deer-flow-mcp
Provides control over LangGraph-based DeerFlow runs, including starting runs with a configurable recursion limit and inspecting run status.
Connects to a deployed DeerFlow instance through its nginx entry point over HTTP to drive research and thread/run/artifact operations.
The MCP server runs on Node.js, requiring version >= 20.18.1.
The deer-flow-mcp server is published on npm and can be run directly with npx without a local build.
DeerFlow runs are driven by models; the server lists available models (OpenAI-compatible) via the internal-token mode.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@deer-flow-mcpstart a deep research on the future of renewable energy and send me the report"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
deer-flow-mcp
An MCP (Model Context Protocol) server that drives a deployed DeerFlow instance over its HTTP API. It exposes DeerFlow's capabilities — deep research, model listing, and full thread/run/artifact control — as MCP tools, so any MCP-compatible client (Kilo, Claude Code, Cursor, VS Code, and others) can use them.
How it works
deer-flow-mcp is a thin, stateless adapter. It does not run DeerFlow itself; it talks to an
already-deployed DeerFlow instance (the nginx entry point) using the credentials you configure.
Each MCP tool maps to one or more DeerFlow HTTP routes and returns the result as MCP content.
Related MCP server: mcp-flowise
Capabilities
Deep research — kick off a DeerFlow "super agent" run on a topic and get back a structured, cited report saved as an artifact.
Model listing — list the models available to DeerFlow (email/password or internal-token mode).
Thread / run / artifact control — create threads, start and inspect runs, track status, and retrieve artifacts and reports.
Requirements
Node.js >= 20.18.1
A deployed DeerFlow instance reachable at
DEERFLOW_BASE_URL
Install
deer-flow-mcp is published on npm and runs directly with npx — no local build required:
npx -y deer-flow-mcp --versionTo build from source (for development or contribution), see Development.
Configuration
All configuration is environment-driven — there is no config file and no .env loading. The
server reads process.env directly, so an MCP client must pass the DeerFlow variables through its
own env / environment field (see Install in an MCP client).
The server fails fast with a descriptive error at startup if required values are missing, so the MCP client gets a clean error instead of a cryptic first-request failure.
Variable | Required | Description |
| yes | Base URL of the deployed DeerFlow instance (trailing slashes ignored) |
| one of three | Account email; used with |
| one of three | Account password; used with |
| one of three | Personal Access Token (starts with |
| one of three | Gateway internal token; full access (models + artifact files) |
| no | Used only with internal-token mode |
| no | Default model when a tool call omits |
| no | Default LangGraph recursion limit (default |
| no | Per-request HTTP timeout in ms (default |
| no | Base URL for "open in DeerFlow" links (defaults to |
| no | Seconds without activity before a running run is reported as stalled (default |
| no | Softer "between steps" signal, below the stall threshold (default |
| no | Cap on |
| no | How often a |
| no | How often the client polls the DeerFlow API when the SSE join stream is unavailable (default |
Authentication
deer-flow-mcp authenticates to DeerFlow one of three ways — a discriminated union, so set
exactly one of the credential modes (email/password is tried first, then PAT, then internal
token):
Email/password (
DEERFLOW_EMAIL+DEERFLOW_PASSWORD) — logs in like the web UI (POST /api/v1/auth/login/local) and carries the resulting session cookie (plus the CSRF token) on every call. This is the same credential you type into the browser: it works on every deployment (no DB, no internal secret) and grants full user access, including models and artifact files. Both variables must be set together; the login happens lazily on first use and is retried once if the session expires.PAT (
DEERFLOW_PAT) — a per-user Personal Access Token (dfp_…), sent asAuthorization: Bearer dfp_…. Restricted to the thread/run lifecycle routes;deerflow_list_modelsanddeerflow_get_artifactreturn 403 for PAT callers.Internal token (
DEERFLOW_INTERNAL_TOKEN) — the deployment-levelDEER_FLOW_INTERNAL_AUTH_TOKENshared secret, sent asX-DeerFlow-Internal-Token(optionally withX-DeerFlow-Owner-User-Id). Full access, including models and artifact files.
All three target the same entry point: the nginx reverse proxy, default http://<host>:2026
(the port is configurable via the PORT env var). That is the URL you put in
DEERFLOW_BASE_URL.
Getting a Personal Access Token (DEERFLOW_PAT)
A PAT is a per-user credential created from the Gateway API while you are logged in. There is
no dedicated page for it in the web UI, and it requires a database-backed deployment (SQLite
or PostgreSQL) — a memory-only instance rejects Bearer tokens and the PAT routes return 503.
Sign in to the web UI. Open your DeerFlow instance.
First boot: open
/setupand create the first admin account (email + password).Afterwards: open
/loginand sign in with your email and password (or your SSO provider). A successful login sets theaccess_tokensession cookie.
Create the token from the API. Copy your
access_tokencookie value (browser DevTools → Application → Cookies, or theCookieheader of any request in Network), then:curl -s -X POST "$DEERFLOW_BASE_URL/api/v1/auth/pats" \ -H "Content-Type: application/json" \ -H "Cookie: access_token=<ACCESS_TOKEN>" \ -d '{ "name": "deer-flow-mcp", "scopes": ["threads:read", "threads:write", "runs:create", "runs:read", "runs:cancel"], "expires_in_days": 365 }'The
tokenfield in the response is yourdfp_…value. It is shown exactly once and cannot be retrieved again — only its SHA-256 digest is stored. Save it immediately.Use it. Put that value in
DEERFLOW_PAT.
The scopes above cover every deer-flow-mcp tool except deerflow_list_models and
deerflow_get_artifact (both 403 for PAT callers — use email/password or an internal token if
you need them).
You can list your tokens with GET /api/v1/auth/pats and revoke one with
DELETE /api/v1/auth/pats/{pat_id}; revocation is immediate.
Getting the internal token (DEERFLOW_INTERNAL_TOKEN)
The internal token is a deployment-level secret set on the Gateway — it is not tied to any
user and is not created from the web UI. Its value is the Gateway's DEER_FLOW_INTERNAL_AUTH_TOKEN
environment variable.
Docker (
make up/ the bundled deploy script) — the token is generated automatically and persisted to$DEER_FLOW_HOME/.internal-auth-token(mode600).DEER_FLOW_HOMEdefaults to<repo>/backend/.deer-flowon the host (mounted into the container at/app/backend/.deer-flow), so read it with:cat backend/.deer-flow/.internal-auth-token # or from the running gateway container: docker compose exec gateway printenv DEER_FLOW_INTERNAL_AUTH_TOKENHelm / Kubernetes — it is stored in the chart's app Secret under the key
DEER_FLOW_INTERNAL_AUTH_TOKEN(the Secret name is printed in the install NOTES):kubectl -n <namespace> get secret <app-secret> \ -o jsonpath='{.data.DEER_FLOW_INTERNAL_AUTH_TOKEN}' | base64 -dManual — set
DEER_FLOW_INTERNAL_AUTH_TOKENto a long random secret in your.envand restart the stack, then use that same value here.
Put the value in DEERFLOW_INTERNAL_TOKEN. To isolate runs under a specific owner, also set
DEERFLOW_OWNER_USER_ID (sent as X-DeerFlow-Owner-User-Id).
Install in an MCP client
deer-flow-mcp is a local stdio server started with npx -y deer-flow-mcp. In every client
config below the server is launched via npx, and you must pass at least DEERFLOW_BASE_URL and
one credential (DEERFLOW_EMAIL + DEERFLOW_PASSWORD, DEERFLOW_PAT, or
DEERFLOW_INTERNAL_TOKEN) through the env / environment field. For remote/shared access over
Streamable HTTP instead, see Usage.
Kilo
Kilo reads MCP servers from kilo.json. Use the project file ./kilo.json (or .kilo/kilo.json)
for a single project, or the global ~/.config/kilo/kilo.json for all projects.
{
"mcp": {
"deerflow": {
"type": "local",
"command": ["npx", "-y", "deer-flow-mcp"],
"environment": {
"DEERFLOW_BASE_URL": "https://deerflow.example.com",
"DEERFLOW_EMAIL": "you@example.com",
"DEERFLOW_PASSWORD": "..."
},
"enabled": true
}
}
}Notes:
commandis an array; the first element is the executable (npx), the rest are its args.Environment variables go in the
environmentobject (KEY: value).Email/password is the simplest full-access option and is tried first. As alternatives:
DEERFLOW_PAT(threads/runs routes only) orDEERFLOW_INTERNAL_TOKEN(deployment-level full access, optionally withDEERFLOW_OWNER_USER_ID).Restart Kilo (or reload MCP servers) to pick up the change.
Add it with the CLI (user scope, so it is available across projects):
claude mcp add --scope user \
--env DEERFLOW_BASE_URL=https://deerflow.example.com \
--env DEERFLOW_EMAIL=you@example.com \
--env DEERFLOW_PASSWORD=... \
--transport stdio \
deerflow -- npx -y deer-flow-mcpOr add a deerflow entry under mcpServers in a project .mcp.json (shared with your team) or
in ~/.claude.json (user scope):
{
"mcpServers": {
"deerflow": {
"command": "npx",
"args": ["-y", "deer-flow-mcp"],
"env": {
"DEERFLOW_BASE_URL": "https://deerflow.example.com",
"DEERFLOW_EMAIL": "you@example.com",
"DEERFLOW_PASSWORD": "..."
}
}
}
}Verify with claude mcp get deerflow or /mcp inside a session.
Add a deerflow entry under mcpServers in ~/.cursor/mcp.json (global) or .cursor/mcp.json
(per project):
{
"mcpServers": {
"deerflow": {
"command": "npx",
"args": ["-y", "deer-flow-mcp"],
"env": {
"DEERFLOW_BASE_URL": "https://deerflow.example.com",
"DEERFLOW_EMAIL": "you@example.com",
"DEERFLOW_PASSWORD": "..."
}
}
}
}Add a deerflow entry under servers in .vscode/mcp.json (per project) or in your user
mcp.json:
{
"servers": {
"deerflow": {
"type": "stdio",
"command": "npx",
"args": ["-y", "deer-flow-mcp"],
"env": {
"DEERFLOW_BASE_URL": "https://deerflow.example.com",
"DEERFLOW_EMAIL": "you@example.com",
"DEERFLOW_PASSWORD": "..."
}
}
}
}Add a [mcp_servers.deerflow] table to ~/.codex/config.toml (or a project-scoped
.codex/config.toml):
[mcp_servers.deerflow]
command = "npx"
args = ["-y", "deer-flow-mcp"]
[mcp_servers.deerflow.env]
DEERFLOW_BASE_URL = "https://deerflow.example.com"
DEERFLOW_EMAIL = "you@example.com"
DEERFLOW_PASSWORD = "..."Or add it with the CLI:
codex mcp add deerflow \
--env DEERFLOW_BASE_URL=https://deerflow.example.com \
--env DEERFLOW_EMAIL=you@example.com \
--env DEERFLOW_PASSWORD=... \
-- npx -y deer-flow-mcpVerify with codex mcp list or /mcp in the TUI.
Add a deerflow entry under mcpServers in ~/.gemini/settings.json:
{
"mcpServers": {
"deerflow": {
"command": "npx",
"args": ["-y", "deer-flow-mcp"],
"env": {
"DEERFLOW_BASE_URL": "https://deerflow.example.com",
"DEERFLOW_EMAIL": "you@example.com",
"DEERFLOW_PASSWORD": "..."
}
}
}
}Add a deerflow entry under context_servers in your Zed settings.json:
{
"context_servers": {
"deerflow": {
"command": "npx",
"args": ["-y", "deer-flow-mcp"],
"env": {
"DEERFLOW_BASE_URL": "https://deerflow.example.com",
"DEERFLOW_EMAIL": "you@example.com",
"DEERFLOW_PASSWORD": "..."
}
}
}
}Add a deerflow entry under mcpServers in .cline/mcp_settings.json (or add it from the Cline
MCP Servers UI):
{
"mcpServers": {
"deerflow": {
"command": "npx",
"args": ["-y", "deer-flow-mcp"],
"env": {
"DEERFLOW_BASE_URL": "https://deerflow.example.com",
"DEERFLOW_EMAIL": "you@example.com",
"DEERFLOW_PASSWORD": "..."
},
"disabled": false,
"autoApprove": []
}
}
}Add a deerflow entry under mcpServers in your Roo Code MCP configuration:
{
"mcpServers": {
"deerflow": {
"command": "npx",
"args": ["-y", "deer-flow-mcp"],
"env": {
"DEERFLOW_BASE_URL": "https://deerflow.example.com",
"DEERFLOW_EMAIL": "you@example.com",
"DEERFLOW_PASSWORD": "..."
}
}
}
}Add a deerflow entry under mcpServers in your claude_desktop_config.json:
{
"mcpServers": {
"deerflow": {
"command": "npx",
"args": ["-y", "deer-flow-mcp"],
"env": {
"DEERFLOW_BASE_URL": "https://deerflow.example.com",
"DEERFLOW_EMAIL": "you@example.com",
"DEERFLOW_PASSWORD": "..."
}
}
}
}Restart Claude Desktop after saving.
Available MCP tools
Tool | Description |
| Start a deep-research run on a fresh thread. Args: |
| Send a message to a DeerFlow thread and start a run. Args: |
| Check a run's status, optionally waiting up to |
| Get live progress: status, live counters, recent activity (one-line event summaries), the plan-mode todo checklist, and stall/quiet detection. Args: |
| Block server-side until new activity, a terminal status, or timeout — one call replaces many polls. Args: |
| Fetch the synthesized report (title, assistant message, artifact paths). Args: |
| List recent threads. Args: optional |
| Cancel (interrupt) an in-flight run. Args: |
| List artifact file paths produced by a thread. Args: |
| Fetch one artifact (inline text, or a URL for binary files). Args: |
| List configured models (name, display name, capability flags). No args. Not available with a PAT (email/password or internal token required). |
The server also advertises MCP instructions that walk a client through the typical deep-research
flow: deerflow_research → wait with deerflow_wait_activity (loop on last_event_seq) →
deerflow_get_report → deerflow_get_artifact, with deerflow_run_status / deerflow_run_progress
for quick non-blocking checks and the report + each artifact also exposed as MCP resources
(deerflow://threads/{thread_id}/report, deerflow://threads/{thread_id}/artifacts/{path}).
Design decisions
No MCP Tasks extension (SEP-1686)
The MCP Tasks extension (tasks/get|result|list|cancel) is intentionally not implemented.
SDK 2.0.0 ships no Tasks runtime (TaskRequestMethod is excluded from the typed method surface),
and a DeerFlow run is already a durable, addressable job keyed by thread_id / run_id —
deerflow_wait_activity (long-poll) and deerflow_run_status (poll) are the spec's async-job
surface, and deerflow_get_report plus the resources read the result. Revisit only if/when the
SDK adds a Tasks runtime.
Usage
Run over stdio (the default MCP transport for local clients):
npx -y deer-flow-mcpRun over Streamable HTTP for remote or shared access (default port 3000, override with
--port):
npx -y deer-flow-mcp --transport http --port 3000For a remote instance, a client points at the resulting URL (e.g. http://localhost:3000) with a
url / remote entry instead of launching a local command.
Or, after a local build, use the package binary:
deer-flow-mcp --transport httpCLI options:
Flag | Description | Default |
| Transport type |
|
| Port for the HTTP transport |
|
| Print the version | — |
Development
To build from source:
pnpm install # install dependencies
pnpm build # compile to dist/
pnpm typecheck # tsc --noEmit
pnpm lint # eslint
pnpm test # vitest run
pnpm format # prettier --write .Run the built server locally:
node dist/index.js # stdio
node dist/index.js --transport http --port 3000 # Streamable HTTPThe same targets are available via the Makefile (see make help):
make install
make build
make check # typecheck + lint + test
make start # build then run the HTTP serverPublishing
npm publish # or: pnpm publishThe prepublishOnly script runs typecheck, lint, test, and build automatically before publishing,
so the published package is always built and verified.
Security
Never commit
.envor secrets; only.env.exampleis tracked.Tokens are credentials — they are sent as auth headers and must never be logged.
All outbound traffic goes to
DEERFLOW_BASE_URL.
Available Tools
11 toolsdeerflow_cancel_runCancel RunAIdempotent
Cancel an in-flight DeerFlow run (interrupts it). Returns the accepted status.
| Name | Required | Description | Default |
|---|---|---|---|
| run_id | Yes | The run id to cancel. | |
| thread_id | Yes | The thread id. |
Output Schema
| Name | Required | Description |
|---|---|---|
| run_id | Yes | |
| status | Yes | |
| thread_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false, idempotentHint=true, and destructiveHint=false, so safety and repeat-call behavior are covered. The description adds the interrupt semantics and the fact that it returns an accepted status, but omits behavior for already-finished runs and does not reinforce idempotency in prose.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the action and scope, with no filler. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, the return value needn't be detailed beyond the brief 'accepted status' note, and the parameters are fully described in the schema. The only gap is the absence of edge-case behavior for non-in-flight runs, which is minor given the low-complexity two-parameter signature.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and both parameters (run_id, thread_id) are documented in the schema, so baseline 3 applies. The description adds no format, source, or relationship detail (e.g., where thread_id comes from) beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Cancel) and resource (an in-flight DeerFlow run) and clarifies scope with 'interrupts it', which helpfully separates it from status/progress siblings. It stops short of naming a sibling or contrasting explicitly, but the action is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied: cancel a run that is in flight. There is no guidance on when-not-to-cancel (e.g., run already completed/failed) or how this relates to siblings like deerflow_wait_activity or deerflow_run_status, so an agent must infer the context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
deerflow_chatSend Chat MessageA
Send a message to a DeerFlow thread and start a run. Omit thread_id to create a new thread, or pass an existing thread_id to continue a conversation. Returns immediately with the thread/run ids and a web URL; poll deerflow_run_status, then deerflow_get_report.
| Name | Required | Description | Default |
|---|---|---|---|
| model | No | Optional DeerFlow model name. | |
| message | Yes | The message to send to the DeerFlow agent. | |
| thread_id | No | Existing thread id to continue. Omit to start a new thread. | |
| recursion_limit | No | Optional agent recursion budget for this run (default 1000). |
Output Schema
| Name | Required | Description |
|---|---|---|
| run_id | Yes | |
| status | Yes | |
| web_url | Yes | |
| thread_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false, openWorldHint=true, idempotentHint=false, and destructiveHint=false. The description adds genuinely useful behavior beyond them: the call is asynchronous and 'returns immediately' with thread/run ids plus a web URL. It does not mention auth requirements or rate limits, keeping it short of a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences, front-loaded with the action and followed by the branching condition and the next-step workflow. No redundant or filler text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, yet the description still succinctly characterizes the immediate return (ids and URL) and the async polling pattern, which is the key behavioral fact an agent needs. Nothing essential is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so model, message, thread_id, and recursion_limit are all documented in the schema itself. The description restates the thread_id omit-vs-continue semantics but adds no syntax or default detail beyond what the schema already provides, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Send a message to a DeerFlow thread and start a run') and immediately differentiates the two modes of operation via the thread_id parameter, so an agent can distinguish it from siblings like deerflow_run_status or deerflow_research.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly names when to omit vs. pass thread_id and routes the agent through the follow-up workflow ('poll deerflow_run_status, then deerflow_get_report'), naming the sibling tools to use next. This is exactly the when/how guidance an agent needs.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
deerflow_get_artifactGet ArtifactARead-onlyIdempotent
Fetch a single artifact file from a DeerFlow thread. Text-like files (markdown, json, csv, plain text) are returned inline as content; binary files return a URL reference instead. Note: with a Personal Access Token this endpoint is not in the PAT route allowlist — an internal token is required.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | The artifact path, as listed by deerflow_list_artifacts (e.g. 'mnt/user-data/outputs/report.md'). | |
| thread_id | Yes | The thread id. |
Output Schema
| Name | Required | Description |
|---|---|---|
| url | Yes | |
| note | No | |
| path | Yes | |
| content | No | |
| content_type | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the safety profile (readOnly, idempotent, non-destructive, openWorld), so the bar is lower. The description adds genuinely non-structured context: text-like files come back inline while binary files return a URL, and a Personal Access Token will not work because this route is not in the PAT allowlist. That auth constraint is exactly the kind of operational detail annotations cannot convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, front-loaded with the core action, followed by return-format behavior and then the auth caveat. No filler, no restatement of the title, and each sentence carries distinct information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, yet the description still usefully summarizes the inline-vs-URL split. Purpose, response shape, and the auth prerequisite are all covered; only failure modes (missing thread or path) are left unaddressed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both parameters are fully documented in the schema, including an example path format and the pointer to deerflow_list_artifacts. The description adds no syntax, format, or validation detail beyond that, which is the expected baseline when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Fetch a single artifact file from a DeerFlow thread') with a scope qualifier ('single') that implicitly distinguishes it from the listing sibling. It stops short of naming deerflow_list_artifacts as the alternative, so the differentiation is inferable rather than explicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The schema's path description points the agent to deerflow_list_artifacts as the source of valid paths, which implies the intended workflow, and the PAT note flags an authentication precondition. However, the description never states when to choose this tool over siblings or when it is not applicable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
deerflow_get_reportGet ReportARead-onlyIdempotent
Fetch the synthesized report for a DeerFlow thread: the most recent assistant message, its title, and any produced artifact file paths. Resolves the report text through a fallback chain (run messages → thread state → summary) and, when no assistant message exists, auto-inlines the first text artifact (≤256 KB) as the report. Also reports the run's terminal status and where the text came from (report_source). Call after a run reaches a terminal status. Optionally pass run_id to scope the report to a specific run.
| Name | Required | Description | Default |
|---|---|---|---|
| run_id | No | Optional run id to scope the report to a specific run. | |
| thread_id | Yes | The thread id. |
Output Schema
| Name | Required | Description |
|---|---|---|
| title | No | |
| report | Yes | |
| web_url | Yes | |
| terminal | No | |
| artifacts | Yes | |
| run_status | No | |
| summary_text | No | |
| artifact_note | No | |
| report_source | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint, idempotentHint, and destructiveHint=false, so safety is covered. The description adds critical behavioral detail beyond annotations: the fallback resolution chain (run messages → thread state → summary), the auto-inline of the first text artifact (≤256 KB) when no assistant message exists, and the reporting of terminal status and report_source. This is exactly the kind of runtime behavior an agent needs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, front-loaded with the core purpose, then behavioral details, then usage timing. Every sentence carries useful information, though the fallback-chain and auto-inline details could be slightly condensed. No redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (fallback logic, artifact handling, status reporting), the description covers all the key behavioral aspects an agent would need to interpret the output correctly. An output schema exists, so return value structure needn't be explained, and the description correctly focuses on the resolution process and conditions. Nothing essential is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so both parameters are already documented in the schema with clear descriptions. The description's mention of run_id scoping adds only slight emphasis beyond the schema, and it doesn't explain thread_id at all. Baseline 3 is appropriate when the schema fully handles parameter documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource ('Fetch the synthesized report for a DeerFlow thread') and enumerates exactly what is returned (assistant message, title, artifact file paths). It's clearly distinguishable from deerflow_run_status and deerflow_get_artifact because it explicitly says it returns the synthesized report and artifact paths, not raw status or artifact content.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says 'Call after a run reaches a terminal status,' giving a clear condition for invocation. It also explains the optional run_id scoping. However, it doesn't explicitly contrast with sibling tools like deerflow_run_status or deerflow_list_artifacts, leaving some ambiguity about when to use this versus those alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
deerflow_list_artifactsList ArtifactsARead-onlyIdempotent
List the artifact file paths produced by a DeerFlow thread (e.g. reports, generated files). Pass a path to deerflow_get_artifact to read its content.
| Name | Required | Description | Default |
|---|---|---|---|
| thread_id | Yes | The thread id. |
Output Schema
| Name | Required | Description |
|---|---|---|
| artifacts | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly/idempotent/destructive=false, so the safety profile is covered. The description adds useful non-annotation context: the output is file paths (metadata only), and reading requires a separate call to deerflow_get_artifact. It does not cover failure cases (e.g. no artifacts produced, thread not found).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, zero filler, with the core action front-loaded and the follow-up workflow second. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be enumerated; the description still helpfully characterizes the result as file paths. Combined with the sibling routing to deerflow_get_artifact, an agent has enough to invoke and chain this tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% for the single thread_id parameter, so the schema already carries the parameter documentation. The description adds nothing about the thread id's format or origin, which is adequate given the high coverage — baseline 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb+resource ("List the artifact file paths produced by a DeerFlow thread") and immediately disambiguates from the sibling deerflow_get_artifact by noting the latter reads content rather than listing it. An agent can select this tool correctly without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides clear usage context and an explicit follow-up route ("Pass a path to deerflow_get_artifact to read its content"), which establishes the list-then-read workflow. It does not state exclusions or when listing is unnecessary, so it stops short of a full when/when-not treatment.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
deerflow_list_modelsList ModelsARead-onlyIdempotent
List the models configured on the DeerFlow instance (name, display name, and capability flags). Use a returned name for the model argument of deerflow_research / deerflow_chat. Note: with a Personal Access Token this endpoint is not in the PAT route allowlist — an internal token is required.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| models | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint/idempotentHint/destructiveHint, so the safety profile is covered. The description adds non-obvious context the annotations cannot convey: the auth/token requirement (no PAT, internal token needed) and what the response contains. No pagination or rate-limit detail, hence not a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences with no filler, front-loaded with what it does, then how to use the result, then the auth caveat. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-param, read-only listing tool with an output schema and full annotation coverage, the description covers the remaining gaps: consumer tools, returned field meaning, and the auth constraint. Nothing an agent needs to call it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so per the rubric the baseline is 4. The description instead clarifies the output field semantics (name vs display name vs capability flags), which is the only meaningful 'argument' concept here.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb+resource ('List the models configured on the DeerFlow instance') plus the returned fields (name, display name, capability flags). It distinguishes itself from siblings by naming deerflow_research/deerflow_chat and explaining the relationship (this tool supplies their model argument).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states the use case — resolve a model name to pass into deerflow_research or deerflow_chat — and adds a hard prerequisite caveat that this endpoint is not in the PAT route allowlist and needs an internal token. Both when-to-use and a blocking condition are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
deerflow_list_threadsList ThreadsARead-onlyIdempotent
List recent DeerFlow threads (id, title, status, timestamps). Use the returned thread_id with deerflow_chat to continue a conversation or deerflow_get_report to read a finished one.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum threads to return (default 20). | |
| include_archived | No | Include archived threads (default false). |
Output Schema
| Name | Required | Description |
|---|---|---|
| threads | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so safety is well covered. The description adds useful lifecycle context (that thread_id can be used to continue a conversation or read a report) and implies default filtering, which goes beyond the structured fields. It is not rich enough for a 5 since it doesn't discuss pagination or archival behavior beyond the parameter names.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two compact sentences with zero filler. The core purpose is front-loaded, and the second sentence efficiently connects the output to downstream actions.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so the description need not explain return values, but it still does so briefly. With annotations covering the safety profile and full schema coverage, the definition is nearly complete. A minor gap is the lack of explicit usage boundaries against sibling listers, which prevents a perfect score.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already fully documents 'limit' and 'include_archived'. The description adds no extra syntax or format details for these parameters, so it stays at the baseline 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description provides a clear verb+resource: 'List recent DeerFlow threads' and even enumerates the returned fields (id, title, status, timestamps). It does not explicitly differentiate from siblings like deerflow_run_status or deerflow_get_report, but the purpose is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives implied usage by naming follow-up tools (deerflow_chat, deerflow_get_report) and the thread_id role, but it does not state when to choose this tool over alternatives such as deerflow_run_status or deerflow_list_artifacts. The guidance is suggestive rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
deerflow_researchStart Deep ResearchA
Kick off a long-running deep-research run on a fresh DeerFlow thread. Returns immediately with the thread/run ids and a web URL; poll deerflow_run_status until it reaches a terminal status, then call deerflow_get_report to read the findings. Deep research takes minutes to ~45 minutes and never blocks this call.
| Name | Required | Description | Default |
|---|---|---|---|
| focus | No | Optional one-line constraint to fold into the brief (e.g. 'focus on the EU'). | |
| model | No | Optional DeerFlow model name (see deerflow_list_models). | |
| topic | Yes | The research topic or question to investigate in depth. | |
| recursion_limit | No | Optional agent recursion budget for this run (default 1000). |
Output Schema
| Name | Required | Description |
|---|---|---|
| run_id | Yes | |
| status | Yes | |
| web_url | Yes | |
| thread_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare this is not read-only, is open-world, and not idempotent, but don't convey timing. The description adds crucial behavior: it returns immediately, never blocks, can take minutes to ~45 minutes, and yields thread/run ids plus a web URL. It doesn't state auth requirements or what happens on failure, keeping it just short of a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, front-loaded with the action, then the async lifecycle, then the timing guarantee. No filler; each sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Output schema exists so return values needn't be explained, yet the description still tells the agent what ids/URL come back and which siblings to call next. The full lifecycle is covered for an async launch tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all four parameters (topic, focus, model, recursion_limit) are already documented inline. The description adds no parameter-level detail beyond the schema, which is the expected baseline when the schema does the work.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('kick off a long-running deep-research run on a fresh DeerFlow thread'), distinguishing it from deerflow_chat and the polling/report siblings. An agent can immediately tell this is the entry point that starts a run.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly lays out the workflow chain: this call returns ids, then poll deerflow_run_status until terminal, then call deerflow_get_report. It also names when to expect it to be used (deep research, minutes to ~45 min) versus a blocking call. Alternatives are named directly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
deerflow_run_progressGet Run ProgressARead-onlyIdempotent
Get live progress for a DeerFlow run: status + live counters (llm_call_count, message_count, total_tokens), recent activity (the latest events as one-line summaries, e.g. tool calls and their results), the plan-mode todo checklist, and stall/quiet detection (stalled: true when no activity for longer than the stall threshold; quiet: true for a softer 'between steps' signal; next_step: a human hint pointing at the web UI and deerflow_cancel_run). Pass since_seq (the last_event_seq from a previous response) to return only new events. Requires session or internal-token auth: the event stream and thread state are not reachable with a Personal Access Token.
| Name | Required | Description | Default |
|---|---|---|---|
| run_id | Yes | The run id. | |
| since_seq | No | Only include events with seq greater than this (delta mode; use last_event_seq from a previous response). | |
| thread_id | Yes | The thread id. | |
| activity_limit | No | Maximum recent events to summarize (default 10). |
Output Schema
| Name | Required | Description |
|---|---|---|
| hint | No | |
| error | No | |
| quiet | Yes | |
| todos | Yes | |
| run_id | Yes | |
| status | Yes | |
| stalled | Yes | |
| activity | Yes | |
| terminal | Yes | |
| next_step | No | |
| thread_id | Yes | |
| created_at | No | |
| updated_at | No | |
| stop_reason | No | |
| total_tokens | No | |
| message_count | No | |
| last_event_seq | No | |
| llm_call_count | No | |
| elapsed_seconds | Yes | |
| last_activity_at | No | |
| seconds_since_update | No | |
| seconds_since_activity | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnly/idempotent/non-destructive annotations, the description discloses the auth constraint (session or internal-token; event stream and thread state unreachable with a PAT), the semantics of stalled vs quiet, and delta-mode behavior via since_seq. This is substantive behavioral context the annotations cannot convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The content is front-loaded (purpose first, then return payload, then delta mode, then auth) and every clause carries information. It is dense in a single block rather than broken into scannable segments, which costs it a point.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists so return values need not be spelled out, yet the description still gives the agent the auth prerequisite, the polling/delta mechanics, and how to interpret stalled/quiet/next_step. Nothing needed to invoke or interpret the tool correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 100% schema coverage the baseline is 3, but the description adds real meaning for since_seq by tying it to last_event_seq from a previous response and framing it as delta mode, beyond the schema's 'only include events with seq greater than this'. activity_limit and the ids are left to the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a precise verb+resource ('Get live progress for a DeerFlow run') and enumerates exactly what is returned: status, live counters, recent activity, todo checklist, and stall/quiet detection. It is highly specific, but it never names or contrasts itself against close siblings like deerflow_run_status or deerflow_wait_activity, so an agent must infer the boundary from wording alone.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage context is implied rather than stated: since_seq is described for delta polling and next_step points at the web UI and deerflow_cancel_run, but there is no explicit 'use this instead of deerflow_run_status when...' guidance. The alternative tools are referenced only in passing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
deerflow_run_statusGet Run StatusARead-onlyIdempotent
Check the status of a DeerFlow run. Optionally wait up to wait_seconds (capped at 30s) for it to reach a terminal status before returning, to reduce polling round-trips. Terminal statuses: success, error, timeout, interrupted. Also returns live counters (llm_call_count, message_count, total_tokens) and elapsed/last-update times: the counters advance while the run is working, so if they stop moving for several minutes the run may be stalled — use deerflow_run_progress or deerflow_wait_activity for event-level detail.
| Name | Required | Description | Default |
|---|---|---|---|
| run_id | Yes | The run id. | |
| thread_id | Yes | The thread id. | |
| wait_seconds | No | Seconds to poll for a terminal status before returning (0 = check once). |
Output Schema
| Name | Required | Description |
|---|---|---|
| error | No | |
| run_id | Yes | |
| status | Yes | |
| terminal | Yes | |
| thread_id | Yes | |
| updated_at | No | |
| stop_reason | Yes | |
| total_tokens | No | |
| message_count | No | |
| llm_call_count | No | |
| elapsed_seconds | No | |
| seconds_since_update | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only cover the safety profile (read-only, idempotent), so the description adds real behavioral value: the wait_seconds cap of 30s, the exact terminal statuses, the fact that counters advance live, and a stall heuristic (counters frozen for several minutes). It does not mention auth requirements or rate limits, but the operational semantics it does disclose are substantive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core purpose in the first sentence, then behavior, then the routing hint. Three dense sentences with no filler, though the stall/counter discussion is lengthy relative to the primary use case.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be spelled out, yet the description still explains how to interpret the counters and when movement indicates a stall. Combined with the terminal-status list and the alternative-tool pointers, an agent has everything needed to call and read this tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents run_id, thread_id, and wait_seconds including the 0-30 range. The description reinforces the wait_seconds cap and its purpose (wait for terminal status), which is mildly useful but largely repeats the schema; baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Check the status of a DeerFlow run') and goes on to enumerate the terminal statuses and live counters returned, so the agent knows exactly what the tool answers. It also names the sibling tools (deerflow_run_progress, deerflow_wait_activity) that provide the event-level detail this tool does not, distinguishing it from them explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives concrete usage context: set wait_seconds to avoid polling round-trips, and switch to deerflow_run_progress or deerflow_wait_activity when event-level detail is needed. It does not state exclusions (e.g. when not to use this versus deerflow_wait_activity as a full substitute), so it falls short of an explicit when/when-not pair.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
deerflow_wait_activityWait for Run ActivityARead-onlyIdempotent
Block server-side until the run produces new activity, reaches a terminal status, or the timeout elapses — one call replaces many status polls. The server joins the run's live event stream (falling back to polling when the stream is unavailable), so it returns the moment new activity appears rather than on a fixed tick. Returns reason ('terminal' | 'activity' | 'timeout'), waited_seconds, timeout_seconds, the new activity since since_seq (one-line summaries), the plan-mode todo checklist, quiet/stall detection, and a next_step hint. Pass the returned last_event_seq as since_seq on the next call to continue from where you left off. While waiting it emits MCP progress notifications (elapsed/timeout) when the client supplies a progress token. Cancelling the request from the client aborts the wait and returns stop_reason 'cancelled_by_client'. Requires session or internal-token auth.
| Name | Required | Description | Default |
|---|---|---|---|
| run_id | Yes | The run id. | |
| since_seq | No | Only report events with seq greater than this (use last_event_seq from a previous response; 0 or omitted = latest events). | |
| thread_id | Yes | The thread id. | |
| timeout_seconds | No | Maximum seconds to wait before returning (default 30, capped server-side). |
Output Schema
| Name | Required | Description |
|---|---|---|
| hint | No | |
| error | No | |
| quiet | Yes | |
| todos | Yes | |
| reason | Yes | |
| run_id | Yes | |
| status | Yes | |
| stalled | Yes | |
| activity | Yes | |
| terminal | Yes | |
| next_step | No | |
| thread_id | Yes | |
| created_at | No | |
| updated_at | No | |
| stop_reason | No | |
| total_tokens | No | |
| message_count | No | |
| last_event_seq | No | |
| llm_call_count | No | |
| waited_seconds | Yes | |
| elapsed_seconds | Yes | |
| timeout_seconds | Yes | |
| last_activity_at | No | |
| seconds_since_update | No | |
| seconds_since_activity | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Adds substantial behavior beyond the annotations: server-side blocking with live event-stream join and polling fallback, immediate return on activity rather than fixed ticks, cancellation semantics (stop_reason 'cancelled_by_client'), MCP progress notifications, and the auth requirement. Annotations only cover the read-only/idempotent profile, so this extra detail is genuinely valuable.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Dense but front-loaded: the core purpose and replacement-for-polling claim come first, followed by return shape, continuation, notifications, and auth. Long, but nearly every sentence carries behavioral information; minor packing could trim the enumeration of return fields.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists so return values needn't be explained, yet the description still enumerates the key fields (reason, waited_seconds, last_event_seq) an agent needs to chain calls. Auth, cancellation, and fallback behavior are all covered, leaving no gaps for a long-polling tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description goes beyond it by explaining the continuation workflow for since_seq (feed back last_event_seq) and the timeout framing, adding meaning the schema alone does not convey.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Names a specific verb+resource ('block server-side until the run produces new activity') and immediately differentiates itself from the sibling status tools by stating it 'replaces many status polls.' An agent can distinguish this from deerflow_run_status and deerflow_run_progress without opening schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Clearly states the context of use (use instead of repeated status polling) and gives the continuation pattern: 'Pass the returned last_event_seq as since_seq on the next call.' It does not name a specific alternative tool or state when-not to use it, but the usage context is unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
11 tool updates
v0.1.5- First observed
deerflow_cancel_run - First observed
deerflow_chat - First observed
deerflow_get_artifact - First observed
deerflow_get_report - First observed
deerflow_list_artifacts - First observed
deerflow_list_models - First observed
deerflow_list_threads - First observed
deerflow_research - First observed
deerflow_run_progress - First observed
deerflow_run_status - First observed
deerflow_wait_activity
TDQS
Scored across 11 tools
Most tools target distinct lifecycle stages, but deerflow_run_status, deerflow_run_progress, and deerflow_wait_activity all revolve around checking run state and overlap in returned data (status, counters, activity). The descriptions do provide clear usage guidance, distinguishing polling, detailed progress, and blocking waits, so confusion is limited but possible. deerflow_research and deerflow_chat also both start runs, though the fresh-thread deep-research vs. continuation-chat distinction is clear.
Every tool uses the same deerflow_ prefix and snake_case, with predictable action-oriented names like get_report, list_threads, cancel_run, and wait_activity. The only minor variation is research/chat lacking an explicit object noun, but the pattern remains overwhelmingly consistent and readable.
Eleven tools is well within the ideal 3-15 range and maps tightly to the deep-research lifecycle: starting runs, monitoring them, retrieving reports/artifacts, listing threads/models, and cancelling work. Each tool has a clear role, and no tool feels redundant or trivial.
The lifecycle is well covered: start research/chat, monitor status/progress/wait, cancel, fetch reports, list/get artifacts, and list threads/models. Minor gaps include no operation to delete threads/artifacts or fetch full details for a single thread beyond list output, but agents can work around these in most workflows.
Maintenance
Related MCP Connectors
Zero-setup MCP gateway securely connecting AI to your tools with authentication and workflows
Remote MCP server exposing SMI Aware tools, resources, and skills over Streamable HTTP.
Remote MCP server for supportsheep: run AI interviews and manage support content for your blog.
MCP server exposing the Backtest360 engine API as tools for AI agents.
Related MCP Servers
- FlicenseNot gradedqualityCmaintenanceA remote MCP server deployed on Cloudflare Workers without authentication. Enables connecting MCP tools from AI Playground or Claude Desktop.-
- AlicenseAqualityBmaintenanceExposes local Flowise chatflows as MCP tools, enabling listing and running chatflows from any MCP client.211 npmMIT
- AlicenseBqualityCmaintenanceExposes your LLMGraph workflow deployments as MCP tools, allowing AI assistants to invoke them via natural language.127 npmMIT
- FlicenseNot gradedqualityCmaintenanceConverts any MCP server into simple HTTP endpoints, enabling AI agents that only support HTTP (like ChatGPT Custom GPT or web_fetch) to use MCP tools.-