mcp-server-quint
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@mcp-server-quintrun a simulation of bank.qnt to check the no_negatives invariant"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
mcp-server-quint
MCP server for the Quint formal specification language. Wraps the Quint CLI to make formal verification accessible to any LLM-powered workflow.
Quick Start
1. Install Quint CLI
npm i -g @informalsystems/quint2. Add to Claude Code
claude mcp add quint -- npx @dpdanpittman/mcp-server-quintThat's it. You now have 6 formal verification tools available in Claude Code.
Other MCP Clients
Any MCP-compatible client can use this server over stdio:
npx @dpdanpittman/mcp-server-quintWith Supergateway (HTTP transport)
{ name: 'quint', command: 'node', args: ['/path/to/mcp-server-quint/index.js'] }Related MCP server: lu-mcp-server
Tools
quint_typecheck
Type-check a Quint specification. Provide either source (inline .qnt code) or file_path.
quint_run
Simulate a Quint spec with random execution. Optionally check an invariant. Returns a counterexample trace if violated.
Parameter | Description |
| Spec to simulate |
| Init action name (default: "init") |
| Step action name (default: "step") |
| Invariant to check |
| Number of runs (default: 10000) |
| Steps per run (default: 20) |
| Random seed for reproducibility |
quint_test
Run named test definitions (run statements). Optionally filter by match regex.
quint_verify
Exhaustive model checking via Apalache. Checks ALL reachable states, not just random samples. Requires Java 17+ and Apalache.
quint_parse
Parse a spec and return the intermediate representation (IR) as JSON.
quint_docs
Quick reference for Quint syntax. Topics: sets, maps, lists, actions, temporal, types, modules, testing, or all.
Example
module bank {
var balances: str -> int
val ADDRS = Set("alice", "bob")
action init = balances' = ADDRS.mapBy(_ => 100)
action transfer(sender: str, receiver: str, amt: int): bool = all {
balances.get(sender) >= amt,
balances' = balances.set(sender, balances.get(sender) - amt)
.set(receiver, balances.get(receiver) + amt)
}
action step = {
nondet sender = ADDRS.oneOf()
nondet receiver = ADDRS.oneOf()
nondet amt = 1.to(balances.get(sender)).oneOf()
transfer(sender, receiver, amt)
}
val no_negatives = ADDRS.forall(a => balances.get(a) >= 0)
}Environment Variables
Variable | Default | Description |
|
| Path to Quint CLI binary |
|
| CLI timeout in ms |
License
Available Tools
6 toolsquint_docsA
Quick reference for Quint syntax and built-in operators. Returns a curated cheat sheet for the requested topic. No CLI call needed.
| Name | Required | Description | Default |
|---|---|---|---|
| topic | Yes | Topic: "sets", "maps", "lists", "actions", "temporal", "types", "modules", "testing", or "all" for the full reference |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It describes the output ('Returns a curated cheat sheet') and operational aspect ('No CLI call needed'), but lacks details on response format, error handling, or performance characteristics like rate limits. It adds some value but not rich behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences with zero waste. The first sentence states the purpose and scope, and the second adds operational context, both earning their place. It's appropriately sized and front-loaded with key information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's low complexity (single parameter, no output schema, no annotations), the description is mostly complete. It covers purpose, output type, and operational note. However, without an output schema, it could benefit from more detail on the cheat sheet format or example output to fully guide the agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents the single 'topic' parameter with its allowed values. The description adds no additional parameter semantics beyond what the schema provides, such as examples or usage tips for specific topics. Baseline 3 is appropriate when schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with specific verbs ('Quick reference', 'Returns a curated cheat sheet') and resource ('Quint syntax and built-in operators'). It distinguishes from sibling tools like quint_run or quint_verify by focusing on documentation retrieval rather than code execution or verification.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when to use this tool ('Quick reference for Quint syntax and built-in operators') and implicitly contrasts with siblings by stating 'No CLI call needed', suggesting it's a lightweight alternative. However, it doesn't explicitly name when-not-to-use scenarios or direct alternatives among the siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
quint_parseA
Parse a Quint spec and return the intermediate representation (IR) as JSON. Useful for inspecting the AST or checking for parse errors.
| Name | Required | Description | Default |
|---|---|---|---|
| source | No | Quint specification source code (.qnt content) | |
| file_path | No | Path to a .qnt file on disk |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It discloses that the tool parses and returns IR as JSON, which is useful, but lacks details on error handling (e.g., how parse errors are reported), performance (e.g., rate limits), or prerequisites (e.g., valid Quint syntax). It does not contradict annotations, but more behavioral context would be helpful.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the core purpose and followed by a specific use case. Every sentence adds value without redundancy, making it efficient and easy to understand quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (parsing with two parameters) and no output schema, the description is adequate but incomplete. It explains the purpose and use case but lacks details on output format (e.g., structure of the JSON IR) and error behavior, which would be important for an AI agent to invoke it correctly without structured output guidance.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 100%, so the schema already documents both parameters (source and file_path). The description does not add any meaning beyond this, such as explaining the relationship between source and file_path (e.g., if one overrides the other) or usage examples. Baseline 3 is appropriate as the schema handles parameter documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action ('Parse a Quint spec') and the resource ('Quint spec'), distinguishing it from siblings by specifying it returns the intermediate representation (IR) as JSON for inspecting AST or checking parse errors. This differentiates it from tools like quint_run or quint_test that likely execute or test specifications rather than parse them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context on when to use this tool ('Useful for inspecting the AST or checking for parse errors'), which implies it's for analysis rather than execution. However, it does not explicitly state when not to use it or name alternatives among siblings, such as quint_typecheck for type-related analysis.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
quint_runA
Simulate a Quint specification with random execution. Runs the state machine and optionally checks an invariant. Returns pass/fail and a counterexample trace if the invariant is violated.
| Name | Required | Description | Default |
|---|---|---|---|
| source | No | Quint specification source code (.qnt content) | |
| file_path | No | Path to a .qnt file on disk | |
| init | No | Init action name (default: "init") | |
| step | No | Step action name (default: "step") | |
| invariant | No | Invariant to check during simulation | |
| max_samples | No | Number of simulation runs (default: 10000) | |
| max_steps | No | Max steps per run (default: 20) | |
| seed | No | Random seed for reproducibility |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden but only partially discloses behavior. It mentions random execution, pass/fail outcomes, and counterexample traces, but lacks critical details like execution environment requirements, potential side effects, performance characteristics, error handling, or what happens when no invariant is provided. The behavioral description is incomplete for a simulation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is perfectly concise with two sentences that each earn their place. The first sentence establishes the core simulation purpose, the second explains the invariant checking capability and return values. No wasted words, well-structured, and front-loaded with the main functionality.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simulation tool with 8 parameters, no annotations, and no output schema, the description is moderately complete. It covers the basic purpose and return values but lacks sufficient behavioral context about execution environment, error conditions, performance limits, and how it differs from sibling tools. The absence of output schema means the description should ideally explain return format more thoroughly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema fully documents all 8 parameters. The description adds minimal value beyond the schema - it mentions 'optionally checks an invariant' which corresponds to the 'invariant' parameter, but provides no additional semantic context about parameter interactions, precedence rules, or usage patterns. Baseline 3 is appropriate when schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action ('simulate a Quint specification with random execution'), the resource ('Quint specification'), and distinguishes from siblings by focusing on simulation rather than documentation, parsing, testing, type checking, or verification. It precisely communicates the tool's function in one sentence.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for simulation and invariant checking in Quint specifications, but provides no explicit guidance on when to use this tool versus alternatives like quint_test or quint_verify. It mentions optional invariant checking but doesn't clarify scenarios where this is preferred over other testing/verification tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
quint_testA
Run named test definitions (run statements) from a Quint spec. Returns pass/fail for each test with failure details.
| Name | Required | Description | Default |
|---|---|---|---|
| source | No | Quint specification source code (.qnt content) | |
| file_path | No | Path to a .qnt file on disk | |
| match | No | Regex to filter test names (e.g. "transfer" to run only tests matching "transfer") |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It mentions the return format (pass/fail with failure details) but does not cover critical aspects such as error handling, execution environment, performance characteristics, or whether it modifies state. For a tool with no annotations, this leaves significant gaps in understanding its behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that efficiently conveys the tool's purpose and output. It is front-loaded with the main action and avoids unnecessary words, making it easy to understand quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the lack of annotations and output schema, the description provides basic purpose and output details but is incomplete for a tool that executes tests. It does not address error cases, input validation, or the format of failure details, which are important for an agent to use it correctly in various scenarios.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all three parameters (source, file_path, match) with clear descriptions. The description does not add any additional meaning or context beyond what the schema provides, such as parameter interactions or examples, meeting the baseline for high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action ('Run named test definitions'), resource ('from a Quint spec'), and outcome ('Returns pass/fail for each test with failure details'). It distinguishes this tool from siblings like quint_parse or quint_typecheck by focusing on test execution rather than parsing, type-checking, or verification.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for running tests from Quint specs, but does not explicitly state when to use this tool versus alternatives like quint_verify (which might verify properties) or quint_run (which might execute general statements). No explicit exclusions or prerequisites are provided, leaving usage context somewhat vague.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
quint_typecheckA
Type-check a Quint specification. Returns success or type errors with locations. Provide either source code or a file path.
| Name | Required | Description | Default |
|---|---|---|---|
| source | No | Quint specification source code (.qnt content) | |
| file_path | No | Path to a .qnt file on disk |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses the behavioral outcome ('Returns success or type errors with locations') and input options (source code or file path), which is useful. However, it lacks details on error handling, performance, or any constraints like rate limits or authentication needs. The description doesn't contradict annotations since none exist, but it's minimal for a tool that performs analysis.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is highly concise and well-structured in two sentences: the first states the purpose and outcome, and the second provides input guidance. Every sentence earns its place with no wasted words, making it easy to scan and understand quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the context: no annotations, no output schema, and a simple input schema with 100% coverage, the description is adequate but has gaps. It covers the basic purpose and input options but lacks details on output format (beyond 'success or type errors'), error cases, or integration with sibling tools. For a type-checking tool, more behavioral context would be helpful, but it meets the minimum viable threshold.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 100%, with clear descriptions for both parameters (source and file_path). The description adds value by explaining the semantics: 'Provide either source code or a file path,' which clarifies that these are mutually exclusive options for providing the Quint specification. This goes beyond the schema's individual parameter descriptions, but it's a modest addition given the high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Type-check a Quint specification' with the outcome 'Returns success or type errors with locations.' It specifies the resource (Quint specification) and verb (type-check). However, it doesn't explicitly differentiate from sibling tools like quint_parse or quint_verify, which might also involve analysis of Quint specifications.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage by stating 'Provide either source code or a file path,' which gives basic context for when to use it (when you have a Quint spec to check). However, it doesn't provide explicit guidance on when to choose this tool over alternatives like quint_verify (which might verify properties) or quint_parse (which might parse without type-checking), nor does it mention any prerequisites or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
quint_verifyA
Exhaustive model checking of a Quint spec via Apalache (requires Java 17+). Slower than simulation but checks ALL reachable states. Returns pass or a counterexample trace. Falls back gracefully if Apalache is not installed.
| Name | Required | Description | Default |
|---|---|---|---|
| source | No | Quint specification source code (.qnt content) | |
| file_path | No | Path to a .qnt file on disk | |
| init | No | Init action name (default: "init") | |
| step | No | Step action name (default: "step") | |
| invariant | Yes | Invariant to verify (required) | |
| max_steps | No | Max steps for bounded model checking (default: 10) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden and does well. It discloses key behavioral traits: the tool 'requires Java 17+', is 'slower than simulation', 'returns pass or a counterexample trace', and 'falls back gracefully if Apalache is not installed'. This covers installation requirements, performance characteristics, output format, and error handling - valuable context beyond basic functionality.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is perfectly structured and concise - four sentences that each earn their place. It front-loads the core purpose, then explains key characteristics (speed vs. completeness), describes the output, and mentions installation requirements. Zero wasted words or redundant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex verification tool with 6 parameters and no output schema, the description provides good contextual completeness. It explains what the tool does, when to use it, performance characteristics, and installation requirements. The main gap is lack of information about return format details since there's no output schema, but the description at least mentions it returns 'pass or a counterexample trace'.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all 6 parameters thoroughly. The description doesn't add any parameter-specific information beyond what's in the schema. It mentions the tool verifies invariants generally but doesn't provide additional context about parameter usage or relationships. Baseline 3 is appropriate when schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Exhaustive model checking of a Quint spec via Apalache' - specifying both the action (model checking) and resource (Quint spec). It distinguishes from siblings by mentioning it's 'slower than simulation but checks ALL reachable states', contrasting with quint_run (simulation) and other analysis tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context about when to use this tool: for exhaustive verification when you need to check ALL reachable states rather than just simulate. It mentions it's 'slower than simulation', implying quint_run is the alternative for faster but less thorough checking. However, it doesn't explicitly state when NOT to use it or compare with other siblings like quint_test.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
TDQS
Each tool has a clearly distinct purpose with no overlap: quint_docs provides syntax reference, quint_parse handles AST inspection, quint_run performs random simulation, quint_test executes named tests, quint_typecheck validates types, and quint_verify does exhaustive model checking. The descriptions clearly differentiate their specific functions within the Quint specification workflow.
All tools follow a perfect 'quint_verb' pattern consistently throughout, using lowercase with underscores. The verbs (docs, parse, run, test, typecheck, verify) are all action-oriented and descriptive, creating a highly predictable and readable naming convention.
Six tools is ideal for a Quint specification server, covering the complete lifecycle from documentation reference to parsing, testing, simulation, type checking, and verification. Each tool earns its place without redundancy, providing a well-scoped surface for working with Quint specifications.
The toolset provides comprehensive coverage for Quint specification workflows: documentation lookup, parsing, simulation, testing, type checking, and exhaustive verification. There are no obvious gaps—agents can perform the full CRUD-like lifecycle from inspection to validation and verification, with clear fallback behavior where appropriate.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Architecture compiler for AI code. 11 tools, 92 actions, 872 Lean4 proofs, 100/100 self-cert.
Deterministic reasoning stack for AI agents: simulate, decide & compute, plus cross-domain tools.
33 tools that make AI write, implement, and verify intent against explicit, testable constraints.
Deterministic validation for AI-generated artifacts: JSON Schema, OpenAPI response, SQL syntax.
Related MCP Servers
- AlicenseBqualityDmaintenanceEnables LLM-powered agents to generate, execute, and analyze Alloy modeling language code for software modeling and formal verification. Provides tools to run Alloy models, access documentation and examples, and generate models from system descriptions.1MIT
- AlicenseAqualityAmaintenanceVerify AI agent communication with session types and formal proofs. 4 tools: parse protocols, verify messages, check safety properties, browse 20 stdlib templates.410Apache 2.0
- AlicenseAqualityDmaintenanceExposes the TLA+ toolchain (TLC, SANY, PlusCal, TLATeX) as structured JSON tools via the Model Context Protocol, enabling AI assistants to parse, check, simulate, and typeset TLA+ specifications.9201MIT
- AlicenseNot gradedqualityBmaintenanceMCP server that gives LLMs access to formal verification via Z3 and SWI-Prolog, plus tree-sitter-based source code analysis. Translates natural language problems into formal logic using a template-based pipeline, verifies results with mathematical certainty, and analyzes call graphs for reachability, dead code, and impact analysis.79210Apache 2.0
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/dpdanpittman/mcp-server-quint'
If you have feedback or need assistance with the MCP directory API, please join our Discord server