Skip to main content
Glama
Majrooo

majrooo-mcp-devkit

by Majrooo
OverviewSchemaSourceRelated ServersDiscussionsAdmin
TypeScript
Local

run_destructive_command

Destructive

Execute destructive shell commands rejected by safety checks only after explicit user confirmation and risk acknowledgment.

Instructions

Use ONLY when run_safe_command rejected the command AND the user explicitly confirmed in the chat that they want to run it despite the risk. NEVER set confirm:true automatically in reaction to a rejection from run_safe_command. First restate the risk to the user in your own words (exactly what the command will do and what it could break) and wait for their explicit 'yes' or 'I confirm' in the next message. If the user is not present in the conversation (e.g. an automated run without a human), do not use this tool at all. EXAMPLE: If the user says 'do it' for a general task and you then hit a dangerous rejection, that is not sufficient confirmation — you must explain the specific risk and get a new explicit confirmation. If the task targets a project other than the primary one (MCP_PROJECT_ROOT), always pass the "cwd" parameter. Get the list of allowed roots via the "list_allowed_roots" tool.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
cwdNoThe directory in which the command will be run (must be inside MCP_PROJECT_ROOT / MCP_EXTRA_ROOTS). Default: the primary project (MCP_PROJECT_ROOT).
commandYesThe command to execute (runs in the directory given by the cwd parameter)
confirmNoConfirmation that you are aware of the risk (required for dangerous commands)
maxLinesNoMaximum number of output lines (default: 200)
timeoutMsNoTimeout in milliseconds (1,000 – 600,000, default 60,000). You can extend it for longer tests/builds, e.g. 180,000 for jest.

Schema Changelog

Changes observed during successful MCP inspections.

  1. First observedv0.1.0

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already flag destructiveHint=true, non-idempotent, open-world, but the description goes well beyond them: it discloses the mandatory confirmation protocol, the no-auto-confirm rule, the headless/no-human exclusion, and the cwd requirement for non-primary projects. That is genuine behavioral context an agent needs to invoke this safely.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the strictest rule ('Use ONLY when...'), then qualification, then a concrete counterexample. Slightly long and the risk-restatement instruction is reiterated in the EXAMPLE, but nearly every sentence carries a distinct constraint.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive, no-output-schema tool this covers everything an agent needs: precondition chain, confirmation workflow, headless behavior, and the cwd root-discovery pointer to list_allowed_roots. Timeout/output limits are already in the schema, so their absence from the description is fine.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds meaning the schema lacks: cwd must be set when the target project differs from MCP_PROJECT_ROOT, and confirm must never be set reflexively. The confirm parameter's social contract is only defined here, not in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description establishes that this tool executes a command that the safe path rejected, and explicitly names the sibling it is gated behind (run_safe_command). The verb 'run' is implied rather than stated outright, but the risk-restatement instruction ('exactly what the command will do and what it could break') makes the effect unambiguous. Distinguishable from all siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit when-to-use (run_safe_command rejected AND user explicitly confirmed), when-not (no human present, general 'do it', automatic confirm:true), and the alternative (run_safe_command) is named. The negative case of insufficient confirmation is even exemplified.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools