Blocks network access for a specified program using its full path; on Linux, it always refuses because firewalls filter by address, port, and user rather than by program.
Blocking a program from the network is not possible on Linux, whose firewalls filter by address, port and user rather than by program: this always refuses there.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | The program's full path (get_process gives it). |
Changes observed during successful MCP inspections.
v0.1.0Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and idempotentHint=true, so the safety profile is partly covered, but the description adds nothing about what the block actually changes, whether it is reversible, or whether elevated privileges are required. The one behavioral fact it does add (firewalls on Linux filter by address/port/user, so the call always refuses there) is useful but narrow given this is a destructive mutation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is a single sentence with no padding, but it front-loads the failure case rather than the capability, so a skimming agent may read the tool as impossible rather than platform-limited. The structure would be stronger with the action stated first and the Linux caveat second.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive, state-changing tool the definition omits the essentials: what blocking does on supported platforms, how to reverse it, and privilege requirements. The schema and annotations cover the parameter and the danger level, but the description leaves the operational picture incomplete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one parameter exists and the schema describes it fully at 100% coverage, including the hint that get_process supplies the path. The description adds no meaning beyond that, so the baseline 3 for schema-covered parameters applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The phrase "Blocking a program from the network" does name a verb and resource, but the sentence is framed entirely as a Linux limitation and never states what the tool actually does on supported platforms or what the resulting state is. An agent can infer it blocks a program's network access, yet the definition reads more like documentation for a refusal than for the operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It supplies a genuine exclusion – do not call this on Linux because it always refuses – which prevents a wasted destructive call. It gives no positive when-to-use context (platforms that work, prerequisites) and never names the sibling unblock_program as the inverse operation, so an agent must infer the counterpart.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.