pterodactyl-mcp

Write a file to the server

ptero_write_file

DestructiveIdempotent

Write or replace a text file on a Pterodactyl game server. Reads existing content first, previews overwrites, and requires confirmation before destructive changes.

Instructions

Write a text file on the game server. The body you pass REPLACES the file entirely — this is not an append and not a patch. There is no partial write.

ALWAYS call ptero_read_file on the same path first and build the new content from what is actually there. Writing a config from memory silently drops every setting you did not happen to include.

Creating a NEW file runs immediately. OVERWRITING an existing file is treated as destructive: the first call returns status "needs_confirmation" with a preview (path, current size, new size) and a confirmation_token, and an automatic backup is taken before the write actually happens. Show that preview to the human and only call again with the token once they have agreed.

Protected paths (PTERODACTYL_PROTECTED_PATHS — by default the world directories, server.properties, ops.json, whitelist.json and banned-*.json) are refused outright.

The file content itself is never written to the audit log; only its sha256 and length are.

Input Schema

TableJSON Schema

Name	Required	Description
`path`	Yes	File path relative to the server root, e.g. `plugins/Geyser-Spigot/config.yml`. Parent directories must already exist. Leading slashes are optional.
`server`	No	Server short identifier (e.g. 1a2b3c4d). Omit to use PTERODACTYL_DEFAULT_SERVER. Call ptero_list_servers to discover valid identifiers.
`content`	Yes	The complete new contents of the file. Everything currently in the file is replaced. Include a trailing newline if the format expects one.
`dry_run`	No	When true, validate and preview the change without performing it. Nothing is modified and no confirmation token is issued. Use this to reason about an operation before committing to it.
`confirmation_token`	No	Two-phase confirmation token. Leave this out on the first call: the tool will refuse to act and instead return a preview of exactly what would change, plus a single-use token that expires in 120 seconds. THE PREVIEW IS FOR THE HUMAN — show it to the user in your reply and let them decide. Do not silently round-trip the token back in an immediate second call. Only call again with the token once the user has seen the preview and approved it. The token is bound to a hash of these exact arguments, so changing any argument invalidates it.

Output Schema

TableJSON Schema

Name	Required	Description
`path`	No	Server-relative path written.
`action`	No
`reason`	No	Why the call was refused.
`server`	Yes
`status`	Yes	success = the change was made. refused = a guardrail blocked it (see reason/variable). dry_run = nothing changed; preview shows what would. needs_confirmation = nothing changed; SHOW the preview to the human and, only if they agree, call again with confirmation_token.
`message`	No
`preview`	No	What would / did change.
`variable`	No	Environment variable that caused the refusal.
`backup_id`	No	UUID of the automatic pre-change backup, if one was taken.
`expires_in_s`	No
`bytes_written`	No
`confirmed_via`	No
`content_sha256`	No	sha256 of the content written, for verification.
`confirmation_token`	No

Schema Changelog

Changes observed during successful MCP inspections.

First observedv0.1.0Sep 26, 2026

TDQS

A5/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Even though annotations already mark this as destructive and idempotent, the description adds crucial behavioral detail: the first call returns needs_confirmation with a preview and token, an automatic backup is taken, the token expires in 120 seconds and is bound to argument hash, protected paths are refused, and file content is never written to the audit log. This goes well beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but every block earns its place: replacement semantics, read-first guidance, new-vs-overwrite workflow, protected paths, and audit logging. It is front-loaded with the most important warning about destructive replacement and stays focused throughout.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a high-risk mutation tool with two-phase confirmation, the description is fully complete. It covers the exact call sequence, confirmation preview, token lifecycle, protected paths, backup behavior, and audit-log implications, so an agent has all necessary context to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Although schema coverage is 100%, the description adds significant meaning: content must be the complete new file and may need a trailing newline; dry_run validates without issuing a token; confirmation_token is single-use, time-limited, and invalidated by argument changes. This meaningfully enriches what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Write a text file on the game server' and immediately clarifies that the body REPLACES the file entirely rather than appending or patching. This clearly differentiates it from ptero_read_file and other file tools even before considering siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly instructs the agent to ALWAYS call ptero_read_file first and build new content from what exists. It also specifies when writes run immediately (new files) versus when confirmation is required (overwrites), tells the agent to show the preview to the human, and calls out protected paths that are refused.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.