Skip to main content
Glama
MoonTzai

FolderBridge MCP

by MoonTzai

FolderBridge MCP

简体中文 | English

License: Apache-2.0 Python 3.11+ Transport: stdio

Eine sicherere, lokal orientierte Brücke zwischen KI-Clients und einem Ordner, den Sie ausdrücklich auswählen.

FolderBridge MCP ist ein Python-MCP-Server ohne Abhängigkeiten plus ein Desktop-Launcher. Er ermöglicht es ChatGPT im Web – oder jedem Client, der lokales stdio-MCP unterstützt – einen begrenzten lokalen Arbeitsbereich zu inspizieren und sorgfältig zu bearbeiten. Er verzichtet bewusst auf einen öffentlichen HTTP-Server, beliebigen Shell-Zugriff, Telemetrie und stille Hintergrunddienste.

[!WICHTIG] Dieses Projekt befindet sich in einer frühen öffentlichen Beta. Es reduziert die Angriffsfläche; es ist keine Betriebssystem-Sandbox. Setzen Sie nur Ordner und Repositorys ein, denen Sie vertrauen.

Warum FolderBridge?

  • Ein-Ordner-Grenze: Jeder Serverprozess ist auf einen kanonischen Arbeitsbereich beschränkt.

  • Standardmäßig schreibgeschützt: Wechseln Sie im Launcher explizit auf Lesen/Schreiben.

  • Konfliktsichere Bearbeitungen: Vorhandene Dateien erfordern den SHA-256-Hash des letzten Lesevorgangs; veraltete Änderungen schlagen fehl, anstatt neuere Arbeit zu überschreiben.

  • Keine beliebige Shell: Optionale Aufgaben sind benannt, lokal geprüft und durch einen exakten Konfigurations-Hash genehmigt.

  • Kein öffentlicher Listener: Der MCP-Server verwendet nur stdio.

  • Keine Telemetrie: FolderBridge selbst stellt keine Netzwerkanfragen.

  • Geheimnisbewusster Launcher: Der OpenAI-Runtime-API-Schlüssel bleibt im Speicher und wird entfernt, bevor der lokale MCP-Prozess ihn verwenden kann.

  • Anfängerfreundliche Desktop-Oberfläche: Ordnerauswahl, Zugriffsmodus, Tunnel-Einrichtung, Diagnose, Start/Stopp, Prozessüberwachung und geschwärzte Protokolle in einem Fenster.

  • Windows-Skalierungsunterstützung: Schriftarten und Fenstergrößen folgen der aktuellen Anzeige-DPI und werden beim Wechsel zwischen Monitoren mit unterschiedlichen Skalierungsfaktoren aktualisiert.

Related MCP server: Forge Workspace MCP Server

Schnellstart

Voraussetzungen:

  • Python 3.11 oder neuer;

  • Windows für die getestete Doppelklick-Launcher-Erfahrung (der stdio-Server ist plattformübergreifend);

  • Git ist optional und wird nur für begrenzte status- und diff-Ansichten verwendet.

Windows-Programm – empfohlen

Laden Sie FolderBridge.exe und FolderBridge.exe.sha256 von der neuesten GitHub-Version herunter. Es ist keine Python-Installation erforderlich. Überprüfen Sie die Prüfsumme und doppelklicken Sie dann auf FolderBridge.exe.

Das Programm enthält FolderBridge und seine Python-Laufzeit, aber es bündelt nicht den tunnel-client von OpenAI; laden Sie den offiziellen Client separat von der OpenAI-Version herunter und wählen Sie ihn im Launcher aus, wenn Sie ChatGPT im Web verwenden.

[!HINWEIS] Der aktuelle Community-Build ist nicht code-signiert, daher identifiziert Windows seinen Herausgeber als unbekannt. Wenn Sie einer unsignierten Binärdatei nicht vertrauen, erstellen Sie sie stattdessen aus dem geprüften Quellcode.

Aus dem Quellcode ausführen

Klonen Sie das Repository und starten Sie die GUI:

git clone https://github.com/MoonTzai/folderbridge-mcp.git
cd folderbridge-mcp
python .\folderbridge_launcher.py gui

Wählen Sie einen Arbeitsbereich, behalten Sie Nur lesen für den ersten Lauf bei und verwenden Sie das Statusfenster, um die Einrichtung abzuschließen. Launcher-Einstellungen werden außerhalb des Repositorys gespeichert; der Runtime-API-Schlüssel wird nie gespeichert.

folderbridge_gui.pyw bleibt als reine Quellcode-Komfortdatei für Python-Installationen erhalten, deren .pyw-Zuordnung auf einen Interpreter mit Tkinter verweist. Das eigenständige FolderBridge.exe ist der unterstützte Doppelklick-Einstiegspunkt.

ChatGPT im Web verbinden

ChatGPT kann keine direkte Verbindung zu einem lokalen stdio-Prozess herstellen. FolderBridge verwendet für diesen Pfad den offiziellen Secure MCP Tunnel von OpenAI. Sie benötigen:

Klicken Sie auf 网页端一键引导 (Web-Setup-Anleitung) in der oberen rechten Ecke des Launchers für dieselben vier Schritte und Verknüpfungen unten.

1. Laden Sie den offiziellen Windows-x64-Client herunter

  1. Öffnen Sie die neueste openai/tunnel-client-Version und erweitern Sie Assets.

  2. Laden Sie das vollständige Archiv mit dem Namen tunnel-client-v<version>-windows-amd64.zip herunter. In Versionsdateinamen bedeutet amd64 Windows x64 und ist für die meisten Intel/AMD-PCs korrekt.

  3. Optional können Sie SHA256SUMS.txt zur Überprüfung herunterladen. Wählen Sie nicht tunnel-client-runtime-*, windows-arm64, all.zip, Quellcode-Archive oder Lizenzdateien.

  4. Entpacken Sie das gesamte ZIP in einen stabilen Ordner; es gibt keinen Installer, und Sie sollten es nicht aus dem Archiv heraus ausführen. Die Anleitung kann %LOCALAPPDATA%\FolderBridge\bin als empfohlenen Speicherort erstellen und öffnen.

  5. Kehren Sie zu FolderBridge zurück, klicken Sie auf 选择已解压的 EXE und wählen Sie tunnel-client.exe.

2. Erstellen Sie den Platform Tunnel

Öffnen Sie die OpenAI Platform Tunnel-Einstellungen, klicken Sie auf Create tunnel und verwenden Sie diese aktuellen Auswahlmöglichkeiten:

Feld

Empfohlener Wert

Hinweise

Name

FolderBridge

Anpassbarer Anzeigename

Beschreibung

Local FolderBridge MCP for private workspace access

Erforderlich; anpassbar

Organisationen

Personal für ein persönliches Konto

Für Teams wählen Sie die Platform-Organisation, die diesen Tunnel verwaltet

ChatGPT-Arbeitsbereiche

Der Arbeitsbereich, in dem Sie die App erstellen werden

Nicht leer lassen; ein persönliches Konto hat normalerweise eine Arbeitsbereichs-ID

Nach der Erstellung kopieren Sie die Tunnel-ID, die mit tunnel_ beginnt. Für die Ausführung und Auswahl sind Tunnels Read + Use erforderlich; für die Erstellung oder Bearbeitung ist auch Manage erforderlich. Verknüpfen Sie nur die Organisationen und ChatGPT-Arbeitsbereiche, die Zugriff auf diesen lokalen Arbeitsbereich benötigen.

Erstellen Sie den Schlüssel für tunnel-client unter den Runtime API Keys derselben Platform-Organisation; sein Ersteller benötigt Tunnels Read + Use. Fügen Sie ihn nur in FolderBridge ein, wo er im Prozessspeicher bleibt. Verwenden Sie keinen Admin-API-Schlüssel und fügen Sie den Runtime-Schlüssel nicht in das Authentifizierungsfeld der ChatGPT-App ein.

3. Starten Sie FolderBridge

  1. Wählen Sie genau einen Arbeitsbereichsordner aus und behalten Sie für den ersten Lauf Nur lesen (empfohlen) bei.

  2. Wählen Sie die entpackte tunnel-client.exe; das Standardprofil folderbridge ist geeignet.

  3. Geben Sie dieselbe Tunnel-ID und denselben Runtime-API-Schlüssel ein und lassen Sie erweiterte benannte Aufgaben deaktiviert.

  4. Klicken Sie auf Start connection. Der Launcher führt den offiziellen init-, doctor- und run-Ablauf aus. Fahren Sie erst fort, wenn der obere Status 运行中 (Läuft) anzeigt.

4. Erstellen Sie die ChatGPT-Entwicklermodus-App

Öffnen Sie ChatGPT Plugins, klicken Sie auf + und verwenden Sie diese kritischen Auswahlmöglichkeiten:

Feld

Erforderliche Auswahl

Verbindung

Tunnel

Verfügbarer Tunnel

Wählen Sie denselben Tunnel oder fügen Sie seine tunnel_...-ID ein

Authentifizierung

Keine Authentifizierung

[!WARNUNG] Lassen Sie das Formular nicht auf der Standardauswahl OAuth und fügen Sie keine https://tunnel-service...-Adresse in die Server-URL ein. FolderBridge implementiert kein Benutzer-OAuth, daher erzeugt diese Konfiguration einen Fehler does not implement OAuth.

Lassen Sie den Launcher laufen, während ChatGPT den Arbeitsbereich verwendet. Das Schließen stoppt den Tunnel-Prozess. Bestätigungen für den Entwicklermodus und die App-Installation auf Kontoebene bleiben in ChatGPT; FolderBridge automatisiert nicht Ihre Browsersitzung oder Sicherheitseinstellungen.

Es ist keine Browsererweiterung erforderlich. FolderBridge lädt absichtlich keine über das Netzwerk gelieferten Binärdateien herunter oder führt sie aus.

Anderen lokalen MCP-Client verbinden

Drucken Sie eine gebrauchsfertige Konfiguration:

python .\folderbridge_launcher.py client-config --workspace C:\path\to\repo --format toml
python .\folderbridge_launcher.py client-config --workspace C:\path\to\repo --format json

Generieren Sie einen schreibgeschützten Befehl:

python .\folderbridge_launcher.py client-config --workspace C:\path\to\repo --format tunnel --read-only

Tools und Bearbeitungsworkflow

Der Standard-Server stellt bereit:

  • server_info: meldet den aktiven Arbeitsbereich und die Sicherheitsgrenze;

  • workspace: listet, liest, sucht und zeigt begrenzte Git-Status-/Diff-Ausgaben;

  • edit_file: erstellt eine UTF-8-Datei oder führt atomare, eindeutige exakte Ersetzungen durch.

Ein sicherer Bearbeitungsablauf ist:

  1. Liste oder Suche nach einer Datei;

  2. Lesen Sie sie und behalten Sie den zurückgegebenen SHA-256-Hash;

  3. Senden Sie eine exakte Ersetzung mit diesem Hash;

  4. Prüfen Sie den Git-Diff.

Der Server kann keine Dateien löschen oder verschieben. Absolute Pfade, .., Symlinks, Junctions/Reparse-Punkte, VCS-Interna, gängige Abhängigkeits-/Build-Ordner und anmeldeinformationsähnliche Namen werden abgelehnt.

Optionale benannte Aufgaben

Beliebiger Befehlstext wird über MCP nie akzeptiert. Wenn Sie eine Test-nach-Bearbeitung-Schleife benötigen, erstellen und prüfen Sie eine lokale Aufgabenrichtlinie:

python .\folderbridge_launcher.py init --workspace C:\path\to\repo
# Review C:\path\to\repo\.folderbridge.json
python .\folderbridge_launcher.py approve --workspace C:\path\to\repo

Aktivieren Sie dann genehmigte Aufgaben im Launcher oder fügen Sie --allow-tasks zum generierten Serverbefehl hinzu. Das Modell kann nur einen Aufgabennamen auswählen; es kann keinen Befehl, keine Argumente, keine Umgebungsvariablen oder kein Arbeitsverzeichnis angeben.

[!WARNUNG] Tests, Build-Tools und Paketskripte führen Repository-Code mit Ihren aktuellen OS-Benutzerrechten aus. Verwenden Sie für nicht vertrauenswürdige Repositorys eine Wegwerf-VM oder einen Container, oder lassen Sie die Aufgabenausführung deaktiviert.

Sicherheitsmodell

FolderBridge behandelt MCP-Anfragen, Repository-Text und Tool-Ausgaben als nicht vertrauenswürdige Daten. Die Durchsetzung erfolgt in der Tool-Implementierung und nicht nur in MCP-Annotationen. Die Hauptkontrollen sind:

  • kanonische Pfadbegrenzung und Link-Ablehnung;

  • begrenzte UTF-8-Lesevorgänge, Suchvorgänge, Git-Ausgaben, Subprozess-Ausgaben und Protokollnachrichten;

  • atomare Schreibvorgänge mit einer Voraussetzung für den aktuellen Inhalts-Hash;

  • geschützte lokale Richtliniendateien;

  • shell=False, feste Argumentarrays, saubere Aufgabenumgebungen und Timeouts;

  • kein eingehender Netzwerk-Listener und keine FolderBridge-Telemetrie.

Lesen Sie das vollständige Sicherheitsmodell und die vorgelagerte Design-Forschung. Um eine Sicherheitslücke zu melden, folgen Sie SECURITY.md.

Entwicklung

Es gibt keine Abhängigkeiten von Drittanbietern zur Laufzeit.

python -m unittest discover -s tests -v

Lesen Sie CONTRIBUTING.md, bevor Sie einen Pull-Request öffnen.

Windows-Programm erstellen

Builds verwenden eine festgelegte, nur zur Build-Zeit verwendete PyInstaller-Abhängigkeit. Das veröffentlichte EXE verwendet den Konsolen-Bootloader mit hide-console=hide-early: Ein Doppelklick öffnet nur die GUI, während dasselbe Programm stdio beibehält, wenn Tunnel seinen serve-Unterbefehl startet.

python -m venv .build-venv
.\.build-venv\Scripts\python.exe -m pip install -r requirements-build.txt
.\scripts\build_windows.ps1 -Python .\.build-venv\Scripts\python.exe

Artefakte und eine SHA-256-Datei werden in release\windows-x64 geschrieben.

Lizenz

Lizenziert unter der Apache License 2.0.

FolderBridge MCP ist ein unabhängiges Open-Source-Projekt. Es ist nicht mit OpenAI verbunden, von OpenAI unterstützt oder gesponsert. ChatGPT, OpenAI, MCP und andere Produktnamen gehören ihren jeweiligen Eigentümern.

Available Tools

10 tools
edit_fileCreate or exactly edit one fileA
Destructive

Atomically create a UTF-8 file, or edit one using unique exact replacements and a current whole-file SHA-256. workspace(read) returns that SHA for small files; use file_info for larger files. When multiple workspaces are configured, pass the same workspace_id used for inspection. Cannot delete files, edit the local task config, follow links, or access credential-like paths.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes
replacementsNo
workspace_idNoRequired when server_info lists multiple workspaces.
create_contentNoUsed only when creating a new file.
expected_sha256NoRequired when editing an existing file.

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate destructive behavior, but the description adds important context: atomicity, exact replacement matching, SHA requirement, and explicit forbidden actions (delete, config, links, credentials).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Concise single paragraph that front-loads the core purpose and then efficiently covers SHA, workspace_id, and limitations without unnecessary detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers creation vs. editing, SHA requirements, workspace_id, and limitations; with no output schema, return values need no explanation, though failure behavior on non-unique replacements could be mentioned.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema covers 60% of parameters with descriptions; the tool description clarifies replacement uniqueness, SHA acquisition, and workspace_id usage, though it adds little for the obvious path parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (create/edit) and resource (UTF-8 file), clearly distinguishing from siblings by noting exact replacements, SHA-256, and forbidden operations like deletion or credential access.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides practical guidance on obtaining the SHA via workspace or file_info, workspace_id handling, and constraints, but does not explicitly name an alternative like write_file.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

extensionUse FolderBridge extensionsA
Destructive

Stable extension gateway. action=list returns a compact pageable catalog of installed/hot-reloaded extensions and action names; action=info returns the full schema for one extension; action=run invokes one declared extension action. Long foreground actions may be transport-safely promoted in-place to a host-owned Job; use action=job_list to rediscover workspace Jobs, action=job_status to inspect completion/runtime health/results, and action=job_cancel to terminate the owned worker process tree. Installing more extensions does not add MCP tool names. External extension code requires exact-hash local approval; globally authorized actions must also be enabled in the FolderBridge extension sidebar. Dynamic workspace adapters are re-evaluated at call time, so later project changes do not require workspace task injection.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoCatalog/job page size for action=list/job_list.
actionYes
job_idNoRequired for job_status/job_cancel; returned by an explicit or auto-promoted Job action.
offsetNoCatalog/job result offset for action=list/job_list.
paramsNoAction parameters validated against the extension's declared input_schema.
extension_idNoRequired for info/run.
workspace_idNoOptional for list/info; required by workspace-bound run/job operations when multiple workspaces are configured.
extension_actionNoRequired for run; choose an action declared by extension info/list.

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes beyond the annotations by mentioning that job_cancel terminates the owned worker process tree, that external extension code requires exact-hash local approval, and that globally authorized actions must be enabled. This adds meaningful safety context beyond the destructiveHint and readOnlyHint annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is somewhat dense and list-like, but it is still focused and each sentence contributes necessary information about actions, job handling, or authorization. It could be organized into clearer bullets, but it is far from bloated or redundant.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity—8 parameters, multiple actions, job lifecycle, and extension authorization—the description covers the essential operational context. It lacks explicit output format details, but no output schema is provided, and the action-specific behavior is sufficiently described for an agent to invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is already high at 88%, and the description adds useful semantic relationships, such as job_id being returned by an explicit or auto-promoted Job action and workspace_id being required for workspace-bound operations when multiple workspaces are configured. This clarifies parameter behavior beyond the raw schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies this as a stable extension gateway and enumerates the exact actions (list, info, run, job_list, job_status, job_cancel). It also distinguishes the tool from ordinary file operations by noting that installing more extensions does not add MCP tool names, making its role unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides practical guidance on how to use the tool: it explains the purpose of each action, how long foreground actions can be promoted to jobs, and that extension code requires approval. It does not explicitly mention competing alternatives, but it gives enough context for an agent to decide when this gateway is the appropriate entry point.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

file_infoInspect file metadata and SHA-256A
Read-only

Return bounded metadata and whole-file SHA-256 for a regular file without exposing its bytes; use this SHA before editing large text files. Uses the same workspace confinement, link denial, and sensitive-path policy as text tools.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes
workspace_idNoRequired when server_info lists multiple workspaces.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate read-only and non-destructive behavior. The description adds that bytes are not exposed and mentions shared workspace/link/sensitive-path policies, providing extra context beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, tightly packed with essential information: function, limitation, use case, and policy alignment. No fluff or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple metadata/hash tool, the description covers key aspects: what it returns, what it avoids, and when to use it. The absence of an output schema is compensated by the clear explanation of the return value. It is complete enough for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema descriptions cover workspace_id but not path, giving 50% coverage. The description does not add any parameter details, but the parameters are simple and self-explanatory (path, workspace_id). This is adequate but not enhanced.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it returns metadata and SHA-256 for a regular file, and explicitly notes it does not expose bytes, distinguishing it from content-reading tools. The phrase 'use this SHA before editing large text files' gives a concrete purpose and workflow.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides a specific use case ('use this SHA before editing large text files') and clarifies the tool's non-content nature. While it doesn't compare directly to sibling tools, the 'without exposing its bytes' phrase implies when not to use it, giving adequate guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

file_opsCopy or move one file within or across workspacesA
Destructive

Core FolderBridge regular-file copy/move with workspace confinement on both ends. Use source_workspace_id when multiple workspaces are configured; destination_workspace_id is optional and defaults to the source workspace. Paths remain workspace-relative, links/reparse points, credentials, dependencies and protected control config writes are denied. No-clobber is the default; overwrite requires the current destination SHA-256. Cross-volume move falls back to verified copy then source removal.

ParametersJSON Schema
NameRequiredDescriptionDefault
actionYes
max_bytesNo
overwriteNo
source_pathYes
create_parentsNo
destination_pathYes
source_workspace_idNoRequired when more than one workspace is configured.
expected_source_sha256NoOptional source-byte guard; also enables safe already-completed retry recognition.
destination_workspace_idNoOptional; defaults to source_workspace_id.
expected_destination_sha256NoRequired when overwrite=true; must match the current destination bytes.

TDQS

A3.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses critical behaviors beyond the destructiveHint annotation: it denies links, credentials, dependencies, and protected writes; explains no-clobber default with overwrite requiring SHA-256; and describes cross-volume move fallback. These specifics are valuable safety context not present in the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded, leading with the core purpose and then detailing constraints. It avoids unnecessary words and presents information in a logical flow, though it could benefit from a clear separation of parameter usage from general behavior.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 10 parameters, no output schema, and moderate complexity, the description covers important safety and overwrite aspects but omits explanations for max_bytes, create_parents, expected_source_sha256 usage, and action semantics. These gaps could lead to incorrect invocation, especially for a file operation tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds meaning for workspace IDs, overwrite requirements, and no-clobber default, which helps with parameters lacking schema descriptions. However, it does not explain max_bytes limits, create_parents behavior, or the action enum values, leaving gaps despite the low schema coverage of 40%. It partially compensates but not fully.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states the exact operation (copy/move) on a single regular file, with workspace confinement. It clearly distinguishes from edit/write operations and sets expectations about scope. The phrasing 'Core FolderBridge regular-file copy/move' is specific and actionable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides parameter-level guidance (workspace IDs, overwrite behavior) but does not explicitly indicate when to choose this tool over siblings like edit_file or write_file. There is no mention of conditions for selecting this tool or exclusions for other operations, leaving tool selection to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

flight_recorderRead recent FolderBridge flight diagnosticsA
Read-only

Read FolderBridge's compact local reliability flight recorder. It keeps only the latest 15 minutes with a 20 MiB total cap, records MCP/Tunnel metadata and bounded redacted diagnostics, and never stores full MCP request/response bodies. Use action=status for storage health, recent for a bounded timeline, or errors for warning/error events only.

ParametersJSON Schema
NameRequiredDescriptionDefault
roleNoall
limitNo
actionYes
minutesNo

TDQS

A4.2/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Discloses retention limits (15 minutes, 20 MiB), recording of MCP/Tunnel metadata, bounded redacted diagnostics, and explicitly states it never stores full request/response bodies, going beyond the read-only annotation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences, first summarizing the tool's purpose and data characteristics, second giving actionable usage for actions; no unnecessary fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Lacks explanation of parameters like role, limit, minutes, and their interaction; while the action usage is covered, the tool cannot be fully used without inferring parameter meanings from the schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Description does not explain any of the parameters (action, role, limit, minutes) except implicitly mentioning action usage; schema has enums and defaults but description adds no parameter definitions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States the verb 'Read' and the resource 'FolderBridge's compact local reliability flight recorder' clearly, distinguishing it from other read tools like server_info or file_info by specifying the domain.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides guidance on which action to use (status, recent, errors) but does not compare with sibling tools or explain when to choose this over others; still, the action-specific advice is useful.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

image_openOpen a workspace image or ZIP image memberA
Read-only

Return one bounded PNG/JPEG/GIF/WebP as MCP image content, either from a direct workspace path or from one exact member inside a workspace ZIP. The archive is never extracted to disk.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathNoDirect image path. Mutually exclusive with archive_path.
memberNoExact POSIX member path inside archive_path.
archive_pathNoZIP path containing the image. Mutually exclusive with path.
workspace_idNoRequired when server_info lists multiple workspaces.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds meaningful behavior beyond the annotations: it states supported formats, the 'bounded' size constraint, and that the archive is never extracted to disk. These are useful operational details that the readOnlyHint annotation does not convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the return value and formats, and the key behavioral guarantee is stated in one short second sentence. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description explains the return form (MCP image content), supported formats, and the two input paths, which is sufficient for an agent to call the tool correctly. It does not describe error cases, but the schema and annotations cover the essential requirements.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all four parameters. The description adds context about the two usage modes but does not go beyond the schema's mutual-exclusion notes or parameter meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Return') and a precise resource: one bounded PNG/JPEG/GIF/WebP as MCP image content. It also clearly distinguishes the two input modes (direct path vs. ZIP member), which separates this tool from sibling file operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context for when to use the tool: when you need an image as MCP content, either from a workspace path or from a ZIP member. It does not explicitly name alternative tools or exclusion criteria, but the direct-vs-archive distinction is actionable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

pptx_inspectInspect PPTX OOXML and SmartArtA
Read-only

Safely inspect a PPTX inside the selected workspace using Python standard-library ZIP/XML parsing. Returns slide text, diagram-to-slide mappings, dgm:pt points, dgm:cxn connections, and orphan/duplicate diagnostics. Does not execute macros, embedded objects, or workspace code.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes
page_endNo
page_startNo
workspace_idNoRequired when server_info lists multiple workspaces.

TDQS

A3.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description explicitly discloses safety-relevant behavior: it does not execute macros, embedded objects, or workspace code. This goes beyond the readOnly/destructive annotations and reassures the agent about side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and well structured: a safety-and-method sentence, a returns list, and a non-execution guarantee. Every sentence adds meaningful information without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the return-value list is helpful, and the safety behavior is clear. However, the description omits parameter semantics and does not fully explain how page_start/page_end affect inspection, leaving noticeable gaps for a four-parameter tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is only 25% and the description does not explain path, page_start, or page_end. Only workspace_id is described in the schema; the description adds no parameter-level clarification, leaving the agent to guess meanings and ranges.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action ('inspect a PPTX') and resource, and lists concrete outputs ('slide text, diagram-to-slide mappings, dgm:pt points...'). It is clearly differentiated from the sibling tools by its OOXML/SmartArt focus.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given on when to use this tool versus alternatives such as file_info or image_open. It implies use for PPTX inspection but does not explicitly state selection criteria or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

server_infoLocal workspace safety statusA
Read-only

List the fixed workspace IDs, enabled capabilities, approved tasks, and safety boundary.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, which the description aligns with by using the non-destructive verb 'List'. The description adds useful specificity about what information is returned, going beyond the annotations. No contradictions are present.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence that lists the exact outputs. It is well-structured and front-loaded with the action verb, making it easy to understand at a glance. No unnecessary words or complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given that there is no output schema, the description adequately informs the agent of what the tool returns: fixed workspace IDs, enabled capabilities, approved tasks, and safety boundary. This is sufficient for understanding the tool's result without needing additional details.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, and the input schema is fully covered with an empty properties object. Since there are no parameters to describe, the baseline of 4 applies. The description does not need to explain parameters because there are none.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose with a specific verb 'List' and identifies the exact resources it returns: workspace IDs, capabilities, approved tasks, and safety boundary. This makes the tool's function unambiguous and distinct from typical file or workspace operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not provide any guidance on when to use this tool versus its siblings. While it is clearly a read-only status tool, it does not explicitly state that it should be used for checking workspace safety before operations, nor does it mention alternatives. Thus, usage context is implied but not explicitly stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

workspaceInspect the local workspaceA
Read-only

List files, page through UTF-8 text, stream literal search across large UTF-8 files, or page through git status/diff output. When multiple workspaces are configured, pass a workspace_id returned by server_info. All paths are relative; links, credentials, dependencies, and VCS internals are denied.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathNo.
limitNoReturned byte page size for read/status/diff.
queryNoRequired for literal search.
actionYes
offsetNoByte offset for read/status/diff; result offset for list/search.
patternNoGlob for list.*
max_resultsNo
workspace_idNoRequired when server_info lists multiple workspaces.
case_sensitiveNo

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark readOnlyHint=true, and the description is consistent with that while adding behaviors beyond it: literal (not regex) UTF-8-only searches, streaming/paging for large files, and denied content categories. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three front-loaded sentences: action capabilities first, workspace_id routing second, path/denial constraints third. No filler; every sentence carries operational information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 9-parameter, five-action tool with no output schema, the description covers the action space, key routing, and constraints well. It does not specify output shapes or per-action result semantics, but the action names themselves make the expected results reasonably clear.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 56% schema coverage, the description adds meaning to several parameters: workspace_id's source and trigger, path's relative-base convention, query's literal-search nature, and limit/offset's page semantics. It does not expand on max_results or case_sensitive, but those are named and defaulted in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names explicit actions — list, read, search, status, diff — with concrete resource and scope (files, UTF-8 text, git output). This distinguishes it from sibling tools like file_info and edit_file by making clear it is a broad read-only workspace inspection surface.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives a clear context for use: multi-workspace routing via server_info, relative paths, and a hard denial list (links, credentials, dependencies, VCS internals). It does not explicitly name sibling tools or say when to prefer file_info or edit_file, so it stops short of full alternative guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

write_fileTransactionally write a large UTF-8 fileA
Destructive

Host-owned five-action transaction for large whole-file creates or replacements without requiring one giant MCP message. Use begin, then one or more append calls with the exact next UTF-8 byte offset, optionally status, then commit with the complete expected size and SHA-256; abort discards staging. Staging stays outside the workspace, replace mode rechecks the original target SHA at commit, and successful commit uses a same-directory fsync + atomic replace.

ParametersJSON Schema
NameRequiredDescriptionDefault
modeNoRequired only for begin.
pathNoRequired only for begin.
chunkNoRequired for append; runtime-enforced maximum is 4 MiB of UTF-8 bytes so even worst-case JSON escaping stays below the MCP message ceiling.
actionYes
offsetNoRequired for append; exact next UTF-8 byte offset, making retries non-duplicating.
workspace_idNoRequired when server_info lists multiple workspaces.
expected_sizeNoRequired for commit; complete UTF-8 byte length.
transaction_idNoReturned by begin; required by append/status/commit/abort.
expected_sha256NoRequired for commit; SHA-256 of complete new UTF-8 bytes.
expected_target_sha256NoRequired for begin in replace mode; obtain with file_info.

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only supply the generic destructive/idempotent profile; the description adds substantive traits beyond them: staging lives outside the workspace, replace mode rechecks the original target SHA at commit, abort discards staging, and commit is a same-directory fsync plus atomic replace. The offset-based non-duplicating retry guarantee is also stated.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three dense sentences that lead with the transaction model, then the action sequence, then the durability and safety guarantees. Nothing is repetitive of the name or title, and every clause carries operational information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 10-parameter, multi-action tool with no output schema, the description covers the full lifecycle and the return of transaction_id is captured in the schema itself. It leaves unstated what status or commit return on success and what happens when an offset mismatch or commit-contract failure occurs.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 90%, so per-parameter documentation is already strong (baseline 3). The description goes further by binding parameters to actions as a cross-field contract: commit needs the complete expected size and SHA-256, append needs the exact next byte offset, and replace mode requires the original target SHA. It doesn't add format examples for the hashes, which the schema already constrains.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource with scope: a host-owned five-action transaction for large whole-file creates or replacements. The 'whole-file ... without requiring one giant MCP message' framing distinguishes it from the sibling edit_file, which handles partial edits.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit protocol sequencing (begin, one or more appends, optionally status, commit, abort) and the size/whole-file condition that motivates it. It stops short of naming edit_file as the alternative for small or partial changes, so the routing decision is implied rather than stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 1 tool updatev0.8.36
    • Addedfile_ops
  2. 1 tool updatev0.8.33
    • Changedwrite_file1 field changed
      • changedInput schema / properties / chunk / description
        Previous value: -"Required for append; runtime-enforced maximum is 128 KiB of UTF-8 bytes so even worst-case JSON escaping stays below the 1 MiB MCP message limit."New value: +"Required for append; runtime-enforced maximum is 4 MiB of UTF-8 bytes so even worst-case JSON escaping stays below the MCP message ceiling."
  3. 9 tool updatesv0.8.25
    • First observededit_file
    • First observedextension
    • First observedfile_info
    • First observedflight_recorder
    • First observedimage_open
    • First observedpptx_inspect
    • First observedserver_info
    • First observedworkspace
    • First observedwrite_file

TDQS

A4/5.0

Scored across 10 tools

Disambiguation5/5

Each tool has a clearly distinct purpose: file operations, editing, reading/searching, metadata, specific format inspection, extension management, and server info. Even edit_file vs write_file are separated by size/chunking, and workspace vs file_info differ in scope. No overlapping or ambiguous tools.

Naming Consistency3/5

All names use lowercase with underscores, but the verb/noun order varies: edit_file and write_file use verb_noun, while file_info and server_info use noun_verb, and workspace and extension are bare nouns. This inconsistency makes the pattern less predictable, though still readable.

Tool Count5/5

10 tools is well-scoped for a file management and inspection server. Each tool covers a distinct aspect (copy/move, create/edit, read/search, metadata, format inspection, extensions, diagnostics) without redundancy or bloat.

Completeness3/5

The surface covers most file lifecycle operations (create, edit, read, copy, move, metadata) but lacks a delete operation. Also missing directory creation and possibly rename (though move may cover that). These are notable gaps for a file management server.

Maintenance

ActivityActive
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • F
    license
    B
    quality
    D
    maintenance
    A read-only MCP server that exposes a local code workspace to AI clients via stdio, providing file browsing and text search capabilities with path safety rules.
    1
    -
  • A
    license
    Not graded
    quality
    C
    maintenance
    A deliberately narrow, approval-gated workspace server that safely reads and writes files and runs allowlisted commands only inside one configured workspace, requiring visible approval for every write, process execution, and file read, with stale-overwrite protection and symlink-escape rejection.
    1
    MIT
  • F
    license
    A
    quality
    C
    maintenance
    A read-only MCP server that lets AI assistants inspect local workspace files, search context, view git diffs, and fetch a fixed GitHub profile, all within a sandboxed stdio transport.
    5
    -
  • A
    license
    Not graded
    quality
    A
    maintenance
    Enables AI clients to safely read, search, understand, and edit local project code and files, with Git inspection, code indexing, and controlled command execution within permissioned workspaces.
    3 npm
    6
    MIT