Skip to main content
Glama
MoonTzai

FolderBridge MCP

by MoonTzai

FolderBridge MCP

简体中文 | English

License: Apache-2.0 Source Python 3.11+ Transport: stdio

[!TIP] FolderBridge 本身是一个单文件 Windows 应用:直接下载 FolderBridge.exe 并双击运行即可。无需安装 Python 或 Node.js。 该二进制文件位于 GitHub Releases → latest release → Assets 中;它不会出现在仓库的源文件列表中。对于网页版 ChatGPT,FolderBridge 仍使用 OpenAI 单独分发的官方 tunnel-client.exe;启动器会引导你选择该文件。你也可以打开完整发布页面获取 EXE 及其可选的 SHA-256 校验文件。

一个更安全、本地优先的桥梁,连接 AI 客户端与你明确选择的少量文件夹。

FolderBridge MCP 是一个零依赖的 Python MCP 服务器,外加一个桌面启动器。它允许网页版 ChatGPT——或任何支持本地 stdio MCP 的客户端——检查并谨慎编辑一个有边界的本地工作区。它刻意避免使用公共 HTTP 服务器、任意 shell 访问、遥测和静默后台服务。

[!IMPORTANT] 本项目处于早期公开测试阶段。它缩小了攻击面,但并非操作系统级沙箱。只暴露你信任的文件夹和仓库。

0.5.1 亮点

  • 浏览器授权的 GitHub 发布: 新的内置 git-publisher 扩展可以通过 Git Credential Manager 打开 GitHub 授权,将 OAuth 凭据保存在 Windows 凭据管理器中,仅提交显式的文件白名单,并且只将当前分支推送到现有的 GitHub HTTPS 远端。模型不会接触到任何 token/PAT/密码字段。

  • Git 发布仍受约束: Publisher 会拒绝预先存在的暂存更改、凭据/密钥类文件、转换内容的 Git attributes 以及不安全的仓库本地 Git 设置;它从不运行 git add .,从不接受任意 remote/ref,在其有边界的提交中禁用 hooks/签名,并且从不强制推送。

  • 原生 Microsoft Office 可视化管线: 内置的 office 扩展可以使用本地安装的 Microsoft Office 渲染 .pptx、.docx 和 .xlsx。PowerPoint 直接将幻灯片导出为 PNG;Word/Excel 使用其原生固定版式引擎和 Windows PDF 渲染器生成页面 PNG。

  • 无需启动 Word 即可读取 Word 结构: inspect_docx 从 OOXML 中暴露段落、样式/编号、表格、节/页面设置、页眉/页脚、媒体、超链接、脚注/尾注和批注。

  • 无需启动 Excel 即可读取 Excel 结构/公式: inspect_xlsx 暴露工作表、有边界的单元格区域、公式及缓存值、合并区域、隐藏行/列、定义名称、计算设置和外部链接部件。

  • 可审计的输出: 原生渲染可以写入确定性的 PNG 目录及同级 ZIP,并返回 Office 源文件和生成输出的 SHA-256/大小元数据;现有的 image_open 工具随后可以可视化检查每个页面或 ZIP 成员。

  • Office 自动化受约束: 只接受工作区相对的非链接路径;排除启用宏的格式;强制禁用 Office 自动化宏;文件以只读方式打开;禁用 Excel 链接更新;内置的 PowerShell 脚本是固定的,从不接受任意命令。

  • 现有 0.4.x 安全/UI 改进保持不变: 高 DPI 滚动、ComfyUI 托管服务诊断、稳定的扩展网关、有边界的全局能力和单文件 Windows 交付均未改变。

完整的发布历史请参阅 CHANGELOG.md,托管服务和插件边界请参阅 Extension ABI v1。

Related MCP server: Forge Workspace MCP Server

为什么选择 FolderBridge?

  • 独立的文件夹边界: 一个连接最多可包含八个规范工作区;每次多工作区工具调用都选择 workspace_id,而不是合并根目录。

  • 默认只读: 在启动器中显式切换到读/写模式。

  • 冲突安全的编辑: 现有文件需要上次读取返回的 SHA-256;过期的编辑会失败,而不是覆盖更新的工作。

  • 无任意 shell: 可选任务是有名称的、经过本地审查的,并通过精确的配置哈希批准。

  • 无公共监听: MCP 服务器仅使用 stdio。

  • 无遥测: FolderBridge 本身不发出任何网络请求。

  • 密钥感知的启动器: OpenAI Runtime API 密钥只保存在内存中,并在本地 MCP 进程可以使用它之前被移除。

  • 对初学者友好的桌面 UI: 添加/删除文件夹列表、全局访问模式、Tunnel 设置、诊断、启动/停止、进程监控和脱敏日志都集中在一个窗口中。

  • Windows 缩放支持: 字体和窗口大小跟随当前显示 DPI,并在不同缩放因子的显示器之间移动时刷新。

快速开始

要求取决于你如何使用 FolderBridge:

  • 独立 Windows EXE: 无需单独安装 Python 或 Node.js;Windows 是经过测试的双击启动器环境。

  • 从源码运行/开发: 需要 Python 3.11 或更高版本;Python 3.11 x64 是推荐的 Windows 构建基线。

  • 项目能力: 只安装工作区本身所需的工具链(例如 Node/npm 项目的测试/构建脚本需要 Node.js LTS)。启用某项能力并不会安装该工具链。

  • Git 是可选的。有边界的 status/diff 视图在可用时使用 Git;Git Publisher 扩展额外要求安装带 Git Credential Manager 的 Git for Windows,以进行浏览器授权的 GitHub 提交/推送。

Windows 可执行文件 — 推荐

从最新 GitHub 发布 Assets 下载单个 FolderBridge.exe,或直接下载 EXE。该二进制文件不会出现在仓库的源文件列表中。FolderBridge.exe 是完整的 FolderBridge 应用,已包含其 Python 运行时,因此普通 EXE 用户无需安装 Python 或 Node.js。旁边的 FolderBridge.exe.sha256 文件是可选的,仅用于完整性验证。

这个单文件可执行文件刻意不重新打包 OpenAI 独立发布的 tunnel-client;请从 OpenAI 的发布中单独下载官方客户端,并且仅在使用网页版 ChatGPT 时在启动器中选择 tunnel-client.exe。

[!NOTE] 当前的社区构建未进行代码签名,因此 Windows 会将其发布者标识为未知。如果你不信任未签名的二进制文件,请改为从经过审计的源码构建。

从源码运行

克隆仓库并启动 GUI:

git clone https://github.com/MoonTzai/folderbridge-mcp.git
cd folderbridge-mcp
python .\folderbridge_launcher.py gui

添加你所需的工作区,首次运行保持选中 Read only,并使用状态面板完成设置。启动器偏好设置存储在仓库之外;Runtime API 密钥从不保存。旧的单工作区设置会自动迁移到第一个列表条目中。

folderbridge_gui.pyw 作为仅源码的便利文件保留,适用于 .pyw 关联指向带 Tkinter 解释器的 Python 安装。独立的 FolderBridge.exe 是受支持的双击入口点。

可选的开发与项目工具链

这些不是正常使用 FolderBridge.exe 的前提条件:

  • 对于源码开发或重新构建 Windows EXE,请从官方 Python Windows 下载 安装 Python 3.11 x64,并验证 python --version。打包流程使用隔离的 .build-venv 和 requirements-build.txt。

  • 仅当目标 Node/npm 工作区需要 node/npm 运行其自身的测试或构建命令时,才从官方 Node.js 下载 安装 Node.js LTS;用 node --version 和 npm --version 验证。

  • 其他项目可能需要自己的运行时或编译器。FolderBridge 能力提供授权和有边界的发现/执行,而非依赖安装。

连接网页版 ChatGPT

ChatGPT 无法直接连接到本地 stdio 进程。FolderBridge 使用 OpenAI 官方的 Secure MCP Tunnel 来实现此路径。你需要:

[!IMPORTANT] Secure MCP Tunnel 只需要本机出站 HTTPS(默认端口 443),不需要面向互联网的入站端口。切勿为 FolderBridge 启用 Windows 远程桌面、路由器端口转发、DMZ、UPnP 映射或端口 3389;它们都不是 Tunnel 设置的一部分。如果防火墙询问入站访问,不要为了 Tunnel 工作而创建宽泛的公共入站规则。

点击启动器右上角的 连接设置向导 可查看与下方相同的步骤和快捷方式,包括可选的 Python/Node 附录。

1. 下载官方 Windows x64 客户端

[!WARNING] 只下载完整的 tunnel-client-v<version>-windows-amd64.zip 压缩包。切勿下载或选择 tunnel-client-runtime-* 文件。 Runtime 文件是内部组件,不实现设置所需的 init 命令;它们相似的文件名仍可能导致"配置失败"。解压完整压缩包后,只选择名称恰好为 tunnel-client.exe 的主程序。

  1. 打开最新的 openai/tunnel-client 发布 并展开 Assets。

  2. 下载名为 tunnel-client-v<version>-windows-amd64.zip 的完整压缩包。在发布文件名中,amd64 表示 Windows x64,适用于大多数 Intel/AMD 电脑。

  3. 可选下载 SHA256SUMS.txt 用于验证。不要选择 tunnel-client-runtime-*、windows-arm64、all.zip、源代码压缩包或许可证文件;Runtime 压缩包不能替代完整客户端。

  4. 将整个 ZIP 解压到稳定的文件夹;没有安装程序,也不应在压缩包内运行。向导可以创建并打开 %LOCALAPPDATA%\FolderBridge\bin 作为推荐位置。

  5. 返回 FolderBridge,点击 选择已解压的 EXE,只选择名称恰好为 tunnel-client.exe 的文件。

2. 创建 Platform Tunnel

打开 OpenAI Platform Tunnel 设置,点击 Create tunnel,并使用以下当前选项:

字段

推荐值

备注

名称(Name)

FolderBridge

可自定义的显示名称

描述(Description)

Local FolderBridge MCP for private workspace access

必填;可自定义

组织(Organizations)

个人账户选择 Personal

团队账户请选择管理该 Tunnel 的 Platform 组织

ChatGPT 工作区

你将要创建应用的工作区

不要留空;个人账户通常只有一个工作区 ID

创建后,复制以 tunnel_ 开头的 Tunnel ID。运行和选择该 Tunnel 需要 Tunnels Read + Use 权限;创建或编辑它还需要 Manage 权限。仅关联需要访问此本地工作区的组织和 ChatGPT 工作区。

在同一 Platform 组织的 Runtime API Keys 下为 tunnel-client 创建密钥;密钥创建者需要 Tunnels Read + Use 权限。请只把它粘贴到 FolderBridge 中,密钥会保留在进程内存中。不要使用 Admin API 密钥,也不要把 Runtime 密钥填入 ChatGPT 应用的 Authentication 字段。

3. 启动 FolderBridge

  1. 添加一个或多个明确的本地工作区文件夹(最多八个),首次运行保持 只读(推荐)。全局访问模式适用于列出的所有文件夹。

  2. 从完整压缩包中选择 tunnel-client.exe,绝不能选 tunnel-client-runtime-* 组件;使用默认的 folderbridge 配置文件即可。

  3. 输入相同的 Tunnel ID 和 Runtime API 密钥。还可以按需一次性启用所需的全局能力;除非你想用自定义命令,否则请保持按工作区的高级命名任务为禁用状态。

  4. 点击 Start connection。启动器会运行官方 init、doctor、run 流程。仅当顶部状态显示 运行中(Running)后再继续。如果之后再更改文件夹或访问模式,请再次点击 应用配置(Apply configuration);启动器会更新它自己管理的同一个 profile。

4. 创建 ChatGPT 开发模式应用

打开 ChatGPT Plugins,点击 +,并采用下列关键选择:

Field

Required choice

Connection

Tunnel

Available Tunnel

选择同一个 Tunnel,或粘贴其 tunnel_... ID

Authentication

No authentication (无需身份验证)

在 Server URL 中不要保留默认的 OAuth 选项,也不要粘贴 https://tunnel-service... 地址。FolderBridge 未实现用户 OAuth,因此这样的配置会产生 does not implement OAuth 错误。

在 ChatGPT 对话中调用该应用

  1. 保持 FolderBridge 状态为 运行中(Running),然后新开一个 ChatGPT 对话。

  2. 点击输入框旁的 +,打开 More(更多),选择刚创建的 FolderBridge 应用。

  3. 发送一个类似这样的任务:“First use FolderBridge server_info to list the available workspaces, then read the root of the workspace I name.” 在批准任何工具确认之前,检查其中的 workspace_id 和文件指向。

该入口遵循 OpenAI 官方的 connect and test guidance。启动器的连接指南中包含相同步骤以及可一键复制的示例提示词。

保持启动器在 ChatGPT 使用工作区期间持续运行。关闭启动器会停止 Tunnel 进程。账户级别的开发模式和安装确认仍会留在 ChatGPT 中;FolderBridge 不会自动化你的浏览器会话或安全设置。

不需要浏览器扩展。FolderBridge 有意不静默下载或执行来自网络的二进制文件。

连接另一个本地 MCP 客户端

可以。FolderBridge 的兼容边界是其标准 MCP stdio server。ChatGPT Tunnel 只是为无法直接拉起本地进程的 Web 客户端提供的桥梁。MCP stdio 传输也是如此:客户端负责启动服务端子进程,并通过标准输入输出交换 JSON-RPC。 MCP stdio specification

客户端要求

  • 能配置一个本地 command + args 对,并持续管理子进程。

  • 支持基于 stdio 的 MCP,保持 stdout 只用于协议消息。

  • 能发现并调用 MCP 工具(initialize、tools/list、tools/call,或现代 2026-07-28 discovery 流程)。

  • 在会话结束时关闭 stdin 或终止子进程。

  • 优先选择带工具确认 UX 的客户端,但不要将确认对话框当作唯一的安全边界。

FolderBridge 目前支持 2024-11-05、2025-03-26、2025-06-18、2025-11-25 和 2026-07-28 协议。它返回 standard tool schemas、text content 和 structuredContent;是否出现确认提示取决于客户端。 MCP Tools specification

Client type

Direct connection?

Route

本地桌面应用或 IDE(stdio MCP)

是

以 FolderBridge.exe 为 command,serve ... 为 args

本地应用但只用单独的合并命令字段

通常可以

使用完整 stdio 命令行并保留路径引号

只接受远程 HTTP/SSE URL 的客户端

否

使用该客户端官方的 stdio gateway/proxy,或部署另外受保护的 MCP bridge

Web-only、移动或云端 sandbox

通常无法直接连到本地 PC

在可访问该工作区的可信主机上,使用官方 Tunnel/remote 机制

最短本地连接步骤

  1. 在 FolderBridge 中添加一个或多个工作区,并保持 Read-only(推荐)。

  2. 打开 连接设置向导 的第 5 页,复制 JSON、TOML 或完整的 stdio 命令。

  3. 把它粘贴到客户端的 MCP 服务端设置中;按其精确字段名遵循客户端文档。

  4. 重新启动或刷新客户端,确认 server_info 和 workspace 出现。

直接 stdio 连接不需要 tunnel-client、Tunnel ID、Runtime API 密钥或正在运行的 FolderBridge GUI。客户端在需要时启动以下命令:

FolderBridge.exe serve --workspace C:\path\to\repo --read-only

重复 --workspace 来添加文件夹,同时保持各根目录独立:

FolderBridge.exe serve --workspace C:\work\frontend --workspace C:\work\backend --read-only

从源码生成可直接粘贴的配置:

python .\folderbridge_launcher.py client-config --workspace C:\path\to\repo --format json --read-only
python .\folderbridge_launcher.py client-config --workspace C:\path\to\repo --format toml --read-only
python .\folderbridge_launcher.py client-config --workspace C:\path\to\repo --format tunnel --read-only

JSON 输出遵循 mcpServers 约定,被许多桌面客户端普遍采用:

{
  "mcpServers": {
    "folderbridge": {
      "command": "C:\\Tools\\FolderBridge.exe",
      "args": ["serve", "--workspace", "C:\\work\\frontend", "--workspace", "C:\\work\\backend", "--read-only"]
    }
  }
}

[!IMPORTANT] JSON/TOML 顶层键是常见约定,不是客户端的强制要求。兼容性的本质是:客户端把 command/args 按 MCP stdio 子进程原样启动。如果客户端只接受 URL,则此版本没有内置 HTTP/SSE 监听器;不要将临时本地端口直接公网暴露。

如需协议版本、进程生命周期、cwd/env、批准边界和远端桥接细节,请查看 client-compatibility research。

工具与编辑工作流

内置的 server tools 不依赖 per-workspace 任务配置:

  • server_info:报告每个可用工作区的名称、稳定的 workspace_id、内置/全局能力和安全边界;

  • workspace:在所选 workspace_id 中列出、读取、搜索并显示有界 Git 状态/diff 输出;

  • file_info:返回二进制文件的有界元数据和 SHA-256;

  • pptx_inspect:检查 PPTX 文本、OOXML 图表关系和 SmartArt 数据,不执行 Office 内容;

  • image_open:向 MCP 客户端返回有界的 PNG/JPEG/GIF/WebP 图片内容,包括 ZIP 中的准确 image member;

  • extension:稳定的 list / info / run 网关,用于热加载扩展;在新引擎里插件本身设置不会增加 MCP 工具名称;

  • edit_file:在读/写模式下,在所选工作区内创建或精确编辑 UTF-8 文件。

当只有一个工作区时,现有客户端可以继续省略 file_schema 中的 workspace_id。当有多个工作区时,workspace 作用域内的工具需要 server_info 返回的 workspace_id;缺失或未知 ID 会被拒绝。重复的根目录、父子重叠以及超过八项的列表都会在启动前被拒绝。

一个安全编辑循环是:

  1. 列出或搜索文件;

  2. 读取它并保留返回的 SHA-256;

  3. 用这个哈希提交精确替换内容;

  4. 检查 Git diff。

服务器不能删除或移动文件。绝对值路径、..、符号链接、junction/reparse point、VCS 内部、常见的依赖/构建目录以及凭据类似的名称都会被拒绝。

全局预授权能力

启动器可以一次性为当前和未来的所有工作区授权常用能力:test、build、package-windows、package-android 和 git-push。这些权限与 .folderbridge.json 不同,它们会出现在 launcher 设置中,因此一个工作区即使在加入几个月后新增了支持的 build 脚本,FolderBridge 也会在调用时检测到。启动器会置于该组提供了 Select all 和 Clear 控件。

git-push 是一个 low-level 高级较低权限,仅 allow 向 GitHub HTTPS origin 推当前分支、不能强制推送,也不能进行 仓库内 credential helper / push-target 重写配置。对于需要浏览器授权并 提交/推送明确文件的场景,请使用内置的 Git Publisher 扩展。build/package 能力可能会执行本地项目代码,所以请只启用你真正需要的全局能力。

对于直接 stdio 客户端,请在 serve 或 client-config 命令中重复 --capability <name>。Windows launcher 将这组 capability 显示为持久复选框。

扩展

FolderBridge Extension ABI v1 是未来添加全局集成的首选方式,例如 ComfyUI、FFmpeg、Blender、Ollama、ADB 或其他本地工具,而无需改变 MCP tool catalog。Windows launcher 有一个默认折叠的 Extensions 侧栏,它会热扫描 user extension directory,显示 installed/approved/loaded 状态,并在 Tunnel 保持连接的状态下让你批准或禁用插件。

每个扩展是一个目录,至少包含 folderbridge-extension.json 和 plugin.py。外部插件会按照整个插件目录的精确 SHA-256,加上声明的权限列表进行批准;更改任何文件或权限都会使批准失效。扩展在一个独立的子进程中运行,带有清理过的环境、有界协议 I/O 和声明的超时时间。这使得崩溃和协议污染被隔离,但两者都不是 OS 安全沙箱:对于不受信任的插件代码,请使用 VM/容器。

工作区特定的适配应使用 workspace_adapter.mode=dynamic 配合 detect.any_of / detect.all_of。FolderBridge 会在调用时重新评估这些模式,因此扩展在安装后无需注入 .folderbridge.json 任务,并且可以在项目后续变更后变得适用。持久化插件状态应使用提供的配置文件状态目录,而不是污染仓库。

ComfyUI 是第一个内置扩展。其状态操作会检查固定的回环端点 127.0.0.1:8188;工作流执行需要在 Extensions 侧边栏中进行一次性批准。在 FolderBridge 0.4.1 中,Windows 启动器还可以自行管理本地 ComfyUI 进程:只需选择一次受支持的 Portable 根目录(python_embeded\\python.exe + ComfyUI\\main.py)或源码根目录(main.py + .venv\\Scripts\\python.exe / venv\\Scripts\\python.exe),启动器即可使用显式的 Python/main.py 参数、shell=False 以及固定的 127.0.0.1:8188 绑定来自动启动它。如果该端点在 FolderBridge 启动它之前已经在线,则该服务会被标记为外部服务并复用,而不是重复启动。

托管服务的所有权有意比扩展权限更严格。FolderBridge 只存储 install_root 和 auto_start,从不存储 PID 或任意命令。只有当前启动器运行所创建的内存中 Popen 句柄才被视为已拥有且可停止。FolderBridge 从不运行用户为 ComfyUI 选择的 BAT/CMD,也从不仅仅因为某个未知进程占用 8188 端口就去查找或终止它。退出时,它会在 Tunnel/MCP 之前停止已拥有的托管服务;外部 ComfyUI 保持运行。

在 Windows 上,启动器会请求 Per-Monitor DPI V2 感知,并轮询当前窗口 DPI 作为轻量级回退方案。固定 GUI 度量仅在 DPI 实际变化时才根据其原始逻辑尺寸(dpi / 96)重新计算,因此从 96 → 144 → 96 DPI 的移动不会累积缩放漂移。

ABI v1 插件应使用 FolderBridge 打包的模块和 Python 标准库,而不是假设单文件 EXE 内存在任意的 pip 依赖。额外的软件通常应通过精确的回环 API 或声明的 process.execute:<basename> 依赖来访问。运行 FolderBridge.exe extensions --json 可检查打包的可执行文件能够发现什么。连接指南附录包含完整格式,以及一个一键式 LLM 插件开发提示,它会告诉模型请求/上传缺失的 API 文档、脚本、工作流、示例文件或项目结构,而不是猜测。参见 Extension ABI v1。

可选的按工作区命名任务

任意命令文本永远不会通过 MCP 接受。对于全局能力未覆盖的、特定于仓库的非常规命令,请创建并审查本地任务策略:

python .\folderbridge_launcher.py init --workspace C:\path\to\repo
# Review C:\path\to\repo\.folderbridge.json
python .\folderbridge_launcher.py approve --workspace C:\path\to\repo

然后在启动器中启用已批准的任务,或向生成的服务器命令添加 --allow-tasks。启用此开关不要求每个配置的工作区都包含 .folderbridge.json:无配置工作区、已批准任务工作区、仅扩展工作区以及配置尚未批准的工作区可以在一个连接中共存。批准会在该工作区的命名任务实际被调用时进行检查。模型只能选择任务名称;它不能提供命令、参数、环境变量或工作目录。

[!WARNING] 测试、构建工具和包脚本会以你当前操作系统用户权限执行仓库代码。对于不受信任的仓库,请使用一次性 VM 或容器,或保持任务执行禁用。

安全模型

FolderBridge 将 MCP 请求、仓库文本和工具输出视为不受信任的数据。强制实施位于工具实现中,而不仅仅是 MCP 注解。主要控制措施包括:

  • 每个工作区的规范路径限制和链接拒绝,重叠根目录被拒绝;

  • 有界的 UTF-8 读取、搜索、Git 输出、子进程输出和协议消息;

  • 带当前内容哈希前置条件的原子写入;

  • 受保护的本地策略文件;

  • shell=False、固定参数数组、干净的任务环境和超时;

  • 扩展清单拒绝未知/过宽的权限名称,扩展批准绑定确切的代码哈希和权限,插件执行被移出 MCP 进程;

  • 无入站网络监听器,无 FolderBridge 遥测。

阅读完整安全模型和上游设计研究。要报告漏洞,请遵循 SECURITY.md。

开发

没有第三方运行时依赖。

python -m unittest discover -s tests -v

在提交拉取请求之前,请参阅 CONTRIBUTING.md。

构建 Windows 可执行文件

构建使用固定的、仅构建时使用的 PyInstaller 依赖。发布的 EXE 使用控制台引导加载程序并带有 hide-console=hide-early:双击仅打开 GUI,而同一可执行文件在 Tunnel 启动其 serve 子命令时保留 stdio。

python -m venv .build-venv
.\.build-venv\Scripts\python.exe -m pip install -r requirements-build.txt
.\scripts\build_windows.ps1 -Python .\.build-venv\Scripts\python.exe

工件和 SHA-256 文件写入 release\windows-x64。

许可证

根据 Apache License 2.0 许可。

FolderBridge MCP 是一个独立的开源项目。它与 OpenAI 无关联、未获其认可,也非其赞助。ChatGPT、OpenAI、MCP 及其他产品名称归其各自所有者所有。

Available Tools

10 tools
edit_fileCreate or exactly edit one fileA
Destructive

Atomically create a UTF-8 file, or edit one using unique exact replacements and a current whole-file SHA-256. workspace(read) returns that SHA for small files; use file_info for larger files. When multiple workspaces are configured, pass the same workspace_id used for inspection. Cannot delete files, edit the local task config, follow links, or access credential-like paths.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes
replacementsNo
workspace_idNoRequired when server_info lists multiple workspaces.
create_contentNoUsed only when creating a new file.
expected_sha256NoRequired when editing an existing file.

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate destructive behavior, but the description adds important context: atomicity, exact replacement matching, SHA requirement, and explicit forbidden actions (delete, config, links, credentials).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Concise single paragraph that front-loads the core purpose and then efficiently covers SHA, workspace_id, and limitations without unnecessary detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers creation vs. editing, SHA requirements, workspace_id, and limitations; with no output schema, return values need no explanation, though failure behavior on non-unique replacements could be mentioned.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema covers 60% of parameters with descriptions; the tool description clarifies replacement uniqueness, SHA acquisition, and workspace_id usage, though it adds little for the obvious path parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (create/edit) and resource (UTF-8 file), clearly distinguishing from siblings by noting exact replacements, SHA-256, and forbidden operations like deletion or credential access.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides practical guidance on obtaining the SHA via workspace or file_info, workspace_id handling, and constraints, but does not explicitly name an alternative like write_file.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

extensionUse FolderBridge extensionsA
Destructive

Stable extension gateway. action=list returns a compact pageable catalog of installed/hot-reloaded extensions and action names; action=info returns the full schema for one extension; action=run invokes one declared extension action. Long foreground actions may be transport-safely promoted in-place to a host-owned Job; use action=job_list to rediscover workspace Jobs, action=job_status to inspect completion/runtime health/results, and action=job_cancel to terminate the owned worker process tree. Installing more extensions does not add MCP tool names. External extension code requires exact-hash local approval; globally authorized actions must also be enabled in the FolderBridge extension sidebar. Dynamic workspace adapters are re-evaluated at call time, so later project changes do not require workspace task injection.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoCatalog/job page size for action=list/job_list.
actionYes
job_idNoRequired for job_status/job_cancel; returned by an explicit or auto-promoted Job action.
offsetNoCatalog/job result offset for action=list/job_list.
paramsNoAction parameters validated against the extension's declared input_schema.
extension_idNoRequired for info/run.
workspace_idNoOptional for list/info; required by workspace-bound run/job operations when multiple workspaces are configured.
extension_actionNoRequired for run; choose an action declared by extension info/list.

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes beyond the annotations by mentioning that job_cancel terminates the owned worker process tree, that external extension code requires exact-hash local approval, and that globally authorized actions must be enabled. This adds meaningful safety context beyond the destructiveHint and readOnlyHint annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is somewhat dense and list-like, but it is still focused and each sentence contributes necessary information about actions, job handling, or authorization. It could be organized into clearer bullets, but it is far from bloated or redundant.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity—8 parameters, multiple actions, job lifecycle, and extension authorization—the description covers the essential operational context. It lacks explicit output format details, but no output schema is provided, and the action-specific behavior is sufficiently described for an agent to invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is already high at 88%, and the description adds useful semantic relationships, such as job_id being returned by an explicit or auto-promoted Job action and workspace_id being required for workspace-bound operations when multiple workspaces are configured. This clarifies parameter behavior beyond the raw schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies this as a stable extension gateway and enumerates the exact actions (list, info, run, job_list, job_status, job_cancel). It also distinguishes the tool from ordinary file operations by noting that installing more extensions does not add MCP tool names, making its role unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides practical guidance on how to use the tool: it explains the purpose of each action, how long foreground actions can be promoted to jobs, and that extension code requires approval. It does not explicitly mention competing alternatives, but it gives enough context for an agent to decide when this gateway is the appropriate entry point.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

file_infoInspect file metadata and SHA-256A
Read-only

Return bounded metadata and whole-file SHA-256 for a regular file without exposing its bytes; use this SHA before editing large text files. Uses the same workspace confinement, link denial, and sensitive-path policy as text tools.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes
workspace_idNoRequired when server_info lists multiple workspaces.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate read-only and non-destructive behavior. The description adds that bytes are not exposed and mentions shared workspace/link/sensitive-path policies, providing extra context beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, tightly packed with essential information: function, limitation, use case, and policy alignment. No fluff or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple metadata/hash tool, the description covers key aspects: what it returns, what it avoids, and when to use it. The absence of an output schema is compensated by the clear explanation of the return value. It is complete enough for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema descriptions cover workspace_id but not path, giving 50% coverage. The description does not add any parameter details, but the parameters are simple and self-explanatory (path, workspace_id). This is adequate but not enhanced.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it returns metadata and SHA-256 for a regular file, and explicitly notes it does not expose bytes, distinguishing it from content-reading tools. The phrase 'use this SHA before editing large text files' gives a concrete purpose and workflow.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides a specific use case ('use this SHA before editing large text files') and clarifies the tool's non-content nature. While it doesn't compare directly to sibling tools, the 'without exposing its bytes' phrase implies when not to use it, giving adequate guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

file_opsCopy or move one file within or across workspacesA
Destructive

Core FolderBridge regular-file copy/move with workspace confinement on both ends. Use source_workspace_id when multiple workspaces are configured; destination_workspace_id is optional and defaults to the source workspace. Paths remain workspace-relative, links/reparse points, credentials, dependencies and protected control config writes are denied. No-clobber is the default; overwrite requires the current destination SHA-256. Cross-volume move falls back to verified copy then source removal.

ParametersJSON Schema
NameRequiredDescriptionDefault
actionYes
max_bytesNo
overwriteNo
source_pathYes
create_parentsNo
destination_pathYes
source_workspace_idNoRequired when more than one workspace is configured.
expected_source_sha256NoOptional source-byte guard; also enables safe already-completed retry recognition.
destination_workspace_idNoOptional; defaults to source_workspace_id.
expected_destination_sha256NoRequired when overwrite=true; must match the current destination bytes.

TDQS

A3.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses critical behaviors beyond the destructiveHint annotation: it denies links, credentials, dependencies, and protected writes; explains no-clobber default with overwrite requiring SHA-256; and describes cross-volume move fallback. These specifics are valuable safety context not present in the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded, leading with the core purpose and then detailing constraints. It avoids unnecessary words and presents information in a logical flow, though it could benefit from a clear separation of parameter usage from general behavior.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 10 parameters, no output schema, and moderate complexity, the description covers important safety and overwrite aspects but omits explanations for max_bytes, create_parents, expected_source_sha256 usage, and action semantics. These gaps could lead to incorrect invocation, especially for a file operation tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds meaning for workspace IDs, overwrite requirements, and no-clobber default, which helps with parameters lacking schema descriptions. However, it does not explain max_bytes limits, create_parents behavior, or the action enum values, leaving gaps despite the low schema coverage of 40%. It partially compensates but not fully.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states the exact operation (copy/move) on a single regular file, with workspace confinement. It clearly distinguishes from edit/write operations and sets expectations about scope. The phrasing 'Core FolderBridge regular-file copy/move' is specific and actionable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides parameter-level guidance (workspace IDs, overwrite behavior) but does not explicitly indicate when to choose this tool over siblings like edit_file or write_file. There is no mention of conditions for selecting this tool or exclusions for other operations, leaving tool selection to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

flight_recorderRead recent FolderBridge flight diagnosticsA
Read-only

Read FolderBridge's compact local reliability flight recorder. It keeps only the latest 15 minutes with a 20 MiB total cap, records MCP/Tunnel metadata and bounded redacted diagnostics, and never stores full MCP request/response bodies. Use action=status for storage health, recent for a bounded timeline, or errors for warning/error events only.

ParametersJSON Schema
NameRequiredDescriptionDefault
roleNoall
limitNo
actionYes
minutesNo

TDQS

A4.2/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Discloses retention limits (15 minutes, 20 MiB), recording of MCP/Tunnel metadata, bounded redacted diagnostics, and explicitly states it never stores full request/response bodies, going beyond the read-only annotation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences, first summarizing the tool's purpose and data characteristics, second giving actionable usage for actions; no unnecessary fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Lacks explanation of parameters like role, limit, minutes, and their interaction; while the action usage is covered, the tool cannot be fully used without inferring parameter meanings from the schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Description does not explain any of the parameters (action, role, limit, minutes) except implicitly mentioning action usage; schema has enums and defaults but description adds no parameter definitions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States the verb 'Read' and the resource 'FolderBridge's compact local reliability flight recorder' clearly, distinguishing it from other read tools like server_info or file_info by specifying the domain.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides guidance on which action to use (status, recent, errors) but does not compare with sibling tools or explain when to choose this over others; still, the action-specific advice is useful.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

image_openOpen a workspace image or ZIP image memberA
Read-only

Return one bounded PNG/JPEG/GIF/WebP as MCP image content, either from a direct workspace path or from one exact member inside a workspace ZIP. The archive is never extracted to disk.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathNoDirect image path. Mutually exclusive with archive_path.
memberNoExact POSIX member path inside archive_path.
archive_pathNoZIP path containing the image. Mutually exclusive with path.
workspace_idNoRequired when server_info lists multiple workspaces.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds meaningful behavior beyond the annotations: it states supported formats, the 'bounded' size constraint, and that the archive is never extracted to disk. These are useful operational details that the readOnlyHint annotation does not convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the return value and formats, and the key behavioral guarantee is stated in one short second sentence. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description explains the return form (MCP image content), supported formats, and the two input paths, which is sufficient for an agent to call the tool correctly. It does not describe error cases, but the schema and annotations cover the essential requirements.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all four parameters. The description adds context about the two usage modes but does not go beyond the schema's mutual-exclusion notes or parameter meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Return') and a precise resource: one bounded PNG/JPEG/GIF/WebP as MCP image content. It also clearly distinguishes the two input modes (direct path vs. ZIP member), which separates this tool from sibling file operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context for when to use the tool: when you need an image as MCP content, either from a workspace path or from a ZIP member. It does not explicitly name alternative tools or exclusion criteria, but the direct-vs-archive distinction is actionable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

pptx_inspectInspect PPTX OOXML and SmartArtA
Read-only

Safely inspect a PPTX inside the selected workspace using Python standard-library ZIP/XML parsing. Returns slide text, diagram-to-slide mappings, dgm:pt points, dgm:cxn connections, and orphan/duplicate diagnostics. Does not execute macros, embedded objects, or workspace code.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes
page_endNo
page_startNo
workspace_idNoRequired when server_info lists multiple workspaces.

TDQS

A3.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description explicitly discloses safety-relevant behavior: it does not execute macros, embedded objects, or workspace code. This goes beyond the readOnly/destructive annotations and reassures the agent about side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and well structured: a safety-and-method sentence, a returns list, and a non-execution guarantee. Every sentence adds meaningful information without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the return-value list is helpful, and the safety behavior is clear. However, the description omits parameter semantics and does not fully explain how page_start/page_end affect inspection, leaving noticeable gaps for a four-parameter tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is only 25% and the description does not explain path, page_start, or page_end. Only workspace_id is described in the schema; the description adds no parameter-level clarification, leaving the agent to guess meanings and ranges.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action ('inspect a PPTX') and resource, and lists concrete outputs ('slide text, diagram-to-slide mappings, dgm:pt points...'). It is clearly differentiated from the sibling tools by its OOXML/SmartArt focus.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given on when to use this tool versus alternatives such as file_info or image_open. It implies use for PPTX inspection but does not explicitly state selection criteria or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

server_infoLocal workspace safety statusA
Read-only

List the fixed workspace IDs, enabled capabilities, approved tasks, and safety boundary.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, which the description aligns with by using the non-destructive verb 'List'. The description adds useful specificity about what information is returned, going beyond the annotations. No contradictions are present.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence that lists the exact outputs. It is well-structured and front-loaded with the action verb, making it easy to understand at a glance. No unnecessary words or complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given that there is no output schema, the description adequately informs the agent of what the tool returns: fixed workspace IDs, enabled capabilities, approved tasks, and safety boundary. This is sufficient for understanding the tool's result without needing additional details.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, and the input schema is fully covered with an empty properties object. Since there are no parameters to describe, the baseline of 4 applies. The description does not need to explain parameters because there are none.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose with a specific verb 'List' and identifies the exact resources it returns: workspace IDs, capabilities, approved tasks, and safety boundary. This makes the tool's function unambiguous and distinct from typical file or workspace operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not provide any guidance on when to use this tool versus its siblings. While it is clearly a read-only status tool, it does not explicitly state that it should be used for checking workspace safety before operations, nor does it mention alternatives. Thus, usage context is implied but not explicitly stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

workspaceInspect the local workspaceA
Read-only

List files, page through UTF-8 text, stream literal search across large UTF-8 files, or page through git status/diff output. When multiple workspaces are configured, pass a workspace_id returned by server_info. All paths are relative; links, credentials, dependencies, and VCS internals are denied.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathNo.
limitNoReturned byte page size for read/status/diff.
queryNoRequired for literal search.
actionYes
offsetNoByte offset for read/status/diff; result offset for list/search.
patternNoGlob for list.*
max_resultsNo
workspace_idNoRequired when server_info lists multiple workspaces.
case_sensitiveNo

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark readOnlyHint=true, and the description is consistent with that while adding behaviors beyond it: literal (not regex) UTF-8-only searches, streaming/paging for large files, and denied content categories. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three front-loaded sentences: action capabilities first, workspace_id routing second, path/denial constraints third. No filler; every sentence carries operational information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 9-parameter, five-action tool with no output schema, the description covers the action space, key routing, and constraints well. It does not specify output shapes or per-action result semantics, but the action names themselves make the expected results reasonably clear.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 56% schema coverage, the description adds meaning to several parameters: workspace_id's source and trigger, path's relative-base convention, query's literal-search nature, and limit/offset's page semantics. It does not expand on max_results or case_sensitive, but those are named and defaulted in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names explicit actions — list, read, search, status, diff — with concrete resource and scope (files, UTF-8 text, git output). This distinguishes it from sibling tools like file_info and edit_file by making clear it is a broad read-only workspace inspection surface.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives a clear context for use: multi-workspace routing via server_info, relative paths, and a hard denial list (links, credentials, dependencies, VCS internals). It does not explicitly name sibling tools or say when to prefer file_info or edit_file, so it stops short of full alternative guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

write_fileTransactionally write a large UTF-8 fileA
Destructive

Host-owned five-action transaction for large whole-file creates or replacements without requiring one giant MCP message. Use begin, then one or more append calls with the exact next UTF-8 byte offset, optionally status, then commit with the complete expected size and SHA-256; abort discards staging. Staging stays outside the workspace, replace mode rechecks the original target SHA at commit, and successful commit uses a same-directory fsync + atomic replace.

ParametersJSON Schema
NameRequiredDescriptionDefault
modeNoRequired only for begin.
pathNoRequired only for begin.
chunkNoRequired for append; runtime-enforced maximum is 4 MiB of UTF-8 bytes so even worst-case JSON escaping stays below the MCP message ceiling.
actionYes
offsetNoRequired for append; exact next UTF-8 byte offset, making retries non-duplicating.
workspace_idNoRequired when server_info lists multiple workspaces.
expected_sizeNoRequired for commit; complete UTF-8 byte length.
transaction_idNoReturned by begin; required by append/status/commit/abort.
expected_sha256NoRequired for commit; SHA-256 of complete new UTF-8 bytes.
expected_target_sha256NoRequired for begin in replace mode; obtain with file_info.

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only supply the generic destructive/idempotent profile; the description adds substantive traits beyond them: staging lives outside the workspace, replace mode rechecks the original target SHA at commit, abort discards staging, and commit is a same-directory fsync plus atomic replace. The offset-based non-duplicating retry guarantee is also stated.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three dense sentences that lead with the transaction model, then the action sequence, then the durability and safety guarantees. Nothing is repetitive of the name or title, and every clause carries operational information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 10-parameter, multi-action tool with no output schema, the description covers the full lifecycle and the return of transaction_id is captured in the schema itself. It leaves unstated what status or commit return on success and what happens when an offset mismatch or commit-contract failure occurs.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 90%, so per-parameter documentation is already strong (baseline 3). The description goes further by binding parameters to actions as a cross-field contract: commit needs the complete expected size and SHA-256, append needs the exact next byte offset, and replace mode requires the original target SHA. It doesn't add format examples for the hashes, which the schema already constrains.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource with scope: a host-owned five-action transaction for large whole-file creates or replacements. The 'whole-file ... without requiring one giant MCP message' framing distinguishes it from the sibling edit_file, which handles partial edits.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit protocol sequencing (begin, one or more appends, optionally status, commit, abort) and the size/whole-file condition that motivates it. It stops short of naming edit_file as the alternative for small or partial changes, so the routing decision is implied rather than stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 1 tool updatev0.8.36
    • Addedfile_ops
  2. 1 tool updatev0.8.33
    • Changedwrite_file1 field changed
      • changedInput schema / properties / chunk / description
        Previous value: -"Required for append; runtime-enforced maximum is 128 KiB of UTF-8 bytes so even worst-case JSON escaping stays below the 1 MiB MCP message limit."New value: +"Required for append; runtime-enforced maximum is 4 MiB of UTF-8 bytes so even worst-case JSON escaping stays below the MCP message ceiling."
  3. 9 tool updatesv0.8.25
    • First observededit_file
    • First observedextension
    • First observedfile_info
    • First observedflight_recorder
    • First observedimage_open
    • First observedpptx_inspect
    • First observedserver_info
    • First observedworkspace
    • First observedwrite_file

TDQS

A4/5.0

Scored across 10 tools

Disambiguation5/5

Each tool has a clearly distinct purpose: file operations, editing, reading/searching, metadata, specific format inspection, extension management, and server info. Even edit_file vs write_file are separated by size/chunking, and workspace vs file_info differ in scope. No overlapping or ambiguous tools.

Naming Consistency3/5

All names use lowercase with underscores, but the verb/noun order varies: edit_file and write_file use verb_noun, while file_info and server_info use noun_verb, and workspace and extension are bare nouns. This inconsistency makes the pattern less predictable, though still readable.

Tool Count5/5

10 tools is well-scoped for a file management and inspection server. Each tool covers a distinct aspect (copy/move, create/edit, read/search, metadata, format inspection, extensions, diagnostics) without redundancy or bloat.

Completeness3/5

The surface covers most file lifecycle operations (create, edit, read, copy, move, metadata) but lacks a delete operation. Also missing directory creation and possibly rename (though move may cover that). These are notable gaps for a file management server.

Maintenance

ActivityActive
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • F
    license
    B
    quality
    D
    maintenance
    A read-only MCP server that exposes a local code workspace to AI clients via stdio, providing file browsing and text search capabilities with path safety rules.
    1
    -
  • A
    license
    Not graded
    quality
    C
    maintenance
    A deliberately narrow, approval-gated workspace server that safely reads and writes files and runs allowlisted commands only inside one configured workspace, requiring visible approval for every write, process execution, and file read, with stale-overwrite protection and symlink-escape rejection.
    1
    MIT
  • F
    license
    A
    quality
    C
    maintenance
    A read-only MCP server that lets AI assistants inspect local workspace files, search context, view git diffs, and fetch a fixed GitHub profile, all within a sandboxed stdio transport.
    5
    -
  • A
    license
    Not graded
    quality
    A
    maintenance
    Enables AI clients to safely read, search, understand, and edit local project code and files, with Git inspection, code indexing, and controlled command execution within permissioned workspaces.
    3 npm
    6
    MIT