de en es ja ko ru zh

GhostDesk

Name: GhostDesk
Author: YV17labs

by YV17labs

Overview Schema Source Related Servers Discussions Admin

Rust

Remote

Related MCP server: umbriel

Why GhostDesk?

Browser automation tools (Playwright, Puppeteer, Selenium…) were built for human test engineers driving a browser with selectors. They do one thing, and they do it well — inside the browser.

GhostDesk is built from the other end: for AI agents, driving everything a desktop runs. Browsers, native apps, IDEs, terminals, office suites, legacy software, internal tools. If it renders pixels on screen, your agent can see it and use it — in one conversation, across many applications, without a line of glue code.

You don't write selectors. You write a prompt:

"Open the CRM, export last month's leads as CSV, open LibreOffice Calc, build a pivot table, screenshot the chart, and email it to the team."

The agent opens the browser, logs in, downloads the file, switches to LibreOffice, processes the data, captures the result, composes the email, sends it. One prompt, multiple apps, fully autonomous — no glue code, no per-site scraper, no brittle selector chain.

That is what agents using a desktop looks like.

Runs on models you can actually host

Desktop control needs to be fast — an agent that takes twelve seconds to decide where to click is unusable. GhostDesk is tuned so that vision-language models from the Qwen family running on a single workstation GPU are a first-class target, not an afterthought. No API bill, no screenshots of your desktop leaving your network.

Frontier models (Claude, GPT-4o, Gemini) work too and remain the smoothest path — but they are not the bar. See Model requirements for the supported stacks and the one coordinate-space setting that matters.

How it works

GhostDesk runs a virtual Linux desktop inside Docker and exposes it as an MCP server. Your agent gets a sandboxed desktop with a taskbar, clock, and pre-installed applications — equivalent to what a human sees on their screen.

The agent perceives the screen by calling screen_shot(), which captures the full desktop at native resolution and returns it as WebP (or PNG). An optional region= argument can crop to a sub-rectangle when the agent explicitly wants to narrow its focus.

This works with any application — web apps, native apps, legacy software, Canvas, WebGL.

Quick start

1. Run the container

One command, plain HTTP, no password. Fine for kicking the tires on a laptop you trust — not fit for anything beyond that. Ready to harden it? Jump to Secure local run.

docker run -d --name ghostdesk-demo \
  --shm-size 2g \
  -p 3000:3000 \
  -p 6080:6080 \
  ghcr.io/yv17labs/ghostdesk:latest

The latest image ships with Firefox, the foot terminal, mousepad (text editor), galculator, and passwordless sudo for the agent user — enough to demo a browsing + note-taking workflow out of the box. Need a different app set? Build your own on top of base — see Custom image.

The container boots in the dev posture: plain HTTP on both ports, every auth gate disarmed on purpose. You'll see warnings in the logs reminding you of that — they go away once you follow the secured path below.

2. Connect your AI

GhostDesk speaks MCP over the Streamable HTTP transport — any MCP-compatible client can drive it. Point your client at http://localhost:3000/mcp:

Claude Desktop / Claude Code

{
  "mcpServers": {
    "ghostdesk": {
      "type": "http",
      "url": "http://localhost:3000/mcp"
    }
  }
}

Any other MCP-compatible client — same URL, no headers, no auth. That's the whole demo posture.

3. Watch your agent work

Open http://localhost:6080/ in your browser to see the virtual desktop in real time. No password prompt — the dev posture skips it.

Service	URL
MCP server	`http://localhost:3000/mcp`
noVNC (browser)	`http://localhost:6080/`

Give your agent a first prompt to confirm the wiring is right:

"Take a screenshot of the desktop, list the installed applications, then open Firefox and go to wikipedia.org."

You should see Firefox launch in the noVNC tab, the URL bar fill in, and the page load — all under your agent's control.

4. When you're done

docker stop ghostdesk-demo && docker rm ghostdesk-demo

The demo run creates no named volume, so this leaves nothing behind.

Secure local run (TLS + auth)

The Quick start above drops every gate so you can kick the tires in thirty seconds. The moment you want to expose this to anything beyond your own laptop — another machine on your LAN, a devcontainer port-forward on an untrusted network, a teammate's browser — flip to the secured posture: real TLS + bearer-token auth on MCP + password prompt on noVNC.

GhostDesk couples TLS and auth: mount a cert and you get wss:// + bearer-token on MCP + a single-password prompt on noVNC (see Security → Auth ≡ TLS). mkcert issues a browser-trusted cert for localhost in two commands:

# Issue a locally-trusted cert (first time only — installs a local CA in your trust store)
mkcert -install
mkdir -p tls
mkcert -cert-file tls/server.crt -key-file tls/server.key localhost 127.0.0.1 ::1

# Generate the MCP and VNC secrets
export GHOSTDESK_AUTH_TOKEN=$(openssl rand -hex 32)
export GHOSTDESK_VNC_PASSWORD=$(openssl rand -hex 16)

Pick a container name that matches the agent's role — sales-agent, research-agent, accounting-agent… Below we use my-agent as a placeholder; replace it everywhere in the command.

# Run the container — cert mounted, TLS + auth enabled everywhere
docker run -d --name ghostdesk-my-agent \
  --restart unless-stopped \
  --cap-add SYS_ADMIN \
  --shm-size 2g \
  -p 3000:3000 \
  -p 6080:6080 \
  -v ghostdesk-my-agent-home:/home/agent \
  -v "$PWD/tls/server.crt:/etc/ghostdesk/tls/server.crt:ro" \
  -v "$PWD/tls/server.key:/etc/ghostdesk/tls/server.key:ro" \
  -e GHOSTDESK_AUTH_TOKEN \
  -e GHOSTDESK_VNC_PASSWORD \
  -e TZ=America/New_York \
  -e LANG=en_US.UTF-8 \
  ghcr.io/yv17labs/ghostdesk:latest

echo "MCP token:    $GHOSTDESK_AUTH_TOKEN"
echo "VNC password: $GHOSTDESK_VNC_PASSWORD"

Once the container is up, update your MCP client config — same shape as the demo, now over https:// with a bearer token:

Claude Desktop / Claude Code

{
  "mcpServers": {
    "ghostdesk": {
      "type": "http",
      "url": "https://localhost:3000/mcp",
      "headers": {
        "Authorization": "Bearer <paste $GHOSTDESK_AUTH_TOKEN here>"
      }
    }
  }
}

Any other MCP-compatible client — same URL, plus an Authorization: Bearer <token> header in whatever form your client accepts.

Then open https://localhost:6080/ in your browser — the mkcert CA installed by mkcert -install is already in your trust store, so the browser accepts the cert with no warning. noVNC will prompt for $GHOSTDESK_VNC_PASSWORD.

Going to production? Swap the mkcert leaf for a real cert, source both secrets from your secret manager, and front port 6080 with an identity-aware proxy — SECURITY.md has the full contract.

--cap-add SYS_ADMIN — Required by Electron apps (VS Code, Slack, etc.) and other applications that need Linux user namespaces to run their sandbox. Safe to remove if you don't need them.

The named volume persists the agent's home directory across restarts — browser passwords, bookmarks, cookies, downloads, and desktop preferences are all preserved. On the first run, Docker automatically seeds the volume with the default configuration from the image.

Tools

13 tools at your agent's fingertips, grouped by concern (verb_noun naming):

Screen

Tool	Description
`screen_shot`	Capture the screen as a WebP image (pass `format="png"` for lossless). Pass `region=` to crop to a sub-rectangle at native resolution. Set `stabilize=False` to skip page stabilization checks (default: True, waits max 5 sec for page to stabilize)

Mouse

Tool	Description
`mouse_move`	Move the cursor to coordinates without clicking — reveals hover-only menus, tooltips, and CSS `:hover` states (e.g. Gmail action bar)
`mouse_click`	Click at coordinates
`mouse_double_click`	Double-click at coordinates
`mouse_drag`	Drag from one position to another
`mouse_scroll`	Scroll in any direction (up/down/left/right)

Keyboard

Tool	Description
`key_type`	Type text with realistic per-character delays
`key_press`	Press keys or combos (`ctrl+c`, `alt+F4`, `Return`...)

Clipboard

Tool	Description
`clipboard_get`	Read clipboard contents
`clipboard_set`	Write to clipboard

Apps

Tool	Description
`app_list`	List the GUI applications installed on the desktop
`app_running`	List the application windows currently open — call before `app_launch` to avoid relaunching an app that is already there
`app_launch`	Start a GUI application by name
`app_status`	Check if an application is running and read its logs

Model requirements

Your inference stack must cover four capabilities — all four are mandatory:

Text + vision — the agent perceives the desktop through screenshots and needs a model that can interpret them.
Tool use — GhostDesk exposes 14 tools as function calls; the model must be able to invoke them.
MCP client — the host needs to speak Streamable HTTP MCP to reach the GhostDesk server.
WebP image support — GhostDesk returns screenshots as WebP by default to keep payloads small and inference fast. A stack that can only decode PNG or JPEG will not work out of the box.

Coordinate space — `GhostDesk-Model-Space` header

By default no header is needed: Claude and the other major frontier LLMs work out of the box. Qwen3.x need the client to send GhostDesk-Model-Space: 1000 on every MCP request.

Example MCP client config:

{
  "mcpServers": {
    "ghostdesk": {
      "url": "https://localhost:3000/mcp",
      "headers": {
        "GhostDesk-Model-Space": "1000"
      }
    }
  }
}

Running locally

For self-hosted inference we use and recommend our fork of llama.cpp, which adds WebP decoding and turbo quant on top of upstream: YV17labs/llama.cpp, branch integration/webp-turbo. The day WebP lands upstream we will archive the fork and point there directly.

macOS users: use llama.cpp, not mlx-vlm (as of 2026-04-01). The mlx-vlm stack currently produces inaccurate coordinate outputs for the same models that work correctly under llama.cpp. This is caused by an upstream bug in an Apple dependency, not the model itself. Until the fix lands, llama.cpp is the recommended backend on every platform — including Apple Silicon Macs.

Run whatever local model you like. Four from the Qwen vision family that I've used and that work well for desktop control:

Qwen3.6-27B — dense 27B; as of today the strongest of the four on complex, multi-step tasks, at the cost of slower inference.
Qwen3.6-35B-A3B — 35B parameters, only 3B active per token.

From one agent to a workforce

Each GhostDesk instance is a container. Spin up one, ten, or a hundred — each agent gets its own isolated desktop, its own apps, its own role. Think of it as hiring a team of digital employees, each with their own workstation.

Scale horizontally

# docker-compose.yml — 3 specialized agents, one command
#
# Prerequisites: the TLS cert + key at ./tls and the two secrets
# (GHOSTDESK_AUTH_TOKEN, GHOSTDESK_VNC_PASSWORD) in your environment or a
# .env file. Generate both exactly as shown in the Secure local run
# section above. See SECURITY.md for the production secret-handling
# contract.

x-ghostdesk-defaults: &ghostdesk-defaults
  image: ghcr.io/yv17labs/ghostdesk:latest
  restart: unless-stopped
  cap_add: [SYS_ADMIN]
  shm_size: 2g
  environment:
    - GHOSTDESK_AUTH_TOKEN
    - GHOSTDESK_VNC_PASSWORD
    - TZ=America/New_York
    - LANG=en_US.UTF-8

services:
  sales-agent:
    <<: *ghostdesk-defaults
    container_name: ghostdesk-sales-agent
    ports: ["3001:3000", "6081:6080"]
    volumes:
      - ghostdesk-sales-agent-home:/home/agent
      - ./tls/server.crt:/etc/ghostdesk/tls/server.crt:ro
      - ./tls/server.key:/etc/ghostdesk/tls/server.key:ro

  research-agent:
    <<: *ghostdesk-defaults
    container_name: ghostdesk-research-agent
    ports: ["3002:3000", "6082:6080"]
    volumes:
      - ghostdesk-research-agent-home:/home/agent
      - ./tls/server.crt:/etc/ghostdesk/tls/server.crt:ro
      - ./tls/server.key:/etc/ghostdesk/tls/server.key:ro

  accounting-agent:
    <<: *ghostdesk-defaults
    container_name: ghostdesk-accounting-agent
    ports: ["3003:3000", "6083:6080"]
    volumes:
      - ghostdesk-accounting-agent-home:/home/agent
      - ./tls/server.crt:/etc/ghostdesk/tls/server.crt:ro
      - ./tls/server.key:/etc/ghostdesk/tls/server.key:ro

volumes:
  ghostdesk-sales-agent-home:
  ghostdesk-research-agent-home:
  ghostdesk-accounting-agent-home:

docker compose up -d   # Your workforce is ready

Each agent runs in parallel, independently, on its own desktop. Connect each to a different LLM, give each a different system prompt, install different apps — full specialization.

Secure by design

Every agent is sandboxed in its own container. No access to the host machine. No access to other agents. Network, filesystem, and process isolation come free from Docker.

This makes GhostDesk a natural fit for enterprises:

Concern	How GhostDesk handles it
Data isolation	Each agent lives in its own container — no shared filesystem, no shared memory
Access control	Restrict network access per agent with Docker networking. An agent with CRM access doesn't see finance tools
Auditability	Watch any agent live via VNC, record sessions, review screenshots
Blast radius	If an agent goes wrong, kill the container. Nothing else is affected
Compliance	No data touches your host. Containers can run in air-gapped environments

Specialize each agent

Give each agent a role, like you would a new hire:

Sales agent — monitors the CRM, enriches leads, updates the pipeline
Research agent — browses the web, compiles competitive intelligence, writes reports
Accounting agent — processes invoices in legacy ERP software, reconciles spreadsheets
QA agent — clicks through your app, files bug reports with screenshots
Support agent — handles tickets, looks up customer info across multiple internal tools

Each agent gets its own system prompt defining its mission, its own installed applications, and its own network permissions. Manage AI agents like employees — each with their own desktop, their own tools, and their own clearance level.

Supervise in real time

Every agent exposes a VNC/noVNC endpoint. Open a browser tab and watch your agent work — or open ten tabs and monitor your entire workforce. Intervene at any time: take over the mouse, correct course, or chat with the orchestrating LLM.

Configuration

Every variable GhostDesk reads is namespaced under GHOSTDESK_*. Standard POSIX variables (TZ, LANG) are kept as-is so the existing Unix ecosystem keeps working.

Secrets (required — container refuses to boot without them)

Variable	Description
`GHOSTDESK_AUTH_TOKEN`	Bearer token required on every MCP request. Generate with `openssl rand -hex 32`.
`GHOSTDESK_VNC_PASSWORD`	Password for wayvnc (username is `agent` in the prod image). Generate with `openssl rand -hex 16`.

Both are plain environment variables. Wire them from your secret store (secretKeyRef on Kubernetes, Docker secrets / Vault / AWS SM on compose) — see SECURITY.md for the full contract.

Runtime knobs

Variable	Default	Description
`GHOSTDESK_PORT`	`3000`	MCP server listening port
`GHOSTDESK_HOST`	`127.0.0.1` (standalone) / `0.0.0.0` (container)	Bind address for the MCP endpoint. Defaults to loopback per MCP transports spec; the container's entrypoint exports `0.0.0.0` so Docker's port-publishing layer can reach it.
`GHOSTDESK_ALLOWED_ORIGINS`	(empty)	Comma-separated list of `Origin` headers accepted from browser clients (e.g. `https://app.example.com,https://localhost:8080`). Non-browser clients (Claude Desktop, SDKs, `curl`) send no `Origin` and are always allowed. Required for any browser-based MCP UI; without it, browser requests are rejected with HTTP 403 to mitigate DNS rebinding (per MCP transports spec).
`GHOSTDESK_TLS_CERT`	`/etc/ghostdesk/tls/server.crt`	Path to the TLS certificate. When the file exists, `websockify` and the MCP server auto-switch to `wss://` / `https://`. See Security.
`GHOSTDESK_TLS_KEY`	`/etc/ghostdesk/tls/server.key`	Path to the TLS private key (matching `GHOSTDESK_TLS_CERT`).
`GHOSTDESK_SCREEN_WIDTH`	`1280`	Virtual screen width in pixels
`GHOSTDESK_SCREEN_HEIGHT`	`1024`	Virtual screen height in pixels
`GHOSTDESK_IDLE_TIMEOUT`	`1800`	Seconds of MCP silence before all open client windows (Firefox, foot, mousepad…) are closed via Sway IPC to free memory. Sway, mako, wayvnc and the MCP server itself are spared. Set to `0` to disable.
`TZ`	`America/New_York`	IANA timezone (POSIX standard, e.g. `Europe/Paris`)
`LANG`	`en_US.UTF-8`	POSIX locale (e.g. `fr_FR.UTF-8`)

Pinned values (not configurable)

Variable	Value	Rationale
`GHOSTDESK_VNC_ADDRESS`	`127.0.0.1`	wayvnc is locked to loopback inside the container's netns; the VNC port is only reachable via the noVNC bridge on 6080. Override attempts are logged and ignored — see SECURITY.md.

Security

GhostDesk owns two things: transport encryption and authentication. Everything else (rate limiting, SSO, WAF, session recording, brute-force protection, per-user identity on noVNC) is a reverse-proxy concern — the container is designed to run behind one, not directly on the internet.

The full threat model, the Auth ≡ TLS posture switch, the wayvnc RFB-type-2-inside-wss:// rationale, the secrets handling contract, and the exhaustive in-scope / out-of-scope table all live in SECURITY.md — single source of truth. Start there before deploying to anything you don't fully trust.

Reporting a vulnerability? Use GitHub's private security advisory — see SECURITY.md § Reporting.

Troubleshooting

My agent's clicks land off-target by a huge margin

Almost always a coordinate-space mismatch. Frontier models (Claude, GPT-4o, Gemini) need no header (default pass-through); the Qwen vision family needs the client to send GhostDesk-Model-Space: 1000 on every MCP request. Full rationale in Model requirements → Coordinate space.

The container refuses to start with a secrets error

The prod posture (cert mounted) requires both GHOSTDESK_AUTH_TOKEN and GHOSTDESK_VNC_PASSWORD to be set — GhostDesk refuses to boot without them on purpose, to prevent an unauthenticated prod container. Generate them as shown in Secure local run and pass them with -e. The demo posture (no cert) has no such requirement.

noVNC shows a black screen or the desktop renders with graphical glitches

You're probably short on shared memory. Browsers and other GPU-accelerated apps inside the container need a reasonable /dev/shm — --shm-size 2g is the baseline in every example and should not be trimmed. If you already have --shm-size 2g, check the container logs for wayvnc or compositor errors.

Firefox / Electron apps fail to launch or crash immediately

Electron-based apps (VS Code, Slack, Discord…) need Linux user namespaces for their sandbox. Add --cap-add SYS_ADMIN to your docker run (already present in the Secure local run example). Firefox itself works without it.

Custom image

The base tag provides GhostDesk without any pre-installed GUI application — just the virtual desktop, VNC, and the MCP server. Use it to build your own image with only the tools you need:

FROM ghcr.io/yv17labs/ghostdesk:base

RUN apt-get update \
    && apt-get install -y --no-install-recommends \
        chromium-browser \
        libreoffice-calc \
    && rm -rf /var/lib/apt/lists/*

docker build -t my-agent .

See the project's Dockerfile for a complete example.

Tag	Description
`latest`, `X.Y.Z`, `X.Y`	Full image — Firefox, foot terminal, mousepad, galculator, passwordless sudo
`base`, `base-X.Y.Z`, `base-X.Y`	Minimal image — no GUI app, meant to be extended

License

Functional Source License, Version 1.1, ALv2 Future License (FSL-1.1-ALv2) — see LICENSE for the authoritative terms.

What this means in practice (informal summary — the LICENSE file governs; this is not legal advice):

Permitted purposes cover the use cases that matter for the vast majority of users: internal use and access inside your company, non-commercial education and research, and professional services you provide to a licensee who is using GhostDesk in accordance with the license. Self-hosting GhostDesk to run your own agents — even commercial, revenue-generating workflows that power your product — is a permitted internal use.
Competing Use is prohibited. You may not make GhostDesk available to others in a commercial product or service that substitutes for GhostDesk, substitutes for any product or service the project offers using GhostDesk, or provides the same or substantially similar functionality. In short: you cannot take GhostDesk and rebrand it, host it as a paid service, or build a competing desktop-automation-for-agents product from it.
Apache 2.0 in two years. Each released version of GhostDesk becomes available under the Apache License 2.0 on the second anniversary of its release, automatically and irrevocably. The Competing Use restriction only applies for those first two years.

Commercial licensing. If your intended use falls under Competing Use — you want to resell GhostDesk, offer it as a managed service, or build a competing product — contact the maintainers to discuss a commercial license before deploying. Open a GitHub issue or reach out directly; we are happy to talk.

Available Tools

12 tools

app_launchA

Launch a desktop GUI application and return its PID and log file path.

Only applications listed by app_list() are accepted. The process runs in the background; its stdout and stderr are captured in a log file under /tmp/ghostdesk/proc-<pid>.log. Use app_status(pid) to check whether it is still running and to read its output.

Returns a dict with:

pid: the process ID of the launched application.
log_file: path to the file capturing stdout and stderr.
action: description of what was launched.

On failure, returns a dict with a single error key describing what went wrong (not a GUI app, invalid syntax, command not found).

ParametersJSON Schema

Name	Required	Description	Default
`command`	Yes

TDQS

A4.6/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It effectively describes key behaviors: the process runs in the background, stdout/stderr are captured in a specific log file path, and failure returns an error dict. However, it doesn't mention potential side effects like resource consumption or system impact, leaving some gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured and front-loaded, starting with the core purpose. Every sentence adds value: launching details, constraints, behavioral context, return values, and error handling. There is no redundant information, making it efficient and easy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (launching GUI apps with background processes) and no annotations or output schema, the description is largely complete. It covers purpose, usage, behavior, parameters, and returns. However, it lacks details on permissions, rate limits, or system requirements, which could be relevant for a launch tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It adds meaning by specifying that the 'command' parameter must be an application listed by app_list(), clarifying its semantics beyond the schema's generic string type. This provides crucial context, though it doesn't detail command format or examples.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific action ('Launch a desktop GUI application') and resource ('application'), distinguishing it from siblings like app_list (which lists applications) and app_status (which checks status). It precisely defines what the tool does beyond just the name.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit usage guidelines: 'Only applications listed by app_list() are accepted' specifies when to use (with listed apps) and implies when not to use (with unlisted apps). It also references alternatives like app_status for checking status, clearly differentiating from sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

app_listA

Return installed GUI apps.

Scans .desktop entries in /usr/share/applications/. Call this before choosing which app to use for a task, or after installing new software during the session.

Returns a list of dicts, each with:

name: human-readable application name.
exec: the executable to pass to app_launch().

ParametersJSON Schema

Name	Required	Description	Default
No parameters

Output Schema

ParametersJSON Schema

Name	Required	Description
`result`	Yes

TDQS

A4.5/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It effectively describes the tool's behavior: it scans .desktop entries in /usr/share/applications/, returns a list of dicts with name and exec fields, and clarifies that exec is used with app_launch(). This covers the operational scope and output format well for a read-only tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is efficiently structured with three paragraphs: purpose, usage guidelines, and return format. Each sentence adds value without redundancy. It's front-loaded with the core function and remains appropriately sized for the tool's complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's low complexity (0 parameters, no annotations, but has output schema), the description is complete. It explains what the tool does, when to use it, and details the return structure. Since an output schema exists, the description doesn't need to fully document return values, but it still provides helpful semantics for the fields.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has 0 parameters, and schema description coverage is 100% (though empty). The description doesn't need to compensate for any parameter gaps. A baseline of 4 is appropriate since no parameters exist, and the description focuses on the tool's function and output instead.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific action ('Return installed GUI apps') and resource (GUI apps from .desktop entries). It distinguishes itself from siblings like app_launch (which launches apps) and app_status (which checks status), establishing a unique purpose for listing applications.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit guidance on when to use this tool: 'before choosing which app to use for a task, or after installing new software during the session.' This gives clear context for usage, though it doesn't explicitly state when NOT to use it or mention alternatives like app_status for checking if an app is already running.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

app_statusA

Check whether a launched app is still running and read its logs.

Only PIDs returned by app_launch() in this session are accepted.

Args: pid: Process ID returned by app_launch(). lines: Number of trailing log lines to return (default 50).

Returns a dict with:

pid: the process ID.
running: whether the process is still alive.
log_file: path to the log file.
tail: the last lines lines of stdout/stderr output.

On failure, returns a dict with a single error key.

ParametersJSON Schema

Name	Required	Description	Default
`pid`	Yes
`lines`	No

TDQS

A4.7/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It discloses key behavioral traits: it checks running status, reads logs, returns specific data (pid, running, log_file, tail), and handles failures with an error dict. However, it doesn't mention potential side effects, rate limits, or authentication needs, leaving some gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured and appropriately sized. It starts with the core purpose, provides usage constraints, details parameters with examples, and explains return values. Every sentence adds value without redundancy, and it's front-loaded with essential information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity (monitoring app status), no annotations, no output schema, and 0% schema coverage, the description is largely complete. It covers purpose, usage, parameters, and return values. However, it lacks details on error conditions beyond 'On failure,' and doesn't specify log file formats or access permissions, leaving minor gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds significant meaning beyond the input schema, which has 0% description coverage. It explains that 'pid' is a 'Process ID returned by ``app_launch()``' and 'lines' is the 'Number of trailing log lines to return (default 50).' This fully compensates for the schema's lack of descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Check whether a launched app is still running and read its logs.' It specifies the verb ('check' and 'read'), the resource ('launched app'), and distinguishes it from siblings like app_launch (which launches apps) and app_list (which lists apps).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit usage guidelines: 'Only PIDs returned by ``app_launch()`` in this session are accepted.' This clearly states when to use (with PIDs from app_launch) and implies when not to use (with other PIDs or outside the session), differentiating it from alternatives like app_list.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

clipboard_getA

Read the current clipboard text.

ParametersJSON Schema

Name	Required	Description	Default
No parameters

Output Schema

ParametersJSON Schema

Name	Required	Description
`result`	Yes

TDQS

A4.2/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It discloses the read-only behavior ('Read') but doesn't mention potential limitations like platform-specific clipboard access, permissions required, or data format returned. It provides basic behavioral context but lacks depth.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, efficient sentence with zero waste. It's front-loaded with the core action and resource, making it immediately understandable without unnecessary elaboration.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (0 parameters, no annotations, but has output schema), the description is mostly complete. It states the purpose clearly, but with no annotations and an output schema present, it could benefit from mentioning what the output contains (e.g., text format) to fully compensate for the lack of behavioral details.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has 0 parameters with 100% schema description coverage, so the schema already fully documents the absence of inputs. The description doesn't need to add parameter information, and it correctly implies no parameters are required, earning a baseline score for this scenario.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific action ('Read') and resource ('current clipboard text'), distinguishing it from sibling tools like clipboard_set. It precisely defines what the tool does without ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage context (when clipboard content is needed) but doesn't explicitly state when to use it versus alternatives like screen_shot or other clipboard-related operations. It provides clear intent but lacks explicit comparison guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

clipboard_setA

Write text to the clipboard. Use with key_press("ctrl+v") to paste.

ParametersJSON Schema

Name	Required	Description	Default
`text`	Yes

Output Schema

ParametersJSON Schema

Name	Required	Description
`result`	Yes

TDQS

A4/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It indicates this is a write operation ('Write text to the clipboard'), which implies mutation, but doesn't specify permissions needed, side effects, or error conditions. It adds some context about integration with key_press, but lacks details on clipboard overwriting or system dependencies.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise with two sentences that are front-loaded and waste-free. The first sentence states the core purpose, and the second adds practical usage context, making every word earn its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's low complexity (1 parameter) and the presence of an output schema (which handles return values), the description is reasonably complete. It covers the action and basic usage, though it could benefit from more behavioral details like error handling or system-specific notes, preventing a perfect score.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It mentions 'text' implicitly but doesn't explain the parameter's purpose, constraints, or format beyond what the schema's title ('Text') provides. The description adds minimal value over the schema, meeting the baseline for low coverage without fully compensating.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific action ('Write text to the clipboard') and identifies the resource ('clipboard'), distinguishing it from sibling tools like clipboard_get (which reads) and other UI automation tools. It provides a complete verb+resource statement with no ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description includes explicit guidance on when to use this tool by mentioning 'Use with key_press("ctrl+v") to paste,' which implies it's part of a workflow for pasting operations. However, it doesn't explicitly state when NOT to use it or name alternatives, keeping it from a perfect score.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

key_pressA

Press a key or key combination.

Friendly names accepted: Tab, Return, Escape, BackSpace, Left, Page_Up, F4, Ctrl, Alt, Shift, Super. Single printable characters stay as-is (a, c, 5).

Examples: Tab, Ctrl+c, Alt+F4, Ctrl+Shift+Tab.

Returns the standard {action, screen_changed, reaction_time_ms} feedback.

ParametersJSON Schema

Name	Required	Description	Default
`keys`	Yes

TDQS

A4.3/5.0

Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses behavioral traits by specifying accepted key names, examples, and return format, but lacks details on permissions, side effects, or error handling. It adds useful context but is not comprehensive for a tool that interacts with system input.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is appropriately sized and front-loaded, starting with the core purpose, followed by details on accepted inputs and examples, and ending with return information. Every sentence adds value without redundancy, making it efficient and well-structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (interacting with system keys) and lack of annotations or output schema, the description is mostly complete: it covers purpose, parameter semantics, and return format. However, it could improve by mentioning potential side effects or error cases, but it's sufficient for basic usage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage with one parameter 'keys' of type string. The description compensates fully by explaining the semantics: it defines what 'keys' means (key or combination), lists accepted friendly names, and provides examples. This adds significant value beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose with a specific verb ('Press') and resource ('a key or key combination'), and it distinguishes from siblings like 'key_type' (which likely types text) and mouse-related tools by focusing on key presses. The description is precise about what the tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context by listing accepted friendly names and examples, which implicitly guides usage for key presses. However, it does not explicitly state when to use this tool versus alternatives like 'key_type' or other input tools, missing explicit exclusions or comparisons.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

key_typeA

Type text. Handles Unicode, newlines, and tabs.

Returns the standard {action, screen_changed, reaction_time_ms} feedback. If screen_changed is false, the text field probably didn't have focus — click on it first and retry.

ParametersJSON Schema

Name	Required	Description	Default
`text`	Yes

TDQS

A3.9/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden and adds valuable behavioral context: it returns standard feedback (action, screen_changed, reaction_time_ms), explains what screen_changed=false means (text field not focused), and advises retry strategy. It doesn't cover rate limits or error handling, but provides clear operational insight.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with core purpose, followed by return details and troubleshooting advice. Every sentence earns its place: no fluff, efficient structure, and appropriately sized for the tool's complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 1 parameter, no annotations, and no output schema, the description provides good context: purpose, return format, and usage advice. It could mention error cases or limitations, but covers key aspects for a text-input tool. Slightly incomplete but mostly sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It doesn't explicitly mention the 'text' parameter, but implies it through 'Type text' and handling details (Unicode, newlines, tabs). This adds meaning beyond the bare schema, though not fully explicit. For 1 parameter, this is adequate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Type text' with specific capabilities (handles Unicode, newlines, tabs). It distinguishes from siblings like key_press (single key) and clipboard_set (copy-paste), though not explicitly named. The purpose is specific but could be more explicit about sibling differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage context through the screen_changed feedback advice: use when a text field has focus, and click first if not. It doesn't explicitly state when to use vs. alternatives like key_press or clipboard_set, nor provide exclusions. Guidance is practical but not comprehensive.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mouse_clickA

Click at screen coordinates. Use coordinates from screen_shot() or inspect().

Returns a dict with:

action: description of what was performed.
screen_changed: whether the 200x200 px zone around the click visibly changed within 2 s. If false the click likely missed its target — retry with adjusted coordinates or take a new screen_shot().
reaction_time_ms: how quickly the change was detected (ms).

ParametersJSON Schema

Name	Required	Default
`x`	Yes
`y`	Yes
`button`	No	left

TDQS

A4.5/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It effectively describes the tool's behavior: it performs a click action, monitors a 200x200 pixel zone for changes within 2 seconds, and provides feedback about success/failure through the screen_changed flag. It also explains what to do when the click misses (retry with adjusted coordinates or take new screenshot).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is perfectly structured and concise. It starts with the core action, provides usage guidance, then details the return structure with clear bullet points. Every sentence earns its place, and the information is front-loaded with the most important details first.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (interactive UI operation with feedback), no annotations, and no output schema, the description provides excellent completeness. It explains what the tool does, how to use it, what it returns, and how to interpret the results. The return value documentation compensates for the lack of output schema by clearly describing the response structure and semantics.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description must compensate for the lack of parameter documentation. While it doesn't explicitly document individual parameters, it provides crucial semantic context about parameter usage ('Use coordinates from screen_shot() or inspect()') and the relationship between parameters and tool behavior. The description explains how the x,y parameters relate to screen coordinates and what happens when they're incorrect.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific action ('Click at screen coordinates') and distinguishes it from siblings by mentioning coordinate sources from screen_shot() or inspect(). It provides a precise verb+resource combination that differentiates it from other mouse-related tools like mouse_double_click or mouse_drag.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context about when to use this tool ('Use coordinates from screen_shot() or inspect()') and implies when not to use it (when you don't have coordinates). However, it doesn't explicitly contrast with alternatives like mouse_double_click or provide specific exclusion criteria beyond the coordinate requirement.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mouse_double_clickA

Double-click at screen coordinates. Use for opening files or selecting words.

Returns a dict with:

action: description of what was performed.
screen_changed: whether the 200x200 px zone around the click visibly changed within 2 s. If false the click likely missed its target.
reaction_time_ms: how quickly the change was detected (ms).

ParametersJSON Schema

Name	Required	Default
`x`	Yes
`y`	Yes
`button`	No	left

TDQS

A3.8/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden and does well by disclosing key behavioral traits: it describes the return structure with three specific fields (action, screen_changed, reaction_time_ms), explains what screen_changed=false means ('click likely missed its target'), and specifies the detection zone (200x200 px) and timeframe (2 s). This goes beyond basic parameter documentation to reveal how the tool behaves and interprets results.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is perfectly structured and concise: first sentence states purpose with examples, followed by a clear bulleted list of return values with helpful explanations. Every sentence earns its place, with no wasted words or redundant information. It's front-loaded with the core functionality.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's moderate complexity (GUI interaction with feedback), no annotations, no output schema, and 0% schema description coverage, the description does well by thoroughly documenting the return behavior and success detection logic. However, it misses some context like coordinate system explanation, error conditions, or performance characteristics. For a mouse interaction tool with rich feedback, it's mostly complete but has minor gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate but provides no parameter-specific information. It doesn't explain what x/y coordinates represent (e.g., screen pixels, relative positioning), the meaning of button options, or default behaviors. The description focuses on output semantics instead, leaving parameters undocumented beyond the schema's basic structure.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Double-click at screen coordinates' with specific examples of use cases ('opening files or selecting words'). It distinguishes from sibling tools like mouse_click (single click) and mouse_drag, but doesn't explicitly contrast with all siblings. The verb+resource combination is specific and actionable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides implied usage guidance through examples ('Use for opening files or selecting words'), but lacks explicit when-to-use vs. when-not-to-use instructions or named alternatives. It doesn't mention when to choose this over mouse_click or other input tools, leaving some ambiguity about optimal selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mouse_dragA

Drag from one position to another. Use for selecting text, moving items, or resizing.

Returns a dict with:

action: description of what was performed.
screen_changed: whether the 200x200 px zone around the drop point visibly changed within 2 s.
reaction_time_ms: how quickly the change was detected (ms).

ParametersJSON Schema

Name	Required	Default
`from_x`	Yes
`from_y`	Yes
`to_x`	Yes
`to_y`	Yes
`button`	No	left

TDQS

A3.5/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It effectively describes the action and return values (action description, screen change detection, reaction time), which helps the agent understand the tool's behavior beyond basic parameters. However, it doesn't mention potential side effects like UI changes or system interactions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is efficiently structured with a clear purpose statement followed by detailed return value documentation. Every sentence adds value: the first explains the action and use cases, the subsequent lines describe the output format. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 5-parameter tool with no annotations and no output schema, the description provides good behavioral context through return value documentation but completely neglects parameter explanations. The output details help compensate for missing schema, but parameter gaps remain significant.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It doesn't explain any of the 5 parameters (from_x, from_y, to_x, to_y, button) beyond what the schema provides (titles and types). The description focuses on output semantics instead, leaving parameters undocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Drag from one position to another') and provides specific use cases ('selecting text, moving items, or resizing'), which distinguishes it from sibling tools like mouse_click or mouse_scroll. However, it doesn't explicitly differentiate from mouse_double_click in terms of dragging vs. double-clicking behavior.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for specific actions (selecting text, moving items, resizing) but doesn't provide explicit guidance on when to use this tool versus alternatives like mouse_click for single clicks or key_press for keyboard interactions. No when-not-to-use scenarios or prerequisites are mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mouse_scrollA

Scroll at a position. direction: up/down/left/right. amount: number of scroll steps (max 5).

Returns a dict with:

action: description of what was performed.
screen_changed: whether the 200x200 px zone around the scroll point visibly changed within 2 s. If false the page may already be at the scroll boundary.
reaction_time_ms: how quickly the change was detected (ms).

ParametersJSON Schema

Name	Required	Default
`x`	Yes
`y`	Yes
`direction`	No	down
`amount`	No

TDQS

A4/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It effectively describes the action (scroll at a position), constraints (max 5 steps), and return values including screen change detection and reaction time, which adds valuable context beyond basic parameters. However, it doesn't cover potential errors or side effects like out-of-bounds scrolling.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is appropriately sized and front-loaded, starting with the core action and key parameters. Every sentence adds value: the first defines the tool, the second explains parameters, and the third details return values, with no wasted words or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity (interactive UI tool), no annotations, and no output schema, the description is fairly complete. It covers the action, parameters, constraints, and return structure, but could improve by addressing error cases or integration with sibling tools like screen_shot for verification.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It adds meaning by explaining 'direction' as up/down/left/right and 'amount' as number of scroll steps with a max of 5, which clarifies beyond the schema's enum and integer types. However, it doesn't detail 'x' and 'y' parameters (e.g., coordinate system or units).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose with a specific verb ('Scroll') and resource ('at a position'), and distinguishes it from siblings like mouse_click or mouse_drag by focusing on scrolling behavior. It explicitly mentions the direction and amount parameters, making the action distinct.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives like mouse_drag or key_press for navigation, nor does it mention prerequisites such as needing a visible screen or active application. It lacks explicit when/when-not instructions or sibling comparisons.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

screen_shotA

Capture the screen, optionally cropped to a region.

Args: region: Area to capture (full screen if omitted). format: "webp" (default, smaller payload) or "png" (lossless). stabilize: Wait for the page to stop moving before capturing (max 2.5 s). Useful right after navigation.

ParametersJSON Schema

Name	Required	Default
`region`	No
`format`	No	webp
`stabilize`	No

TDQS

A4.5/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It does well by explaining the stabilization behavior ('Wait for the page to stop moving before capturing'), timeout constraint ('max 2.5 s'), and default behavior ('full screen if omitted'). However, it doesn't mention what happens on failure or the output format beyond format options.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Perfectly structured with a clear opening statement followed by organized parameter explanations. Every sentence adds value: the first establishes purpose, and each parameter description provides essential context without redundancy. The formatting with bullet-like indentation enhances readability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 3-parameter tool with no annotations and no output schema, the description does an excellent job covering parameter semantics and basic behavior. The main gap is lack of information about what the tool returns (image data format, error conditions), which would be important given the absence of output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description fully compensates by explaining all three parameters: 'region' (area to capture, full screen default), 'format' (webp vs png with rationale), and 'stabilize' (behavior and use case). Each parameter gets meaningful context beyond what the bare schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific action ('Capture the screen') and distinguishes it from all sibling tools (which are about app control, clipboard, and mouse/keyboard interactions). It provides a clear verb+resource combination that is unambiguous in this context.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context for when to use certain features ('useful right after navigation' for stabilize parameter), but doesn't explicitly state when to use this tool versus alternatives. Since sibling tools are all different interaction types (not alternative screenshot methods), this is reasonable, but no explicit comparison is made.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

12 tool updatesv7.0.1Apr 17, 2026
- First observedapp_launch
- First observedapp_list
- First observedapp_status
- First observedclipboard_get
- First observedclipboard_set
- First observedkey_press
- First observedkey_type
- First observedmouse_click
- First observedmouse_double_click
- First observedmouse_drag
- First observedmouse_scroll
- First observedscreen_shot

Deploy Server

One endpoint for every MCP toolRayrun runs every MCP server behind one URL and holds the credentials. Each call is decided per client, tool, and argument, then recorded.ray.runAd

TDQS

A4.2/5.0

Scored 2026-04-17 20:25 across 12 tools

Disambiguation5/5

Each tool has a clearly distinct purpose with no overlap: app_launch, app_list, and app_status form a coherent app management group; clipboard_get/set handle clipboard operations; key_press and key_type cover keyboard input; mouse_click, mouse_double_click, mouse_drag, and mouse_scroll provide distinct mouse actions; and screen_shot handles screen capture. The descriptions clearly differentiate their functions, preventing misselection.

Naming Consistency4/5

The naming is mostly consistent with a verb_noun pattern (e.g., app_launch, clipboard_get, mouse_click), but there are minor deviations: key_press and key_type use 'key' instead of 'keyboard', and screen_shot uses 'shot' instead of 'capture'. These deviations are minor and do not significantly hinder readability or predictability.

Tool Count5/5

With 12 tools, the count is well-scoped for a desktop automation server covering app management, clipboard, keyboard, mouse, and screen operations. Each tool earns its place, providing a comprehensive yet manageable set for the domain without being overly sparse or bloated.

Completeness5/5

The tool set offers complete coverage for desktop automation: app management (launch, list, status), clipboard operations (get/set), keyboard input (press/type), mouse actions (click, double-click, drag, scroll), and screen capture. There are no obvious gaps; agents can perform full workflows from launching apps to interacting with them via input and monitoring via screenshots.

Maintenance

ActivityActive

ResponsivenessUnresponsive

Resources

GitHub Repository

Need Help?

Related Servers

Related MCP Connectors

Swamix MCP
com.swamix.mcp
Hosted MCP catalog with 30 tenant-isolated browser, RAG, AI, mail and media tools.
Browser Automation RAG Systems AI & Machine Learning
1
browser-mcp
io.github.Shreyas-Profile
Hosted real Google Chrome MCP with per-user persistent state. Navigate, click, type, screenshot.
Browser Automation Web Scraping
2
Fiskmas A
dev.fiskmas
Hosting for AI agents: your AI client deploys Docker apps to live HTTPS URLs over MCP.
Agent Orchestration Cloud Platforms Virtualization
211
mintqa-mcp
io.github.adamgusky
MCP server for Mint — AI-powered QA that runs your app in a real browser on every PR.
Testing & QA Tools CI/CD & DevOps
2

Related MCP Servers

taw-computer
Virtualization Shell Access Browser Automation
tawgroup
A
license
B
quality
D
maintenance
An MCP server that provides AI agents with a full Ubuntu desktop environment inside Docker, enabling them to perform complex computer tasks like browsing, coding, testing, and GUI automation.
Updated 4 months ago (2026-05-16 01:11 UTC)
36
9
MIT
umbriel
OS Automation Testing & QA Tools File Systems
ObscuritySRL
A
license
Not graded
quality
B
maintenance
MCP server for driving any Windows app through five layers including OCR, UI Automation, and direct OS operations. Enables AI agents to control Windows desktop and OS cursor-free, even on background/locked windows.
Updated a month ago (2026-08-15 06:31 UTC)
78 npm
2
MIT
da-mcp
OS Automation Image & Video Processing Command Line
cioinside
F
license
A
quality
A
maintenance
Cross-platform desktop automation MCP server that lets AI agents capture screenshots, run OCR with UI-element classification, control mouse/keyboard, and launch programs on Linux, macOS, and Windows.
Updated a month ago (2026-08-08 19:47 UTC)
20
1
-
linux-computer-mcp
OS Automation Autonomous Agents
Ocean-Moist
A
license
Not graded
quality
C
maintenance
Provides an AI agent with a fixed, isolated Linux desktop workspace, enabling bounded screen capture, input control, and application launching via MCP.
Updated a month ago (2026-08-06 22:35 UTC)
-

Table of contents

Why GhostDesk?

Runs on models you can actually host

How it works

Quick start

1. Run the container

2. Connect your AI

3. Watch your agent work

4. When you're done

Secure local run (TLS + auth)

Tools

Screen

Mouse

Keyboard

Clipboard

Apps

Model requirements

Coordinate space — GhostDesk-Model-Space header

Running locally

From one agent to a workforce

Scale horizontally

Secure by design

Specialize each agent

Supervise in real time

Configuration

Secrets (required — container refuses to boot without them)

Runtime knobs

Pinned values (not configurable)

Security

Troubleshooting

My agent's clicks land off-target by a huge margin

The container refuses to start with a secrets error

noVNC shows a black screen or the desktop renders with graphical glitches

Firefox / Electron apps fail to launch or crash immediately

Custom image

License

Available Tools

Output Schema

Output Schema

Output Schema

Tool Schema Changelog

Maintenance

Resources

Related MCP Connectors

Related MCP Servers

Coordinate space — `GhostDesk-Model-Space` header