Secure Local Workspace MCP
Secure Local Workspace MCP(안전한 로컬 워크스페이스 MCP)
English | 中文(默认)
ChatGPT 웹 버전이 로컬 프로젝트에 안전하게 연결할 수 있게 합니다: Git 사용 여부와 관계없이 파일을 보고, 검색하고, 수정하고, 화이트리스트 작업을 실행할 수 있습니다. Git 프로젝트는 diff 확인, 로컬 커밋 생성, 그리고 사용자의 명시적 승인 후 지정된 원격 저장소와 브랜치로 푸시도 가능합니다.
Codex를 설치할 필요가 없습니다. ChatGPT는 OpenAI Secure MCP Tunnel을 통해 사용자 컴퓨터에서 계속 실행 중인 MCP 서비스를 호출합니다. 프로젝트 디렉터리와 MCP 포트를 공개 네트워크에 노출할 필요가 없습니다.
먼저 사용 시나리오를 선택하세요
사용자 상황 | 시작 위치 |
ChatGPT에 처음 연결하고 Tunnel이 아직 없음 | 최초 설치: 처음부터 ChatGPT 연결 절차를 따르세요 |
Tunnel이 이미 ChatGPT에서 사용 가능하고, 프로젝트만 추가하려는 경우 | |
이미 프로젝트를 연결했고, ChatGPT가 수정하거나 커밋하게 하려는 경우 | 일상 사용 프롬프트를 바로 복사하세요 |
ChatGPT가 push하도록 허용하려는 경우 | 먼저 제한된 push 별도 활성화를 완료하세요 |
설치 또는 연결 오류 발생 | 자주 묻는 질문을 확인하세요 |
Related MCP server: Local Supervisor Bridge
제공되는 기능
워크플로 | MCP 도구 | 핵심 보호 |
프로젝트 발견 |
| Git 저장소와 일반적인 비-Git 프로젝트를 식별하며, 사전 승인된 상위 디렉터리만 스캔 |
연결 또는 해제 |
| 승인 범위를 벗어날 수 없음. 해제해도 프로젝트 파일은 삭제되지 않음 |
보기 및 검색 |
| 디렉터리, 깊이, 개수, 파일 크기 제한 |
파일 수정 |
| 기존 파일 수정 또는 삭제 시 최신 SHA-256과 일치해야 함 |
검증 실행 |
| 설정된 고정 작업만 실행 가능 |
Git 검토 |
| 고정된 읽기 전용 Git 명령만 실행하며 상태/diff 해시 반환 |
로컬 커밋 |
| 명시적 파일, 동시성 방지 상태, 민감 정보 스캔, 기존 staged 내용 혼합 방지 |
원격 푸시 |
| 기본 비활성화. 지정된 remote/branch만 허용. force push 금지 |
프로젝트는 임의 Shell, git add ., 강제 푸시, 히스토리 재작성, 프로덕션 배포 또는 임의 디스크 접근을 제공하지 않습니다.
최초 설치: 처음부터 ChatGPT 연결
아래 절차는 Windows PowerShell 기준입니다. 일반적으로 한 번만 완료하면 됩니다.
1단계: 사전 요구 사항 확인
필요한 것:
Windows PowerShell;
Git;
Node.js 20 이상;
ChatGPT 개발자 모드 사용 가능;
OpenAI Platform에서 Tunnel에 필요한 권한.
로컬 명령 확인:
git --version
node --version
npm --versionChatGPT가 Git commit을 생성하도록 할 예정이라면 먼저 Git 신원(identity)을 설정해야 합니다. 이미 설정했다면 건너뛸 수 있습니다:
git config --global user.name "Your Name"
git config --global user.email "you@example.com"2단계: 프로젝트 다운로드
git clone https://github.com/dxawdc/secure-local-workspace-mcp.git
Set-Location .\secure-local-workspace-mcp3단계: OpenAI 페이지에서 Tunnel 준비
OpenAI Secure MCP Tunnel 공식 문서에 따라 다음 작업을 완료하세요:
OpenAI Platform에서 Tunnel 생성;
Tunnel을 사용할 ChatGPT workspace에 연결;
tunnel-client용 Runtime API Key 생성;공식 최신 버전
tunnel-client다운로드;tunnel_id와tunnel-client.exe의 로컬 경로 기록.
이 단계들은 계정 권한과 키가 관련되므로 반드시 사용자가 OpenAI 페이지에서 확인해야 하며, 프로젝트가 사용자를 대신해 계정 자격 증명을 생성하거나 읽지 않습니다.
4단계: Runtime Key를 저장소 외부에 저장
Key를 README, 프로젝트 설정, Git 또는 PowerShell 명령 히스토리에 작성하지 마세요. 먼저 저장소 외부 파일을 생성할 수 있습니다:
New-Item -ItemType Directory -Path "C:\Secrets" -Force
notepad "C:\Secrets\openai-tunnel-runtime-key.txt"메모장에 Runtime Key를 붙여넣고 한 줄만 유지한 후 저장하고 닫습니다. 프로덕션 또는 팀 환경에서는 조직이 승인한 키 관리 방식을 사용하고 해당 파일의 접근 권한을 제한해야 합니다.
5단계: 원클릭 설정 실행
예시의 세 경로와 Tunnel ID를 자신의 값으로 바꾸세요:
.\scripts\quick-setup.ps1 `
-ProjectRoot "D:\Projects\my-app" `
-DiscoveryRoot "D:\Projects" `
-TunnelId "tunnel_REPLACEME" `
-TunnelClient "C:\Tools\tunnel-client\tunnel-client.exe" `
-ControlPlaneApiKeyRef "file:C:\Secrets\openai-tunnel-runtime-key.txt" `
-RegisterStartup `
-StartTunnel매개변수 입력 방법:
ProjectRoot: 이번에 ChatGPT가 작업할 프로젝트 디렉터리. Git 저장소가 아니어도 됨;DiscoveryRoot: ChatGPT가 프로젝트를 발견하도록 허용할 상위 디렉터리. 일반적으로ProjectRoot의 상위 수준;TunnelId: OpenAI Platform에 표시된 실제tunnel_id;TunnelClient: 다운로드 후 압축 해제한tunnel-client.exe;ControlPlaneApiKeyRef: Runtime Key 파일 경로. 반드시file:접두사를 붙여야 함.
스크립트가 자동으로 완료하는 작업:
잠금 파일을 사용해 Node.js 의존성 설치;
단위 테스트 및 MCP 스모크 테스트 실행;
프로젝트를 읽기/쓰기 가능으로 설정하고 로컬 commit 허용;
프로젝트 발견 디렉터리 승인;
package.json의test,lint,build,typecheck자동 식별;Tunnel profile 생성 및 확인;
현재 사용자 로그인 자동 시작 작업 등록 및 Tunnel 즉시 시작.
기본적으로 push는 허용되지 않습니다. 비-Git 프로젝트는 파일 읽기/쓰기 기능을 자동으로 유지하면서 commit과 push를 강제로 비활성화하므로 -DisableCommit을 수동으로 추가할 필요가 없습니다.
로컬에서 OpenAI에 접근할 때 프록시를 거쳐야 한다면 명령 끝에 다음을 추가하세요:
-HttpProxy "http://127.0.0.1:7890"6단계: ChatGPT에서 프라이빗 앱 생성
ChatGPT 설정에서 개발자 모드를 활성화합니다. Enterprise/Edu 사용자는 관리자 승인이 필요할 수 있습니다;
ChatGPT Plugins을 엽니다;
더하기(+)를 클릭해 개발자 모드 앱을 생성합니다;
Connection에서 Tunnel을 선택합니다;
방금 생성한 Tunnel을 선택하거나 실제
tunnel_id를 붙여넣습니다;앱을 생성하고 ChatGPT가 도구를 발견할 때까지 기다립니다.
공식 설명에 따르면 tunnel-client가 계속 실행 중이어야 합니다. 그렇지 않으면 ChatGPT가 도구를 발견하거나 호출할 수 없습니다.
7단계: 연결 확인
ChatGPT 새 대화에서 이 앱을 선택하거나 @로 호출한 후 다음을 보내세요:
调用 diagnostics 和 list_projects。
告诉我 Tunnel 后面的本地 MCP 是否正常,并列出已授权项目、读写权限、commit 权限和 push 权限。
不要修改任何文件。정상적으로 프로젝트 목록이 표시되어야 하며 기본 allowPush는 false여야 합니다. 새 버전은 총 17개의 도구를 제공합니다. 여전히 이전 도구가 표시되면 Tunnel을 재시작한 후 ChatGPT에서 앱을 새로고침하거나 새 대화를 만드세요.
기존 Tunnel: 새 프로젝트 연결
Tunnel과 로그인 자동 시작 작업이 모두 이 프로젝트를 통해 구성된 경우, 저장소 디렉터리에서 다음을 실행하세요:
.\scripts\quick-setup.ps1 `
-ProjectRoot "D:\Projects\another-app" `
-DiscoveryRoot "D:\Projects" `
-SkipInstall `
-SkipTests `
-RestartTunnel이 명령은 프로젝트 구성을 추가하거나 업데이트하며 다른 승인된 프로젝트를 덮어쓰지 않습니다.
이 프로젝트로 로그인 작업을 등록하지 않았다면 -RestartTunnel을 제거하고, 구성 완료 후 원래 방식으로 tunnel-client를 재시작하세요. 재시작 후 ChatGPT 앱 설정에서 도구를 새로고침하세요.
ChatGPT가 비-Git 프로젝트를 자동으로 연결하게 하기
일반적인 Node.js, Python, Java, Go, Rust, .NET, PHP, Ruby, Elixir, Swift, CMake 등의 프로젝트 디렉터리는 discover_projects가 자동으로 식별합니다. 디렉터리에 일반적인 프로젝트 식별 표시가 없어도 승인된 DiscoveryRoot 내에서 명시적 절대 경로를 통해 연결할 수 있습니다:
调用 discover_projects,列出已批准目录中的 Git 和非 Git 项目。
把 D:\Projects\notes-app 接入为可读写项目。
如果它不是 Git 仓库,必须自动关闭 commit 和 push。
接入后调用 list_projects,确认 projectType 和最终权限。ChatGPT가 connect_project를 호출하면 구성이 즉시 영구 저장되고 현재 MCP 프로세스에 적용되므로 개별 프로젝트마다 Tunnel을 다시 재시작할 필요가 없습니다.
보기만 허용, 수정 불가
.\scripts\quick-setup.ps1 `
-ProjectRoot "D:\Projects\reference-project" `
-DiscoveryRoot "D:\Projects" `
-ReadOnly `
-SkipInstall `
-SkipTests `
-RestartTunnel수정 허용, commit 불가
.\scripts\quick-setup.ps1 `
-ProjectRoot "D:\Projects\my-app" `
-DiscoveryRoot "D:\Projects" `
-DisableCommit `
-SkipInstall `
-SkipTests `
-RestartTunnel발견 가능한 프로젝트 상위 디렉터리만 추가
.\scripts\quick-setup.ps1 `
-DiscoveryRoot "E:\OtherProjects" `
-SkipInstall `
-SkipTests `
-RestartTunnelDiscoveryRoot를 디스크 루트, 전체 사용자 디렉터리 또는 개인 파일이 많은 디렉터리로 설정하지 마세요. 코드 저장소를 전용으로 보관하는 상위 디렉터리여야 합니다.
일상 사용 프롬프트
프로젝트 이름은 list_projects가 반환한 ID를 기준으로 합니다. 아래 프롬프트를 ChatGPT에 직접 복사한 후 프로젝트 이름과 요구 사항을 바꾸면 됩니다.
1. 보기 및 분석만
使用 Secure Local Workspace MCP 检查项目 my-app。
先调用 list_projects 确认项目,再查看与登录流程有关的代码。
解释实现和可能的问题,不要修改文件,不要提交。2. 수정 및 테스트, 커밋은 하지 않음
检查项目 my-app 的重复提交问题并完成修复。
修改前重新读取目标文件并使用最新 SHA-256,只改与本次问题有关的文件。
运行项目允许的 test 或 lint 任务,最后展示 git_status 和 git_diff。
不要 commit,不要 push。3. 수정, 테스트 및 로컬 커밋 생성
修复项目 my-app 的重复提交问题。
运行相关测试,然后展示完整 git_diff 和 git_status。
确认差异只包含本次修改后,使用最新 statusSha256,
只提交本次涉及的明确文件,提交信息为:fix: prevent duplicate submissions。
提交后报告本地 commit SHA。不要 push。4. 이미 완료된 수정 사항만 커밋
检查项目 my-app 当前 git_status 和 git_diff,不要继续改代码。
如果存在与本任务无关或已经预暂存的文件,停止并告诉我。
否则使用最新 statusSha256,只提交这些明确文件:src/example.js、test/example.test.js。
提交信息为:fix: handle duplicate submissions。不要 push。git_commit은 다음을 거부합니다:
., 디렉터리 또는 프로젝트 외부 경로;검토 후 변경된 Git 상태;
기존 staged changes;
.env, 개인 키, 인증서, 비밀번호 저장소 등 민감 경로;신뢰도 높은 API Key, Token, 개인 키 또는 실제 Tunnel/조직 식별자;
git diff --cached --check실패;로컬 구성에서 commit이 활성화되지 않음.
커밋 성공은 로컬에 커밋되었음을 의미할 뿐 push되었음을 의미하지 않습니다.
제한된 push 별도 활성화
Push는 외부 쓰기 작업이므로 반드시 로컬에서 프로젝트별로 명시적으로 활성화해야 합니다. 대상 브랜치도 함께 제한하는 것을 권장합니다:
.\scripts\quick-setup.ps1 `
-ProjectRoot "D:\Projects\my-app" `
-AllowPush `
-AllowedRemote "origin" `
-AllowedBranch "main" `
-SkipInstall `
-SkipTests `
-RestartTunnel그런 다음 ChatGPT에서 명확히 요청하세요:
检查项目 my-app 当前分支、HEAD、git_status 和待推送 commit。
只有在工作区状态和 commit 都符合预期时,才把当前 HEAD 推送到允许的 origin/main。
禁止 force push。分别报告本地 commit SHA、远端分支和推送结果。git_push는 commit을 자동으로 생성하지 않으며, 구성되지 않은 remote 또는 branch로 푸시하지 않습니다.
자동화와 수동 작업 경계
작업 | 자동화 여부 | 이유 또는 설명 |
의존성 설치, 테스트 실행 | 자동 |
|
발견 디렉터리 및 프로젝트 추가 | 자동 | 멱등 업데이트, 다른 프로젝트 덮어쓰지 않음 |
일반적인 npm 작업 식별 | 자동 | 고정 작업 화이트리스트에만 추가 |
Tunnel profile 생성, 확인 | 자동 | 사용자가 Tunnel ID, Client 경로, 키 참조를 제공해야 함 |
로그인 자동 시작 등록 | 선택적 자동 |
|
OpenAI Tunnel 생성 | 사용자 확인 | OpenAI 조직 및 workspace 권한 관련 |
Runtime API Key 생성 | 사용자 확인 | 키는 사용자 또는 조직 관리자만 관리해야 함 |
ChatGPT에서 앱 생성 | 사용자 확인 | ChatGPT가 권한 및 연결 확인 화면 표시 |
Git commit | ChatGPT가 명시적 지시에 따라 실행 | 기본적으로 상태 검토와 명시적 파일 필요 |
Git push | 로컬 승인 후 ChatGPT가 실행 | 기본 비활성화, remote/branch 제한 |
더 자세한 일괄 구성, 프록시, 자동 시작, 롤백 및 무인 참조는 Windows 자동화 구성 절차를 참조하세요.
구성 관리
기본 구성 파일은 저장소 외부에 있습니다:
%USERPROFILE%\.secure-local-workspace-mcp\config.json새 버전 구성이 없으면 서비스가 이전 경로를 호환하여 읽습니다:
%USERPROFILE%\.local-project-workspace\config.json현재 구성 확인:
npm run config -- listPowerShell 자동화를 사용하지 않는 경우에도 크로스 플랫폼 구성 CLI를 호출할 수 있습니다:
npm run config -- add-discovery-root --root "D:\Projects"
npm run config -- add-project `
--root "D:\Projects\my-app" `
--writable `
--allow-commit `
--no-push호환 스크립트 bootstrap-config.ps1도 개별 프로젝트를 멱등적으로 추가하거나 업데이트하며 전체 구성을 대체하지 않습니다.
프로젝트 업데이트
Set-Location .\secure-local-workspace-mcp
git pull --ff-only
npm ci
npm test
npm run smoke:mcp코드 또는 도구 정의가 업데이트된 후에는 반드시 tunnel-client를 재시작하고 ChatGPT에서 앱을 새로고침하거나 새 대화를 만들어야 합니다.
프로젝트 접근 해제
ChatGPT에서 다음을 보내세요:
调用 disconnect_project 撤销项目 my-app 的 MCP 访问权限,然后重新列出项目。이 작업은 로컬 승인 구성만 삭제하며 프로젝트 디렉터리, 파일 또는 Git 히스토리를 삭제하지 않습니다.
로그인 자동 시작 작업을 제거하려면:
Stop-ScheduledTask -TaskName "Secure Local Workspace MCP Tunnel"
Unregister-ScheduledTask -TaskName "Secure Local Workspace MCP Tunnel" -Confirm:$false이 작업은 Tunnel, Runtime Key, profile 또는 프로젝트 파일을 삭제하지 않습니다.
자주 묻는 질문
Git commit identity is missing
먼저 Git 사용자 이름과 이메일을 설정한 후 구성을 다시 실행하세요:
git config --global user.name "Your Name"
git config --global user.email "you@example.com"Scheduled task not found
-RestartTunnel을 사용했지만 Tunnel이 이 프로젝트를 통해 등록되지 않았습니다. 해당 매개변수를 제거하고 프로젝트 구성을 완료한 후 원래 방식으로 tunnel-client를 재시작하세요.
ChatGPT에서 Tunnel이 보이지 않음
순서대로 확인하세요:
Tunnel이 Platform organization뿐만 아니라 현재 ChatGPT workspace에 연결되어 있는지;
현재 계정에 Tunnels Read + Use 권한이 있는지;
ChatGPT 개발자 모드가 활성화되어 있는지;
tunnel-client가 계속 실행 중이고 healthy/ready 상태인지.
ChatGPT가 17개 도구를 발견하지 못함
Tunnel runtime 재시작;
tunnel-client doctor --profile <profile> --explain실행;ChatGPT 앱 설정에서 새로고침;
새 ChatGPT 대화를 만들어 이전 대화가 캐시된 도구 정의를 계속 사용하지 않도록 함.
프로젝트를 발견하거나 연결할 수 없음
프로젝트는 승인된
DiscoveryRoot내에 있어야 함;Git 저장소와 일반적인 프로젝트 식별 표시가 있는 비-Git 디렉터리는 발견 결과에 자동으로 표시됨;
프로젝트 식별 표시가 없는 일반 디렉터리는 자동으로 나열되지 않지만, ChatGPT가 명시적 절대 경로로
connect_project를 호출하게 할 수 있음;비-Git 프로젝트는
projectType: non-git으로 표시되며 commit과 push가 강제로 비활성화됨;npm run config -- list를 실행해 실제 구성을 확인;필요 시 상위 디렉터리를 다시 추가하고 Tunnel을 재시작.
쓰기가 거부되거나 SHA 만료 안내
프로젝트가 쓰기를 허용해야 함;
기존 파일을 수정하거나 삭제하기 전에 ChatGPT가
read_file을 다시 호출해야 함;파일이 다른 프로그램에 의해 수정되면 이전 SHA가 무효화되는 것은 정상적인 동시성 보호입니다.
기존 staged changes로 인해 Commit 거부
먼저 ChatGPT가 git_status를 호출해 확인하게 하세요. Unstage가 가능하다고 확인되면 git_unstage를 호출해 명시적 파일을 처리하세요. 이 작업은 워크스페이스 내용을 버리지 않습니다.
Tunnel은 로컬에서 정상인데 ChatGPT 호출이 타임아웃
api.openai.com:443으로의 아웃바운드 연결 확인;브라우저가 프록시를 사용할 수 있다고 해서
tunnel-client가 동일한 프록시를 자동으로 사용하는 것은 아님;최초 구성 시
-HttpProxy로 프록시를 기록;로컬 방화벽, 프록시 인증서, 조직 네트워크 정책 확인.
로컬 검증
npm ci
npm test
npm run smoke:mcp
npm audit --omit=dev로컬 MCP 포그라운드 시작:
.\scripts\start-local.ps1Tunnel 상태는 최소한 다음을 충족해야 합니다:
process_running = true
healthy = true
ready = true보안 권장 사항
Discovery Root는 전용 프로젝트 상위 디렉터리여야 하며 디스크 루트나 전체 사용자 디렉터리를 사용하지 마세요;
우선 commit만 활성화하고, 실제 필요 시에만 프로젝트, remote, branch별로 push를 활성화하세요;
Runtime Key, Tunnel profile, 실제 구성 및 로그는 반드시 저장소 외부에 보관하세요;
MCP commit은 프로젝트 Git hooks를 일시적으로 비활성화하므로 테스트와 포맷팅은 명시적 작업 화이트리스트로 실행해야 합니다;
push 전에도 명확한 commit SHA, remote, branch를 확인해야 합니다;
키가 실수로 커밋되면 즉시 폐기하고 전체 Git 히스토리를 정리하세요.
보안 설계 및 취약점 보고는 SECURITY.md를 참조하세요.
공식 참고 자료
License
MIT
Available Tools
17 toolsapply_patchApply a guarded unified patchA
Apply a unified diff to one existing text file after verifying the SHA-256 returned by read_file.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| patch | Yes | ||
| projectId | Yes | ||
| expectedSha256 | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false and destructiveHint=false. The description adds the guard context (verification step) which is useful, but it does not disclose what happens on patch failure, SHA mismatch, or non-existent file. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence that communicates the core action and the guard with zero wasted words. Exemplary conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Adequate for a guarded mutation tool but incomplete: it does not describe failure behavior, whether changes are reversible, or what happens on SHA mismatch. Given the potential consequences of applying patches, more detail would strengthen completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds meaning to expectedSha256 (the hash returned by read_file) and patch (unified diff format), which helps beyond the bare schema. However, projectId and path are left to inference, and with 0% schema coverage, more compensation would be expected.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('apply'), resource ('unified diff to one existing text file'), and a distinctive guard (SHA-256 verification). It clearly distinguishes itself from sibling tools like create_text_file and delete_text_file.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the prerequisite of calling read_file first (to obtain the SHA-256) but does not explicitly state when to use this tool versus alternatives like create_text_file. It lacks explicit 'when not to use' or alternative routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
connect_projectConnect a local projectA
Authorize one directory beneath a locally approved discovery root. Non-Git projects can be edited, but commit and push are automatically disabled.
| Name | Required | Description | Default |
|---|---|---|---|
| label | No | ||
| writable | No | ||
| projectId | No | ||
| allowCommit | No | Applied only when the selected directory is a Git root. | |
| projectPath | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate readOnlyHint=false and destructiveHint=false, but the description adds the key behavioral detail that non-Git projects have commit and push automatically disabled. This is useful context beyond the annotations and helps the agent anticipate side effects. However, it does not detail permission requirements or what happens to existing connections.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences that immediately capture the primary purpose and a critical behavioral condition. No redundant phrases or filler; every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 5 parameters and no output schema, the description covers the main purpose and a key behavioral nuance but misses parameter semantics and clear usage steps. It does hint at the workflow (authorize before editing), but does not fully prepare the agent for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 20% (just allowCommit). The description does not explain any of the parameters such as projectPath, label, writable, or projectId. With such low coverage, the description should compensate by describing parameter meanings, but it does not. The only implied hint is that allowCommit relates to the commit/push behavior, but it's not explicit.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific action (authorize a directory) and resource (one directory beneath a locally approved discovery root), and distinguishes it from siblings like disconnect_project and list_projects. The verb 'authorize' is precise and the scope is defined.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage context (connecting a project before editing) but does not explicitly state when to use this tool versus alternatives such as discover_projects or list_projects. No exclusions or alternatives are mentioned, so it relies on inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
create_text_fileCreate a text fileB
Create a new text file without overwriting an existing path.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| content | Yes | ||
| projectId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds the non-overwrite behavior, which is useful and not fully captured by the annotations (which only mark readOnly and destructive hints). However, it does not disclose other behavioral traits such as error handling when the path exists, whether parent directories are created, or any permission requirements. Given the annotations cover the readOnly/destructive baseline, the description provides moderate added value but lacks deeper context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, compact sentence that front-loads the action and the critical constraint. Every word earns its place, and there is no fluff or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has three required parameters and no output schema, and the description does not explain the parameter format, expected inputs, or how the tool interacts with the project. It also lacks guidance on prerequisites or alternatives. For an agent to call it correctly, it would need the schema (which has no descriptions) or external knowledge, making this definition incomplete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for parameter meaning, but it does not. It provides no explanation of projectId, path, or content beyond their names. An agent has to infer that projectId identifies the project, path is the file location, and content is the text to write, which could be ambiguous.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb (create), resource (text file), and a key constraint (without overwriting an existing path), which clearly distinguishes it from siblings like delete_text_file and apply_patch. It is not a tautology and leaves no ambiguity about what the tool accomplishes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. It does not mention that it should be used for creating new files, or that apply_patch or other write mechanisms would be inappropriate. The description only states what it does, not the context or preconditions (e.g., project must be connected) for using it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
delete_text_fileDelete a guarded text fileADestructive
Delete one regular text file only after verifying the latest SHA-256 returned by read_file.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| projectId | Yes | ||
| expectedSha256 | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already flag destructiveHint and readOnlyHint, so the description adds value by specifying the file type ('regular text file') and the safety requirement (SHA-256 verification). This goes beyond the flags, though it does not disclose behavior on SHA mismatch or irreversibility beyond what 'delete' implies.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that front-loads the action and the condition with zero redundancy. Every word earns its place, and the structure is optimally concise for an agent to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive operation, the description covers the essential prerequisite (SHA-256 check) and limits the scope (regular text file). It relies on annotations for destructiveness and omits failure behavior, but the provided context is sufficient for correct invocation in most cases.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, requiring the description to explain parameters. Only expectedSha256 is implicitly referenced via the verification condition; path and projectId are left to name inference. This does not compensate sufficiently for the missing schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a precise verb ('Delete'), a specific resource ('one regular text file'), and a conditioning prerequisite (verifying the latest SHA-256). This clearly differentiates it from sibling tools like apply_patch (modifies) and create_text_file (creates), leaving no ambiguity about its scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a clear condition for use: 'only after verifying the latest SHA-256 returned by read_file.' This explicitly defines a prerequisite but does not name alternatives or exclusions (e.g., when to prefer apply_patch), so the guidance is strong but not fully explicit about when not to use the tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
diagnosticsCheck local project workspaceARead-only
Check configuration and safety capabilities before starting local project work.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, covering the safety profile. The description adds the usage context 'before starting local project work' but does not elaborate on what the tool actually checks or how it behaves beyond that. It does not contradict the annotations and provides minimal additional behavioral detail.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no wasted words. It states the purpose and usage timing efficiently, making it easy for an agent to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has no parameters and no output schema, the description could still be more complete by specifying what 'configuration and safety capabilities' refers to and what the result looks like (e.g., a pass/fail report, a list of issues). As written, it leaves the agent without a clear expectation of the output, though it is sufficient to invoke the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has 0 parameters and the schema coverage is 100% (empty schema). Per the rubric, a baseline score of 4 applies for 0 parameters. The description does not need to explain parameters since there are none.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Check' and the resource 'configuration and safety capabilities' within the context of the local project workspace. It is distinct from sibling tools like list_projects or read_file because it focuses on diagnostics rather than project listing or file operations, though it does not explicitly name siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a clear usage context: 'before starting local project work.' However, it does not explicitly mention alternatives or exclusion conditions (e.g., when not to use this tool or which sibling tool to use instead). The guidance is implied rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
disconnect_projectDisconnect an authorized projectADestructive
Remove one project from the MCP authorization list without deleting any project files.
| Name | Required | Description | Default |
|---|---|---|---|
| projectId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate destructive behavior, but the description adds important context by clarifying that only authorization is removed, not files. This goes beyond the annotations and prevents misinterpreting the destructiveness as file loss.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, word-efficient sentence that front-loads the core action and includes a critical caveat. No waste.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter tool with no output schema, the description covers the main effect and clarifies non-destructiveness to files. It omits potential error cases or how to find projectId, but these are minor for this simplicity level.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description should explain the projectId parameter. It does not. The tool name and schema property name imply it identifies a project, but no format, source, or how to obtain it is provided. The description fails to compensate for the missing schema detail.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('Remove') on a specific resource ('one project from the MCP authorization list') and explicitly clarifies it does not delete project files. This clearly distinguishes it from siblings like connect_project (which adds) and file-deletion tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage by stating what it does and what it avoids (file deletion), but it does not explicitly contrast with alternatives like connect_project or give conditions for when to use it. The differentiation is implicit, not explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
discover_projectsDiscover local projectsARead-only
Find Git repositories and common non-Git project folders only beneath parent folders that the user approved locally during setup.
| Name | Required | Description | Default |
|---|---|---|---|
| maxDepth | No | ||
| maxProjects | No | ||
| includeNonGit | No | ||
| maxDirectories | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, covering the safety profile. The description adds a meaningful behavioral detail beyond annotations: the search is limited to approved parent folders and includes non-Git folders. This tells the agent the tool will not scan arbitrary paths, which is important for setting expectations. It doesn't describe return format or performance, but given annotation coverage, this is acceptable.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that immediately states the verb and resource, then adds the key scope constraint. No wasted words; every part contributes to the tool's purpose. It is efficient and clear, though brevity comes at the cost of parameter explanation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, 0% parameter schema coverage, and four parameters, the description is insufficient. It explains only the scope (approved folders) and a hint at non-Git inclusion, but omits what maxDepth/maxProjects/maxDirectories do, what the return shape is, or any pagination/concurrency behavior. For a tool with this parameter complexity and no schema descriptions, the description should do much more to make the tool callable correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for the four parameters (maxDepth, maxProjects, includeNonGit, maxDirectories). The description only hints at includeNonGit via 'non-Git project folders' but doesn't name or explain any parameter. Depth limits, count limits, and directory limits are entirely undocumented. This leaves the agent with no meaning for the parameters beyond defaults and types.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Find') and resource ('Git repositories and common non-Git project folders'), and adds a critical scope constraint ('only beneath parent folders that the user approved locally during setup'). This clearly distinguishes it from siblings like list_projects, which presumably lists known projects without that restriction. The purpose is unambiguous and actionable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage context by restricting to approved parent folders, but does not explicitly name alternatives or when to use another tool. It lacks guidance on when not to use this (e.g., when a user needs to see all projects regardless of approval status). The constraint hints at a filtering role, but no alternatives are referenced, so an agent has to infer the boundary between this and list_projects.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
git_commitCommit selected project changesB
Stage and commit only explicit relative paths after status review, concurrency validation, whitespace checks, and sensitive-content scanning.
| Name | Required | Description | Default |
|---|---|---|---|
| paths | Yes | ||
| message | Yes | ||
| projectId | Yes | ||
| expectedStatusSha256 | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds useful behavioral context beyond the annotations by revealing that the tool performs concurrency validation, whitespace checks, and sensitive-content scanning. However, it does not explain what happens if these checks fail, the consequences of the commit, or the role of the expectedStatusSha256 parameter in the concurrency mechanism. The description is partially transparent but lacks depth for this complex operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-constructed sentence that immediately conveys the core action and its constraints. It is front-loaded with the primary verb ('Stage and commit') and scope ('only explicit relative paths'), followed by the key validation steps. There is no redundant or superfluous language, making it highly concise and effective.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with concurrency checks and four required parameters, the description is incomplete. It does not explain how to compute the expectedStatusSha256, the semantics of paths relative to the project root, or the expected output/behavior after a successful commit. Given the tool's complexity and the lack of parameter documentation, the description is insufficient for an agent to invoke it correctly without additional knowledge.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has zero description coverage for its four required parameters, and the description does not explain any of them. While the description mentions 'explicit relative paths' which loosely maps to the `paths` parameter, there is no clarification of the expected format, the meaning of `expectedStatusSha256`, or how `projectId` and `message` should be used. The description adds no parameter-level meaning beyond the schema, which is a significant gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool stages and commits only explicit relative paths after performing several checks. It identifies the specific action (stage and commit), the resource (project changes), and the scope (explicit relative paths), which is specific and unambiguous. It also subtly differentiates from a generic commit by emphasizing the selective path requirement.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not provide any guidance on when to use this tool versus alternatives like git_push, git_unstage, or git_status. Although it mentions 'after status review,' it does not explicitly state the conditions for invoking this tool or when to avoid it. There is no mention of alternative tools or exclusions, leaving the agent to infer usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
git_diffShow Git diffBRead-only
Run a fixed, read-only Git diff command in an authorized project.
| Name | Required | Description | Default |
|---|---|---|---|
| staged | No | ||
| projectId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover read-only and non-destructive nature. The description adds that the command is 'fixed' (non-customizable) and requires authorization, which is useful context. However, it does not clarify the effect of the 'staged' parameter or output behavior, so it adds limited value beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence with no redundancy. The key constraint 'fixed, read-only' is front-loaded, and every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple, but the description omits how the 'staged' parameter changes behavior (diff against index vs working tree) and does not describe the output format. Given no output schema, this is a notable gap for an agent to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema coverage, the description should explain parameters, but it only mentions 'Git diff command' without clarifying 'projectId' or 'staged'. The 'staged' boolean is self-evident from Git knowledge, but the description adds no explicit meaning, leaving a gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (run) and resource (Git diff command), and specifies 'fixed, read-only' and 'authorized project'. It is distinct from siblings like git_status by focusing on diff, though it does not explicitly name alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Mentions 'authorized project' as a contextual requirement, but provides no guidance on when to use this tool versus git_status or other read-only tools. No exclusions or alternatives are listed, leaving usage to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
git_pushPush the current commitA
Push the reviewed current commit without force to an allowlisted remote and branch. This must be enabled locally per project.
| Name | Required | Description | Default |
|---|---|---|---|
| remote | No | origin | |
| projectId | Yes | ||
| expectedCommitSha | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate non-read-only, non-destructive, and open-world behavior. The description adds meaningful context: the destination must be allowlisted, force push is disallowed, and local per-project enablement is required. These details go beyond the annotations and help the agent understand operational constraints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, 22 words, with zero fluff. The core action and constraints are front-loaded, and the prerequisite (local enablement) is stated efficiently. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with no output schema and no parameter descriptions, the description is too thin. It does not explain what happens if the remote is not allowlisted, what 'enabled locally per project' means in practice, error scenarios, or the return value. The agent cannot fully predict the tool's behavior or know if it can call it correctly without additional information.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description does not reference any parameters. The tool has 3 parameters (remote, projectId, expectedCommitSha), but the description never explains their meaning, relationships, or how they relate to the action (e.g., 'current commit' vs expectedCommitSha). The agent must rely solely on the schema, which provides only names and patterns, not semantic guidance.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear, specific action: push the current commit without force to an allowlisted remote/branch. It distinguishes itself from sibling git tools (e.g., git_commit creates, git_push pushes) and adds constraints (without force, allowlisted). No tautology or ambiguity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The usage context is implied (when you have a reviewed commit and need to push it) but not explicitly stated. No exclusions, alternatives, or prerequisites beyond the 'must be enabled locally per project' note. There is no guidance on when not to use this tool or when another tool would be more appropriate, but the purpose is clear enough.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
git_statusShow Git statusBRead-only
Run a fixed, read-only Git status command in an authorized project.
| Name | Required | Description | Default |
|---|---|---|---|
| projectId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is established. The description adds 'fixed' (implying no custom arguments) and 'authorized' (implying a prerequisite), which are useful contextual details beyond the annotation. However, it does not disclose what the status output contains (e.g., modified, staged, untracked files) or whether it includes branch information, so it adds only modest behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no wasted words. It is compact and readable. However, it could add a brief clause about what status returns without losing conciseness, so it is not a perfect 5.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter read-only tool, the description is thin. It does not explain the projectId parameter, does not mention the need to have a project authorized (despite implying 'authorized'), and provides no information about the return value or output format. There is no output schema, so the description carries the full burden, which is left unmet.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has a single parameter, projectId, with no description and zero schema coverage. The description only says 'in an authorized project,' which hints that projectId should reference an authorized project, but it does not explain what the parameter format is, how to obtain a valid ID, or that it might be listed via list_projects. Since schema coverage is 0%, the description must compensate, and it fails to do so.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Run') and the resource ('a fixed, read-only Git status command'), and the 'read-only' plus 'fixed' qualifiers distinguish it from mutation tools like git_commit and git_push, and from comparison tools like git_diff. It is unambiguous what this tool does.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus its siblings. It does not mention that git_status is the go-to for checking working tree state, nor does it warn against using it for diffs or staging. It only mentions 'in an authorized project,' which is a prerequisite, not a usage comparison.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
git_unstageUnstage selected Git pathsA
Remove explicit paths from the Git index without changing their working-tree contents.
| Name | Required | Description | Default |
|---|---|---|---|
| paths | Yes | ||
| projectId | Yes | ||
| expectedStatusSha256 | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false and destructiveHint=false. The description adds the behavioral nuance that the working tree remains unchanged, which is valuable and not fully captured by the annotations. It does not contradict the annotations and clarifies the scope of the mutation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, tightly written sentence that front-loads the action and scope. Every word earns its place; there is no fluff or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with three required parameters, no output schema, and zero parameter descriptions, the description does not provide enough detail for correct invocation. It omits parameter semantics, expected input formats, and the role of the concurrency guard. The core purpose is clear, but the operational details are missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must explain the three parameters (paths, projectId, expectedStatusSha256). It does not mention any of them, their format, or their purpose. The agent receives no guidance on what values to provide, especially for expectedStatusSha256, which is not self-evident.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Remove' and the resource 'Git index', specifies 'explicit paths', and adds a crucial qualifier that working-tree contents are untouched. This distinguishes it from siblings like git_status, git_diff, and git_commit, which deal with other aspects of staging.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'Remove explicit paths from the Git index' provides clear context that this is for unstaging operations. However, it does not explicitly mention when not to use it or point to alternative tools, though the context is sufficiently distinct given the sibling set.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_filesList project filesBRead-only
List files and directories beneath an authorized project path.
| Name | Required | Description | Default |
|---|---|---|---|
| maxDepth | No | ||
| projectId | Yes | ||
| maxEntries | No | ||
| pathPrefix | No | . |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, covering the safety profile, so the description's burden is lighter. It adds the 'authorized project path' context, hinting at an access-control consideration, but reveals nothing about traversal behavior, error cases, or how max entries/depth limits surface.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, readable sentence that front-loads the action and object with no filler. Every word earns its place; the 'authorized' qualifier is the only mildly extraneous addition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 4-parameter tool with 0% schema coverage and no output schema, this description is minimal. It leaves unaddressed how pathPrefix relates to 'authorized project path', what the depth/entry limits imply about returned data, and how results are structured. An agent gets enough to attempt a call but not to call it correctly on the first try.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the description names none of the 4 parameters (projectId, pathPrefix, maxDepth, maxEntries). It does not clarify what 'authorized project path' maps to in terms of pathPrefix or projectId, so the agent gets no help beyond the raw schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('List') and a clear resource ('files and directories beneath a project path'), which clearly differentiates it from siblings like read_file (reads content) and search_text (searches content). The qualifier 'authorized' is slightly vague but does not obscure the core purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The purpose implies when to use it (browse a project's file tree), and the sibling list makes the alternative obvious. However, there is no explicit when-to-use vs when-not-to-use guidance, no mention of the relationships to discover_projects or read_file, and no stated exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_projectsList authorized local projectsARead-only
List the local projects, write permissions, and task names authorized by the user.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, covering the safety profile. The description adds the scope of listing only what is authorized, which is useful context. However, it does not discuss output format, ordering, or potential errors, so it adds moderate value beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence states the core action and scope without any fluff. Every word contributes to understanding the tool's purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
As a simple read-only listing tool with no parameters and no output schema, the description adequately conveys its purpose and output components. However, it could mention whether results are filtered or sorted, and it does not describe error cases, which is a minor gap. The absence of a return schema is compensated by listing the types of information returned.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With no parameters, the schema is trivially fully covered. The description does not need to explain any parameters, and per baseline for 0 params, a score of 4 is appropriate. It does clarify that the tool returns write permissions and task names, which are not parameters but output content.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'List' and clearly identifies the resource 'local projects' plus additional elements 'write permissions, and task names'. The qualifier 'authorized by the user' differentiates it from the sibling discover_projects, making its purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus its sibling discover_projects. The description lacks any conditional context or exclusions, leaving the agent to infer when it should be preferred.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_fileRead a project text fileBRead-only
Read a bounded line range from a text file and return its SHA-256 edit precondition.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| endLine | No | ||
| projectId | Yes | ||
| startLine | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover readOnlyHint=true and destructiveHint=false, which the agent knows. The description adds the behavioral detail that it returns a SHA-256 edit precondition, which is useful context but does not fully disclose behavior like error conditions, encoding assumptions, or effect on file state. Given the annotations, a score of 3 is appropriate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loads the core action, and wastes no words. Every phrase contributes to the meaning, making it highly concise and well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only tool with annotations covering safety and no output schema, the description is adequate but not complete. It does not explicitly mention that the returned hash is intended for later edit precondition checks, nor does it note that the tool reads only text files. An agent could call it correctly but might miss the intended workflow integration with sibling patch tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description carries the full burden of explaining parameters. It mentions 'bounded line range' but does not explain startLine and endLine semantics, defaults, or how they interact. For a 4-parameter tool with zero schema coverage, the description falls short of even the baseline minimal value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Read'), a resource ('a text file'), and a bounded line range, plus the return value (SHA-256 edit precondition). This is clear enough for an agent to know what the tool does, though it does not differentiate it from sibling read-like tools such as search_text or list_files.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance on when to use this tool versus alternatives. It does not mention that it is likely a pre-edit step for apply_patch, nor does it specify any conditions or exclusions. An agent would have to infer the use case from the return value, which is not ideal.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
run_taskRun an allowlisted project taskA
Run one task whose executable and arguments were explicitly configured by the user.
| Name | Required | Description | Default |
|---|---|---|---|
| taskName | Yes | ||
| projectId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate the operation is not read-only and not destructive, so the bar for behavioral disclosure is lower. The description adds the crucial context that the task is 'allowlisted' and user-configured, implying security sensitivity. However, it does not mention potential side effects, output format, or error behavior, leaving some behavioral ambiguity.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that conveys the core function without verbosity. Every word adds value, and the critical 'allowlisted' qualifier is front-loaded. Perfectly concise for a tool of this simplicity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite the tool's low complexity, the description does not specify what the tool returns (e.g., output of the task), whether it blocks until completion, or how errors are surfaced. Since there is no output schema and annotations give minimal guidance, the agent is left guessing about the call behavior. A sentence on return format or side effects would meaningfully improve completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the description does not explicitly define the two parameters. It only implies that taskName refers to the configured task and projectId to the project. An agent without prior knowledge would not know what values to supply for these parameters, making this a weak point.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific verb 'Run' with a clearly bounded resource: 'one task' that is 'allowlisted' and whose executable/arguments were pre-configured. This distinguishes it from all siblings (none of which execute tasks) and leaves no ambiguity about what the tool does.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage: run a pre-configured task, but provides no explicit guidance on when to prefer this over alternatives, nor any exclusions (e.g., 'do not use for ad-hoc commands'). Since no sibling does anything similar, the lack of named alternatives is acceptable, but the description could be clearer about when to invoke it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_textSearch project textARead-only
Search for a literal string across bounded text files in an authorized project.
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | ||
| projectId | Yes | ||
| extensions | No | ||
| maxResults | No | ||
| pathPrefix | No | . | |
| caseSensitive | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide readOnlyHint=true and destructiveHint=false, so the description's burden is reduced. It adds 'bounded text files' and 'authorized project' scope, but does not disclose whether the search is substring or exact, the result format, or performance characteristics. These details remain unspecified.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that is front-loaded with the action ('Search') and scope ('literal string across bounded text files'). Every word adds value, with no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having six parameters and no output schema, the description is extremely brief. It does not explain what 'bounded text files' means, the default behavior of parameters, or what the tool returns. While annotations cover safety, an agent would be uncertain about output structure and edge cases, making the description insufficiently complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description makes no mention of parameters. While parameter names like 'query', 'extensions', and 'caseSensitive' are self-explanatory, the description fails to compensate for the absence of schema descriptions, offering no additional meaning for any of the six parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific action, 'Search for a literal string', on a bounded resource, 'bounded text files in an authorized project'. This distinguishes it from siblings like read_file and list_files, and no ambiguity exists about its core function.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies its use case (finding a literal string) but provides no explicit guidance on when to choose it over alternatives or when not to use it. The phrase 'bounded text files' hints at scope but does not clarify which files qualify, leaving the usage context implied rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
17 tool updates
v0.3.0- First observed
apply_patch - First observed
connect_project - First observed
create_text_file - First observed
delete_text_file - First observed
diagnostics - First observed
disconnect_project - First observed
discover_projects - First observed
git_commit - First observed
git_diff - First observed
git_push - First observed
git_status - First observed
git_unstage - First observed
list_files - First observed
list_projects - First observed
read_file - First observed
run_task - First observed
search_text
TDQS
Scored across 17 tools
Each tool targets a distinct operation—project discovery/auth, file read/write, git workflow, or task execution—so an agent can reliably select based on action. The only mild pairing is list_projects vs discover_projects, but their descriptions clearly separate authorized projects from available ones.
Most tools follow a predictable verb_noun pattern like list_files, read_file, apply_patch, and run_task. diagnostics is a noun-style outlier, and the git_* family uses command nouns (git_status, git_diff) rather than verbs, but the overall pattern remains recognizable.
At 17 tools, the server is slightly above the typical 3–15 range, but the count is justified by covering project discovery, authorization, file editing, git operations, and task execution. Each tool earns its place and none feel redundant.
The toolset covers project lifecycle, file CRUD/search, core git commit/push workflows, and configured task execution with no dead ends. Minor gaps like file rename/move or git branch/log operations are not essential to the secure workspace purpose but could be nice additions.
Related MCP Connectors
Safe folder access for ChatGPT and Claude: read, write and search files, risky tools opt-in.
Use your Mac, Windows or Linux computer from ChatGPT, Claude or Codex: files, commands, documents.
Your own computer's files from ChatGPT or Claude: folder rules, confirmations and undo.
Work on your own computers from Claude or ChatGPT: run commands, edit and search files.
Related MCP Servers
- AlicenseNot gradedqualityAmaintenanceEnables ChatGPT to inspect and edit local projects through a secure MCP interface, offering workspace management, file operations, git integration, and safe command execution.6MIT
- AlicenseNot gradedqualityCmaintenanceEnables ChatGPT web to safely read and modify only explicitly allowed local project files through OpenAI Secure MCP Tunnel, including git operations, file edits, and running project scripts, while enforcing strict security boundaries.29MIT
- AlicenseNot gradedqualityCmaintenanceEnables ChatGPT or any MCP client to operate safely on a designated workspace by listing, reading, searching, writing, and trashing files, inspecting Git status/log/diff, and optionally running allowlisted executables without a shell.Apache 2.0
- AlicenseNot gradedqualityBmaintenanceEnables ChatGPT to read and edit local project files, inspect Git changes, and run approved development scripts through a secure MCP tunnel, with optional Codex Desktop integration.31 npm8Apache 2.0