beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short but under-specified rather than concise. Two sentence fragments leave the main concept ('network topology') unexplained and do not front-load actionable information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Even though an output schema and annotations exist, the description omits what topology information is returned and how SSH credentials are used. For a six-parameter, open-world remote-operation tool, it does not give enough context to call it confidently.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the description need not document the six parameters in detail. However, it adds no meaning about how remote_host, username, identity_file, password_ref, patterns, or log_paths affect topology discovery; baseline 3 is appropriate given the complete schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description mostly restates the title ('Network topology') and adds only a vague phrase, 'Remote system intelligence via SSH.' It does not state a specific action (collect? map? audit?) or distinguish this tool from siblings like tm_system_discover_services or tm_system_get_info.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given about when to use this tool versus alternatives, nor about prerequisites such as SSH credentials or when topology discovery is appropriate. The note that it works 'via SSH' gives context but no selection criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tunnel_ingest_hostsIngest Hosts to Knowledge GraphCRead-onlyIdempotent
List the managed SSH inventory and push it into the epistemic-graph KG.
Maps each alias → a typed :Host node (+ :HostGroup / :SshKey and
their :inGroup / :usesKey links). Best-effort: no-ops cleanly when no
KG engine is reachable.
| Name | Required | Description | Default |
|---|---|---|---|
| group | No | HostGroup name to attach the ingested hosts to. | all |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description's claim to 'push it into the epistemic-graph KG' suggests a write operation, contradicting the annotation readOnlyHint=true. Annotations indicate no modifications, while the description implies data ingestion. This is a clear annotation contradiction, lowering the score to 1.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences long, with the first sentence stating the core purpose and the second providing behavioral detail. Every word is necessary, and critical information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the output schema exists and schema coverage is high, the description covers the main action and best-effort behavior. However, it fails to explain the group parameter's role and does not differentiate from sibling tools, leaving gaps for an agent choosing among related tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the single parameter, so baseline is 3. The description does not add any meaning beyond the schema's description of the 'group' parameter; it omits explaining its role in attaching hosts to a host group.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action: 'List the managed SSH inventory and push it into the epistemic-graph KG.' This clearly identifies the verb and resource. However, it does not explicitly differentiate itself from sibling tools like tm_inventory or tm_hosts, which may have overlapping functionality.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions 'Best-effort: no-ops cleanly when no KG engine is reachable,' which implies safe usage but does not specify when to use this tool versus alternatives like tm_inventory for direct inventory listing or tm_hosts for host management. No explicit when-not or alternative guidance is given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tunnel_manager_add_hostAdd hostD
Invoke the add_host operation.
| Name | Required | Description | Default |
|---|---|---|---|
| port | No | ||
| user | Yes | ||
| alias | Yes | ||
| hostname | Yes | ||
| password | No | ||
| params_json | No | {} | |
| password_ref | No | ||
| identity_file | No | ||
| proxy_command | No | ||
| known_hosts_file | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false and openWorldHint=true, so openness to network is covered, but the description adds nothing: it doesn't say whether the host is persisted to a config/inventory file, how password vs. password_ref vs. identity_file interact, or what happens on duplicate alias. No contradiction with annotations, but zero added behavioral context for a mutation with 10 parameters.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is one short sentence, but the brevity is under-specification rather than efficiency; there is nothing front-loaded about behavior, scope, or parameters.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 10-parameter write operation with no schema descriptions and no output schema, the description supplies none of the missing context an agent needs to call it correctly or predict its effects.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across 10 parameters, including ambiguous ones like params_json, password_ref, known_hosts_file, and proxy_command. The description provides no semantics for any of them, leaving the agent with property names only.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
"Invoke the add_host operation" only restates the tool name and title; it names no resource beyond the alias 'host' and gives no scope. It does not distinguish this from siblings like tunnel_manager_load_inventory, tunnel_ingest_hosts, or tm_remote_copy_ssh_config, all of which also bring hosts into the system.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this versus loading an inventory or ingesting hosts, and no prerequisites (e.g., needing existing credentials or a reachable SSH target) are stated. The agent must infer everything from the name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tunnel_manager_get_hostGet hostARead-onlyIdempotent
Get a host config by alias, denying an alias the caller isn't entitled to.
Returns None when the alias is simply unknown (unchanged, callers
fall back to raw connection params), but raises PermissionError
when the alias exists and the caller's identity is not entitled to it.
| Name | Required | Description | Default |
|---|---|---|---|
| alias | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations, the description discloses important behavioral details: it returns None for an unknown alias and raises PermissionError when the alias exists but the caller is not entitled to it. It does not describe the successful return shape, but it adds meaningful auth and fallback context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is reasonably front-loaded, starting with the core purpose before the return and exception behavior. It is slightly verbose with parenthetical fallback context, but every sentence provides useful operational detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter read-only lookup with rich annotations, the description covers the key failure modes and fallback behavior. The main remaining gap is that it does not describe the successful return value beyond calling it a "host config."
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must carry the burden for the single alias parameter. It clarifies that alias identifies a host config and distinguishes unknown aliases from unauthorized aliases, but it does not specify alias format or case sensitivity.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: "Get a host config by alias." It is clear what the tool retrieves, but it does not explicitly distinguish itself from siblings such as tunnel_manager_list_hosts or tunnel_manager_add_host.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the alias-based lookup and by the note that unknown aliases cause callers to fall back to raw connection params. However, it does not explicitly say when to use this instead of tunnel_manager_list_hosts or other host-management siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tunnel_manager_list_hostsList hostsARead-onlyIdempotent
List the host aliases the CALLER is entitled to, secrets redacted.
Scoped to the caller's Okta/Keycloak identity
(CONCEPT:AU-OS.identity.identity-scoped-resource-autoload); an
unauthenticated/local caller (SYSTEM_ACTOR) sees all — unchanged from
today. Each entry excludes password/password_ref in favor of a
password_configured boolean so listing hosts never leaks secrets.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover readOnly/idempotent/openWorld, but the description adds real behavioral context: results are filtered by caller identity, unauthenticated SYSTEM_ACTOR callers bypass the filter, and secrets are never returned (password/password_ref replaced by password_configured). The internal concept tag and 'unchanged from today' changelog phrasing dilute but don't negate that value.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The purpose is correctly front-loaded in the opening sentence, and the redaction detail earns its place. However, the second paragraph leaks internal dev artifacts — a namespaced CONCEPT identifier, 'SYSTEM_ACTOR', and 'unchanged from today' — which are implementation notes rather than agent-facing guidance, so the text is longer than it needs to be.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description usefully sketches the return shape (host aliases with password_configured instead of password fields) and the visibility rule that determines the result set. It omits ordering/pagination expectations and what fields an entry otherwise carries, which is a minor gap for a zero-arg list tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so the baseline is 4; there is nothing the description could add on this dimension and nothing it misrepresents.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The first sentence gives a specific verb and resource ('List the host aliases') plus the two defining scope qualifiers: entitlement-scoped to the caller and secrets redacted. 'List' vs. the sibling 'tunnel_manager_get_host' / 'add_host' / 'remove_host' is inferable from the verb, but no sibling is named explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied: reach for this to enumerate hosts the caller can see, and get_host for a single one. The description explains the identity-scoping rule but never states when to prefer this over get_host or over the inventory tools, and gives no exclusions or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tunnel_manager_load_inventoryLoad inventoryC
Invoke the load_inventory operation.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint=false and openWorldHint=true, meaning this is a mutating, externally-connected operation, yet the description says nothing about side effects, what is overwritten or merged, permission requirements, or where the external load happens. For an open-world write operation this is a significant disclosure gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The single sentence is technically free of padding but is pure under-specification rather than conciseness; it conveys no information an agent could act on beyond the tool name it already sees.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an empty schema, no output schema, and an open-world mutation annotation, the description is the only place to explain source of the inventory and resulting state, and it provides none of that. An agent cannot predict what calling this does.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters and schema coverage is 100%, so there is nothing for the description to clarify about inputs. Baseline 4 applies since the description cannot add parameter meaning to an empty schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
"Invoke the load_inventory operation" is a tautology that restates the tool name and title without saying what an inventory is, where it is loaded from, or into what. It also fails to distinguish this from the sibling tunnel_manager_save_inventory, which is the natural counterpart an agent would confuse it with.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this versus tunnel_manager_save_inventory, tm_inventory_mesh_bootstrap, or tunnel_ingest_hosts, all of which plausibly deal with inventory data. The agent gets no prerequisites, ordering constraints, or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tunnel_manager_remove_hostRemove hostDDestructive
Invoke the remove_host operation.
| Name | Required | Description | Default |
|---|---|---|---|
| alias | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true, readOnlyHint=false, and openWorldHint=true, so the safety profile is covered by structured data. The description adds nothing beyond that — no statement of what is destroyed, whether the change persists to the saved inventory, or whether confirmation is required.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One short sentence, so there is no padding to trim, but the brevity reflects under-specification rather than economy. Nothing is front-loaded because there is no substantive content to order.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive, open-world mutation with no output schema and an undocumented required parameter, the description should explain effects and side effects. Instead it gives an agent nothing beyond what the annotations and a one-field schema already say.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the single `alias` parameter is undocumented in both schema and description. The description never explains what an alias refers to, whether it must match an existing entry, or what happens on a bad value, so it fails to compensate for the coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The sentence 'Invoke the remove_host operation' merely restates the tool name and title without adding a specific verb-plus-resource framing of its own. It implies deletion of a host but never says what a host is in this context or what is removed from (inventory, tunnel config, SSH config).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no precondition, and no pointer to alternatives. Given siblings like tm_remote_remove_host_key and tunnel_manager_list_hosts, an agent gets no help deciding whether this is the right removal tool or which should run first.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tunnel_manager_save_inventorySave inventoryC
Invoke the save_inventory operation.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false, openWorldHint=true and destructiveHint=false, so the safety profile is covered. The description adds nothing beyond that: it does not say whether saving overwrites an existing inventory, where the inventory data comes from, or what permissions/connectivity the open-world operation requires.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is a single short sentence, but it is under-specified rather than concise — the one sentence it contains carries no information beyond the title, so it does not earn its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and a state-changing (non-readOnly) operation, the description should explain what gets persisted and what the agent should expect. Instead it supplies nothing, leaving the agent unable to distinguish save from load or ingest in this 40-tool surface.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, which is the baseline-4 case; there is no parameter semantics for the description to clarify. Schema coverage is 100% and the empty object schema matches the description's implication of a parameterless invocation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description is a restatement of the tool name and title ("save_inventory" / "Save inventory") with no added specificity. It does not say what an inventory is, what is being saved, or how it differs from tunnel_manager_load_inventory or tunnel_ingest_hosts.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this versus tunnel_manager_load_inventory, tunnel_ingest_hosts, or tunnel_manager_add_host. The agent must infer the workflow from the tool name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
9 tool updates
v3.4.6- Changed
tm_remote_check_ssh20 fields changed- changed
Input schema / properties / certificate / defaultPrevious value: -""New value: +null - changed
Input schema / properties / certificate / descriptionPrevious value: -"Teleport certificate."New value: +"Teleport certificate; unset uses the alias." - added
Input schema / properties / cfg / anyOfAdded value: +[ + { + "type": "string" + }, + { + "type": "null" + } +] - changed
Input schema / properties / cfg / defaultPrevious value: -"/root/.ssh/config"New value: +null - changed
Input schema / properties / cfg / descriptionPrevious value: -"SSH config path."New value: +"SSH config path; unset uses ~/.ssh/config." - removed
Input schema / properties / cfg / typeRemoved value: -"string" - added
Input schema / properties / confirmAdded value: +{ + "default": false, + "description": "Confirm a destructive action (remove_host_key) without elicitation.", + "type": "boolean" +} - changed
Input schema / properties / host / descriptionPrevious value: -"Remote host."New value: +"Inventory alias, or a raw hostname with an explicit user." - changed
Input schema / properties / id_file / defaultPrevious value: -"/app/.ssh/id_ed25519"New value: +null - changed
Input schema / properties / id_file / descriptionPrevious value: -"Private key path."New value: +"Private key path; unset uses the alias." - changed
Input schema / properties / password_ref / defaultPrevious value: -""New value: +null - changed
Input schema / properties / password_ref / descriptionPrevious value: -"Runtime secret reference for the SSH password."New value: +"Runtime secret reference for the SSH password; unset uses the alias." - added
Input schema / properties / port / anyOfAdded value: +[ + { + "type": "integer" + }, + { + "type": "null" + } +] - changed
Input schema / properties / port / defaultPrevious value: -22New value: +null - changed
Input schema / properties / port / descriptionPrevious value: -"Port."New value: +"Port; unset uses the inventory alias, else 22." - removed
Input schema / properties / port / typeRemoved value: -"integer" - changed
Input schema / properties / proxy / defaultPrevious value: -""New value: +null - changed
Input schema / properties / proxy / descriptionPrevious value: -"Teleport proxy."New value: +"Teleport proxy; unset uses the alias." - changed
Input schema / properties / user / defaultPrevious value: -""New value: +null - changed
Input schema / properties / user / descriptionPrevious value: -"Username."New value: +"Username; unset uses the inventory alias."
- Changed
tm_remote_copy_ssh_config20 fields changed- changed
Input schema / properties / certificate / defaultPrevious value: -""New value: +null - changed
Input schema / properties / certificate / descriptionPrevious value: -"Teleport certificate."New value: +"Teleport certificate; unset uses the alias." - added
Input schema / properties / cfg / anyOfAdded value: +[ + { + "type": "string" + }, + { + "type": "null" + } +] - changed
Input schema / properties / cfg / defaultPrevious value: -"/root/.ssh/config"New value: +null - changed
Input schema / properties / cfg / descriptionPrevious value: -"SSH config path."New value: +"SSH config path; unset uses ~/.ssh/config." - removed
Input schema / properties / cfg / typeRemoved value: -"string" - added
Input schema / properties / confirmAdded value: +{ + "default": false, + "description": "Confirm a destructive action (remove_host_key) without elicitation.", + "type": "boolean" +} - changed
Input schema / properties / host / descriptionPrevious value: -"Remote host."New value: +"Inventory alias, or a raw hostname with an explicit user." - changed
Input schema / properties / id_file / defaultPrevious value: -"/app/.ssh/id_ed25519"New value: +null - changed
Input schema / properties / id_file / descriptionPrevious value: -"Private key path."New value: +"Private key path; unset uses the alias." - changed
Input schema / properties / password_ref / defaultPrevious value: -""New value: +null - changed
Input schema / properties / password_ref / descriptionPrevious value: -"Runtime secret reference for the SSH password."New value: +"Runtime secret reference for the SSH password; unset uses the alias." - added
Input schema / properties / port / anyOfAdded value: +[ + { + "type": "integer" + }, + { + "type": "null" + } +] - changed
Input schema / properties / port / defaultPrevious value: -22New value: +null - changed
Input schema / properties / port / descriptionPrevious value: -"Port."New value: +"Port; unset uses the inventory alias, else 22." - removed
Input schema / properties / port / typeRemoved value: -"integer" - changed
Input schema / properties / proxy / defaultPrevious value: -""New value: +null - changed
Input schema / properties / proxy / descriptionPrevious value: -"Teleport proxy."New value: +"Teleport proxy; unset uses the alias." - changed
Input schema / properties / user / defaultPrevious value: -""New value: +null - changed
Input schema / properties / user / descriptionPrevious value: -"Username."New value: +"Username; unset uses the inventory alias."
- Changed
tm_remote_receive_file20 fields changed- changed
Input schema / properties / certificate / defaultPrevious value: -""New value: +null - changed
Input schema / properties / certificate / descriptionPrevious value: -"Teleport certificate."New value: +"Teleport certificate; unset uses the alias." - added
Input schema / properties / cfg / anyOfAdded value: +[ + { + "type": "string" + }, + { + "type": "null" + } +] - changed
Input schema / properties / cfg / defaultPrevious value: -"/root/.ssh/config"New value: +null - changed
Input schema / properties / cfg / descriptionPrevious value: -"SSH config path."New value: +"SSH config path; unset uses ~/.ssh/config." - removed
Input schema / properties / cfg / typeRemoved value: -"string" - added
Input schema / properties / confirmAdded value: +{ + "default": false, + "description": "Confirm a destructive action (remove_host_key) without elicitation.", + "type": "boolean" +} - changed
Input schema / properties / host / descriptionPrevious value: -"Remote host."New value: +"Inventory alias, or a raw hostname with an explicit user." - changed
Input schema / properties / id_file / defaultPrevious value: -"/app/.ssh/id_ed25519"New value: +null - changed
Input schema / properties / id_file / descriptionPrevious value: -"Private key path."New value: +"Private key path; unset uses the alias." - changed
Input schema / properties / password_ref / defaultPrevious value: -""New value: +null - changed
Input schema / properties / password_ref / descriptionPrevious value: -"Runtime secret reference for the SSH password."New value: +"Runtime secret reference for the SSH password; unset uses the alias." - added
Input schema / properties / port / anyOfAdded value: +[ + { + "type": "integer" + }, + { + "type": "null" + } +] - changed
Input schema / properties / port / defaultPrevious value: -22New value: +null - changed
Input schema / properties / port / descriptionPrevious value: -"Port."New value: +"Port; unset uses the inventory alias, else 22." - removed
Input schema / properties / port / typeRemoved value: -"integer" - changed
Input schema / properties / proxy / defaultPrevious value: -""New value: +null - changed
Input schema / properties / proxy / descriptionPrevious value: -"Teleport proxy."New value: +"Teleport proxy; unset uses the alias." - changed
Input schema / properties / user / defaultPrevious value: -""New value: +null - changed
Input schema / properties / user / descriptionPrevious value: -"Username."New value: +"Username; unset uses the inventory alias."
- Changed
tm_remote_remove_host_key20 fields changed- changed
Input schema / properties / certificate / defaultPrevious value: -""New value: +null - changed
Input schema / properties / certificate / descriptionPrevious value: -"Teleport certificate."New value: +"Teleport certificate; unset uses the alias." - added
Input schema / properties / cfg / anyOfAdded value: +[ + { + "type": "string" + }, + { + "type": "null" + } +] - changed
Input schema / properties / cfg / defaultPrevious value: -"/root/.ssh/config"New value: +null - changed
Input schema / properties / cfg / descriptionPrevious value: -"SSH config path."New value: +"SSH config path; unset uses ~/.ssh/config." - removed
Input schema / properties / cfg / typeRemoved value: -"string" - added
Input schema / properties / confirmAdded value: +{ + "default": false, + "description": "Confirm a destructive action (remove_host_key) without elicitation.", + "type": "boolean" +} - changed
Input schema / properties / host / descriptionPrevious value: -"Remote host."New value: +"Inventory alias, or a raw hostname with an explicit user." - changed
Input schema / properties / id_file / defaultPrevious value: -"/app/.ssh/id_ed25519"New value: +null - changed
Input schema / properties / id_file / descriptionPrevious value: -"Private key path."New value: +"Private key path; unset uses the alias." - changed
Input schema / properties / password_ref / defaultPrevious value: -""New value: +null - changed
Input schema / properties / password_ref / descriptionPrevious value: -"Runtime secret reference for the SSH password."New value: +"Runtime secret reference for the SSH password; unset uses the alias." - added
Input schema / properties / port / anyOfAdded value: +[ + { + "type": "integer" + }, + { + "type": "null" + } +] - changed
Input schema / properties / port / defaultPrevious value: -22New value: +null - changed
Input schema / properties / port / descriptionPrevious value: -"Port."New value: +"Port; unset uses the inventory alias, else 22." - removed
Input schema / properties / port / typeRemoved value: -"integer" - changed
Input schema / properties / proxy / defaultPrevious value: -""New value: +null - changed
Input schema / properties / proxy / descriptionPrevious value: -"Teleport proxy."New value: +"Teleport proxy; unset uses the alias." - changed
Input schema / properties / user / defaultPrevious value: -""New value: +null - changed
Input schema / properties / user / descriptionPrevious value: -"Username."New value: +"Username; unset uses the inventory alias."
- Changed
tm_remote_rotate_key20 fields changed- changed
Input schema / properties / certificate / defaultPrevious value: -""New value: +null - changed
Input schema / properties / certificate / descriptionPrevious value: -"Teleport certificate."New value: +"Teleport certificate; unset uses the alias." - added
Input schema / properties / cfg / anyOfAdded value: +[ + { + "type": "string" + }, + { + "type": "null" + } +] - changed
Input schema / properties / cfg / defaultPrevious value: -"/root/.ssh/config"New value: +null - changed
Input schema / properties / cfg / descriptionPrevious value: -"SSH config path."New value: +"SSH config path; unset uses ~/.ssh/config." - removed
Input schema / properties / cfg / typeRemoved value: -"string" - added
Input schema / properties / confirmAdded value: +{ + "default": false, + "description": "Confirm a destructive action (remove_host_key) without elicitation.", + "type": "boolean" +} - changed
Input schema / properties / host / descriptionPrevious value: -"Remote host."New value: +"Inventory alias, or a raw hostname with an explicit user." - changed
Input schema / properties / id_file / defaultPrevious value: -"/app/.ssh/id_ed25519"New value: +null - changed
Input schema / properties / id_file / descriptionPrevious value: -"Private key path."New value: +"Private key path; unset uses the alias." - changed
Input schema / properties / password_ref / defaultPrevious value: -""New value: +null - changed
Input schema / properties / password_ref / descriptionPrevious value: -"Runtime secret reference for the SSH password."New value: +"Runtime secret reference for the SSH password; unset uses the alias." - added
Input schema / properties / port / anyOfAdded value: +[ + { + "type": "integer" + }, + { + "type": "null" + } +] - changed
Input schema / properties / port / defaultPrevious value: -22New value: +null - changed
Input schema / properties / port / descriptionPrevious value: -"Port."New value: +"Port; unset uses the inventory alias, else 22." - removed
Input schema / properties / port / typeRemoved value: -"integer" - changed
Input schema / properties / proxy / defaultPrevious value: -""New value: +null - changed
Input schema / properties / proxy / descriptionPrevious value: -"Teleport proxy."New value: +"Teleport proxy; unset uses the alias." - changed
Input schema / properties / user / defaultPrevious value: -""New value: +null - changed
Input schema / properties / user / descriptionPrevious value: -"Username."New value: +"Username; unset uses the inventory alias."
- Changed
tm_remote_run_command20 fields changed- changed
Input schema / properties / certificate / defaultPrevious value: -""New value: +null - changed
Input schema / properties / certificate / descriptionPrevious value: -"Teleport certificate."New value: +"Teleport certificate; unset uses the alias." - added
Input schema / properties / cfg / anyOfAdded value: +[ + { + "type": "string" + }, + { + "type": "null" + } +] - changed
Input schema / properties / cfg / defaultPrevious value: -"/root/.ssh/config"New value: +null - changed
Input schema / properties / cfg / descriptionPrevious value: -"SSH config path."New value: +"SSH config path; unset uses ~/.ssh/config." - removed
Input schema / properties / cfg / typeRemoved value: -"string" - added
Input schema / properties / confirmAdded value: +{ + "default": false, + "description": "Confirm a destructive action (remove_host_key) without elicitation.", + "type": "boolean" +} - changed
Input schema / properties / host / descriptionPrevious value: -"Remote host."New value: +"Inventory alias, or a raw hostname with an explicit user." - changed
Input schema / properties / id_file / defaultPrevious value: -"/app/.ssh/id_ed25519"New value: +null - changed
Input schema / properties / id_file / descriptionPrevious value: -"Private key path."New value: +"Private key path; unset uses the alias." - changed
Input schema / properties / password_ref / defaultPrevious value: -""New value: +null - changed
Input schema / properties / password_ref / descriptionPrevious value: -"Runtime secret reference for the SSH password."New value: +"Runtime secret reference for the SSH password; unset uses the alias." - added
Input schema / properties / port / anyOfAdded value: +[ + { + "type": "integer" + }, + { + "type": "null" + } +] - changed
Input schema / properties / port / defaultPrevious value: -22New value: +null - changed
Input schema / properties / port / descriptionPrevious value: -"Port."New value: +"Port; unset uses the inventory alias, else 22." - removed
Input schema / properties / port / typeRemoved value: -"integer" - changed
Input schema / properties / proxy / defaultPrevious value: -""New value: +null - changed
Input schema / properties / proxy / descriptionPrevious value: -"Teleport proxy."New value: +"Teleport proxy; unset uses the alias." - changed
Input schema / properties / user / defaultPrevious value: -""New value: +null - changed
Input schema / properties / user / descriptionPrevious value: -"Username."New value: +"Username; unset uses the inventory alias."
- Changed
tm_remote_send_file20 fields changed- changed
Input schema / properties / certificate / defaultPrevious value: -""New value: +null - changed
Input schema / properties / certificate / descriptionPrevious value: -"Teleport certificate."New value: +"Teleport certificate; unset uses the alias." - added
Input schema / properties / cfg / anyOfAdded value: +[ + { + "type": "string" + }, + { + "type": "null" + } +] - changed
Input schema / properties / cfg / defaultPrevious value: -"/root/.ssh/config"New value: +null - changed
Input schema / properties / cfg / descriptionPrevious value: -"SSH config path."New value: +"SSH config path; unset uses ~/.ssh/config." - removed
Input schema / properties / cfg / typeRemoved value: -"string" - added
Input schema / properties / confirmAdded value: +{ + "default": false, + "description": "Confirm a destructive action (remove_host_key) without elicitation.", + "type": "boolean" +} - changed
Input schema / properties / host / descriptionPrevious value: -"Remote host."New value: +"Inventory alias, or a raw hostname with an explicit user." - changed
Input schema / properties / id_file / defaultPrevious value: -"/app/.ssh/id_ed25519"New value: +null - changed
Input schema / properties / id_file / descriptionPrevious value: -"Private key path."New value: +"Private key path; unset uses the alias." - changed
Input schema / properties / password_ref / defaultPrevious value: -""New value: +null - changed
Input schema / properties / password_ref / descriptionPrevious value: -"Runtime secret reference for the SSH password."New value: +"Runtime secret reference for the SSH password; unset uses the alias." - added
Input schema / properties / port / anyOfAdded value: +[ + { + "type": "integer" + }, + { + "type": "null" + } +] - changed
Input schema / properties / port / defaultPrevious value: -22New value: +null - changed
Input schema / properties / port / descriptionPrevious value: -"Port."New value: +"Port; unset uses the inventory alias, else 22." - removed
Input schema / properties / port / typeRemoved value: -"integer" - changed
Input schema / properties / proxy / defaultPrevious value: -""New value: +null - changed
Input schema / properties / proxy / descriptionPrevious value: -"Teleport proxy."New value: +"Teleport proxy; unset uses the alias." - changed
Input schema / properties / user / defaultPrevious value: -""New value: +null - changed
Input schema / properties / user / descriptionPrevious value: -"Username."New value: +"Username; unset uses the inventory alias."
- Changed
tm_remote_setup_passwordless20 fields changed- changed
Input schema / properties / certificate / defaultPrevious value: -""New value: +null - changed
Input schema / properties / certificate / descriptionPrevious value: -"Teleport certificate."New value: +"Teleport certificate; unset uses the alias." - added
Input schema / properties / cfg / anyOfAdded value: +[ + { + "type": "string" + }, + { + "type": "null" + } +] - changed
Input schema / properties / cfg / defaultPrevious value: -"/root/.ssh/config"New value: +null - changed
Input schema / properties / cfg / descriptionPrevious value: -"SSH config path."New value: +"SSH config path; unset uses ~/.ssh/config." - removed
Input schema / properties / cfg / typeRemoved value: -"string" - added
Input schema / properties / confirmAdded value: +{ + "default": false, + "description": "Confirm a destructive action (remove_host_key) without elicitation.", + "type": "boolean" +} - changed
Input schema / properties / host / descriptionPrevious value: -"Remote host."New value: +"Inventory alias, or a raw hostname with an explicit user." - changed
Input schema / properties / id_file / defaultPrevious value: -"/app/.ssh/id_ed25519"New value: +null - changed
Input schema / properties / id_file / descriptionPrevious value: -"Private key path."New value: +"Private key path; unset uses the alias." - changed
Input schema / properties / password_ref / defaultPrevious value: -""New value: +null - changed
Input schema / properties / password_ref / descriptionPrevious value: -"Runtime secret reference for the SSH password."New value: +"Runtime secret reference for the SSH password; unset uses the alias." - added
Input schema / properties / port / anyOfAdded value: +[ + { + "type": "integer" + }, + { + "type": "null" + } +] - changed
Input schema / properties / port / defaultPrevious value: -22New value: +null - changed
Input schema / properties / port / descriptionPrevious value: -"Port."New value: +"Port; unset uses the inventory alias, else 22." - removed
Input schema / properties / port / typeRemoved value: -"integer" - changed
Input schema / properties / proxy / defaultPrevious value: -""New value: +null - changed
Input schema / properties / proxy / descriptionPrevious value: -"Teleport proxy."New value: +"Teleport proxy; unset uses the alias." - changed
Input schema / properties / user / defaultPrevious value: -""New value: +null - changed
Input schema / properties / user / descriptionPrevious value: -"Username."New value: +"Username; unset uses the inventory alias."
- Changed
tm_remote_test_key_auth20 fields changed- changed
Input schema / properties / certificate / defaultPrevious value: -""New value: +null - changed
Input schema / properties / certificate / descriptionPrevious value: -"Teleport certificate."New value: +"Teleport certificate; unset uses the alias." - added
Input schema / properties / cfg / anyOfAdded value: +[ + { + "type": "string" + }, + { + "type": "null" + } +] - changed
Input schema / properties / cfg / defaultPrevious value: -"/root/.ssh/config"New value: +null - changed
Input schema / properties / cfg / descriptionPrevious value: -"SSH config path."New value: +"SSH config path; unset uses ~/.ssh/config." - removed
Input schema / properties / cfg / typeRemoved value: -"string" - added
Input schema / properties / confirmAdded value: +{ + "default": false, + "description": "Confirm a destructive action (remove_host_key) without elicitation.", + "type": "boolean" +} - changed
Input schema / properties / host / descriptionPrevious value: -"Remote host."New value: +"Inventory alias, or a raw hostname with an explicit user." - changed
Input schema / properties / id_file / defaultPrevious value: -"/app/.ssh/id_ed25519"New value: +null - changed
Input schema / properties / id_file / descriptionPrevious value: -"Private key path."New value: +"Private key path; unset uses the alias." - changed
Input schema / properties / password_ref / defaultPrevious value: -""New value: +null - changed
Input schema / properties / password_ref / descriptionPrevious value: -"Runtime secret reference for the SSH password."New value: +"Runtime secret reference for the SSH password; unset uses the alias." - added
Input schema / properties / port / anyOfAdded value: +[ + { + "type": "integer" + }, + { + "type": "null" + } +] - changed
Input schema / properties / port / defaultPrevious value: -22New value: +null - changed
Input schema / properties / port / descriptionPrevious value: -"Port."New value: +"Port; unset uses the inventory alias, else 22." - removed
Input schema / properties / port / typeRemoved value: -"integer" - changed
Input schema / properties / proxy / defaultPrevious value: -""New value: +null - changed
Input schema / properties / proxy / descriptionPrevious value: -"Teleport proxy."New value: +"Teleport proxy; unset uses the alias." - changed
Input schema / properties / user / defaultPrevious value: -""New value: +null - changed
Input schema / properties / user / descriptionPrevious value: -"Username."New value: +"Username; unset uses the inventory alias."
47 tool updates
v3.3.1- Added
tm_file_backup - Added
tm_file_content_search - Added
tm_file_diff_compare - Added
tm_file_recursive_ops - Added
tm_file_watch - Removed
tm_files - Removed
tm_hosts - Removed
tm_inventory - Added
tm_inventory_configure_key_auth - Added
tm_inventory_copy_ssh_config - Added
tm_inventory_mesh_bootstrap - Added
tm_inventory_receive_file - Added
tm_inventory_rotate_key - Added
tm_inventory_run_command - Added
tm_inventory_send_file - Added
tm_operation_cancel - Added
tm_operation_get_metrics - Added
tm_operation_get_progress - Added
tm_operation_list_sessions - Added
tm_operation_start - Removed
tm_operations - Removed
tm_remote - Added
tm_remote_check_ssh - Added
tm_remote_copy_ssh_config - Added
tm_remote_receive_file - Added
tm_remote_remove_host_key - Added
tm_remote_rotate_key - Added
tm_remote_run_command - Added
tm_remote_send_file - Added
tm_remote_setup_passwordless - Added
tm_remote_test_key_auth - Removed
tm_security - Added
tm_security_access_control_audit - Added
tm_security_compliance_check - Added
tm_security_security_audit - Added
tm_security_vulnerability_scan - Removed
tm_system - Added
tm_system_analyze_logs - Added
tm_system_discover_services - Added
tm_system_get_info - Added
tm_system_network_topology - Added
tunnel_manager_add_host - Added
tunnel_manager_get_host - Added
tunnel_manager_list_hosts - Added
tunnel_manager_load_inventory - Added
tunnel_manager_remove_host - Added
tunnel_manager_save_inventory
8 tool updates
v2.0.1- First observed
tm_files - First observed
tm_hosts - First observed
tm_inventory - First observed
tm_operations - First observed
tm_remote - First observed
tm_security - First observed
tm_system - First observed
tunnel_ingest_hosts
TDQS
Scored across 41 tools
The tm_remote_* and tm_inventory_* families duplicate actions such as run_command, send_file, receive_file, copy_ssh_config, and rotate_key, distinguished mainly by single-host vs bulk YAML-group scope. Host listing/inventory tools also overlap conceptually, though security and operation-lifecycle tools are clearer.
Names are consistently snake_case, but prefixes mix tunnel_manager_, tm_, and tunnel_, and tm_security_security_audit redundantly repeats the domain. The domain-grouping is readable, but the convention is not fully predictable.
41 tools is heavy for a tunnel manager and includes many niche file, system, and security operations. Several tools are near-variants of the same action across remote and inventory scopes, suggesting the surface is over-scoped.
Coverage is broad across host inventory, remote operations, bulk inventory, files, system intelligence, security, and operation lifecycle. However, there is no explicit update_host operation and no obvious tunnel open/close/list lifecycle despite the server name, leaving notable gaps.
Maintenance
Related MCP Connectors
Secure MCP server for exploring incwo CRM data, documents, and email workflows.
Secure and manage MCP servers through the Speakeasy AI Control Plane from your agent.
Related MCP Servers
- AlicenseBqualityAmaintenanceA server that enables secure interaction with remote SSH hosts through standardized MCP interface, providing functions like listing hosts, executing commands, and transferring files using native SSH tools.7545 npm103MIT
- AlicenseNot gradedqualityDmaintenanceMCP server for SSH remote execution, file transfer, and file editing with automatic backup/trash and ~/.ssh/config integration.117 npm1MIT
- AlicenseAqualityDmaintenanceMCP server for managing remote servers via SSH, enabling command execution, file transfer, rsync, tunnels, health checks, backups, and database operations.172,431 npm1MIT
- AlicenseNot gradedqualityBmaintenanceMCP server providing safe, persistent SSH sessions to remote machines with multi-hop ProxyJump tunneling, SFTP file transfer, and stored host profiles.MIT