fetchsandbox-mcp
OfficialThis server is an MCP-based verification engine for API integrations: it checks, debugs, and proves integrations against realistic FetchSandbox provider sandboxes that can simulate failures.
Route a symptom to the provider behavior, spec, workflow, or bug pattern that explains it (
guide).Audit a local project for real integration bugs across payments, webhooks, auth, email, and SMS (
find_bugs).Get a proposed
git difffor a specific bug without modifying your files (fix_bug).Prove a fix works by running the same failure against buggy vs fixed code, producing a shareable receipt only on a measured flip (
prove_fix).Verify your own code against a provider by handing back a fresh twin sandbox and reporting what your app actually called (
validate_integration).Run curated provider workflows on the happy path or with armed failures like declined cards, webhook retries, and rate limits (
quickrun,run_workflow,run_all_workflows).Browse available provider specs, workflows, and injectable failure scenarios (
list_specs,list_workflows,list_scenarios).Arm failure scenarios on a sandbox to test how your integration behaves under production-style misbehavior (
set_scenario).Show buggy-vs-fixed reference behavior and attach before/after evidence to run receipts (
verify_behavior,submit_proof).Get multi-turn conversational help building an integration (
coach).Review past runs and share visual timeline URLs (
list_runs).
Provides curated workflows for issue lifecycle management (create, comment, close, reopen).
Allows importing the Linear OpenAPI spec and running workflows.
Allows importing the Notion OpenAPI spec and running workflows.
Allows importing the Paddle Billing OpenAPI spec and running workflows.
Provides curated workflows for accepting payments, including creating customers, PaymentIntents, and verifying webhooks.
Provides curated workflows for sending SMS and verifying messages with realistic Twilio-formatted responses.
fetchsandbox-mcp
Also on Smithery, npm and the official MCP registry.
A deterministic verification engine for agents, as an MCP server for FetchSandbox.
Your agent writes an integration. This checks whether it actually works — against a sandbox that behaves like the real provider, including the failures: retried webhooks, declined cards, rate limits, auth errors.
When it finds a bug, it can propose a fix and then prove it: the same failure is run against your code before and after the diff. Green only if it reproduced first and stopped after. You get a receipt URL either way.
Install
The MCP server runs locally through Node.js. Clients can resolve npx differently; Cursor on Mac may need the full path from command -v npx.
{
"mcpServers": {
"fetchsandbox": {
"command": "npx",
"args": ["-y", "fetchsandbox-mcp@latest"],
"env": { "FETCHSANDBOX_API_KEY": "fsk_your_key_here" }
}
}
}Discovery and reference tools are available without a key. Application planning, verification and managed local tunnelling require sign-in or an API key from https://fetchsandbox.com/keys. See Accounts.
Client | File |
Claude Code |
|
Claude Desktop |
|
Cursor |
|
Zed |
|
Codex |
|
Cursor on Mac: tested setup
Get a real account key from https://fetchsandbox.com/keys. Run command -v npx
and use that full path in ~/.cursor/mcp.json. This example is for Homebrew
on Apple Silicon; replace the path if yours differs. On Windows, use
where.exe npx to locate your installed command.
{
"mcpServers": {
"fetchsandbox": {
"command": "/opt/homebrew/bin/npx",
"args": ["-y", "fetchsandbox-mcp@0.7.24"],
"env": { "FETCHSANDBOX_API_KEY": "fsk_your_key_here" }
}
}
}Replace fsk_your_key_here privately with the real raw key, without a Bearer
prefix. The placeholder cannot authenticate. Check for a second FetchSandbox
entry in .cursor/mcp.json in your project. Fully quit and reopen Cursor after
saving; a window reload may retain the old MCP process. Enable the server if
needed and confirm its tools load. A green connection alone does not prove
that an application verification call is authenticated.
Restart the client afterwards. Anything else that speaks MCP takes the same command and args.
No terminal? Use the hosted endpoint
Browser-based builders — Lovable, Bolt, v0 — can't run npx. They connect
straight to the hosted streamable-HTTP transport instead:
https://fetchsandbox.com/mcp/v1Authenticate with a Bearer token, not "None" — paste the key from https://fetchsandbox.com/keys.
Same twins, same scenarios, seven tools: validate_integration, quickrun,
run_workflow, verify_behavior, list_workflows, guide, coach.
The rest are not hidden — they cannot work there. find_bugs, fix_bug and
prove_fix read your project from disk and a hosted server has no copy of it,
so advertising them only produced sessions that dead-ended. To analyse your own
code, run npx fetchsandbox-mcp locally in the project you want looked at.
Start with validate_integration. A green quickrun proves the provider
behaves as documented; it does not touch your checkout endpoint, your webhook
handler, or your email send. validate_integration hands you a fresh twin per
provider and then reports what your code actually called.
Related MCP server: API Debugger MCP
Using it
Describe the problem the way you'd describe it to a colleague. You don't need to name a tool.
Customers are reporting more seats than they bought after a Paddle payment. Can you find out why?
The agent works through: route the symptom, reproduce it against the provider sandbox, read your code, get a fix, prove the fix on your code. Each step hands back what the next one needs.
One thing worth knowing, because it's easy to get backwards: prove_fix needs
the unfixed tree. Run it before you write the diff to disk, or there's no
bug left to reproduce and no proof to be had.
Accounts
You don't need one to start. Install it, ask a question, and everything runs.
The first time a run produces something worth keeping — a receipt, or a set of findings — you'll get a short code and a link. Signing in takes about twenty seconds and does two things: the evidence behind your receipts stops being archived after 15 days, and the runs from that machine collect in one place. You'll be asked at most once a day, and never once you're signed in.
For CI, the hosted endpoint, or anywhere a browser isn't available, set a key
instead. Create one at https://fetchsandbox.com/keys — sign in, then
"Create a key". It looks like fsk_....
In an MCP client config, it goes in env:
"env": { "FETCHSANDBOX_API_KEY": "fsk_your_key_here" }In a shell or CI:
export FETCHSANDBOX_API_KEY=fsk_your_key_hereOn the hosted endpoint, send it as Authorization: Bearer fsk_....
The key is also written to ~/.fetchsandbox/credentials.json when you sign in
from an editor; the environment variable always wins.
Tools
Start with guide. It picks the right ones for what you asked.
Finding and fixing
Tool | What it does | Arguments |
| Routes a symptom to a spec, workflow and known failure class |
|
| Audits your project against known integration failure classes. No git remote needed — it reads the directory you point it at |
|
| Returns a |
|
| Retrieve the same running job without starting another analysis or proof |
|
| Runs the failure against your code before and after the diff. Green only on a measured flip |
|
Verifying an integration
Tool | What it does | Arguments |
| Proves your own code against a provider, not that our twin works. Hands back a fresh twin per provider, then reads our request log to report what your app actually called |
|
| Runs one of OUR curated workflows against a bundled spec. Green here says the provider behaves as documented — it says nothing about your integration |
|
| The same, on a sandbox you already have — this is where you re-run with a |
|
| Shows a failure class on reference handlers — buggy vs fixed. Not your code |
|
| Workflows AND the failure scenarios a spec can inject, in one answer |
|
| Routes a symptom to the provider behaviour that explains it, and returns the next call with its arguments filled in |
|
| Multi-turn help building an integration |
|
Those seven are the whole of what a browser-based builder sees, and they are the only ones that need no filesystem. Everything below requires a local project.
On a machine with your code
Tool | What it does | Arguments |
| Audits your project against known integration failure classes |
|
| Returns a |
|
| Retrieve the same running job without starting another analysis or proof |
|
| Runs the failure against your code before and after the diff. Green only on a measured flip |
|
| Runs several workflows in one call |
|
| The failures a spec can inject |
|
| Arms a failure on a sandbox |
|
| Past runs for a sandbox |
|
| Specs already available |
|
| Publishes a receipt for a run |
|
* = required.
What leaves your machine
find_bugs, fix_bug and prove_fix package the directory you point them at
and upload it for analysis. Worth saying plainly, because the previous wording
here implied the opposite.
Excluded before packing: .git, node_modules and build output, agent
instruction files, and anything credential-shaped — .env*, *.pem, *.key,
id_rsa*, *.tfstate, .npmrc, .aws, .ssh, .mcp.json, .mcp.*.json, mcp.json, and more.
Then the archive is read back and refused if it still contains something
shaped like a live credential, wherever it lives and whatever it is called. A
key in config/local.yml stops the upload and names the file. Patterns only
cover what someone thought of; the scan is there for the rest.
If you would rather nothing left at all, the analysis needs the source today. That is the honest state.
Long-running work
The MCP response waits briefly, then returns status: running, its job_id,
and a next_tool_call for get_job. Follow that call until status: done or
error. It reads the existing backend job; it does not upload the project
again or start another proof. Keep the original tree unchanged while the proof
runs. A running job does not establish a pass.
This applies to discovery, proposed fixes, application proofs, and async reference verification. Direct library calls keep their blocking behavior. Job retention and ownership still belong to the existing backend. This change does not make its in-memory job tracker survive a backend restart.
Receipts are public to anyone holding the link
submit_proof attaches the real requests and responses from your app's
before/after run to the receipt page, so the receipt shows your code's own
behaviour. That page is served without a login — that is the point of it, you
drop the link in a PR — which means the bodies on it are readable by anyone who
has the link.
Provider execution can use a FetchSandbox twin or a recording test double; read the receipt's execution scope. A recording double does not establish twin or live-provider fidelity. But the request bodies are the ones your app built, and those can carry values from your config. Look at a receipt before you share it.
Configuration
Env var | Default | Purpose |
| none | Sign in without a browser. Overrides the stored credentials |
|
| Point at a different backend |
| on | Set to |
Telemetry records an opaque per-machine id (a random UUID in
~/.fetchsandbox/session.json), the tool name, latency, and whether the call
succeeded. Not spec content, not request bodies, not credentials. It's how we
count sessions and see which APIs people bring.
Once you sign in, calls are also attributed to your account — that is the point of signing in, and it is what lets your runs appear in one place.
FETCHSANDBOX_TELEMETRY=0 stops the per-machine id being sent, so calls are no
longer linked to your machine. It does not make a call invisible: the server
still records that a tool ran, because it is the thing running it. And if you
are signed in, your key identifies you regardless — that is what a key is. To
be unattributed, don't sign in.
License
MIT — see LICENSE.
Verify a local app without ngrok
Version 0.7.13 adds manage_tunnel to the local MCP package. Start your actual isolated app, open its loopback port, and give the returned app_base_url to validate_integration. Declare the existing app webhook path in application_config.event_destinations. FetchSandbox signs provider-native events and checks independently saved state through the existing application runner. Configure test secrets via the protected handoff, preflight, execute once and retrieve the same run receipt. Close the connection and remove temporary settings afterward. Connectivity alone is not a passing test.
Requires outbound HTTPS to fetchsandbox.com, a running local MCP process and a real local app. No inbound firewall rule or separate tunnel install is needed. Restricted networks may require their approved proxy/CA configuration. Node 22.21+ or 24.5+ supports NODE_USE_ENV_PROXY=1 with HTTPS_PROXY and NO_PROXY; include 127.0.0.1/localhost in NO_PROXY and use NODE_EXTRA_CA_CERTS for an approved corporate CA. Older Node versions do not automatically support this proxy setup. Do not disable TLS certificate validation. Corporate firewalls can still block the connection. Leases expire after 30 minutes or server restart; uncertain writes are not automatically repeated.
Private credentials for local app verification (0.7.14)
After configuring an owned application run, Cursor, Claude Code and other local
MCP clients call install_test_credentials with its session and run IDs.
The existing FetchSandbox account key authorizes retrieval. Temporary provider
keys, webhook secrets and the verifier token are written to a new private dotenv
file under ~/.fetchsandbox/handoffs/ (directory 0700, file 0600), outside the
project. Only its path and variable names enter the tool result. env_mapping
explicitly maps returned names to the real app's environment settings.
Load that file with the disposable application's dotenv loader without printing
it. Configure the returned twin base URLs, restart the app, preflight, execute
once and retrieve the same receipt. Remove the temporary file after testing.
Files do not delete themselves and are not production credentials. Never paste
values into chat, source, logs or command arguments. Replit/Lovable keep their
existing owner browser handoff and native secret managers. This change does not
route prove_fix through the local relay.
Available Tools
16 toolscoachARead-onlyIdempotentInspect
Conversational integration coach for FetchSandbox. Server-side orchestrator that walks the user through adding an API integration (payments / email / auth / etc.) — intake the goal, elicit domain-aware discovery questions from the spec's brain.yaml, route to the right workflow, prove the contract via FetchSandbox, surface compliance notes. Call this BEFORE any other FetchSandbox tool when the user has an open-ended 'help me add X', 'integrate X', 'test my X integration' ask. BEHAVIOR — strict, do exactly this each turn: (1) Say message_for_user to the user (verbatim or lightly paraphrased to fit your voice — but don't add new content). (2) If next_action=wait_for_user AND options is present + non-empty: USE YOUR CLIENT'S NATIVE QUESTION-PICKER TOOL (in Cursor / Claude Code this is AskUserQuestion) to render the lettered picker with the question text, the options[].label as rows, default_option as default, and an 'Other...' freeform row when allow_freeform=true. When the user picks or types, call coach again with {session_id, user_response: <picked value or freeform text>}. (3) If next_action=wait_for_user AND no options: just wait for free text. (4) If next_action=call_tool: invoke tool_call.tool with tool_call.args, then call coach again with the result in context. (5) If next_action=done: end the session. For a hosted app-builder request to build or test an integration, keep the user's simple goal intact and let the server route all named providers into one validation session. When FetchSandbox returns twin bindings, treat those as temporary TEST credentials: configure them server-side in the app-builder project, never ask the user for live Paddle/Resend keys, and never claim they were applied until the builder reports the change and the verifier observes app traffic. Infer app configuration details from the project when available; ask the user only for a fact the builder cannot discover. The deterministic verifier, not this conversation, owns the verdict. The state machine is server-side — DON'T try to predict the next step or skip ahead; let the server drive.
| Name | Required | Description | Default |
|---|---|---|---|
| intent | No | User's free-form integration ask, on the FIRST call only. Pass through verbatim — the server's intent router benefits from the full phrasing. | |
| context | No | Optional context the LLM brings to the turn — e.g. a summary of the user's repo (if you ran an introspect step), or the result of a previously-instructed `tool_call`. | |
| session_id | No | Returned by a previous coach call. Required on every call after the first. | |
| user_response | No | The user's reply to the previous coach turn's question. Required when the previous turn returned `next_action: wait_for_user`. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, openWorld, idempotent, and non-destructive hints, but the description adds substantial behavioral context beyond them: the server-side state machine, next_action handling, use of native question pickers, temporary test credentials, and verification ownership. This is exactly the kind of protocol detail an agent needs to invoke the tool correctly.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is long but front-loads purpose, usage, and behavior in a structured way. For a complex orchestrator, most sentences earn their place, though the turn-by-turn protocol is dense and could be tightened slightly without losing necessary meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the high complexity, lack of an output schema, and stateful conversational protocol, the description is complete enough for correct invocation. It explains the return flow through next_action values, session_id reuse, tool_call handling, and completion without requiring the agent to infer missing behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all four parameters thoroughly. The description mainly repeats those requirements, such as intent only on the first call and user_response after wait_for_user, and adds only minor extra context about passing picker values versus freeform text.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: a conversational integration coach that orchestrates adding an API integration in FetchSandbox. It clearly distinguishes itself from siblings by positioning the tool as the entry point to call before any other FetchSandbox tool for open-ended integration requests.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives a clear when: call before any other FetchSandbox tool when the user has an open-ended 'help me add X', 'integrate X', or 'test my X integration' ask. It also provides a detailed turn-by-turn protocol, but it does not explicitly name when-not to use it or name specific sibling alternatives such as run_workflow or validate_integration.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
find_bugsARead-onlyInspect
FIRST STEP for any API-integration bug — webhooks, payments, auth, email, SMS, subscriptions. Reach for this the moment a user reports a symptom in an app that talks to a provider: 'customers charged twice', 'the webhook fires but nothing happens', 'their balance is wrong', 'we keep emailing a bounced address', 'paused but they still have access'. Packages the current project — local, uncommitted, private, no git URL needed — and audits it against a corpus of real, harvested API-integration failures (idempotency, signature verification, event ordering, pagination, rate limits, state drift) that a read of the code alone does not surface. THIS IS A FINDING, NOT A PROOF. Every finding is a hypothesis until it is measured on the real code. Do NOT stop here, and do NOT write your own test to confirm one — call fix_bug for a proposed diff, then prove_fix to measure it. The response carries next_actions telling you exactly what to call next; follow it. Runs for up to a few minutes.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | OPTIONAL. Absolute path to the project to analyze. Defaults to the current working directory. Pass the repo root for a full audit. | |
| spec | No | OPTIONAL. Grounding hint for which integration to focus on (e.g. 'stripe', 'paddle', 'twilio'). Narrows the analysis to that API's known failure classes. | |
| timeout_s | No | OPTIONAL. Analysis budget in seconds (default 300, max 600). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark it read-only and non-destructive, and the description adds valuable behavior: it packages local uncommitted code without a git URL, runs for minutes, and produces hypotheses rather than confirmed proofs. This goes well beyond the safety profile already conveyed by annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The most important guidance is front-loaded: FIRST STEP, examples, and the finding-not-proof caveat. The longer symptom list and repeated emphasis on the next actions are purposeful and reinforce the critical workflow rather than padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description still tells the agent what the response will contain (next_actions) and to follow it. It covers runtime, scope, optional path behavior, and the limitation that findings are hypotheses, making the definition complete for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all three optional parameters are already documented with meaning. The description adds contextual color about the project being analyzed, but no parameter-level semantics beyond what the schema provides, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States an explicit purpose: it is the FIRST STEP for API-integration bug discovery, auditing the current project against a corpus of known failure classes. It clearly distinguishes itself from siblings by calling itself a finding, not a proof, and by being the audit step before fix_bug and prove_fix.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit when-to-use context with concrete symptom examples, and explicitly says not to stop here or write a test, directing the agent to fix_bug and prove_fix. It even tells the agent to follow next_actions, making the routing unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fix_bugARead-onlyInspect
FetchSandbox remediation: get a proposed fix for a specific bug in YOUR code. The 'fix' step after find_bugs. Ships the project to the FetchSandbox runtime, which authors a MINIMAL fix grounded in the known remediation for that failure class and returns a git diff — it does NOT modify your files, so review the diff and apply it yourself. IMPORTANT: the diff is a proposal, not a proof. After applying it, prove the fix (submit_proof / verify_behavior) so the buggy→fixed flip is measured, not assumed. Runs for up to a few minutes.
| Name | Required | Description | Default |
|---|---|---|---|
| bug | Yes | The specific bug to fix — ideally 'file:line — description', taken from a find_bugs finding. | |
| path | No | OPTIONAL. Absolute path to the project, as it is. Defaults to the current working directory. Do NOT copy the project first: fix_bug returns a diff and never writes to your tree. | |
| spec | No | OPTIONAL. Grounding hint for the integration (e.g. 'stripe'). | |
| timeout_s | No | OPTIONAL. Fix budget in seconds (default 300, max 600). | |
| fix_pattern | No | OPTIONAL. The known remediation pattern for this failure class, if you have it (e.g. from guide's matched_bug_pattern). Improves fix quality; the proof still certifies. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, and the description consistently reinforces this by stating 'it does NOT modify your files'. It adds valuable behavior beyond the annotations: the project is shipped to FetchSandbox runtime, the tool authors a minimal fix, the result is a git diff, and runtime can take up to a few minutes.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences carry a lot of precisely relevant information: what the tool does, what it does not do, how long it runs, and what the user should do next. There is no filler, and the most important caveat is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 5 parameters, no output schema, and annotations that already cover read-only/destructive behavior, the description is complete enough for correct invocation. It tells the agent the input source (find_bugs), the output (git diff), the non-mutating behavior, the runtime bound, and the follow-up proof step.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the input schema already documents each parameter in detail. The description adds workflow-level context (e.g., bug should come from a find_bugs finding, and fix_pattern relates to the guide's matched_bug_pattern), but it does not materially expand parameter semantics beyond what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear verb+resource: 'get a proposed fix for a specific bug in YOUR code', and explicitly names its role as 'The fix step after find_bugs'. It differentiates from siblings by emphasizing it returns a git diff and does not modify files, so an agent can distinguish it from prove_fix, submit_proof, and verify_behavior.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit usage context: use it after find_bugs, and after applying the diff prove the fix using submit_proof or verify_behavior. It also warns that the diff is a proposal not a proof, which is a clear when-to-use/when-not-to-use boundary.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
guideARead-onlyIdempotentInspect
ROUTE a symptom to the provider behaviour that explains it. Use this when the user names a provider or a domain (payments, email, auth, SMS, subscriptions) and you need to know what that provider ACTUALLY does — not what its docs say, and not what can be inferred from reading the integration code. Reading the code tells you what your app does with a field. It cannot tell you what the field MEANS at the provider — whether a line item is a seat count, whether a 200 body carries ok:false, whether an event can arrive out of order. That is the class of bug this routes. Returns {spec, workflow, scenario, confidence, reasoning} plus next_actions: a typed list of what to call next, with arguments pre-filled. Follow it rather than improvising the next step.
| Name | Required | Description | Default |
|---|---|---|---|
| hints | No | Optional caller-supplied overrides. Each field short-circuits the corresponding detection step. | |
| intent | Yes | The developer's free-form prompt as they typed it. Don't pre-process or shorten — the router benefits from the full phrasing (capture timing, geo cues, failure mode language). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, openWorldHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description adds value by explaining the routing logic and the return shape ('Returns {spec, workflow, scenario, confidence, reasoning} plus next_actions'), which is not redundant with annotations. It does not contradict any annotation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is longer than average but every sentence serves a purpose: it defines the tool's unique value, explains the failure class it addresses, and outlines the output. The key action ('ROUTE a symptom...') is front-loaded, and the subsequent examples are illustrative, not filler. It could be tightened slightly but is not wasteful.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (routing across providers and domains) and the absence of an output schema, the description compensates by explicitly listing the return fields and next_actions. It also explains the reasoning behind its use, making it complete for an agent to decide when to call it and what to expect. No critical information is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds meaningful guidance beyond the schema, particularly for the intent parameter: 'Don't pre-process or shorten — the router benefits from the full phrasing (capture timing, geo cues, failure mode language)'. This is concrete, behavioral guidance that improves correct usage, justifying a 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with 'ROUTE a symptom to the provider behaviour that explains it', stating a specific verb and resource, and clearly distinguishes itself from code-reading and documentation tools by explaining what it does NOT do ('not what its docs say, and not what can be inferred from reading the integration code'). This makes its purpose unmistakable and separates it from siblings like find_bugs or fix_bug.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly provides a use condition ('Use this when the user names a provider or a domain...') and explains why alternatives fail (code cannot reveal provider meaning). It also instructs the agent to 'Follow it rather than improvising the next step', giving clear post-call guidance. This is strong, actionable usage direction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_runsARead-onlyIdempotentInspect
List recent workflow runs (and ad-hoc traffic) for a sandbox, newest first. Use when the user asks 'what did I run', 'show me recent validation runs', 'did the stripe test pass earlier', or wants to find a previous run to share or re-inspect. Each run includes its shareable timeline URL (fetchsandbox.com/runs/<sandbox_id>) so the user can open the visual trace in a browser or drop it in Slack / a PR comment. Requires sandbox_id (from import_spec).
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max number of runs to return (default 20, server may cap). | |
| sandbox_id | Yes | The sandbox_id returned by import_spec. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the agent knows this is a safe read. The description adds behavioral context beyond annotations by noting that each run includes a shareable timeline URL (fetchsandbox.com/runs/<sandbox_id>) and that the server may cap the limit. This gives the agent a preview of the return payload and server-side behavior, which is useful. No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded: it opens with the tool's core function and ordering, then immediately gives usage triggers, then explains the output benefit (shareable URLs). Every sentence earns its place—there is no filler or repetition. The length is appropriate for the tool's complexity, and the logical flow (what → when → output) helps an agent parse it quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description carries the burden of explaining what the tool returns. It mentions that runs include a shareable timeline URL, which is the most important output detail for sharing/re-inspection. It also clarifies that it covers ad-hoc traffic, and notes the limit default/cap. However, it does not enumerate other fields of each run (e.g., run ID, status, timestamps) that might be expected from a list endpoint. Given the tool's simplicity and the described use cases, this is a minor gap; the description is still largely complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already covers both parameters (limit and sandbox_id) with descriptions, achieving 100% coverage. The description adds extra semantic value by clarifying that sandbox_id comes specifically from import_spec, and that limit may be capped by the server, which the schema does not mention. This goes beyond the baseline expectation for high schema coverage, so a 4 is warranted.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states the tool lists recent workflow runs and ad-hoc traffic for a sandbox, newest first. The verb is specific ('list'), the resource is specific ('recent workflow runs'), and it distinguishes from siblings like list_workflows by focusing on runs rather than defined workflows. The description also gives concrete example queries, making the purpose unmistakable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly enumerates when to use the tool: 'Use when the user asks "what did I run", "show me recent validation runs", "did the stripe test pass earlier", or wants to find a previous run to share or re-inspect.' It also states the required prerequisite (sandbox_id from import_spec), leaving no ambiguity about invocation conditions. While it doesn't state when not to use it, the positive triggers are clear and the tool is distinct from siblings, so this is sufficient.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_scenariosARead-onlyIdempotentInspect
List the FAILURE SCENARIOS this sandbox can inject on demand — the specific ways the real provider misbehaves in production. Call this BEFORE claiming an integration works. A checkout that passes on the happy path tells you almost nothing; the bugs that reach customers are declined cards, webhooks delivered twice or out of order, expired tokens, rate limits and slow networks. Typical names: payment_declined, insufficient_funds, webhook_retries, flaky_webhooks, replayed_old_signed_event, signed_event_with_mutated_body, auth_failure, rate_limited, slow_network — but they differ per provider, which is why you list them instead of guessing. Returns each scenario's name and what it does. Arm one with set_scenario, then re-run the same request and check the app still behaves correctly.
| Name | Required | Description | Default |
|---|---|---|---|
| sandbox_id | Yes | The sandbox_id returned by quickrun, run_workflow or import_spec. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description adds valuable behavioral context beyond annotations: it explains that the tool returns each scenario's name and what it does, and that scenario names differ per provider. It also implies the tool is a read-only discovery operation, consistent with annotations. Minor gap: it doesn't specify pagination or ordering, but that's not critical for a list operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is moderately long but every sentence earns its place: it defines the resource, gives usage timing, explains why the tool matters, provides example scenario names, notes provider variability, and routes to the next step. It is front-loaded with the core purpose ('List the FAILURE SCENARIOS') and the critical usage instruction ('Call this BEFORE claiming an integration works'). Slightly verbose in the middle with the example list, but that list adds concrete value for an agent.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list tool with one parameter, 100% schema coverage, and annotations covering safety, the description is nearly complete. It explains what the return value contains (each scenario's name and what it does), which is useful since there is no output schema. It also provides the workflow context (list then set_scenario). It doesn't mention error cases or empty results, but those are minor for a discovery tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents the single parameter sandbox_id. The description mentions sandbox_id indirectly by referencing 'this sandbox' and the sibling set_scenario, but doesn't add new semantic detail about the parameter beyond what the schema provides. Baseline 3 is appropriate since the schema carries the parameter documentation burden.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('List') and resource ('FAILURE SCENARIOS this sandbox can inject on demand'), and explains what these scenarios are (specific ways the real provider misbehodes in production). It distinguishes itself from siblings by framing the tool as the discovery step before using set_scenario, and by noting that scenario names differ per provider, so listing is necessary rather than guessing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit when-to-use guidance: 'Call this BEFORE claiming an integration works.' It explains why the happy path is insufficient and that the tool should be used to discover provider-specific failure scenarios. It also names the sibling set_scenario as the next step ('Arm one with set_scenario'), providing clear routing between related tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_specsARead-onlyIdempotentInspect
Browse the FetchSandbox spec catalog — every API (Stripe, GitHub, Twilio, Notion, OpenAI, Polar, GitLab, and 40+ more) that has a ready-to-use sandbox with curated workflows. Use when the user asks 'what APIs do you support?', 'what specs are available?', 'show me the catalog', 'do you have ?', or wants to explore before committing to one. Returns each spec's slug (use as name arg to import_spec), description, endpoint count, and tags. Pass filter to narrow by substring (e.g., filter='pay' returns Stripe, Paddle, Polar).
| Name | Required | Description | Default |
|---|---|---|---|
| filter | No | Optional case-insensitive substring filter. Matches against spec name, slug, description, and tags. Omit to return the full catalog. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already carry the safety profile (readOnlyHint=true, idempotentHint=true, destructiveHint=false), and the description adds meaningful context beyond that: the return structure (slug, description, endpoint count, tags) and how the slug feeds into import_spec. OpenWorldHint ('40+ more') is honored without contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Resource is front-loaded first, then usage triggers, then return format, then filter example — a logical, scannable order. Slightly long, but each sentence contributes (concrete API names, query phrases, downstream slug usage, filter example), so no waste.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
A low-complexity tool (one optional param) with no output schema, so the description rightly takes on the return-format burden, which it meets. The only minor gap is no mention of result limits or pagination, but that's immaterial for a simple catalog browse tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% — the schema already fully documents the filter param (case-insensitive substring, matches name/slug/description/tags, omit for full catalog). The description's filter example (filter='pay') is a nice illustration but adds little beyond what the schema states, so the high-coverage baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a precise verb ('Browse') and a specific resource ('FetchSandbox spec catalog') with concrete examples of covered APIs (Stripe, GitHub, Twilio, etc.). It implicitly differentiates from siblings like list_workflows (workflows, not specs) and import_spec (the consumer of the returned slug).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit query triggers ('what APIs do you support?', 'do you have <X>?') and the decision context 'before committing to one', which routes the agent to import_spec afterward. This is as explicit as it gets for a browse tool without listing every sibling as a negative case.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_workflowsARead-onlyIdempotentInspect
List the named, runnable workflows for a previously-imported spec. Workflows are realistic multi-step API journeys (e.g. 'create customer → attach payment method → create subscription'). Use this after import_spec for exploration ("what can I do?", "show me the flows") OR before run_all_workflows when the user wants a SCOPED validation: list, filter by user intent ("checkout", "webhooks"), then pass the matching ids as workflow_names to run_all_workflows. Returns the workflows AND the failure scenarios this spec can simulate — each with a plain description and the exact call to run it. Read the scenarios out to the user and ask which matter; do not guess scenario names.
| Name | Required | Description | Default |
|---|---|---|---|
| spec_id | No | The spec_id returned by import_spec. | |
| spec_slug | No | A human name like 'resend' or 'stripe'. Use this when you do not have a spec_id — you do not need to look one up first. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover read-only/idempotent/non-destructive behavior. The description adds meaningful non-obvious behavior: the tool returns failure scenarios alongside workflows and instructs the agent to read them to the user and ask which matter. This goes beyond the annotations and clarifies the tool's side effects on the conversation flow.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is longer than typical but information-dense: purpose, example, usage context, chaining instruction, return content, and user-interaction rule all earn their place. It is front-loaded with the core purpose, though it could be tightened by moving the workflow example later.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description compensates by explaining what the result contains ('workflows AND failure scenarios', each with descriptions and an exact call), and it tags the critical interaction requirement around scenario selection. The parameter usage, sibling chaining, and result semantics are all covered.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and both spec_id and spec_slug are documented in the input schema. The description does not add syntax-level parameter detail beyond the schema, and the usage context ('after import_spec') is also present in the schema description for spec_id.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a clear verb+resource: 'List the named, runnable workflows for a previously-imported spec' and gives an illustrative workflow example. It does not explicitly distinguish itself from the sibling list_scenarios, despite the fact that both this tool and that sibling appear to deal with scenarios, so it stops short of full sibling differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly prescribes when to call it: after import_spec for exploration, or before run_all_workflows for scoped validation, with a concrete chaining pattern ('list, filter by user intent, then pass matching ids'). It also gives a behavioral instruction for the scenario results, telling the agent not to guess scenario names and to ask the user which matter.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
prove_fixAInspect
THE PROOF STEP. The only way to establish that a fix actually works, and the only thing that produces a shareable receipt. Ship the STILL-BUGGY project plus your proposed diff: FetchSandbox applies the diff to a copy and runs the SAME failure probe against the buggy and the fixed tree, against real provider behaviour. Green ONLY on a measured flip — the bug demonstrably present before, demonstrably gone after. CALL THIS BEFORE YOU WRITE THE FIX TO DISK. prove_fix needs the broken tree to reproduce against; applying the diff first makes a measured proof impossible. DO NOT SUBSTITUTE YOUR OWN TEST. A harness you write runs only the FIXED code, so it can show a fix passing while proving nothing about whether the bug was ever reproduced or is genuinely gone — and an agent-authored check must never be reported to a user as 'proven' or 'verified'. If you have already written one, still call this: your test and this proof answer different questions.
| Name | Required | Description | Default |
|---|---|---|---|
| bug | No | The finding being fixed — used to select FetchSandbox's scenario. | |
| diff | Yes | The unified diff returned by fix_bug. | |
| path | No | OPTIONAL. The project root, as it is. Defaults to cwd. Do NOT copy the project first: prove_fix builds its own before/after copies and never writes to your tree. A path outside the workspace is refused. | |
| scenario | No | OPTIONAL. Explicit scenario id, if known. | |
| timeout_s | No | OPTIONAL. Budget in seconds (default 300). | |
| sandbox_id | No | OPTIONAL. A twin from quickrun/run_workflow. Usually omit — the last twin this session used is attached automatically. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already say readOnlyHint=false and destructiveHint=false, and the description adds valuable behavior beyond that: the tool builds its own before/after copies, never writes to the user's tree, applies the diff to a copy, requires a measured before/after flip, and refuses paths outside the workspace. It does not fully disclose failure-mode or pass-vs-error semantics, which keeps it from a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense and imperative, with front-loaded purpose and clear ordering constraint. It is longer than average and includes some repetition and all-caps emphasis, but nearly every sentence carries operational significance; a small amount of rhetorical repetition ('only way', 'DO NOT SUBSTITUTE', 'never') costs it one point.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a six-parameter tool with no output schema, the description explains the core behavior (applies diff to a copy, runs same probe, measured flip), security/order constraints, and parameter idioms. It does not describe the result receipt shape, error cases, or what happens when the flip is not observed, which an agent would need to interpret the tool's output.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already covers 100% of parameters with descriptions, so the baseline is 3. The description goes above the schema by explaining the significance of 'diff' (must come from fix_bug), 'path' (do not copy the project; outside paths refused), and 'sandbox_id' (usually omit; last twin auto-attached). This is genuine added value beyond the schema text.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('prove'), a precise mechanism (FetchSandbox applies the diff to a copy and runs the same failure probe against buggy and fixed trees), and a measurable success condition (green only on a measured flip). This makes it clearly distinct from siblings like verify_behavior, fix_bug, or submit_proof, and from an agent's own ad-hoc test.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives explicit timing ('CALL THIS BEFORE YOU WRITE THE FIX TO DISK'), explains why ordering matters (the broken tree is needed for reproduction), and explicitly warns against substituting a custom harness with the rule that such a check must never be reported as proven or verified. This is strong when-vs-when-not guidance with clear user-facing consequences.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
quickrunAInspect
Run a curated proof workflow against a KNOWN, bundled spec (stripe, clerk, descope, resend, twilio, and 50+ others) in ONE call — it spins up the sandbox by slug, so you do NOT need import_spec or a sandbox_id first. This is the normal path when the user is testing an integration with a well-known provider: call guide on their prompt, then call quickrun with the returned spec + workflow. To reproduce a failure, pass the scenario from guide's matched_bug_pattern.reproduce_with.scenario (e.g. webhook_retries, payment_declined). Returns sandbox_id + flow_run_id — pass BOTH to verify_behavior to prove the fix — plus a receipt URL. Use run_workflow instead ONLY when you already hold a sandbox_id from import_spec of a custom/private spec.
| Name | Required | Description | Default |
|---|---|---|---|
| scenario | No | OPTIONAL failure scenario to reproduce (e.g. webhook_retries, payment_declined). Take it from guide's matched_bug_pattern.reproduce_with.scenario. Omit for the happy path. | |
| spec_slug | Yes | The bundled spec slug from guide (e.g. 'stripe'). Lowercase. | |
| workflow_name | Yes | The workflow id from guide (e.g. 'accept_payment'). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false, openWorldHint=true, and destructiveHint=false for the safety profile; the description adds meaningful behavioral context beyond that — it spins up a sandbox as a side effect, requires no prior sandbox_id, and discloses the exact return contract (sandbox_id + flow_run_id + receipt URL) with chaining guidance to verify_behavior. This exceeds baseline transparency for a state-changing tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four dense sentences, front-loaded with the core purpose and key differentiator (no import_spec needed). Every subsequent sentence earns its place: the normal call path, scenario reproduction, return contract, and the run_workflow exclusion. Slightly long, but no wasted words given the routing and chaining information it must carry.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Complete for a tool with no output schema: it discloses return values (sandbox_id, flow_run_id, receipt URL), preconditions (no import_spec needed), the failure-reproduction parameter path, and the surrounding workflow (guide → quickrun → verify_behavior). An agent has everything needed to invoke it correctly in context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3 and the schema already documents all three parameters, including where to source them ('from guide') and the scenario semantics. The description reinforces these sources with concrete examples (stripe, accept_payment, webhook_retries) but adds little meaning the schema doesn't already provide.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Run a curated proof workflow against a KNOWN, bundled spec') and immediately distinguishes itself from siblings: it does NOT need import_spec or a sandbox_id, and it is explicitly differentiated from run_workflow at the end. An agent can tell exactly what this tool is for and how it differs from its peers.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit when-to-use guidance: 'This is the normal path when the user is testing an integration with a well-known provider: call guide... then call quickrun.' It also names the alternative and its condition: 'Use run_workflow instead ONLY when you already hold a sandbox_id from import_spec of a custom/private spec.' Nothing is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
run_all_workflowsAInspect
Execute EVERY workflow (or a scoped subset) for a sandbox in ONE call. Use this — NOT a loop of run_workflow — for any validation-style request: "validate this integration", "run all workflows", "check coverage", "test stripe checkout", "fs validate". IDEs (Cursor, Claude Code) approve each MCP call individually, so 18 workflows via run_workflow = 18 clicks. This tool = 1 click, total. Scope via workflow_names: pass an array of workflow ids to run a subset (e.g., user says "validate stripe CHECKOUT" → pass ["create_checkout_session", "checkout_complete"]). Names are case-insensitive; dashes and underscores interchangeable. Returns: summary (pass/fail counts, totals) + full step trace per workflow. After running, the user can visit fetchsandbox.com/runs/<sandbox_id> for a shareable visual timeline.
| Name | Required | Description | Default |
|---|---|---|---|
| sandbox_id | Yes | The sandbox_id returned by import_spec. | |
| workflow_names | No | Optional list of workflow ids/names to run. Case-insensitive; dashes and underscores are interchangeable. Omit to run every workflow for the spec. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only provide flags (readOnlyHint=false, destructiveHint=false), so the description must fill in behavior. It discloses that this is a write/mutating operation (runs workflows), reduces UI approvals, and returns a summary plus full step trace. It also mentions the shareable timeline link. Slightly less than 5 because it doesn't detail failure behavior, but it covers key points.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is information-dense and front-loads the primary use case early with 'Execute EVERY workflow... in ONE call.' It then explains usage, scoping, and returns concisely. Slight padding with the IDE click explanation could be trimmed but serves a purpose for user context. Overall, it's structured effectively.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (batch execution), the description provides sufficient usage context, scoping options, and return information. It lacks a detailed list of possible failure modes or timeouts, but since there's no output schema and annotations are minimal, it does well. A 4 is justified as it could be more complete with error handling, but it's solidly above average.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, covering sandbox_id and workflow_names. The description adds value by explaining how workflow_names scopes the subset with examples, and clarifies case-insensitivity and character interchangeability, beyond the schema's brief notes. It reinforces the semantics, which is helpful. A 4 is appropriate since it's not adding entirely new meaning but contextualizes the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool executes every workflow (or a subset) for a sandbox in one call, and distinguishes it from run_workflow. It provides a strong verb (execute), specific resource (workflows for a sandbox), and concrete use cases (validate, run all workflows), making its purpose unmistakable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explicitly tells users to use this instead of a loop of run_workflow, and gives concrete examples of when to use it ('validate this integration', 'run all workflows', etc.). It also explains how to scope with workflow_names, including case-insensitivity and dash/underscore handling, so an agent knows exactly when and how to invoke it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
run_workflowAInspect
Execute ONE specific workflow by name and return its step-by-step trace PLUS a share_url — a public, replayable proof URL that renders the full timeline (every request, response, webhook event) for this run. The share_url is the canonical 'here's what happened' artifact: surface it verbatim in any reply that needs evidence (PR comments, Slack threads, blog posts, X replies). Do NOT substitute a docs URL or any other link as the proof — the share_url is the only valid receipt. Use ONLY when the user explicitly names a single workflow to run (e.g., "run accept_payment", "just check the refund workflow"). For ANY validation-style request — "validate stripe", "check coverage", "run all workflows", "test this integration", or even "validate stripe checkout" (multiple workflows match "checkout") — use run_all_workflows instead. The batch tool collapses N approvals to 1 and supports a workflow_names filter for scope. Calling this in a loop is an anti-pattern.
| Name | Required | Description | Default |
|---|---|---|---|
| scenario | No | OPTIONAL failure scenario to exercise (e.g. payment_declined, insufficient_funds, fraud_hold). Toggles the sandbox engine's scenario for the duration of the run, then restores. Use this for 'test with declined card' / 'simulate failure X' intents. Omit for the happy path. | |
| sandbox_id | Yes | The sandbox_id returned by import_spec. | |
| workflow_name | Yes | Workflow id or name from list_workflows. Case-insensitive; dashes and underscores are interchangeable. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false, openWorldHint=true, idempotentHint=false, and destructiveHint=false, and the description is consistent with all of them (execution implies side effects; webhook events align with openWorld). The description adds genuine value beyond annotations: the scenario toggling behavior (set for the run's duration then restored), the canonical status of share_url, and the instruction not to substitute a docs URL as proof. No contradictions found.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is longer than average but every sentence earns its place — primary action first, then output semantics, then usage rules and alternatives. It is front-loaded with the core action before the routing guidance. Slightly verbose in the exclusion list, but dense with actionable information rather than filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema present, the description correctly takes on the burden of explaining the return value (trace + share_url) and its role as the proof artifact. The tool is simple (3 params, 2 required, no enums, no nesting) and the description fully covers invocation, output, and routing — an agent has everything needed to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with each parameter (scenario, sandbox_id, workflow_name) already well documented including case-insensitivity and scenario-restore semantics. The description reinforces the workflow_name routing and scenario intent but does not add parameter details beyond what the schema provides, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource ('Execute ONE specific workflow by name') plus the precise output contract (step-by-step trace and a share_url proof artifact). It clearly distinguishes itself from run_all_workflows by contrasting single-workflow execution against batch validation, so an agent can tell them apart without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Extremely explicit about when to use it ('Use ONLY when the user explicitly names a single workflow') and when not to, naming the alternative (run_all_workflows) with concrete examples of ambiguous intents like 'validate stripe checkout' where multiple workflows match. Also flags calling this in a loop as an anti-pattern. Nothing is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
set_scenarioAIdempotentInspect
ARM a failure scenario on a sandbox, so the next requests hit the provider misbehaving instead of the happy path. This is how you find out whether the integration you just wrote actually survives production. Use it like this: run the flow once on 'default' and confirm it works, call set_scenario with a failure from list_scenarios, run the SAME flow again, then check the end state is still correct — not that the call merely returned. A declined payment must not produce a confirmed order; a webhook delivered twice must not charge twice or send two emails. Set scenario to 'default' to return the sandbox to normal. The scenario stays armed until you change it, and it affects every caller of that sandbox — so put it back when you are done.
| Name | Required | Description | Default |
|---|---|---|---|
| scenario | Yes | A scenario name from list_scenarios, or 'default' to restore normal behaviour. Guessing a name that does not exist fails — list first. | |
| sandbox_id | Yes | The sandbox to arm. From quickrun, run_workflow or import_spec. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate non-read-only, open-world, idempotent, and non-destructive. The description adds that the scenario persists until changed and affects all callers of the sandbox, which is critical behavioral context beyond annotations. It also emphasizes the importance of resetting, fully disclosing side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single paragraph of about 150 words, covering purpose, usage, restoration, and warnings. While not as tight as a two-sentence description, every sentence contributes to correct usage, so it is appropriately sized and front-loaded with the core action.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with two parameters and no output schema, the description covers the intended workflow, restoration, and side effects. It is complete for an agent to know when and how to invoke it correctly, including the need to verify end state and reset after testing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already provides thorough descriptions for both parameters, including valid values for scenario and failure behavior on unknown names. The description adds usage context but no new parameter-specific semantics, so the baseline of 3 is appropriate given 100% schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb (ARM) and resource (failure scenario on a sandbox), clearly distinguishing it from list_scenarios. It explains the purpose of testing integration resilience, leaving no ambiguity about what the tool does.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives an explicit step-by-step workflow: run on 'default', arm a failure from list_scenarios, re-run, verify end state, and restore with 'default'. It also warns about side effects and the need to reset, making when and how to use it unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
submit_proofAInspect
Receipts are readable by anyone with the link — do not attach bodies the user would not paste into a public PR. Attach REAL before/after evidence from the USER's actual app to the run receipt. Use this AFTER you've fixed the bug and re-run the app: it makes the receipt show their own code's behavior (before your fix vs after), which is far stronger proof than a reference simulation. Provide one proofs entry per probe you fired — the request you sent, the response BEFORE the fix (bug reproduces), and the response AFTER the fix (bug gone) — keyed to the run's sandbox_id + flow_run_id (from run_workflow's result). This is SELF-REPORTED evidence: it's shown on the receipt but never counts as a proven (green) result. For a MEASURED green proof — FetchSandbox reproduces the bug on your real code and verifies your fix flips it — use prove_fix instead.
| Name | Required | Description | Default |
|---|---|---|---|
| proofs | Yes | one per probe: { name, request:{method,path,body}, before:{status,body}, after:{status,body} }. before = pre-fix (bug reproduces), after = post-fix (bug gone). | |
| summary | No | optional one-line description of what you ran against the app | |
| sandbox_id | Yes | sandbox_id from the run_workflow result | |
| flow_run_id | Yes | flow_run_id from the run_workflow result | |
| bug_pattern_id | Yes | the bug_pattern id you reproduced (e.g. webhook_duplicate_side_effect) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=false and destructiveHint=false, but the description adds critical behavioral context: this is self-reported evidence that 'never counts as a proven (green) result'. It also discloses that receipts are public and the submission is non-authoritative. This goes well beyond annotations and prevents misinterpretation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is detailed but every sentence earns its place: it front-loads the privacy warning, then gives usage timing, then explains the self-reported nature and contrast with prove_fix, then parameter guidance. It is structured logically and avoids redundancy with the schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 5 parameters, nested objects, and no output schema, the description covers everything an agent needs: when to use it, what to attach, how to structure proofs, keying to run IDs, and its non-green status. The presence of an alternative (prove_fix) is clearly stated, so the agent can make an informed choice.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so parameters are already documented. However, the description adds operational semantics by instructing 'Provide one proofs entry per probe you fired' and explaining the expected structure (request, before, after) and keying to sandbox_id + flow_run_id. This adds value beyond the schema's field definitions, though it could have gone further with concrete examples.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states the tool's purpose: to submit self-reported proof of a bug fix by attaching real before/after evidence from the user's app to the run receipt. It clearly distinguishes itself from the sibling tool 'prove_fix' by contrasting self-reported vs measured green proof, so an agent can tell them apart without opening schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides explicit when-to-use guidance: 'Use this AFTER you've fixed the bug and re-run the app'. It also names the alternative (prove_fix) for measured green proof and explains the condition (when you want FetchSandbox verification). Additionally, it warns about public visibility of receipts, which is an exclusion condition for sensitive content.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
validate_integrationAInspect
Start a validation session for the user's integration. quickrun and run_workflow execute OUR curated workflow against a twin — green there says the provider behaves as documented, and says nothing about whether their integration wired to it correctly. This instead hands back a FRESH twin per provider and asks the user to point their app at it, then reads external provider traffic. Direct agent calls also appear there; caller identity is not established. Use it when someone wants their integration verified before launch. Call once with providers, then follow the returned next_action. Inspect the app and supply a complete receipt_config before configuring the suite; the application suite drives its own purchases and webhooks, so do not ask the user to run a manual flow first. The matrix is returned before any traffic: pass arm with a probe ID before exercising the app. Send the returned request_headers on every provider request in that attempt, then pass probe and run_id to evaluate. Use cancel: true with run_id to abort or retry failed cleanup. Request logs alone do not prove application state or production readiness. For a supported payment-to-receipt integration, follow the structured next_action; call next_tool_call only when it is non-null and its arguments are complete. Never execute while host-side setup is pending. Do not substitute guide, quickrun, list_workflows, or reference probes for application verification. Use the widest suite the server recommends. receipt_recovery_v1 includes R1-R4 and adds checks R5-R8 for accepted-send response loss, concurrent redelivery, source/email transient failures and delayed redelivery. Pass suite plus receipt_config with the app's exact webhook URL, test recipients and observable purchase marker. FetchSandbox freezes all four receipt rules for both same-customer and different-customer purchases. You are responsible for completing this setup: treat the target as a disposable test app, not the user's live production service, until its declared suite passes. For a greenfield app, keep live billing disabled and publish a temporary test build first to obtain its stable public origin. Use the published webhook URL, not a private preview URL. Inspect the app and identify the exact webhook route before suite configuration. Before requesting or applying test secrets, send an unsigned POST to that exact URL from outside the workspace; a 400 signature rejection is expected, while a 307/login redirect is a blocker. Keep signature validation enabled. After the successful preflight, configure the suite with its complete receipt_config. Apply the returned twin URLs, X-Flow-Run-Id, and three temporary credentials only to this disposable app; execute only after the host-side setup actions are complete. The credentials are twin-only test values: PADDLE_API_KEY, RESEND_API_KEY, and PADDLE_WEBHOOK_SECRET. Use the platform's supported secret store or secret-writing tool and never use real provider credentials or enable live billing. After every required check is held, remove only the test secrets and twin config this run added, including from the disposable test app's published scope. Never modify a separate live production app or delete pre-existing, shared, or real-provider values. Confirm the temporary names are absent, then hand the app to its owner to configure separate development/staging credentials. If the suite is failing or inconclusive, retain test config for repair and a fresh run. The configure_app response contains public twin URLs/IDs and a secret_handoff_url, never the secret values themselves. If the host exposes no safe way for you to write test secrets, explain that specific limitation and show the human the link to open while signed in to the owning FetchSandbox account; they can copy the three values directly into the platform secret store. Do not ask the human to discover endpoints, call FetchSandbox manually, or paste secret values into chat, project files, or logs. Wait for confirmation only when the human must complete that secure-store action. Then call execute:true with its run_id. FetchSandbox drives signed events and independently observes accepted email records. Keep every check and the observation windows in your report. Restore any temporary host privacy setting after the test. On an inconclusive execute result, inspect and report its execution_diagnostics field directly; do not ask the human to infer a cause from the public receipt page, which intentionally omits private proof. If you cannot configure the app, report that blocker; reference tests cannot replace app execution. A verified receipt suite covers only its declared rules and windows, never all production behavior. A missing or untriggered recovery fault stays unmeasured. This application suite requires sign-in. Paddle checkout is a separate app-owned browser flow: if a transaction's checkout.url points to fetchsandbox.com/checkout, returns 404, or does not show a checkout page, do not imply FetchSandbox hosts the merchant's payment UI. Inspect the exact URL and the Paddle Sandbox default payment link or per-transaction override. Tell the builder to use a reachable app checkout page that loads Paddle.js and opens the _ptxn transaction, or a supported Paddle-hosted flow. Verify browser checkout/payment separately from twin API and webhook tests; transaction creation alone is not payment proof.
| Name | Required | Description | Default |
|---|---|---|---|
| arm | No | Probe ID from the matrix to arm before running the app. Requires session_id. | |
| probe | No | Probe ID from the matrix to evaluate after running the app. Requires session_id and run_id. | |
| suite | No | Configure the declared application receipt suite on this session. | |
| cancel | No | Abort the attempt or retry failed cleanup. Requires session_id and run_id; cannot combine with arm or probe. | |
| run_id | No | Attempt ID returned by arm. Required with probe or cancel; prevents stale calls from consuming a newer attempt. | |
| execute | No | Drive the configured app and evaluate the frozen receipt suite. Requires session_id/run_id; configuration acknowledgment alone is not proof. | |
| providers | No | Provider slugs the app integrates, e.g. ['stripe'] or ['paddle','resend']. Required to start a session. | |
| session_id | No | Returned by the first call. Pass it back after their app has run a flow to see what it did. | |
| app_base_url | No | Where their app is deployed, if known. Recorded so a later step can deliver webhooks to it. | |
| receipt_config | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only declare the generic safety profile (readOnlyHint=false, openWorldHint=true, non-idempotent, non-destructive); the description adds far more: it returns fresh twins and credentials, requires host-side setup, expects a 400 preflight and treats a 307 as a blocker, mandates secret cleanup, and warns that logs/receipt pages do not prove production readiness. No contradiction with the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The first sentence is front-loaded and much of the content is substantive, but the body is a single undifferentiated wall of operational policy that would benefit heavily from structure. Length is defensible for a 10-parameter, multi-phase tool, yet the lack of headings/grouping makes it harder to parse than it needs to be.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having no output schema, the description explains return shapes (matrix before traffic, next_action, configure_app's URLs and secret_handoff_url, execution_diagnostics), covers credentials, preflight, checkout-vs-API separation, and cleanup. An agent has enough to call it correctly and interpret results.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is already 90%, so the baseline is 3, but the description adds real operational meaning: arm/probe/cancel/run_id dependencies, the value of receipt_recovery_v1 (R1-R4 plus R5-R8 scenarios), the need for an exact published webhook URL in receipt_config, and that configure_app returns URLs and secret_handoff_url rather than values. This exceeds what the schema alone conveys.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Opens with a specific verb+resource ('Start a validation session for the user's integration') and explicitly contrasts itself with siblings quickrun/run_workflow, explaining that those test provider-vs-twin behavior while this tests whether the app itself is wired correctly. An agent can distinguish it from every listed sibling without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit when-to-use ('when someone wants their integration verified before launch'), when-not ('do not substitute guide, quickrun, list_workflows, or reference probes'), and sequencing rules (call once with providers, then follow next_action; never execute while host-side setup is pending). The alternative tools are named and excluded.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
verify_behaviorAInspect
Prove a known fix survives a bug — the 'prove' half of reproduce→prove. The backend spawns a buggy AND a fixed reference handler and fires the bug_pattern's probes at both, returning the side-by-side diff (e.g. the buggy handler double-charges on a duplicate webhook, the fixed handler dedupes). Call this AFTER run_workflow reproduces a failure, when the matched bug_pattern has a simulation block, to show the fix actually holds — not just that the failure reproduced. Pass sandbox_id + flow_run_id from the run so the diff is saved onto that run's receipt URL. bug_pattern_id comes from guide's matched_bug_pattern. The buggy/fixed handlers are FetchSandbox reference implementations, NOT the user's code. A confirmed reference result does not verify the user's app or show that it is ready to ship. Keep the returned provider and evidence scope with any reported result.
| Name | Required | Description | Default |
|---|---|---|---|
| prompt | No | OPTIONAL. The user's own description of the symptom. For patterns that can originate in the handler OR the provider, this classifies which side to simulate. Omit to run both. | |
| sandbox_id | No | OPTIONAL. The sandbox from the run. Pass with flow_run_id to save the diff onto that run's receipt. This binds the pattern to that sandbox's provider; provide it when verifying a provider integration. | |
| flow_run_id | No | OPTIONAL. The flow_run_id returned by run_workflow. Pass with sandbox_id so the receipt URL renders the diff alongside the steps. | |
| bug_pattern_id | Yes | The bug_pattern to prove (e.g. webhook_duplicate_side_effect). Comes from guide's matched_bug_pattern.id or the spec's brain. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare it is not read-only and is open-world, so the bar is lower; the description still adds rich behavioral detail — the backend spawns both a buggy and a fixed reference handler, fires the probes at each, and returns a side-by-side diff. It also discloses that the handlers are FetchSandbox reference implementations, not the user's code, which prevents a serious misinterpretation of the result.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Dense and multi-clause, but front-loaded with the core action and every sentence carries distinct information (lifecycle position, side effects, parameter wiring, scope caveat). No filler, though it runs longer than strictly necessary.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
A multi-step orchestration tool with no output schema; the description explains what is produced (side-by-side diff with a concrete example), where it is persisted (receipt URL), and what the result does and does not prove. Nothing needed to call it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3, but the description adds real meaning beyond the schema: sandbox_id and flow_run_id must be passed together to bind the pattern to a provider and save the diff onto that run's receipt, and bug_pattern_id's provenance (guide's matched_bug_pattern) is spelled out.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Prove a known fix survives a bug') and frames itself as the 'prove' half of a reproduce→prove pair, explicitly distinguishing it from run_workflow. An agent can tell exactly what this does without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit trigger ('Call this AFTER run_workflow reproduces a failure, when the matched bug_pattern has a simulation block') plus a clear limit ('a confirmed reference result does not verify the user's app'). Both when-to-use and when-not are stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
2 tool updates
v0.7.1- Changed
validate_integration7 fields changed- added
Input schema / properties / armAdded value: +{ + "description": "Probe ID from the matrix to arm before running the app. Requires session_id.", + "type": "string" +} - added
Input schema / properties / cancelAdded value: +{ + "description": "Abort the attempt or retry failed cleanup. Requires session_id and run_id; cannot combine with arm or probe.", + "type": "boolean" +} - added
Input schema / properties / executeAdded value: +{ + "description": "Drive the configured app and evaluate the frozen receipt suite. Requires session_id/run_id; configuration acknowledgment alone is not proof.", + "type": "boolean" +} - added
Input schema / properties / probeAdded value: +{ + "description": "Probe ID from the matrix to evaluate after running the app. Requires session_id and run_id.", + "type": "string" +} - added
Input schema / properties / receipt_configAdded value: +{ + "additionalProperties": false, + "properties": { + "app_version": { + "description": "Declared application build identifier; not code attestation.", + "type": "string" + }, + "observation_seconds": { + "description": "Observation window after each checkpoint; default 2 seconds. Verdict covers only measured windows.", + "maximum": 5, + "minimum": 0.1, + "type": "number" + }, + "purchase_context": { + "description": "Application routing custom_data, e.g. test workspace ID. Never credentials.", + "type": "object" + }, + "purchase_marker": { + "additionalProperties": false, + "description": "Where the normal receipt includes its Paddle transaction ID; same-record recipient/marker matching is required.", + "properties": { + "field": { + "enum": [ + "html", + "text", + "subject", + "tags" + ], + "type": "string" + }, + "tag_name": { + "type": "string" + } + }, + "required": [ + "field" + ], + "type": "object" + }, + "recipient_a": { + "description": "Expected test recipient for purchase A, fixed before execution.", + "type": "string" + }, + "recipient_b": { + "description": "Different test recipient for the different-customer case.", + "type": "string" + }, + "source_lookup_required": { + "description": "Whether the app reads the source provider during its normal webhook handler.", + "type": "boolean" + }, + "webhook_url": { + "description": "Exact normal application webhook URL, including path.", + "type": "string" + } + }, + "required": [ + "webhook_url", + "recipient_a", + "recipient_b", + "purchase_marker", + "app_version", + "source_lookup_required" + ], + "type": "object" +} - added
Input schema / properties / run_idAdded value: +{ + "description": "Attempt ID returned by arm. Required with probe or cancel; prevents stale calls from consuming a newer attempt.", + "type": "string" +} - added
Input schema / properties / suiteAdded value: +{ + "description": "Configure the declared application receipt suite on this session.", + "enum": [ + "receipt_delivery_v1", + "receipt_recovery_v1" + ], + "type": "string" +}
- Changed
verify_behavior1 field changed- changed
Input schema / properties / sandbox_id / descriptionPrevious value: -"OPTIONAL. The sandbox from the run. Pass with flow_run_id to save the diff onto that run's receipt."New value: +"OPTIONAL. The sandbox from the run. Pass with flow_run_id to save the diff onto that run's receipt. This binds the pattern to that sandbox's provider; provide it when verifying a provider integration."
2 tool updates
v0.7.0- Removed
import_spec - Added
validate_integration
1 tool update
v0.5.9- Changed
list_workflows2 fields changed- added
Input schema / properties / spec_slugAdded value: +{ + "description": "A human name like 'resend' or 'stripe'. Use this when you do not have a spec_id — you do not need to look one up first.", + "type": "string" +} - removed
Input schema / requiredRemoved value: -[ - "spec_id" -]
2 tool updates
v0.5.7- Added
list_scenarios - Added
set_scenario
2 tool updates
v0.5.6- Changed
fix_bug1 field changed- changed
Input schema / properties / path / descriptionPrevious value: -"OPTIONAL. Absolute path to the project. Defaults to the current working directory."New value: +"OPTIONAL. Absolute path to the project, as it is. Defaults to the current working directory. Do NOT copy the project first: fix_bug returns a diff and never writes to your tree."
- Changed
prove_fix1 field changed- changed
Input schema / properties / path / descriptionPrevious value: -"OPTIONAL. Project dir. Defaults to cwd."New value: +"OPTIONAL. The project root, as it is. Defaults to cwd. Do NOT copy the project first: prove_fix builds its own before/after copies and never writes to your tree. A path outside the workspace is refused."
13 tool updates
v0.5.1- Added
coach - Added
find_bugs - Added
fix_bug - Added
guide - Changed
import_spec1 field changed- changed
Input schema / properties / name / descriptionPrevious value: -"Optional friendly name for the spec. Defaults to info.title from the spec, or the URL hostname."New value: +"Optional DISPLAY label only — NOT a lookup key. Defaults to info.title from the spec. To resolve a known API by name (\"Stripe\", \"GitHub\"), call list_specs first."
- Added
list_runs - Added
list_specs - Added
prove_fix - Added
quickrun - Added
run_all_workflows - Changed
run_workflow1 field changed- added
Input schema / properties / scenarioAdded value: +{ + "description": "OPTIONAL failure scenario to exercise (e.g. payment_declined, insufficient_funds, fraud_hold). Toggles the sandbox engine's scenario for the duration of the run, then restores. Use this for 'test with declined card' / 'simulate failure X' intents. Omit for the happy path.", + "type": "string" +}
- Added
submit_proof - Added
verify_behavior
3 tool updates
v0.1.1- First observed
import_spec - First observed
list_workflows - First observed
run_workflow
TDQS
Scored across 16 tools
Several tool clusters overlap heavily: quickrun/run_workflow/run_all_workflows all execute workflows, verify_behavior/prove_fix/submit_proof all produce proof artifacts, and validate_integration overlaps with the quickrun/run_all_workflows path. The very verbose descriptions do attempt to carve out boundaries, but the distinctions are subtle enough that an agent could easily misselect among the proof and workflow-running families.
Most tools follow a clear snake_case verb_noun pattern (list_specs, find_bugs, fix_bug, prove_fix, run_workflow, set_scenario, list_scenarios, list_runs, verify_behavior), which is consistent and readable. The deviations are a few single-word names (coach, guide, quickrun) that break the pattern slightly.
16 tools is one over the ideal 3-15 band and feels slightly heavy given the overlap among workflow-running and proof tools, but the domain (catalog browsing, bug finding, fixing, validation, proof, scenario injection) is genuinely broad, so each tool roughly earns its place.
The surface references a critical import_spec tool that does not appear in the provided set, yet run_workflow, list_workflows, and list_runs all depend on holding a sandbox_id from it — a notable gap. Core lifecycle (specs, workflows, scenarios, runs, bug find/fix/prove) is otherwise well covered, and quickrun partially works around the missing import step.
Maintenance
Related MCP Connectors
End-to-end API testing — generate and run tests from OpenAPI, curl, Postman, or real user traffic.
AI-callable tools for API mocking, testing, monitoring, security, and automation.
Webhook, email, WebSocket and tunnel testing for AI agents: capture, wait, verify, replay.
Discover, compare, and monitor 1,400+ APIs directly from your AI coding agent.
Related MCP Servers
- AlicenseAqualityDmaintenanceEnables testing and validation of APIs for AI agent compatibility, providing scores, grades, and actionable recommendations.3MIT
- AlicenseNot gradedqualityCmaintenanceEnables AI agents to inspect, test, validate, compare, and debug HTTP APIs through a structured toolkit, with features such as secret redaction, response contract validation, regression comparison, health checks, and incident investigation workflows.MIT
- AlicenseAqualityCmaintenanceEnables AI agents to call real API endpoints and verify responses against OpenAPI specs, supporting contract testing, auth presets, spec diffing, and health checks.834 npmMIT
- AlicenseAqualityBmaintenanceEnables AI agents to read realistic, coherent data—repos, pull requests, issues, commits, users—through API-compatible, read-only replicas of 21 developer platforms including GitHub, Jira, Linear, Slack, Sentry and Salesforce, all preloaded with one simulated company so integrations can be built and tested with no accounts, credentials, rate-limit worry, or cleanup.10266 npmMIT