Skip to main content
Glama
dpdanpittman

mcp-server-quint

by dpdanpittman

mcp-server-quint

MCP server for the Quint formal specification language. Wraps the Quint CLI to make formal verification accessible to any LLM-powered workflow.

Quick Start

1. Install Quint CLI

npm i -g @informalsystems/quint

2. Add to Claude Code

claude mcp add quint -- npx @dpdanpittman/mcp-server-quint

That's it. You now have 6 formal verification tools available in Claude Code.

Other MCP Clients

Any MCP-compatible client can use this server over stdio:

npx @dpdanpittman/mcp-server-quint

With Supergateway (HTTP transport)

{ name: 'quint', command: 'node', args: ['/path/to/mcp-server-quint/index.js'] }

Related MCP server: lu-mcp-server

Tools

quint_typecheck

Type-check a Quint specification. Provide either source (inline .qnt code) or file_path.

quint_run

Simulate a Quint spec with random execution. Optionally check an invariant. Returns a counterexample trace if violated.

Parameter

Description

source / file_path

Spec to simulate

init

Init action name (default: "init")

step

Step action name (default: "step")

invariant

Invariant to check

max_samples

Number of runs (default: 10000)

max_steps

Steps per run (default: 20)

seed

Random seed for reproducibility

quint_test

Run named test definitions (run statements). Optionally filter by match regex.

quint_verify

Exhaustive model checking via Apalache. Checks ALL reachable states, not just random samples. Requires Java 17+ and Apalache.

quint_parse

Parse a spec and return the intermediate representation (IR) as JSON.

quint_docs

Quick reference for Quint syntax. Topics: sets, maps, lists, actions, temporal, types, modules, testing, or all.

Example

module bank {
  var balances: str -> int
  val ADDRS = Set("alice", "bob")
  action init = balances' = ADDRS.mapBy(_ => 100)
  action transfer(sender: str, receiver: str, amt: int): bool = all {
    balances.get(sender) >= amt,
    balances' = balances.set(sender, balances.get(sender) - amt)
                        .set(receiver, balances.get(receiver) + amt)
  }
  action step = {
    nondet sender = ADDRS.oneOf()
    nondet receiver = ADDRS.oneOf()
    nondet amt = 1.to(balances.get(sender)).oneOf()
    transfer(sender, receiver, amt)
  }
  val no_negatives = ADDRS.forall(a => balances.get(a) >= 0)
}

Environment Variables

Variable

Default

Description

QUINT_CMD

quint

Path to Quint CLI binary

QUINT_TIMEOUT

120000

CLI timeout in ms

License

PolyForm Noncommercial 1.0.0

Available Tools

6 tools
quint_docsA

Quick reference for Quint syntax and built-in operators. Returns a curated cheat sheet for the requested topic. No CLI call needed.

ParametersJSON Schema
NameRequiredDescriptionDefault
topicYesTopic: "sets", "maps", "lists", "actions", "temporal", "types", "modules", "testing", or "all" for the full reference

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It describes the output ('Returns a curated cheat sheet') and operational aspect ('No CLI call needed'), but lacks details on response format, error handling, or performance characteristics like rate limits. It adds some value but not rich behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences with zero waste. The first sentence states the purpose and scope, and the second adds operational context, both earning their place. It's appropriately sized and front-loaded with key information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's low complexity (single parameter, no output schema, no annotations), the description is mostly complete. It covers purpose, output type, and operational note. However, without an output schema, it could benefit from more detail on the cheat sheet format or example output to fully guide the agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents the single 'topic' parameter with its allowed values. The description adds no additional parameter semantics beyond what the schema provides, such as examples or usage tips for specific topics. Baseline 3 is appropriate when schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose with specific verbs ('Quick reference', 'Returns a curated cheat sheet') and resource ('Quint syntax and built-in operators'). It distinguishes from sibling tools like quint_run or quint_verify by focusing on documentation retrieval rather than code execution or verification.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context for when to use this tool ('Quick reference for Quint syntax and built-in operators') and implicitly contrasts with siblings by stating 'No CLI call needed', suggesting it's a lightweight alternative. However, it doesn't explicitly name when-not-to-use scenarios or direct alternatives among the siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

quint_parseA

Parse a Quint spec and return the intermediate representation (IR) as JSON. Useful for inspecting the AST or checking for parse errors.

ParametersJSON Schema
NameRequiredDescriptionDefault
sourceNoQuint specification source code (.qnt content)
file_pathNoPath to a .qnt file on disk

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It discloses that the tool parses and returns IR as JSON, which is useful, but lacks details on error handling (e.g., how parse errors are reported), performance (e.g., rate limits), or prerequisites (e.g., valid Quint syntax). It does not contradict annotations, but more behavioral context would be helpful.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the core purpose and followed by a specific use case. Every sentence adds value without redundancy, making it efficient and easy to understand quickly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's moderate complexity (parsing with two parameters) and no output schema, the description is adequate but incomplete. It explains the purpose and use case but lacks details on output format (e.g., structure of the JSON IR) and error behavior, which would be important for an AI agent to invoke it correctly without structured output guidance.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema description coverage is 100%, so the schema already documents both parameters (source and file_path). The description does not add any meaning beyond this, such as explaining the relationship between source and file_path (e.g., if one overrides the other) or usage examples. Baseline 3 is appropriate as the schema handles parameter documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific action ('Parse a Quint spec') and the resource ('Quint spec'), distinguishing it from siblings by specifying it returns the intermediate representation (IR) as JSON for inspecting AST or checking parse errors. This differentiates it from tools like quint_run or quint_test that likely execute or test specifications rather than parse them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context on when to use this tool ('Useful for inspecting the AST or checking for parse errors'), which implies it's for analysis rather than execution. However, it does not explicitly state when not to use it or name alternatives among siblings, such as quint_typecheck for type-related analysis.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

quint_runA

Simulate a Quint specification with random execution. Runs the state machine and optionally checks an invariant. Returns pass/fail and a counterexample trace if the invariant is violated.

ParametersJSON Schema
NameRequiredDescriptionDefault
sourceNoQuint specification source code (.qnt content)
file_pathNoPath to a .qnt file on disk
initNoInit action name (default: "init")
stepNoStep action name (default: "step")
invariantNoInvariant to check during simulation
max_samplesNoNumber of simulation runs (default: 10000)
max_stepsNoMax steps per run (default: 20)
seedNoRandom seed for reproducibility

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden but only partially discloses behavior. It mentions random execution, pass/fail outcomes, and counterexample traces, but lacks critical details like execution environment requirements, potential side effects, performance characteristics, error handling, or what happens when no invariant is provided. The behavioral description is incomplete for a simulation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is perfectly concise with two sentences that each earn their place. The first sentence establishes the core simulation purpose, the second explains the invariant checking capability and return values. No wasted words, well-structured, and front-loaded with the main functionality.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simulation tool with 8 parameters, no annotations, and no output schema, the description is moderately complete. It covers the basic purpose and return values but lacks sufficient behavioral context about execution environment, error conditions, performance limits, and how it differs from sibling tools. The absence of output schema means the description should ideally explain return format more thoroughly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema fully documents all 8 parameters. The description adds minimal value beyond the schema - it mentions 'optionally checks an invariant' which corresponds to the 'invariant' parameter, but provides no additional semantic context about parameter interactions, precedence rules, or usage patterns. Baseline 3 is appropriate when schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific action ('simulate a Quint specification with random execution'), the resource ('Quint specification'), and distinguishes from siblings by focusing on simulation rather than documentation, parsing, testing, type checking, or verification. It precisely communicates the tool's function in one sentence.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for simulation and invariant checking in Quint specifications, but provides no explicit guidance on when to use this tool versus alternatives like quint_test or quint_verify. It mentions optional invariant checking but doesn't clarify scenarios where this is preferred over other testing/verification tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

quint_testA

Run named test definitions (run statements) from a Quint spec. Returns pass/fail for each test with failure details.

ParametersJSON Schema
NameRequiredDescriptionDefault
sourceNoQuint specification source code (.qnt content)
file_pathNoPath to a .qnt file on disk
matchNoRegex to filter test names (e.g. "transfer" to run only tests matching "transfer")

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It mentions the return format (pass/fail with failure details) but does not cover critical aspects such as error handling, execution environment, performance characteristics, or whether it modifies state. For a tool with no annotations, this leaves significant gaps in understanding its behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-structured sentence that efficiently conveys the tool's purpose and output. It is front-loaded with the main action and avoids unnecessary words, making it easy to understand quickly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the lack of annotations and output schema, the description provides basic purpose and output details but is incomplete for a tool that executes tests. It does not address error cases, input validation, or the format of failure details, which are important for an agent to use it correctly in various scenarios.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all three parameters (source, file_path, match) with clear descriptions. The description does not add any additional meaning or context beyond what the schema provides, such as parameter interactions or examples, meeting the baseline for high schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the specific action ('Run named test definitions'), resource ('from a Quint spec'), and outcome ('Returns pass/fail for each test with failure details'). It distinguishes this tool from siblings like quint_parse or quint_typecheck by focusing on test execution rather than parsing, type-checking, or verification.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for running tests from Quint specs, but does not explicitly state when to use this tool versus alternatives like quint_verify (which might verify properties) or quint_run (which might execute general statements). No explicit exclusions or prerequisites are provided, leaving usage context somewhat vague.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

quint_typecheckA

Type-check a Quint specification. Returns success or type errors with locations. Provide either source code or a file path.

ParametersJSON Schema
NameRequiredDescriptionDefault
sourceNoQuint specification source code (.qnt content)
file_pathNoPath to a .qnt file on disk

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses the behavioral outcome ('Returns success or type errors with locations') and input options (source code or file path), which is useful. However, it lacks details on error handling, performance, or any constraints like rate limits or authentication needs. The description doesn't contradict annotations since none exist, but it's minimal for a tool that performs analysis.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is highly concise and well-structured in two sentences: the first states the purpose and outcome, and the second provides input guidance. Every sentence earns its place with no wasted words, making it easy to scan and understand quickly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the context: no annotations, no output schema, and a simple input schema with 100% coverage, the description is adequate but has gaps. It covers the basic purpose and input options but lacks details on output format (beyond 'success or type errors'), error cases, or integration with sibling tools. For a type-checking tool, more behavioral context would be helpful, but it meets the minimum viable threshold.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema description coverage is 100%, with clear descriptions for both parameters (source and file_path). The description adds value by explaining the semantics: 'Provide either source code or a file path,' which clarifies that these are mutually exclusive options for providing the Quint specification. This goes beyond the schema's individual parameter descriptions, but it's a modest addition given the high schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Type-check a Quint specification' with the outcome 'Returns success or type errors with locations.' It specifies the resource (Quint specification) and verb (type-check). However, it doesn't explicitly differentiate from sibling tools like quint_parse or quint_verify, which might also involve analysis of Quint specifications.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage by stating 'Provide either source code or a file path,' which gives basic context for when to use it (when you have a Quint spec to check). However, it doesn't provide explicit guidance on when to choose this tool over alternatives like quint_verify (which might verify properties) or quint_parse (which might parse without type-checking), nor does it mention any prerequisites or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

quint_verifyA

Exhaustive model checking of a Quint spec via Apalache (requires Java 17+). Slower than simulation but checks ALL reachable states. Returns pass or a counterexample trace. Falls back gracefully if Apalache is not installed.

ParametersJSON Schema
NameRequiredDescriptionDefault
sourceNoQuint specification source code (.qnt content)
file_pathNoPath to a .qnt file on disk
initNoInit action name (default: "init")
stepNoStep action name (default: "step")
invariantYesInvariant to verify (required)
max_stepsNoMax steps for bounded model checking (default: 10)

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries full burden and does well. It discloses key behavioral traits: the tool 'requires Java 17+', is 'slower than simulation', 'returns pass or a counterexample trace', and 'falls back gracefully if Apalache is not installed'. This covers installation requirements, performance characteristics, output format, and error handling - valuable context beyond basic functionality.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is perfectly structured and concise - four sentences that each earn their place. It front-loads the core purpose, then explains key characteristics (speed vs. completeness), describes the output, and mentions installation requirements. Zero wasted words or redundant information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex verification tool with 6 parameters and no output schema, the description provides good contextual completeness. It explains what the tool does, when to use it, performance characteristics, and installation requirements. The main gap is lack of information about return format details since there's no output schema, but the description at least mentions it returns 'pass or a counterexample trace'.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all 6 parameters thoroughly. The description doesn't add any parameter-specific information beyond what's in the schema. It mentions the tool verifies invariants generally but doesn't provide additional context about parameter usage or relationships. Baseline 3 is appropriate when schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Exhaustive model checking of a Quint spec via Apalache' - specifying both the action (model checking) and resource (Quint spec). It distinguishes from siblings by mentioning it's 'slower than simulation but checks ALL reachable states', contrasting with quint_run (simulation) and other analysis tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context about when to use this tool: for exhaustive verification when you need to check ALL reachable states rather than just simulate. It mentions it's 'slower than simulation', implying quint_run is the alternative for faster but less thorough checking. However, it doesn't explicitly state when NOT to use it or compare with other siblings like quint_test.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

TDQS

A4.1/5.0
Disambiguation5/5

Each tool has a clearly distinct purpose with no overlap: quint_docs provides syntax reference, quint_parse handles AST inspection, quint_run performs random simulation, quint_test executes named tests, quint_typecheck validates types, and quint_verify does exhaustive model checking. The descriptions clearly differentiate their specific functions within the Quint specification workflow.

Naming Consistency5/5

All tools follow a perfect 'quint_verb' pattern consistently throughout, using lowercase with underscores. The verbs (docs, parse, run, test, typecheck, verify) are all action-oriented and descriptive, creating a highly predictable and readable naming convention.

Tool Count5/5

Six tools is ideal for a Quint specification server, covering the complete lifecycle from documentation reference to parsing, testing, simulation, type checking, and verification. Each tool earns its place without redundancy, providing a well-scoped surface for working with Quint specifications.

Completeness5/5

The toolset provides comprehensive coverage for Quint specification workflows: documentation lookup, parsing, simulation, testing, type checking, and exhaustive verification. There are no obvious gaps—agents can perform the full CRUD-like lifecycle from inspection to validation and verification, with clear fallback behavior where appropriate.

Maintenance

ActivityInactive
ResponsivenessNo issues

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • A
    license
    B
    quality
    D
    maintenance
    Enables LLM-powered agents to generate, execute, and analyze Alloy modeling language code for software modeling and formal verification. Provides tools to run Alloy models, access documentation and examples, and generate models from system descriptions.
    1
    MIT
  • A
    license
    A
    quality
    D
    maintenance
    Exposes the TLA+ toolchain (TLC, SANY, PlusCal, TLATeX) as structured JSON tools via the Model Context Protocol, enabling AI assistants to parse, check, simulate, and typeset TLA+ specifications.
    9
    20
    1
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    MCP server that gives LLMs access to formal verification via Z3 and SWI-Prolog, plus tree-sitter-based source code analysis. Translates natural language problems into formal logic using a template-based pipeline, verifies results with mathematical certainty, and analyzes call graphs for reachability, dead code, and impact analysis.
    79
    210
    Apache 2.0

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/dpdanpittman/mcp-server-quint'

If you have feedback or need assistance with the MCP directory API, please join our Discord server