HexStrike AI MCP
Supports optional isolated execution of tools and commands inside Docker containers when Docker is installed on the server, providing a sandboxed alternative to running directly on the host.
Supports optional isolated execution of tools and commands inside Podman containers when Podman is installed on the server, providing a sandboxed alternative to running directly on the host.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@HexStrike AI MCPrun nmap against scanme.nmap.org and summarize open ports"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
HexStrike AI MCP
HexStrike connects AI assistants to the tools, terminal, files and browser on your server through the Model Context Protocol (MCP). Your AI client requests work; HexStrike runs it, records output and evidence, and shows progress in a terminal dashboard.
What it does
Runs installed command-line tools and custom scripts without requiring an adapter for each program.
Supports persistent shells and REPLs, incremental input/output, terminal resizing, timeouts and cancellation.
Provides browser navigation, forms, screenshots, uploads/downloads and saved sessions.
Discovers server executables and offers optional typed adapters for structured arguments and results.
Retains jobs, paginated evidence and local memory for subsequent review.
Shows jobs, sessions, installed tools and connection settings in the server dashboard.
Ten MCP tools provide discovery, execution and result retrieval. Detailed capability schemas load when requested. Available software and the server account's OS permissions determine what can run.
Related MCP server: Shuttle
Install on your server
Run on Linux, Kali or macOS:
curl -fsSL https://raw.githubusercontent.com/Lyrie-ai/hexstrike-ai-beta/main/install.sh | shOr install from a checkout:
git clone https://github.com/Lyrie-ai/hexstrike-ai-beta.git
cd hexstrike-ai-beta
./install.shThe installer handles Python, dependencies and browser setup, then starts the server and opens the dashboard without a setup questionnaire. You do not need to create a virtual environment or change your system Python. Internet access and curl or wget are required; installing a missing Linux browser may request sudo. Windows users can run the server in a Linux VM.
First startup generates and saves an authentication token and listens at http://127.0.0.1:8000/mcp. Existing connection settings are reused. For access from another machine, configure an HTTPS endpoint using the connection guide; the installer does not create a public HTTPS endpoint automatically. The AI-client machine does not need HexStrike installed.
Installation, platform requirements and troubleshooting
To install now and start later, use ./install.sh --no-start. HexStrike uses command-line tools installed on the host; an adapter is not required for each program.
Connect and run
Reopen the dashboard on the server:
~/.local/share/hexstrike/hexstrikeIf ~/.local/bin is on your PATH, use hexstrike. Open Connect for the MCP URL, token and copyable Cursor, Claude Code, Codex or VS Code configuration. Closing the dashboard with q leaves the server running. Clear view hides displayed history without deleting evidence; Refresh restores it.
For unattended operation, configure a service manager. The background launcher does not install a boot service automatically.
Server configuration and client connections
Documentation
Guide | Contents |
One-command install, checkout install, platforms, upgrades and uninstall | |
Authentication, HTTPS, state paths, clients, service operation and optional integrations | |
Native tools, terminals, browsers, evidence, adapters and dashboard controls | |
Components, execution flow, storage and trust boundaries | |
Tests, benchmarks, builds and repository hygiene |
Execution model
Authenticated native execution has the server account's filesystem and network access. Optional isolated execution uses Docker, Podman or Bubblewrap when installed. Scanner findings and intelligence metadata need review; they are not proof of exploitability. Local memory supports retrieval and provenance, not automatic code rewriting.
The server supports POSIX systems. Client configuration formats, container engines and external tool versions need testing in their actual deployment environment. See the development guide for the automated checks and opt-in integration tests.
Available Tools
10 toolsaction_prepareC
Validate a capability-specific argument object against its schema and return an immutable plan and approval grant.
| Name | Required | Description | Default |
|---|---|---|---|
| arguments | No | ||
| operation | No | run | |
| capability_id | Yes | ||
| engagement_id | No | default | |
| worker_target | No | ||
| timeout_seconds | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It does disclose meaningful behavior — output is an immutable plan plus an approval grant, implying a mutation-adjacent side effect rather than a pure read — but it says nothing about failure modes, whether the grant expires, or whether a plan is persisted. The presence of timeout_seconds on a 'prepare' tool is unexplained and suggests heavier execution than the name implies.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler or repetition. It is efficient, though its density leaves little room for the guidance a six-parameter tool needs.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values needn't be described. But for a six-parameter tool with zero schema coverage and no annotations, one sentence is inadequate: the plan/approval lifecycle and five of the six inputs are undocumented.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across six parameters, so the description must compensate. It only implicitly covers capability_id and the arguments object; operation, engagement_id, worker_target, and timeout_seconds are never mentioned or explained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Names a specific verb (validate), a specific input (capability-specific argument object), and concrete artifacts produced (immutable plan, approval grant). This clearly separates it from execution siblings like job_start and from capabilities_describe, even without naming them explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description never says when to call this versus job_start, nor does it state prerequisites such as needing a capability_id from capabilities_search. The approval-grant output hints at a prepare-then-execute flow, but the sequencing is left entirely to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
capabilities_describeB
Return operation schemas, supported versions, informational risk labels, and examples. Risk labels do not restrict execution.
| Name | Required | Description | Default |
|---|---|---|---|
| probe_version | No | ||
| capability_ids | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It usefully discloses that risk labels are informational and do not restrict execution, but it does not explicitly state that this is a read-only operation, nor does it describe authorization needs or side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences with zero waste. The returned artifacts are front-loaded, and the risk-label caveat is placed immediately after.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return-value detail is not strictly required, and the risk-label note adds important context. However, the missing parameter explanation and usage guidance leave material gaps for an agent deciding when and how to call it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description never names or explains capability_ids or probe_version. The mention of operation schemas and versions offers only a weak hint about what capability_ids represent.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb, 'Return', and the artifacts returned: operation schemas, supported versions, risk labels, and examples. It is clear what the tool does, though it does not explicitly distinguish itself from the sibling capabilities_search.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit when-to-use guidance, no comparison to capabilities_search or action_prepare, and no prerequisites. Inspection usage is only weakly implied by 'Describe'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
capabilities_searchC
Find typed adapters and general capabilities. execution.host runs installed tools and scripts without registration; tools.inventory discovers server executables.
| Name | Required | Description | Default |
|---|---|---|---|
| pack | No | ||
| limit | No | ||
| query | No | ||
| category | No | ||
| only_available | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It gives examples of capabilities but says nothing about read-only behavior, filtering semantics, authentication, rate limits, or what the search returns.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences and front-loads the purpose. The second sentence is somewhat cryptic but not bloated or wasteful.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Although an output schema exists, the description is incomplete for an unannotated five-parameter search tool. It leaves parameter semantics and invocation guidance undocumented, making correct use difficult.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has five parameters and 0% schema description coverage, yet the description never mentions query, category, pack, limit, or only_available. An agent cannot infer parameter meaning or usage from the description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (“Find”) and resource (“typed adapters and general capabilities”), and the examples clarify the domain. However, it does not distinguish this search tool from the sibling capabilities_describe tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit guidance on when to use this tool versus alternatives such as capabilities_describe. The examples describe kinds of capabilities but do not state when a search is appropriate or when it should not be used.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
engagement_manageC
Inspect, create, update, or revoke an engagement scope, port/protocol rules, rate/timeout budgets, and worker target. Risk labels do not restrict execution; max_risk_level is a legacy compatibility field.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | ||
| action | No | inspect | |
| valid_from | No | ||
| valid_until | No | ||
| allowed_ports | No | ||
| engagement_id | No | default | |
| worker_target | No | ||
| max_risk_level | No | Legacy compatibility field, retained in stored settings but not enforced. Risk labels never block execution. | |
| allowed_targets | No | ||
| autonomous_mode | No | ||
| max_concurrency | No | ||
| excluded_targets | No | ||
| allow_all_targets | No | ||
| allowed_protocols | No | ||
| max_artifact_bytes | No | ||
| max_rate_per_minute | No | ||
| max_timeout_seconds | No | ||
| block_metadata_endpoints | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It notes that risk labels do not restrict execution and that max_risk_level is legacy, but this largely repeats the schema's deprecated-field note and omits key behavior such as destructive effects of revoke, permission requirements, scope enforcement, and side effects on jobs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two compact sentences and front-loads the core operations before the risk-label caveat. It is appropriately sized in principle, though its brevity leaves substantial semantic gaps for such a complex tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 18 parameters, no annotations, and mutation/revocation capabilities, the description is far too sparse to be complete. It benefits from an existing output schema, but still fails to explain action values, most parameter meanings, and operational side effects an agent needs to invoke it safely.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 6% across 18 parameters, so the description must compensate. It only loosely maps categories like port/protocol rules and rate/timeout budgets; most parameters such as action values, allowed versus excluded targets, autonomous_mode, max_concurrency, and block_metadata_endpoints remain unexplained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses specific verbs (inspect, create, update, revoke) and names the managed resource (engagement scope, rules, budgets, worker target). It is clear what domain the tool covers, though it does not explicitly differentiate itself from sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It lists possible operations but gives no guidance on when to choose inspect versus create, update, or revoke, no prerequisites, and no conditions for using this tool over alternatives. The agent must infer action semantics from the parameter schema alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
evidence_readC
Paginated, redacted access to raw evidence artifacts by evidence_id or job_id.
| Name | Required | Description | Default |
|---|---|---|---|
| view | No | raw | |
| limit | No | ||
| job_id | No | ||
| method | No | ||
| offset | No | ||
| evidence_id | No | ||
| status_code | No | ||
| url_contains | No | ||
| engagement_id | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden, and it does disclose two meaningful traits: results are paginated and content is redacted. It does not state permission/auth requirements, what 'redacted' removes, how an invalid or missing id behaves, or any rate/size limits beyond pagination.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no wasted words, and the key scoping qualifiers come first. It is arguably too terse for a nine-parameter tool, which costs it a point, but there is no padding or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, but for a nine-parameter filter tool with zero annotation coverage the description omits filter-combination logic, valid 'view' values beyond the default 'raw', and pagination behavior. An agent would have to inspect the schema and guess at semantics for most of the parameters.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across nine parameters, and the description only names evidence_id and job_id without clarifying their semantics (mutually exclusive? ANDed with other filters?). The remaining seven parameters — view, limit, offset, method, status_code, url_contains, engagement_id — get no mention at all, so the description fails to compensate for the coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb ('access') and resource ('raw evidence artifacts') and scopes it to retrieval by evidence_id or job_id, which is enough to distinguish it from siblings like memory_query or job_status. It stops short of explicitly contrasting with those siblings, keeping it just under a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'by evidence_id or job_id' hints at two retrieval paths but never says when to choose one over the other, whether they can be combined, or what to do when neither is known. There are no exclusions and no named alternatives among the nine siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
job_cancelA
Cancel a running job (or all active jobs via cancel_all=True) and terminate its OS process group.
| Name | Required | Description | Default |
|---|---|---|---|
| job_id | No | ||
| cancel_all | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries the full burden; it does disclose the key behavioral trait that the OS process group is terminated, which tells the agent this is a forceful, destructive action. It omits permissions/auth requirements, what happens to an already-finished job, whether termination is graceful, and the override relationship between the two parameters.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with the primary case first and the variant parenthesized; every clause carries information and nothing is padded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The return shape is covered by the output schema, and the core destructive behavior is named. But for a destructive, unannotated mutation, the description should still resolve the job_id-null vs cancel_all precedence and say something about jobs that are not currently running.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It adds real meaning for cancel_all ('all active jobs'), which the bare boolean/default does not convey, but job_id gets no explanation at all despite being nullable with a null default, leaving the mutual-exclusion/precedence question unanswered.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Cancel') on a specific resource ('a running job'), plus the scope variant for all jobs. The destructive action is unambiguous and clearly distinct from siblings like job_start and job_status.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the usage condition (a job must be running, use cancel_all=True for all active jobs), but it never states what to do when neither job_id nor cancel_all is supplied, nor does it name the alternative tool to inspect state before cancelling. Usage is inferable rather than spelled out.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
job_startC
Start an authorized plan (via plan_id) OR directly prepare-and-start a capability (via capability_id + arguments) with optional idempotency key.
| Name | Required | Description | Default |
|---|---|---|---|
| wait | No | ||
| plan_id | No | ||
| arguments | No | ||
| operation | No | run | |
| capability_id | No | ||
| engagement_id | No | default | |
| worker_target | No | ||
| idempotency_key | No | ||
| timeout_seconds | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It mentions idempotency and the two start modes, but it does not disclose the effects of wait=true by default, what operation means, timeout behavior, worker_target semantics, or what happens if both plan_id and capability_id are supplied.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with no filler, and the two main invocation paths are stated early. It is appropriately concise, though its density leaves important parameter distinctions unexplained.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Although an output schema exists and need not be explained, this is a nine-parameter action tool with no annotations and no schema parameter descriptions. The description covers the core plan/capability choice and idempotency but omits enough behavioral and parameter context that an agent could not confidently use it without inspecting the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for nine undocumented parameters. It clarifies plan_id, capability_id, arguments, and idempotency_key, but leaves wait, operation, engagement_id, worker_target, and timeout_seconds without any semantic explanation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Start') and two resource paths: an authorized plan via plan_id or a capability via capability_id + arguments. It distinguishes the two invocation modes clearly, though it does not explicitly differentiate job_start from siblings such as action_prepare or capabilities_search.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explains how to choose between starting via plan_id versus capability_id + arguments, which gives implied usage context. However, it does not state when to use job_start versus action_prepare, job_status, or job_cancel, and it provides no exclusions or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
job_statusB
Query bounded job status, structured output, findings, and streaming events by job_id and cursor.
| Name | Required | Description | Default |
|---|---|---|---|
| job_id | No | ||
| cursor_seq | No | ||
| engagement_id | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden but does disclose that the tool returns bounded structured output, findings, and streaming events, which is meaningful behavioral context. However, it does not explain streaming/pagination semantics, authorization needs, what happens when job_id is null, or how cursor_seq controls retrieval.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with no wasted framing, clearly leading with the core action. It could be slightly clearer by separating the retrieval modes, but it remains appropriately compact.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so the description need not detail return values, and it does mention the main result categories. Still, for a status tool with three optional parameters and no annotations, it leaves important invocation details unclear, especially engagement_id, null job_id behavior, and cursor semantics.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must carry parameter meaning, but it only repeats job_id and cursor without explaining formats, defaults, optionality, or the purpose of cursor_seq. It entirely omits engagement_id, leaving a third of the parameters undocumented in both the schema and the description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb-resource pair: querying job status by job_id and cursor, plus structured output, findings, and streaming events. It is clearly distinct from sibling tools like job_start and job_cancel, though it does not explicitly name those alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied by the phrase 'by job_id and cursor' and by the tool name job_status. There is no explicit guidance on when to poll, when to use job_start or job_cancel instead, or how this differs from system_status.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
memory_queryC
Bounded, engagement-scoped retrieval from local temporal memory and promoted lessons.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| query | No | ||
| entity_type | No | ||
| engagement_id | No | default | |
| include_promoted_lessons | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must carry the behavioral burden. It does disclose that retrieval is bounded, engagement-scoped, local, and includes promoted lessons, which conveys read-style scope and source, but it does not explicitly state read-only safety, permissions, rate limits, or side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The single sentence is front-loaded and waste-free, with scope qualifiers placed before the resource. It is concise, though extremely terse for a five-parameter query tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, but the tool has five undocumented parameters and no annotations. The description states the broad purpose but leaves key call semantics, filtering behavior, and usage conditions incomplete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across five parameters, so the description must compensate. It hints at engagement scope and promoted lessons, but gives no meaning for query, limit, entity_type, or the relationship between engagement_id and the retrieval scope.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies a retrieval operation over local temporal memory and promoted lessons, with scope qualifiers "bounded" and "engagement-scoped." It is distinct from siblings like evidence_read or capabilities_search, though it does not explicitly name those alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives, no prerequisites, and no exclusions. The phrase "engagement-scoped retrieval" implies a context but does not tell an agent when to choose memory_query over evidence_read or capabilities_search.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
system_statusC
Fast core health, worker readiness, active engagement scope, and capability summary.
| Name | Required | Description | Default |
|---|---|---|---|
| engagement_id | No | default |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full disclosure burden. 'Fast' hints at low cost and the enumerated items imply a read-only aggregate, but nothing states whether the call is side-effect free, requires authentication, is cached/rate-limited, or how expensive it is.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One short, front-loaded sentence with no filler or repetition. The tradeoff is that packing four nouns into a fragment costs readability, but no sentence is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained. However, with zero annotations, an undocumented parameter, and overlapping siblings, an agent lacks what it needs to decide when this tool is the right first call — the description stops at naming the outputs.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% for the single engagement_id parameter, which defaults to 'default', so the description must compensate. 'Active engagement scope' is the only hint that engagement_id controls which tenant's scope is reported, and it does not explain the default value's meaning or accepted identifier format.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description enumerates what the tool reports — core health, worker readiness, engagement scope, capability summary — but is a bare noun phrase with no verb, so the agent must infer it is a read-only status report. It also overlaps thematically with sibling tools like job_status, capabilities_search, and capabilities_describe without saying how it differs from them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no statement of when to call this versus job_status for job health, capabilities_search for capability detail, or engagement_manage for scope. The adjective 'Fast' weakly implies a cheap first-line check, but no condition, exclusion, or alternative is named.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
10 tool updates
v0.1.0- First observed
action_prepare - First observed
capabilities_describe - First observed
capabilities_search - First observed
engagement_manage - First observed
evidence_read - First observed
job_cancel - First observed
job_start - First observed
job_status - First observed
memory_query - First observed
system_status
TDQS
Scored across 10 tools
The job lifecycle tools are distinct, but action_prepare overlaps heavily with job_start, which can itself prepare-and-start a capability from capability_id + arguments, leaving two paths to the same end state. engagement_manage also multiplexes inspect/create/update/revoke behind one name, so its invocation semantics are less predictable than the single-purpose job_* tools.
Most names follow a resource_action pattern (job_start, job_status, job_cancel, evidence_read, memory_query, capabilities_search), with system_status and action_prepare as the only deviations. The convention is readable and predictable, but 'action_prepare' uses a vague resource noun and breaks the otherwise consistent scheme.
Ten tools is well-scoped for a security engagement orchestration server: discovery, planning, execution, monitoring, evidence, and memory each get representation. No obvious filler tools, and no critical concern is absent from the surface for count reasons.
The lifecycle is largely closed: discover capabilities, prepare a plan, start, poll, cancel, and read evidence plus memory. Minor gaps remain — there is no job enumeration tool (only cancel_all as a workaround) and no explicit approval/rejection operation for the approval grant produced by action_prepare, which may force agents into awkward paths.
Maintenance
Related MCP Connectors
Connect AI assistants to authorized Windows and macOS devices for files, commands, and management.
11Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.
- NoxgildOAuthcom.noxgild
Secure AI access to Windows, macOS, Linux computers and a hosted Cloud Browser.
Securely control computers you explicitly pair through files, terminals, processes, screenshots, desktop UI/input, clipboard, browser automation, diagnostics, and document tools.
Related MCP Servers
- AlicenseNot gradedqualityFmaintenanceProvides AI assistants with direct terminal access to execute commands, manage files, and run persistent REPL sessions. It features automated installation scripts that educate AI assistants on its capabilities for seamless integration.MIT
- AlicenseNot gradedqualityCmaintenanceEnables AI assistants to securely execute SSH commands on remote servers with connection pooling, session isolation, and a web audit panel.4MIT
- AlicenseBqualityCmaintenanceEnables AI tools to perform server operations such as log inspection, system monitoring, code management, Nginx and certificate management, with support for local and remote SSH modes and built-in security controls.2326 npmMIT
- AlicenseNot gradedqualityCmaintenanceEnables AI agents to securely execute terminal commands with persistent sessions, async jobs, and mission control, while providing a live dashboard for human oversight.4Apache 2.0