Woow Podman MCP Server
This server exposes a Podman host as MCP tools, letting an AI assistant inspect and operate the host's containers, images, volumes, networks, and pods through the libpod API.
Inspect & monitor: list containers (running or all), inspect full container configs/state, fetch container logs (with grep/tail/since filters), get resource usage snapshots, list processes inside containers, run healthchecks, list images/pods/volumes/networks, show disk usage, read the bounded podman event streams, and get host/podman info.
Operate containers: start, stop, restart containers; execute commands inside existing containers (with optional user, workdir, tty) and return stdout/stderr/exit code.
Manage images: pull images from registries with configurable policy and TLS verification.
Safety gating: only tools in the active profile are registered; this schema exposes the 18-tool
safeprofile (read-only inspection plus start/stop/restart/exec/image-pull). Destructive removal/prune tools exist only in thefullprofile and are not present here.Access is bounded by the host user's Podman permissions, with an optional name allow-list and response size limits applied to the MCP tools.
Provides tools for interacting with a Podman host via the libpod REST API, including managing containers, images, volumes, networks, and pods, with safety profiles gating available operations.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Woow Podman MCP Servershow me all running containers"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Woow Podman MCP Server
English · 繁體中文
A FastMCP server that exposes a Podman host through its libpod REST API as MCP tools, plus a web admin console that supervises it, gates it, and publishes it on an authenticated URL that Claude (or any MCP client) can connect to directly.
It runs as one rootless Podman container that borrows the host's Podman socket. The container manages the host's containers by reaching the daemon over the bind-mounted socket directory; it never runs a Podman of its own. Three components live in that one container:
# | Component | What it is |
1 |
| The MCP server. 23 tools over the libpod API, gated by a safety profile. Binds to loopback only. |
2 |
| The admin console: React SPA + FastAPI, on |
3 |
| Product-agnostic plumbing shared with the other Woow MCP consoles: app factory, JWT auth, config store, process manager, reverse proxy. |
The connector URL is https://<host>/private_<mcp_auth_token>/mcp/. The path segment is the
credential; see Authentication.
Install (rootless Podman + Quadlet + systemd)
The supported deployment is a set of Quadlet units run by the user's systemd manager. Tested on Ubuntu 24.04 with podman 4.9.3 (the minimum this repo accepts is 4.9) and systemd 255, rootless, with linger.
git clone https://github.com/WOOWTECH/Woow_podman__mcp_server.git
cd Woow_podman__mcp_server
scripts/install.sh # or: scripts/install.sh --port 18080scripts/install.sh is idempotent. It:
checks the host (not root, podman >= 4.9, the Quadlet generator, a reachable
systemctl --user), enables linger andpodman.socketif they are off;creates
~/.config/podman-mcp-admin/podman-mcp-admin.env(mode 0600) fromconfig/podman-mcp-admin.env.exampleon the first run and writes the daemon's API version into it.--port N,--bind ADDRand--set KEY=VALUEchange a setting and save it there;refuses to continue when a container named
podman-mcp-adminexists that Quadlet does not manage, or when the old hand-written unit is still enabled (see Migrating), because Quadlet starts containers withpodman run --replace;renders the units in
quadlet/with the env file (@@VAR@@tokens, whitelist inquadlet/render-vars) and checks them with the podman 4.9.3 generator andsystemd-analyze --user verifybefore anything is installed;builds
localhost/woow-podman-mcp-admin:<VERSION>from theDockerfilewhen that tag does not exist yet (--rebuildforces it,--no-buildforbids it);creates three podman secrets if they are missing (random, never printed): the JWT signing key, the first-boot admin password and the first-boot connector token;
installs only the files that changed and restarts only the units whose files changed. A re-run with nothing changed restarts nothing;
waits for the container to be healthy and runs
tests/smoke.sh.
scripts/install.sh --dry-run renders and validates everything and reports what it would change,
without changing anything.
What gets installed:
Path | What |
| the console; published on |
| volume |
| network |
| your per-host settings (0600) |
podman secrets |
|
First login
podman secret inspect --showsecret --format '{{.SecretData}}' podman-mcp-admin-passwordThat is the password the console was seeded with on its first boot. Open the console through your
tunnel (or ssh -L 8080:127.0.0.1:8080 <host> and http://localhost:8080), log in, and print the
connector URL with:
scripts/show-connector.sh --base https://podman-mcp.example.comIt reads the live token from /data/config.json, so it stays right after you rotate the token on
the Tokens page.
Settings
Edit ~/.config/podman-mcp-admin/podman-mcp-admin.env and re-run scripts/install.sh. The values
are rendered into the unit at install time, so a changed value restarts the container and an
unchanged one does not.
Key | Default | Notes |
|
| Publish address. A LAN IP only when the tunnel runs on another machine. |
|
| Host port. |
|
|
|
| (empty) | Regex of container/pod names the tools may touch (no spaces or quotes). |
| the daemon's | Written by the first install. A version newer than the daemon 404s every call. |
|
| Per-call response ceiling; tools truncate by row and say how many they dropped. |
|
| Console session lifetime. |
/data/config.json wins after the first boot. The console self-seeds config.json on an empty
volume from PODMAN_*, ADMIN_PASSWORD and MCP_AUTH_TOKEN (see
podman_mcp_admin/bootstrap.py), and the values in that file override the container environment
from then on. A later change of PODMAN_MCP_PROFILE or PODMAN_API_VERSION in the env file
therefore does not reach a deployment whose config.json already holds it (a key that was empty at
first boot, such as an unset PODMAN_MCP_NAME_ALLOW, is not stored and still follows the env
file). Change stored values on the settings pages, or edit config.json in the volume and restart
the unit.
Local development, no container
pip install -e ".[dev]"
python3 scripts/seed.py --config /tmp/pm/config.json \
--podman-uri unix:///run/user/$(id -u)/podman/podman.sock
MCP_ADMIN_CONFIG=/tmp/pm/config.json JWT_SECRET=dev \
uvicorn podman_mcp_admin.main:app --port 8080Or the bare MCP server over stdio, no console at all:
PODMAN_MCP_PROFILE=readonly python3 -m woow_podman_mcp_server.serverRelated MCP server: AAP MCP Server
Authentication
Network. The console is published on
127.0.0.1only, so only processes on the same host reach it: a cloudflared with host networking, or Nginx Proxy Manager. WidenMCP_ADMIN_BINDonly when the tunnel runs on another machine, and then only to one LAN IP.Admin console. One admin password, stored in
/data/config.json(mode 0600). The session is an HS256 JWT signed withJWT_SECRET, sent in a cookie that isHttpOnly,SameSite=Strict, andSecurewhen the request arrived as HTTPS (X-Forwarded-Proto: https;ADMIN_COOKIE_SECUREoverrides). It lastsJWT_EXPIRY_HOURS; logout or a password change revokes every issued token. Five failed logins within 300 s lock that client out for 30 s, doubling up to 900 s. The client is identified by the firstX-Forwarded-Forhop, which the client controls unless the proxy overwrites it, so the throttle only means something behind a same-host tunnel.MCP connector. The URL
https://<host>/private_<token>/mcp/is a bearer credential. It is compared in constant time and answers 403 on a mismatch. Rotating it from the Tokens page restarts the child. There is no OAuth:/.well-known/*and/registerreturn a JSON 404 on purpose. The URL lands in the tunnel's access logs and in the claude.ai connector settings; treat it like a password.What a token holder can do. Everything this user's podman socket can do, narrowed by
PODMAN_MCP_PROFILEandPODMAN_MCP_NAME_ALLOW.safe(the default) includesexec, which reads any container's files and environment. Evenreadonlyincludes container inspect, which returns every container'sConfig.Env, including podman secrets passed astype=env(podman 4.9.3). The connector token is therefore also a read credential for the env secrets of every stack of that user, including this one'sJWT_SECRET. Usereadonlyand a name allow-list for agents that only monitor.Recommended exposure. A Cloudflare Access policy on the console hostname for everything except
/private_*: the console then needs SSO plus the password, and the connector path stays reachable for claude.ai, which cannot perform an Access login. Or use a separate hostname for the connector if you do not want Access path rules.
The secrets reach the container as type=env podman secrets, so they never appear in the unit
files, systemctl --user cat, the container's create command or the journal. They do appear in
podman inspect of the running container (point 4). Moving them to file mounts needs *_FILE
support in mcp_admin_core first.
Behind a Cloudflare tunnel
If cloudflared runs on the same host (for example with host networking), point its ingress at
http://localhost:8080 (or your MCP_ADMIN_PORT). This is the default and needs nothing else.
If cloudflared runs elsewhere, for example an in-cluster cloudflared pod on a different
machine, localhost is that pod's own loopback and will 502. Publish on the Podman host's LAN
address and point the ingress there:
scripts/install.sh --bind 192.168.1.20 # this host's LAN IP; 0.0.0.0 is refused# cloudflared config.yaml ingress entry
- hostname: podman-mcp.example.io
service: http://192.168.1.20:8080Two consequences to accept first: the console and the connector path are then reachable by anything on that LAN, behind a single admin password; and the host's LAN IP must be stable (static lease), or the tunnel silently 502s. If that is more surface than you want, run a second cloudflared on the Podman host pointing at localhost instead.
Upgrade
git pull
scripts/upgrade.shupgrade.sh snapshots the installed units, exports podman_mcp_data with scripts/backup.sh,
runs scripts/install.sh (which builds the new VERSION tag and restarts what changed) and
tests/smoke.sh. If anything fails, it puts the previous units back, restarts them on the
previous image tag (install never deletes image tags) and exits 1. The version lives in
VERSION, the unit's Image= tag and pyproject.toml; CI fails when they disagree.
Backup and restore
scripts/backup.sh # -> ~/backups/podman-mcp-admin/<timestamp>/
scripts/backup.sh --include-secrets # also the three podman secrets, in secrets.env (0600)
scripts/backup.sh --stop # stop the container around the export and start it again
scripts/restore.sh ~/backups/podman-mcp-admin/<timestamp> # asks first; --yes to skipThe backup is a podman volume export of podman_mcp_data, whose config.json holds the admin
password and the live connector token: keep backups private. restore.sh stops the unit, replaces
the volume with the export, starts it and runs the smoke test.
Uninstall
scripts/uninstall.sh # stop and remove the units; keep volume, secrets, image, env file
scripts/uninstall.sh --purge # also delete the volume (final backup first), network and secrets
scripts/uninstall.sh --purge-images # also remove the localhost/woow-podman-mcp-admin:* images--purge is the only way these scripts delete data; it asks you to type the app name (--yes
skips that). Re-running install.sh after a plain uninstall adopts the same volume, so the
connector URL and the admin password are unchanged. podman.socket is never touched: other
stacks use it. The env file stays in ~/.config/podman-mcp-admin/; delete it yourself.
Migrating an existing deployment
For a host that runs the container from the old README - a hand-made podman run … podman-mcp-admin plus a hand-written podman-podman-mcp-admin.service (or a
podman generate systemd unit). This is woowtechopenclaw today. One script does it:
scripts/migrate-legacy.sh --dry-run # checks + a render; changes nothing
scripts/migrate-legacy.sh --prepare-only # env file, secrets, image, backup; no downtime
scripts/migrate-legacy.sh # the cutover (seconds)
scripts/migrate-legacy.sh --status # what it recorded
scripts/migrate-legacy.sh --rollback # back to the legacy deploymentWhat it does not guess. The pre-flight refuses rather than assumes: no container, a
container already managed by Quadlet or by a foreign unit, a stopped one, a /data that is not
the named volume podman_mcp_data, a mount the Quadlet unit does not reproduce, added
capabilities or --privileged, a busy port, units already installed, or a plain
podman-mcp-admin.service that shadows the generated one and does not belong to this app.
What it adopts. podman_mcp_data where it is - so the connector token and the admin
password in /data/config.json are unchanged - plus JWT_SECRET and ADMIN_PASSWORD out of
the legacy container's environment into podman secrets (values pass through a pipe, never
through argv or the journal), and PODMAN_MCP_PROFILE, PODMAN_MCP_NAME_ALLOW,
PODMAN_MCP_MAX_CHARS, JWT_EXPIRY_HOURS and the publish port into the env file. Even the
console session survives, because JWT_SECRET is adopted rather than regenerated.
After the cutover it re-reads the volume's CreatedAt and the inode of its mountpoint and of
config.json and compares them with the values recorded before. A Quadlet .volume adopts by
name; that is only worth trusting if the name still resolves to the same directory. A
mismatch fails the migration and rolls it back.
Exposure is narrowed on purpose. openclaw's container publishes 0.0.0.0:8080 - the
rootless podman socket, reachable from the LAN. The new unit publishes 127.0.0.1:8080 unless
you pass --keep-exposure or --bind <addr>, and the script says so loudly either way. Check
the tunnel ingress first: cf-tunnel-webgui runs with host networking there, so an ingress to
localhost:8080 keeps working after the narrowing; an ingress that names the LAN IP does not.
API version. openclaw's container carries PODMAN_API_VERSION=v5.0.0 against a 4.9.3
daemon. /data/config.json froze whatever the first boot saw, so this usually only matters for
a fresh config, but the migration still prefers the daemon's own version and says so;
--api-version v5.0.0 keeps the legacy value.
Rollback shape (STANDARD 7a). How the legacy container is kept is asked of the host, never
of its name: ql_rollback_strategy answers rename (rename it and leave it stopped) or
capture (ql_capture_container into the backup directory, then a plain podman rm - never
podman rm -v, which would delete the volume). capture is chosen only where this user's
podman-restart.service is enabled and the container's restart policy is exactly always,
because such a container revives at the next boot and fights the Quadlet container for its
name, its port and the socket. woowtechopenclaw has the unit enabled but the container is
unless-stopped, so it takes the rename path there today - a fact about the host, which is why
the script asks instead of hardcoding. The capture is taken in --prepare-only, before any
downtime, so a container that cannot be replayed is refused while the console still serves.
Backup. ~/backups/podman-mcp-admin/migrate-<timestamp>/ holds the volume export, the full
podman inspect, the legacy unit file, a precheck.txt and, on the capture path, the rollback
copy - all listed in SHA256SUMS (cd <dir> && sha256sum -c SHA256SUMS). The directory is
0700 and the files 0600: the inspect carries the container's environment.
Downtime is measured, not estimated. Two probes sample /healthz every 100 ms from
outside - one on the address the legacy container publishes, one on the address the new unit
will - because the cutover may change it. The reported downtime is the gap between the last
answer of the old endpoint and the first answer of the new one; the wall clock of the whole
cutover (which also covers install.sh, its health wait and tests/smoke.sh) is reported
separately. On the toypark1234 rehearsal that was 10-11 s of unreachable console inside a
42 s cutover - the console is down for as long as podman takes to stop the old container and
start the new one; the rest of the wall clock is install.sh verifying its own work while the
new console is already answering.
Afterwards. Rotate the admin password and the connector token: both sat in the legacy container's environment and probably in shell history. Once the soak period is over, remove the renamed legacy container and the old unit file.
Docker and compose
Docker Compose is no longer part of this repo. The last commit with docker-compose.yml is tagged
compose-final; it is
not maintained. For Kubernetes use Woow_k3s_mcp_server. The image is built locally (Pull=never);
publishing it to GHCR is future work.
Safety profiles
Tools are gated at registration time, not at list time. A tool outside the active profile does
not exist on the protocol: it cannot be called by name, cannot be reached by a client that cached
an older tools/list, and does not appear in the schema. A gate that only filters the listing
is bypassed by any client that already knows the tool name.
Profile | Tools | Includes |
| 13 |
|
| 18 | + |
| 23 | + |
This is the only meaningful boundary once the socket is mounted: anything that can reach the socket has that uid's full Podman; the profile is what narrows it.
Security
The Podman socket is the entire boundary. libpod has no API key: anything that can reach the
socket can create a privileged container and bind-mount the host root, so it is root-equivalent
for that uid. The Quadlet unit mounts the rootless socket directory (%t/podman) and runs as
container root, which is the host user in the rootless user namespace. It also drops every
capability, sets no-new-privileges and a read-only root filesystem (/data is the only
writable volume).
No OAuth. The server answers every /.well-known/* probe and /register with a JSON 404.
The SPA catch-all used to answer those probes with 200 text/html, which a client reads as "yes,
I have an authorization server"; it then attempted Dynamic Client Registration, got HTML back, and
failed with "Couldn't register with … 's sign-in service" in a redirect loop. A clean 404 makes
discovery fail fast so the client falls back to anonymous access and just sends initialize.
A remote host over tcp:// has no authentication at all. PODMAN_URI=tcp://host:2376 is
supported by the client (with optional mTLS via PODMAN_TLS_*), but podman system service itself
does no TLS and no auth. Only use tcp:// inside a trusted, isolated segment, and terminate mTLS in
front of it yourself. For an authenticated remote transport, prefer an SSH tunnel to the socket.
Notes from the field
podman statswith an unknown name. libpod answersHTTP 200with{"Error": {}, "Stats": null}, and{}is falsy, so the obviousif payload.get("Error")check never fires and the tool silently returns nothing. It also returns no stats when any requested name is unknown, so the error names the whole batch.podman topwith plainpsflags. libpod returns fewer columns than titles for flag-style args likeaux, so the rows cannot be tabulated. The tool detects the mismatch and prints the raw output with a hint to use descriptor form (ps_args="-eo pid,user,comm").Stream framing. libpod is always 8-byte multiplexed, even with a TTY; only the Docker-compat
/v1.xendpoints go raw. Thettyflag is passed down explicitly rather than guessed from the payload, because output that happens to start with\x01\x00\x00\x00is otherwise eaten.
Tests
pytest # 33 tests, no network, no Podman required
tests/dryrun.sh # renders the units and checks them with the podman 4.9.3 generator + systemd-analyze
tests/smoke.sh # on an installed host: health, loopback-only, login, MCP initialize, wrong-token 403CI: quadlet-ci.yml (vendored lib checksum, dry-run,
shellcheck) and tests.yml (pytest, credential scan, image build).
Layout
Dockerfile two-stage build (node 22.23.2 SPA stage, python 3.12.14 runtime), pinned
VERSION image tag; must match quadlet/podman-mcp-admin.container and pyproject.toml
quadlet/ podman-mcp-admin.container, podman-mcp.volume, podman-mcp.network, render-vars
config/ podman-mcp-admin.env.example
scripts/ install, upgrade, uninstall, backup, restore, show-connector; lib/quadlet-lib.sh (vendored)
scripts/migrate-legacy.sh hand-made `podman run` deployment -> these units, with --prepare-only and --rollback
scripts/app.sh the facts and helpers migrate-legacy.sh and tests/rollback-model.sh share
tests/ pytest suite, dryrun.sh (+ dryrun.local.sh, fixtures/), smoke.sh
tests/rollback-model.sh shim-driven: both rollback shapes of STANDARD 7a, and the migration pre-flight
tests/shims/ podman and systemctl doubles (no container is created)
verification/ in-container client for manual checks against a live deploymentRoadmap
Phase 1 (this release) is "the console comes up and the connector works". The MCP server is a
single self-contained server.py; the console supervises it, proxies it, streams its logs and
rotates its token.
Phase | Scope |
1 ✅ | Console boots, self-seeds, auth, process supervision, encrypted proxy, 18/23 tools live |
2 | Profile data model: |
3 | Connection & health: real Podman probe, Test Connection with distinct errors per failure mode, full dashboard |
4 | Podman operations pages (containers, images, volumes, networks, pods) |
Until Phase 2/3 land, the Connection and Tools pages get a JSON 404 from the API fallback
and render empty. That is intentional and easier to debug than a stub that pretends to work.
License
MIT; see LICENSE.
Available Tools
18 toolspodman_container_execADestructive
在既有 container 內執行指令,回傳 stdout/stderr 與 exit code。 stderr 行會以 'E| ' 前綴標示(tty=true 時為 raw、無前綴)。
| Name | Required | Description | Default |
|---|---|---|---|
| tty | No | ||
| name | Yes | ||
| user | No | ||
| command | Yes | ||
| workdir | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true, so the agent knows this is a potentially destructive operation. The description adds useful output-format context (stderr prefix, tty behavior) but does not mention prerequisites like the container being running or error handling behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, efficient, and front-loaded with the core purpose followed by detailed output behavior, with no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the core purpose and output format, and an output schema exists, so return-value details are covered. However, it lacks context about prerequisites (e.g., container must be running) and potential destructive side effects beyond the annotation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description should compensate; it only clarifies the tty parameter's effect on stderr formatting, while leaving user, workdir, and command semantics implicit from their parameter names.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool executes commands inside an existing container and returns stdout/stderr and exit code, distinguishing it from container lifecycle siblings like start/stop.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for executing commands in existing containers, but it does not explicitly compare with alternatives or state when not to use this tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
podman_container_healthcheckBRead-only
執行並回報 container 的 healthcheck 結果。
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is clear. The description adds that the tool executes the healthcheck (not just reads a cached status), but it does not explain behaviors like what happens if no healthcheck is configured or whether the result is returned as structured output.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, direct sentence. It is extremely concise and front-loaded, with no unnecessary words or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one parameter, an output schema exists, and annotations are provided), the description is mostly sufficient. However, it could mention edge cases like containers without a healthcheck or how the result is reported, so it is not fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter 'name' is left entirely to the schema, which only provides its type and title. With schema description coverage at 0%, the description needed to clarify that 'name' refers to the container name and any constraints, but it does not. This fails to compensate for the schema's lack of detail.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific action (execute and report) on a specific resource (container's healthcheck result). It is distinct from sibling tools like podman_container_inspect or podman_container_logs, which serve different purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It does not mention prerequisites, such as the container needing a healthcheck defined, or when one would prefer inspect or logs to get health information.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
podman_container_inspectARead-only
Inspect 單一 container 的完整設定/狀態。輸出很大,只查你要的那一個。
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | ||
| section | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so safety is clear. The description adds the behavioral trait that output is large and advises querying only the needed container, which is useful context beyond the annotations. No contradictions found.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is exactly two short sentences, front-loaded with the main purpose, and the extra warning about output size earns its place. There is no redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Output schema exists and annotations cover the safety profile, but the 'section' parameter is completely unexplained, and there is no detailed usage guidance. The description is adequate for a simple inspect tool but leaves gaps in parameter semantics and alternative usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, and the description provides no information about the 'name' or 'section' parameters. It does not clarify what 'section' filters or the expected format of 'name', leaving a significant gap in parameter understanding.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Inspect single container's complete configuration/status' with a specific verb and resource, distinguishing it from sibling tools like podman_ps or podman_container_logs. It also emphasizes 'single container', making the scope explicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for inspecting one container, and the warning 'output is large, only query the one you want' gives a hint to be selective. However, there is no explicit mention of when to use this tool versus alternatives or when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
podman_container_logsARead-only
取 container logs。預設只取最後 200 行;stderr 行會以 'E| ' 前綴標示。
| Name | Required | Description | Default |
|---|---|---|---|
| grep | No | ||
| name | Yes | ||
| tail | No | ||
| since | No | ||
| until | No | ||
| stderr | No | ||
| stdout | No | ||
| timestamps | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is known. The description adds useful behavioral details beyond annotations: the default 200-line tail limit and the 'E| ' prefix for stderr lines. This helps the agent anticipate output formatting without overselling.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences, with the action stated first and key defaults included. Every word earns its place, and there is no redundant content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the output schema exists, return values need not be described. However, with 8 parameters and no parameter guidance or usage scenarios, the description is minimally complete for a log-fetching tool. It provides the essential behavioral facts but misses opportunities to mention filtering options or when to use them.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description does not compensate. It fails to explain any of the 8 parameters (grep, since, until, stdout, stderr, timestamps, etc.) beyond what the schema already provides. The only mention of 'tail' default is a value already present in the schema, adding no semantic value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('取' / fetch) and the resource ('container logs'), which unambiguously distinguishes it from sibling tools like podman_container_inspect or podman_container_top. The name and description together leave no doubt about the tool's function.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is used to retrieve container logs, but it provides no explicit guidance on when to use this over other tools (e.g., when to use grep, since, until filters). No exclusions or alternative recommendations are given, so the usage context is only implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
podman_container_restartCIdempotent
重啟 container。
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | ||
| timeout | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate readOnlyHint=false, destructiveHint=false, and idempotentHint=true. The description adds no extra behavioral context beyond the fact that it restarts a container, such as what happens to running processes or network settings. Given annotations, the bar is lower, but the description still adds minimal value.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely brief (three Chinese characters plus 'container'), but this brevity reflects under-specification rather than effective conciseness. It lacks any explanation of parameters or usage context, so it does not earn its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with two parameters and an output schema, the description is inadequate. It provides no context on side effects, required permissions, or typical use cases. While the output schema exists, the description does not guide the agent on what to expect or how to handle failures.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description provides no information about the 'name' or 'timeout' parameters. Since the description fails to compensate for the schema's lack of descriptions, parameter semantics are entirely missing.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description '重啟 container' clearly states the action (restart) and the resource (container), making the purpose immediately understandable. It does not explicitly distinguish itself from sibling tools like start or stop, but the verb 'restart' implies a specific operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. The description does not mention prerequisites, conditions, or exclusions, leaving the agent to infer usage from the tool name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
podman_container_startCIdempotent
啟動 container。
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate the tool is idempotent and non-destructive, but the description adds no context about behavioral side effects, such as what happens if the container is already running, failure modes, or resource implications. It offers zero additional behavioral transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely short but under-specified; it merely restates the tool name and does not earn its place by adding useful information. It is concise in length but lacks necessary structure or elaboration.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool this description is bare minimum, but it lacks important context such as preconditions, state changes, or relationship to sibling tools. The presence of an output schema reduces the need to explain return values, yet the description still feels incomplete for an agent to select and invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has a single 'name' parameter with 0% coverage in the description. The description does not explain what the parameter represents (e.g., container name or ID), so it fails to compensate for the lack of schema-level descriptions, though the parameter is somewhat self-evident from the tool name.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Start container' is a direct tautology of the tool name, adding no new information about the action's scope or distinguishing it from sibling tools like restart or stop. It communicates a basic action but fails to differentiate the tool from alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives such as podman_container_restart or podman_container_stop, nor does it mention preconditions like the container needing to exist or be in a stopped state.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
podman_container_statsBRead-only
container 即時資源用量(單次快照,不 streaming)。
| Name | Required | Description | Default |
|---|---|---|---|
| all | No | ||
| names | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare the tool as read-only and non-destructive, so the description does not need to repeat that. The description adds the behavioral trait of returning a snapshot rather than a stream, which is valuable beyond the annotations. However, it does not describe output format or any operational constraints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise—a single sentence that is easy to parse and front-loads the core purpose. It omits additional useful detail, but it earns its place by being clear and compact.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With a read-only annotation, a non-destructive hint, and an output schema available, the description is minimally adequate. However, it lacks essential parameter semantics and does not mention prerequisites like running containers, making it incomplete for a tool with two parameters and no schema descriptions.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description provides no information about the 'all' and 'names' parameters, and schema description coverage is 0%. While the parameter names are somewhat self-explanatory, the description does not clarify semantics such as whether 'all' includes stopped containers or how 'names' filters results, leaving the agent without sufficient guidance.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool as retrieving container resource usage, with a specific qualifier of 'single snapshot, no streaming.' While it lacks an explicit verb like 'get' or 'show', the meaning is unambiguous and differentiates from sibling tools like podman_container_top (process-level) and podman_ps (listing).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies that this tool is for one-time snapshots rather than continuous monitoring ('single snapshot, no streaming'), but it does not explicitly state when to use it over alternatives or provide exclusions. This is a thin but present usage hint.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
podman_container_stopAIdempotent
停止 container(預設 10 秒後 SIGKILL)。
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | ||
| timeout | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses the timeout behavior (default 10 seconds then SIGKILL), which goes beyond the annotations' idempotent/destructive hints. It adds context about how the stop process executes but doesn't mention other side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that front-loads the primary action. It is efficient and without filler, though it omits some contextual details such as usage guidance.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity, the annotations (idempotent, non-destructive), an existing output schema, and the timeout behavior description, the description is mostly complete. It lacks usage guidance but covers the essential behavioral detail.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description fails to compensate for parameter explanations. It indirectly references the timeout default but does not explicitly link it to the timeout parameter or explain the name parameter beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action 'stop container' with a specific resource (container). The additional detail about SIGKILL after 10 seconds further clarifies the behavior, distinguishing it from start/restart siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is used to stop a container but provides no explicit guidance on when to use it versus alternatives like podman_container_start or podman_container_restart. No exclusions or alternative tool references are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
podman_container_topARead-only
列出 container 內的 process (podman top)。
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | ||
| ps_args | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, indicating a safe read operation. The description adds minimal behavioral context beyond the basic purpose, such as noting it lists processes but does not disclose any additional nuances like requiring a running container or the effect of ps_args. With annotations covering the safety profile, a 3 is appropriate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that is front-loaded with the action and resource. No unnecessary words or repetition exist, making it highly efficient for an agent to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, return values are covered. However, the description lacks usage context (e.g., when to prefer this over exec), parameter semantics, and any prerequisites like container state. It is adequate for a simple read tool but leaves clear gaps that could cause incorrect invocation in ambiguous situations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate by explaining parameters. It does not. The names 'name' and 'ps_args' are somewhat self-evident, but ps_args' purpose (likely formatting/filtering arguments to ps) is not clarified. The description provides no added meaning beyond the schema's type definitions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's action: '列出 container 內的 process' (list processes inside a container), and the parenthetical '(podman top)' explicitly references the underlying command. This specific verb+resource pairing distinguishes it from sibling tools like logs or stats.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance is given about when to use this tool versus alternatives. However, the name and description imply it is for process listing, making the usage context inferable but not explicitly contrasted with siblings like podman_container_exec or podman_container_stats.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
podman_eventsARead-only
讀取 podman 事件流(有界,不會卡住)。查故障時間線很好用。
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| since | No | 30m | |
| until | No | ||
| filters | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is known. The description adds the valuable behavioral detail that the event stream is bounded and will not hang, which is informative beyond the annotations. It does not disclose other traits such as filtering behavior or output format, so a 3 is appropriate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is exceptionally concise—two short sentences that convey the core purpose, the bounded non-blocking behavior, and a primary use case. Every word earns its place without unnecessary detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present and straightforward read-only operation, the description is adequate but leaves parameter semantics unexplained. It covers the tool's purpose and key behavior, but for a tool with 4 optional parameters, the lack of parameter guidance makes it only minimally complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description adds no information about the parameters (limit, since, until, filters). The parameter names are somewhat self-explanatory, but the description does not compensate for the lack of schema descriptions, especially for time formats and filter syntax.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool reads the podman event stream and notes it is bounded and non-blocking. It gives a specific use case (troubleshooting timelines), but does not explicitly differentiate it from sibling tools like podman_container_logs, so it falls short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a clear context for use ('good for troubleshooting timelines'), implying when to prefer this tool. However, it does not mention exclusions or explicitly name alternative tools, so it lacks the explicit when-not-to-use guidance that would merit a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
podman_image_pullA
從 registry 拉 image。會等到拉完,大 image 請留意 timeout。
| Name | Required | Description | Default |
|---|---|---|---|
| policy | No | missing | |
| reference | Yes | ||
| tls_verify | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations (readOnlyHint=false, openWorldHint=true), the description discloses that the operation is blocking ('會等到拉完' - waits until done) and warns about timeout for large images. This adds valuable behavioral context not captured by annotations, though it does not mention side effects like modifying the local image store.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two succinct sentences. The first states the core purpose, and the second adds a key behavioral warning. Every word is useful, and the structure is front-loaded with the main action.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
While the tool is relatively simple and has an output schema, the description lacks parameter guidance, which is essential given the 0% schema description coverage. The timeout warning is helpful, but without explaining what 'reference' should contain (e.g., image name and tag), the description is incomplete for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for missing parameter documentation. However, it does not explain any of the three parameters (reference, policy, tls_verify), leaving the agent without crucial information such as how to format the image reference or what policy values mean. This is a critical gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function with a specific verb and resource: '從 registry 拉 image' (pull image from registry). It distinguishes from sibling tools like podman_images (list images) and podman_ps, making it unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context on when to use the tool—for pulling images from a registry—and adds an important usage caveat about blocking until completion and timeout for large images. However, it does not explicitly mention alternatives or when-not-to-use scenarios, which would justify a higher score.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
podman_imagesBRead-only
列出本機 images。
| Name | Required | Description | Default |
|---|---|---|---|
| all | No | ||
| format | No | text | |
| filters | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, covering the safety profile. The description adds the 'local' scope but does not mention return format, pagination, or other behavioral details. With annotations present, this is adequate but not enriched.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise phrase with zero wasted words. It is immediately front-loaded and efficient for a simple list tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity, annotations, and output schema, the description is minimally viable. However, it lacks any mention of parameter usage or filtering capabilities, which are relevant for correct invocation. Sibling tools help, but the description itself leaves gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description provides no information about the parameters (all, format, filters). The description fails to compensate for the complete lack of parameter documentation, leaving the agent to infer meaning solely from names/types.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description '列出本機 images' clearly states the tool lists local images, with a specific verb (list) and resource (images). It distinguishes from sibling tools like podman_ps (containers) and podman_volumes (volumes).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when one needs to view local images, but does not explicitly state when to use this tool versus alternatives like podman_info or podman_image_pull. No exclusions or alternate tool guidance is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
podman_infoARead-only
Podman host 概況:版本、OS、runtime、rootless、資源用量。
| Name | Required | Description | Default |
|---|---|---|---|
| format | No | text |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide readOnlyHint=true and destructiveHint=false, so the safety profile is known. The description adds the specific data fields returned, which is useful context, but it does not disclose any subtle behaviors such as potential daemon requirements or performance implications. It is adequate but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is one concise sentence, front-loaded with 'Podman host overview', and lists key aspects without unnecessary verbiage. Every word adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only info tool with an output schema available, the description covers the primary purpose and data scope. It omits any mention of the 'format' parameter, but the optional enum is self-explanatory. The presence of annotations and output schema reduces the need for more detail.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 0% description coverage for the 'format' parameter. The description does not mention this parameter at all, so the agent must infer its meaning solely from the enum values (text/json). Since the schema coverage is low, the description should have compensated, but it does not.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly specifies a host-level overview tool, listing concrete data points (version, OS, runtime, rootless, resource usage). It distinguishes from sibling tools like podman_container_inspect and podman_images by focusing on the Podman host itself.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for when to use this tool: when host-level information is needed. It does not explicitly name alternatives or exclusions, but the host scope inherently separates it from container/image/pod tools. A note distinguishing it from podman_system_df would have earned a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
podman_networksCRead-only
列出 networks。
| Name | Required | Description | Default |
|---|---|---|---|
| format | No | text |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark this as read-only and non-destructive, so the description needs to add extra context. It adds nothing beyond the basic action, such as output behavior, pagination, or permission requirements, providing minimal value over the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, direct sentence that efficiently conveys the core purpose without unnecessary words. It is appropriately brief for a simple list operation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple, and the output schema and annotations cover some aspects. However, the description lacks context about when to use it or how the format parameter behaves, leaving a clear gap in usage guidance. It is adequate but not complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema contains one parameter 'format' with enum values and a default, but no description. The tool description does not explain this parameter, so the 0% schema description coverage is not compensated, leaving the agent to infer its meaning from the schema alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'List networks' which is a clear verb+resource pair. It doesn't explicitly differentiate from sibling list tools like podman_images or podman_volumes, but the resource is unambiguous and the action is specific.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It does not mention the format parameter, any exclusions, or prerequisites, leaving the agent without context for selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
podman_podsBRead-only
列出 pods 與其中的 containers。
| Name | Required | Description | Default |
|---|---|---|---|
| format | No | text | |
| filters | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is clear. The description adds the detail that containers within pods are included in the listing, which is useful scope context. No behavioral traits beyond that are disclosed, and there is no contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, compact sentence in Chinese that gets straight to the point. Every word is necessary, and there is no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is a simple listing operation, but the description is too sparse to be fully complete. It does not explain the 'filters' parameter or the 'format' options, which are important for controlling the output. The output schema exists, but the parameter semantics are missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 0% description coverage, and the description provides no information about the 'format' or 'filters' parameters. This leaves the agent without guidance on how to use these parameters, so the description fails to compensate for the schema gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb '列出' (list) and identifies the resource as 'pods' with the additional scope of including the containers within them. This distinguishes it from sibling tools like podman_ps or podman_images.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly states what the tool does but provides no explicit when-to-use or alternative guidance. It is implied that this is the tool for listing pods, but there is no mention of when to prefer it over podman_ps.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
podman_psARead-only
列出 containers。預設只列 running,all=true 含已停止。
| Name | Required | Description | Default |
|---|---|---|---|
| all | No | ||
| format | No | text | |
| filters | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already declare readOnlyHint=true and destructiveHint=false, establishing the safe read profile. The description adds the crucial behavioral trait that only running containers are listed by default and that all=true broadens the result to include stopped ones, which is beyond what annotations provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences, front-loaded with the main action '列出 containers' and then elaborating the default and all parameter. Every word earns its place, with no redundant filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given that this is a simple read-only listing tool with an output schema, the description adequately covers the core behavior and the most important parameter (all). It does not explain filters or format, but those are visible in the schema and the read-only nature is annotated, making it complete enough for a basic list operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage, leaving the meaning of parameters solely to types and names. The description explains only the 'all' parameter ('all=true 含已停止') but does not clarify 'format' or 'filters', particularly the complex anyOf structure for filters, leaving significant semantic gaps.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states '列出 containers' (List containers), which clearly identifies the verb and resource. It further specifies the default scope (only running) and the all=true option to include stopped containers, distinguishing it from inspection or management tools like podman_container_inspect and podman_container_start.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context about the default behavior (listing running containers) and explicitly mentions how to include stopped ones using all=true. While it does not mention alternatives or when-not-to-use, the context is clear enough for basic usage compared to sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
podman_system_dfBRead-only
磁碟用量統計 (podman system df)。
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=true and destructiveHint=false, so the safety profile is clear. The description adds minimal extra behavioral context—just 'disk usage statistics'—but does not elaborate on what scopes are covered (e.g., containers, images, volumes) or the nature of the output. It does not contradict the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single short sentence with no unnecessary words. It is concise and straight to the point, containing the core meaning without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only, zero-parameter tool, the description is minimally adequate but sparse. It does not specify which disk usage categories are included (e.g., container, images, volumes) or mention that it provides a system-wide summary. However, given the tool's simplicity and available output schema, the description meets the baseline but leaves room for richer context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the input schema is trivially 100% covered. The 0-parameter baseline applies, and the description need not explain any parameter details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description '磁碟用量統計 (podman system df)' clearly identifies that the tool provides disk usage statistics, which is a specific and distinct function among the sibling tools. It goes beyond merely restating the tool name, though it could be more action-oriented (e.g., 'list' or 'show').
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description offers no guidance on when to use this tool versus alternatives such as podman_info or podman_images. There is no mention of context, prerequisites, or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
podman_volumesARead-only
列出 volumes。
| Name | Required | Description | Default |
|---|---|---|---|
| format | No | text |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is clear. The description adds no extra behavioral context beyond the basic listing operation. It does not contradict annotations, but it also does not disclose any additional traits such as output format or scope.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence. It is appropriately sized for a simple list operation and contains no unnecessary words or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity, the presence of an output schema, and annotations covering safety, the description is mostly complete. It lacks any mention of the format parameter or scope (e.g., 'all volumes'), but these are not critical for a basic listing tool and are largely covered by the schema and name.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 0%, and the description does not compensate for the 'format' parameter. Although the schema fully documents the parameter with enum values and a default, the description offers no additional meaning, leaving the agent to rely solely on the schema for a parameter that could benefit from contextual explanation (e.g., 'json output for machine parsing').
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description '列出 volumes。' clearly states a specific verb (list) and resource (volumes), distinguishing it from sibling tools that operate on containers, images, pods, or networks. It fully captures the tool's purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit guidance on when to use this tool versus alternatives. However, the resource name and sibling list imply its use for listing volumes. It lacks contextual cues such as 'use this when you need to see available volumes' or exclusions for other resource types.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
18 tool updates
v0.1.0- First observed
podman_container_exec - First observed
podman_container_healthcheck - First observed
podman_container_inspect - First observed
podman_container_logs - First observed
podman_container_restart - First observed
podman_container_start - First observed
podman_container_stats - First observed
podman_container_stop - First observed
podman_container_top - First observed
podman_events - First observed
podman_image_pull - First observed
podman_images - First observed
podman_info - First observed
podman_networks - First observed
podman_pods - First observed
podman_ps - First observed
podman_system_df - First observed
podman_volumes
TDQS
Scored across 18 tools
Every tool has a clearly distinct purpose: listing containers, inspecting, starting, stopping, logs, stats, top, healthcheck, exec, plus separate tools for images, pods, volumes, networks, and host-level info. There is no overlap that would cause an agent to misselect.
The tools consistently use the podman_ prefix and snake_case throughout. Most container operations follow a resource_action pattern (podman_container_start), while some are noun-only (podman_ps, podman_images, podman_events) or compound (podman_system_df), mirroring the podman CLI. The minor style variation is acceptable but not perfectly uniform.
With 18 tools, the server is slightly above the typical well-scoped range of 3-15. However, the breadth of Podman features covered (containers, images, pods, volumes, networks, events, exec) justifies the count, and each tool adds value without redundancy.
The tool set is largely read-oriented and lacks fundamental lifecycle operations. There is no way to create or delete containers, pods, volumes, networks, or images (except pulling). Starting/stopping/restarting and exec provide some control, but the missing CRUD operations are significant gaps for a general Podman server.
Maintenance
Related MCP Connectors
MCP server for mandates, delegation, policy-gated execution, credential grants, and audit.
Personal assistant MCP server with search, execute, packages, jobs, secrets, and integrations.
An MCP server that provides an API to LLMs to manage their JumpCloud resources.
- UnifAPIOAuthcom.unifapi
Hosted MCP server for live public-data APIs and Skills for AI agents.
Related MCP Servers
- FlicenseAqualityDmaintenanceEnables AI tools to manage containerized applications through Podman, supporting container lifecycle operations, command execution, log viewing, image management, and resource monitoring. Features automatic network discovery for seamless integration with MCP Discovery Hub.12-
- AlicenseBqualityDmaintenanceEnterprise-grade MCP server exposing Ansible Automation Platform 2.x as a complete AI interface for LLMs, enabling natural language management of automation resources.861Apache 2.0
- AlicenseNot gradedqualityBmaintenanceEnables management of Podman containers, pods, images, and compose stacks via natural language, with support for container stats, logs, exec, health analysis, and a web dashboard.1MIT
- FlicenseBqualityBmaintenanceMCP server for natural-language control of local Docker, covering containers, images, volumes, networks, and Compose stacks, plus security scanning and diagnostics.34-