ntdrive
Drive a Windows VMware guest from an agent: manage VMs and snapshots, debug the kernel, run SSH terminals, capture console screenshots, transfer files, and check system state/health.
VM lifecycle: list VMs and state, start/resume, stop (soft/hard), reboot (soft/hard/kd), suspend.
Snapshots: list, take, revert, delete (with confirm, children, allow_suspend).
Kernel debugging: setup host/guest, attach/detach kd.exe, break/go, exec debugger commands, wait for events, inspect state, tail logs.
Terminal: open SSH PTY sessions, send text/keys, read output/wait for regex/render screen, exec commands, resize, close, list.
Console: capture PNG screenshot (optional base64).
Files: push/pull files with optional SHA-256 verification.
System: unified VM/debugger/terminal state and health checks.
Provides tools for managing VMware Workstation virtual machines, including power operations, snapshot management, console screenshots, file transfer, and kernel debugging via KDNET.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@ntdriverevert to the last good snapshot and power on the VM"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
ntdrive
Drive a Windows guest on VMware Workstation from an LLM agent: power and snapshots, kernel
debugging with kd.exe over KDNET or a serial pipe, and a real-time SSH terminal, behind one local
daemon and one set of tools exposed as an MCP server, a CLI and a Python SDK. It is built for the
kernel driver and Windows security loop: build, deploy to the guest, load, hit a crash or
breakpoint, analyze in the debugger, revert a snapshot, repeat. Each step is a tool call, and the
daemon keeps the pieces consistent so the agent does not have to. Windows only. The name is the
point: NT is the Windows kernel, and ntdrive drives it.
Needs: a Windows 11 host with VMware Workstation Pro 17.6 or newer, the Debugging Tools for
Windows (kd.exe and kdnet.exe from the Windows SDK or WDK), Python 3.12 and uv. Guest: Windows
10 or 11 x64 with VMware Tools, Secure Boot off and, for KDNET, the e1000e NIC. No administrator
shell on the host.
Fastest path in (guest first, then host):
In the guest, copy
scripts\setup-guest.cmdandscripts\setup-guest.ps1in and run the.cmd.On the host:
git clone https://github.com/jiy2745/ntdrive cd ntdrive scripts\setup-host.cmdIt ends with
ntdrive verifyand prints ALL SET.Point an MCP client at the installed
ntdrive-mcpcommand (a clone carries.mcp.json).
Read next: SKILL.md if you are an agent using the tools, AGENTS.md if you are changing this
code, PRD.md for the requirements. The full map is under Documentation map below.
Why it exists
An agent that wants to debug a driver needs three windows at once: the VMware controls, WinDbg, and an SSH or RDP session into the guest. ntdrive exposes all three as tools and, more importantly, keeps their state in sync. Revert a snapshot and the debugger reattaches and the terminal reconnects on its own. Break into the debugger and the terminal tools refuse to hang, because the guest is frozen. That cross-tool consistency is the part existing debugger-only or VM-only tools leave to you.
Related MCP server: winvm-mcp
How it fits together
Claude Code (agent) Human / CI (shell) pytest / automation
| stdio | argv | import
v v v
ntdrive-mcp ntdrive CLI Python SDK (NtDrive)
| | |
+------------------------+-----------------------+
| HTTP + WebSocket, 127.0.0.1, token
v
+------------- ntdrived (daemon, holds every session) -------------+
| ToolRegistry -> StateStore -> Orchestrator -> AuditLog |
| VmwareAdapter (vmrun) KdSession (kd.exe) TermManager (SSH) |
+---------+------------------------+-----------------------+--------+
| vmrun.exe | UDP KDNET | TCP 22 (SSH PTY)
v v v
+------------------------ VM (Windows guest) -----------------------+
| KDNET (boot-time) OpenSSH -> PowerShell PTY VMware Tools |
+-------------------------------------------------------------------+The daemon owns the sessions. The MCP server, the CLI and the SDK are thin, stateless clients of it,
so an agent, a person at a shell, and a test script all see the same live sessions. Every tool is
declared once in a single registry (ntdrive.core.registry) and the three front doors are generated
from it, so they never drift apart.
Setup
Host: Windows 11, VMware Workstation Pro 17.6 or newer, the Debugging Tools for Windows (kd.exe
and kdnet.exe from the Windows SDK or WDK), Python 3.12 and uv. No
administrator shell is needed. Guest: Windows 10 or 11 x64 with VMware Tools, Secure Boot off in
the VM settings (bcdedit /debug on needs that) and, for KDNET, the e1000e NIC. Guest first,
then host: the host script ends with the end-to-end check and reboots the guest itself when the
debugger needs it. ntdrive sys health names the fix for anything that is missing.
1. Guest. Copy scripts\setup-guest.cmd and scripts\setup-guest.ps1 into the guest (drag and
drop works once VMware Tools are in) and run the .cmd from any shell or by double click. It asks
for administrator rights itself (one UAC click), creates the local administrator ntdrive and
asks for its password (type the same one in ntdrive setup on the host), installs OpenSSH Server
with PowerShell as the default shell, opens port 22 and turns on KDNET. The host IP comes from the
NAT gateway and the key is generated in the guest, so nothing is copied by hand. Running it again
is safe. Reboot the guest when it says so.
2. Host. One command from a clone:
git clone https://github.com/jiy2745/ntdrive
cd ntdrive
scripts\setup-host.cmdIt runs uv sync, puts the ntdrive, ntdrive-mcp and ntdrived commands on your PATH (an
editable uv tool install, so they follow the clone), then for each VM you pick from the VMware
library asks for the guest account and passwords (masked while you type, stored as User
environment variables, never in a file), restarts the daemon, repairs the host firewall for KDNET
through one UAC prompt and ends with ntdrive verify. The config lands in
%LOCALAPPDATA%\ntdrive\vms.yaml, and vms.example.yaml documents every field. Without a clone:
uv tool install git+https://github.com/jiy2745/ntdrive, then ntdrive setup.
3. Verify. The host script already ran this. Run it again after any change, or whenever the guest was set up after the host:
ntdrive verify # config, power, SSH login, firewall, then attach, break in, resumeIt ends with ALL SET or the first thing to fix and how. When the guest was configured a moment
ago it reboots the guest itself so the debugger connects.
Options, all optional:
Where | Switch | What it does |
guest |
| use your own Windows account for SSH instead of creating |
guest |
| also create |
guest |
| OpenSSH from the Win32-OpenSSH zip, for a guest without internet (Insider builds have no capability package, and the script falls back to a download on its own) |
guest |
| serial named-pipe transport instead of KDNET |
host |
| only the end-to-end check |
host |
| manual repair of the KDNET firewall rules, from an Administrator shell |
host |
| serial transport for a host where nobody can approve a UAC prompt, then |
Several VMs: run setup-host.cmd again (or ntdrive setup) for each VM and setup-guest.cmd in
each guest. Every guest picks its own KDNET port from its machine id, and the host moves a guest
whose port collides with another VM's. A guest set up by hand gets its KDNET settings from
ntdrive kd setup-guest <vm>. scripts\probe-guest.ps1 prints what a guest has (build, Secure
Boot, NIC model, OpenSSH state) before you run the setup script.
4. MCP clients. The server is the installed ntdrive-mcp command: stdio, no arguments, no
environment variables (the config lives in %LOCALAPPDATA%\ntdrive), and it starts the daemon
itself. Set the client's MCP tool-call timeout above 600 s, because the wait tools long-poll.
Claude Code: a clone carries .mcp.json, elsewhere claude mcp add ntdrive -- ntdrive-mcp. Allow
the tools with the permission rule mcp__ntdrive__*.
{ "mcpServers": { "ntdrive": { "command": "ntdrive-mcp" } } }Claude Desktop (%APPDATA%\Claude\claude_desktop_config.json) does not search PATH, so give the
full path. uv tool dir --bin prints the directory, %USERPROFILE%\.local\bin by default:
{ "mcpServers": { "ntdrive": { "command": "C:\\Users\\you\\.local\\bin\\ntdrive-mcp.exe" } } }VS Code (.vscode/mcp.json), and Cursor takes the Claude Desktop shape in .cursor/mcp.json:
{ "servers": { "ntdrive": { "type": "stdio", "command": "ntdrive-mcp" } } }Quick start (CLI)
The CLI has the same tools as subcommands. The first call auto-starts the daemon.
The daemon runs windowless (started with pythonw.exe, detached), and the vmrun and kd.exe
processes it starts are hidden too, so nothing pops up on the desktop. ntdrive daemon status
says whether it is up. ntdrive daemon logs -f follows what it is doing: one line per tool call
(name, caller, outcome, never the arguments) plus the daemon's own messages, from
%LOCALAPPDATA%\ntdrive\logs\daemon.out.log.
ntdrive sys health # host binaries and config, then each VM live: power, SSH, debugger transport
ntdrive vm start win11
ntdrive term open win11 # prints a session id and a CoView URL, a browser page that mirrors the session
ntdrive kd attach win11 # serial: attaches at once. net: the target connects while the guest boots
ntdrive kd break win11 # freezes the guest at a kd> prompt
ntdrive kd exec win11 "!process 0 0"
ntdrive kd go win11 # resume the guestAdd --json to any command for the raw tool result. Exit codes: 0 ok, 1 error, 2 bad arguments,
3 confirmation required, 4 guest frozen by the debugger, 5 timeout.
A person can sit down in a session the agent opened:
ntdrive term attach <session-id> # Ctrl+] to detach, your keystrokes are logged as humanThe Python SDK has the same tools as methods, vt.<group>.<verb>(...):
from ntdrive.sdk import NtDrive
vt = NtDrive() # talks to the daemon, starts it if needed
vt.vm.start("win11")
print(vt.sys.state(vm="win11")) # sys_state takes keyword arguments onlyWhat an agent can do
VM power and snapshots: start, stop, suspend, three reboot modes, and live snapshots with a tree listing, revert, and delete.
Kernel debugging over KDNET or a serial pipe: set up the guest, attach
kd.exe, break in, run debugger commands, wait for a bugcheck or breakpoint, and detach.Real-time terminal: open SSH PTY sessions, stream output, render the screen, wait on a regex, and send keys including
{ctrl+c}.Console and files: capture a console screenshot (for a BSOD or login screen) and copy files both ways with checksum verification.
Unified state: one
sys_statecall returns VM power, debugger state and terminal sessions, and compound actions like snapshot revert run as a single orchestrated step.
The full list below is generated from the tool registry (scripts/tools_table.py --write README.md refreshes it, a test keeps it current). Effect is what the MCP annotations say: a read tool
changes nothing, an additive one adds or starts something, a destructive one can discard state,
and the ones that need confirm=true say so in their arguments. Arguments are in PRD.md section
7 and in ntdrive <group> <verb> --help.
Tool | Effect | What it does |
| read | List registered VMs with power, debugger and terminal state. |
| read | Power, debugger and terminal state of one VM. |
| read | Wait until the guest is back up: block until SSH answers, or the timeout passes. For after a reboot or a bugcheck's auto-restart, so no manual polling loop is needed. |
| additive | Power on (or resume) a VM without the GUI by default. discard_saved_state boots fresh when a stale saved state blocks the resume. |
| destructive | Stop the VM: mode soft, hard or kill. hard and kill need confirm=true. |
| destructive | Reboot the guest (soft, hard or from the debugger) and bring kd and terminals back, the terminals under new session ids. hard needs confirm=true. |
| additive | Suspend the VM to disk. |
| additive | Resume a suspended VM (same as vm_start). |
| additive | Read or change the VM hardware in the vmx: cpus, memory_mb, nic. Without arguments it reports the current values. A change needs the VM powered off. |
| additive | Clone a VM into a new registered VM, for giving each agent its own guest. An unencrypted VM is cloned from a snapshot with vmrun (linked shares the base disk, full copies it). An ENCRYPTED VM is cloned by copying its files instead, which vmrun cannot do, keeping the encryption and vTPM and reusing the same password: powered off it copies the whole current state, running it copies the frozen snapshot chain (needs a snapshot) without touching the live VM. The clone gets its own KDNET port, so run kd_setup_guest and reboot it before kd_attach. |
| additive | Create a new, unencrypted VM (empty 64 GB disk, UEFI, e1000e NIC for KDNET) and register it, optionally booting an installer ISO. This is how to get a guest that vmrun CAN clone: no encryption and no vTPM, unlike an encrypted base. Install the OS into it once, then vm_clone it freely. |
| additive | Register an existing VM (a manual or GUI clone) as a new ntdrive VM, inheriting the template VM's guest, debugger and encryption config with its own fresh KDNET port. For encrypted VMs, which no CLI can clone: clone once in the VMware GUI, then register the copy here. |
| destructive | Delete a VM and its files (a clone, usually), and drop its vms.yaml entry. Powers it off first. Needs confirm=true. When the VM's files are already gone (moved or deleted by hand) it just removes the stale entry. A base VM with linked clones cannot be deleted until the clones are gone. |
| read | Snapshot tree of a VM plus the current snapshot and stored metadata. |
| additive | Take a snapshot (memory included while running), record description and kd state, and return the snapshot list. |
| destructive | Revert to a snapshot: detach kd, revert, start, reattach kd, reopen terminals. |
| destructive | Delete a snapshot (and optionally its children). Needs confirm=true. |
| additive | Prepare the host side of the kd transport: serial adds the named-pipe COM port to the vmx (VM must be off), net checks the host firewall for kd.exe and repairs it through one UAC prompt. |
| additive | Enable kernel debugging in the guest with bcdedit over SSH (serial or KDNET per kd_transport) and save the KDNET port and key to vms.yaml. Settings that already point at this host are read back, not rewritten. |
| additive | Start kd.exe for the VM and wait until the target connects. |
| additive | Resume the target if needed and stop kd.exe. |
| additive | Break into the running target and wait for the kd> prompt. |
| additive | Resume the target (g). |
| destructive | Run one or more debugger commands at the kd> prompt and return each command's output. |
| read | Classify the current bugcheck cheaply: runs .bugcheck (two lines) and returns the code, its arguments and the faulting instruction. Use this before !analyze -v, which takes tens of seconds and prints tens of kilobytes of chkimg noise that is false on a patched kernel. |
| destructive | Break on a symbol, let the target run, and collect the value of one or more expressions at each of the next n hits, then clear the breakpoint. Replaces a manual bp/g/eval round trip per hit. The breakpoint is plain and conditions are evaluated by the daemon, never compiled into the breakpoint, because a conditional breakpoint with gc on a hot function NMIs the guest. |
| read | Wait until the running target stops (bugcheck, breakpoint, ...) or the timeout expires. |
| read | Debugger state: attached (kd.exe alive), state (detached, waiting, running, broken), transport, target info, last event and log path. |
| read | Last bytes of the kd.exe transcript. |
| additive | Open a real-time PTY session (SSH) on the guest and return its session_id. |
| destructive | Type text and/or keys into a session and return at once. Tokens: {enter} {tab} {esc} {ctrl+c} {up}. Use it for a long-running command or one that will stop in the debugger, then term_read or kd_wait_event. |
| read | Read new output (delta), wait for a regex (until), or render the screen (mode=screen). A wait ends with guest_frozen_by_debugger when the target stops at kd>. |
| destructive | Run one command in the session, wait for it to end (up to timeout) and return only its output and exit code. For a command that will stop in the kernel debugger or drop SSH, use term_send, then kd_wait_event or term_read. |
| additive | Resize the PTY. |
| additive | Close a session. |
| read | List terminal sessions (the usable ids in open) and the CoView page that mirrors them live in a browser (# selects one). |
| additive | Forget closed and disconnected terminal sessions (their open successors stay), so the list shows only what is usable. |
| read | Save a PNG of the VM console and return its path (base64 on request). method=vnc reads the console framebuffer without any guest login (con_enable_vnc turns VNC on first). |
| destructive | Type keys into the VM console over VNC, no guest login needed (con_enable_vnc turns VNC on). For a lock or login screen or before the network is up: keys=['{password}', '{enter}'] logs in without the password crossing the wire. |
| destructive | Click the VM console at a framebuffer pixel over VNC, no guest login needed. Read the coordinate off con_screenshot method=vnc (same pixels), for example to pick a user tile on the lock screen, then con_send_keys for the password. |
| additive | Configure Windows automatic logon in the guest so a reboot lands on an unlocked interactive desktop (session 1), which term_* over SSH (session 0) cannot open. enabled=false clears it. needs_reboot: run vm_reboot mode=soft next. |
| destructive | Run a command on the guest's interactive desktop (session 1) and return its output, for GUI or session-bound programs that SSH in session 0 cannot open. It runs through a scheduled task in the logged-on user's session, so the account must be logged in (con_autologon). detach=true starts it and returns at once, leaving it running. |
| additive | Turn on the console VNC server in the vmx so con_screenshot method=vnc can read the screen without a guest login. Run it with the VM off, then start the VM. |
| destructive | Copy a file, directory or glob from the host into the guest and verify it by SHA-256 (over SFTP, or through VMware Tools when SSH is down). |
| additive | Copy a file from the guest to the host. |
| read | Size, last-modified time and is_dir of a guest path, so freshness can be checked without a shell. exists=false when the path is not there. |
| read | List a guest directory (each entry name, size, modified, is_dir), without a shell. |
| destructive | Delete a guest file or directory (recurse for a non-empty directory). deleted=false when it was already absent. |
| read | VM power, debugger state, terminal sessions and last events in one answer. |
| read | Check binaries, config and backend capabilities, then probe every VM: power, guest SSH port and the debugger transport on the host. Run this first: ok is false when the host or any VM has an issue, and every issue names its fix. |
The state model to respect
While the debugger is broken in (
kd_state == broken) the whole guest is frozen. Terminal, file and screenshot tools returnguest_frozen_by_debuggerat once instead of hanging, and a runningterm_execorterm_readwait ends the same way. Runkd gofirst.snap revertdetaches the debugger andvm rebootkeeps kd.exe waiting for the reconnect. Both drop terminal sessions, then reattach and reopen them unless you pass--no-reattach-kdor--no-reopen-term. The reopened sessions have new ids, listed in the result asterm[].new.After a reconnect the old terminal session id is kept and points to its successor.
The full state model and the procedures are in SKILL.md.
Encrypted VMs
Set encryption_password_env (the name of an environment variable, preferred) or
encryption_password (inline, acceptable because vms.yaml is git-ignored) and every operation
that opens the vmx passes -vp to vmrun. Power, snapshot list, revert, delete, screenshot, guest IP
and file copy all work on an encrypted VM, including the partial encryption that a Windows 11 vTPM
requires. The one rough edge: vmrun refuses a live snapshot, or a memory snapshot delete, of a
running encrypted VM. snap_take and snap_delete then answer with
error.reason=encrypted_live_snapshot, and --allow-suspend handles it (suspend, snapshot or
delete, resume: terminal sessions are dropped and the debugger is reattached). A snapshot of a
powered-off VM never needs it. When the resume fails the call fails with the snapshot recorded
and the facts in the error, and vm_start --discard-saved-state boots fresh when the vmx still
names a saved state Workstation cannot restore. What vmrun accepts is recorded in AGENTS.md, Things that bit us.
Safety
The daemon binds only to
127.0.0.1and checks a per-daemon token on every request.Secrets (guest password, KDNET key, VM encryption password, daemon token) live only in
vms.yaml, environment variables, and the daemon state file. They never appear in tool arguments, results or logs, and the audit log masks them.The guest's SSH host key is pinned per VM on first use under
%LOCALAPPDATA%\ntdrive\hostkeys. A different key later is refused before the password is sent. Delete that file after reinstalling a guest.The CoView URL carries a view token, a second secret that only lists terminal sessions and opens their streams. That is still a shell in the guest, so treat it like a password and do not paste it into chat or tickets. Terminal transcripts under the log directory record everything typed into a session, by the agent or by a person, so passwords typed interactively land there too.
kd_execexecutes any debugger command, and kd's.shellruns commands on the host. The policy file can setkd_exec: denyfor agents that should not have that.Destructive actions (
snap_delete,vm_stop mode=hardorkill,vm_reboot mode=hard) requireconfirm=trueand go through a policy gate you can tune inpolicy.yaml.
Documentation map
File | Read it if you are |
| a human setting up or using ntdrive |
| an agent using the tools. State model, standard procedures, and moves to avoid |
| any coding agent changing this repo. Conventions, commands and where things live |
| Claude Code. Points at |
| anyone who wants the full requirements and design rationale |
| someone editing |
| someone tuning the allow, confirm, deny level per tool |
| host and guest setup, see Setup above |
SKILL.md is written for the agent. MCP clients that read skill files pick it up, and any agent can
be pointed at it. It covers the state model, the setup and debug-loop and BSOD-recovery procedures,
and the forbidden moves (such as touching the terminal while the debugger is broken in).
Development
uv sync
uv run --no-sync pre-commit run --all-files # ruff format, ruff check, mypy, prettier, ASCII check
uv run --no-sync pytest -q # unit tests, all fakes, no real VM neededBoth must pass before a commit, and CI runs exactly these two on windows-latest. --no-sync
because a sync rewrites ntdrive-mcp.exe, which fails while an MCP client such as Claude Code
holds it. Conventions, the map of the code and what to update when a tool changes are in
AGENTS.md. Ruff is the only Python formatter and linter, mypy is strict for the whole package,
and Prettier runs on the CoView web assets only. A pre-commit hook rejects non-ASCII characters
and semicolons in Markdown prose, which keeps every document English and plain. Nothing in the
test suite needs a VM: the one test that touches the real Windows firewall runs only with
NTDRIVE_LIVE_TESTS=1, and the live check is ntdrive verify (Setup, step 3).
The MCP face can be poked by hand with the inspector: npx @modelcontextprotocol/inspector ntdrive-mcp (from a clone, npx @modelcontextprotocol/inspector uv run ntdrive-mcp) opens a page
that lists the tools with their annotations and calls them.
Only the VMware backend is implemented. Hyper-V and VirtualBox sit behind the same
HypervisorAdapter interface and are planned for a later version.
Layout
src/ntdrive/
config.py vms.yaml and policy.yaml models
errors.py NtDriveError with code, hint and backend reason tags
hostproc.py runs vmrun and the PowerShell helpers without a console window
paths.py host path helpers shared by the CLI, SDK and file tools
core/ registry, state store, policy gate, audit log, orchestrator, service
core/tools/ tool handlers: vm, snap, kd, term, console, file, sys
hypervisor/ HypervisorAdapter, the VMware (vmrun) adapter, vmx file access
kd/ KdSession around kd.exe, host firewall repair for KDNET
term/ terminal transports, sessions, reconnect and successor ids, key tokens
screen/ VNC framebuffer capture for con_screenshot method=vnc
daemon/ ntdrived HTTP and WebSocket app, lifecycle, client, CoView page
mcp/ sdk/ generated front doors
cli/ generated tool commands plus setup, verify, term attach and the daemon group
scripts/ host and guest setup with their .cmd launchers, a guest probe, the ASCII hook,
the README table generator
tests/ unit tests with fake vmrun, fake kd.exe and fake terminal channelsLicense
MIT. See LICENSE.
Available Tools
33 toolscon_screenshotA
Save a PNG of the VM console and return its path (base64 on request).
| Name | Required | Description | Default |
|---|---|---|---|
| vm | Yes | VM name as registered in vms.yaml | |
| base64 | No | Also return the PNG as base64 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must disclose behavioral traits. It states that the tool saves a PNG and returns a path, optionally returning base64. This adequately describes the primary behavior. However, it does not mention side effects (e.g., whether it changes VM state) or any prerequisites (like VM must be running). Given the simplicity of the operation and the clear output, this is sufficient but not rich. A cautious agent might want to know if this is read-only, but the description implies a non-destructive capture.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that states the action, the output type, and the optional mode (base64). It is front-loaded with the main action, and every word earns its place. No fluff or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with 2 parameters (1 required, 1 optional) and no output schema, the description is fairly complete. It specifies the output format (PNG path, optionally base64) and the parameter semantics. It could have benefited from mentioning whether the VM needs to be running or if it captures the current console state, but these are minor gaps given the tool's simplicity. The agent has enough to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents both 'vm' (VM name) and 'base64' (return as base64). The description's mention of 'base64 on request' adds meaning to the 'base64' parameter, confirming its purpose)Skip. The 'vm' parameter is standard. Since the schema does the heavy lifting, this is a solid baseline 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Save' with a clear resource ('a PNG of the VM console'), and states the output ('return its path (base64 on request)'). It clearly distinguishes itself from siblings like 'snap_take' or 'vm_state' by focusing on the console screenshot. This is unambiguous and actionable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not explicitly state when to use this tool versus alternatives, but the purpose is obvious enough that an agent can infer it is for capturing a console image. No exclusions or alternative tools are mentioned, but given the tool's specificity, this is adequate. However, it could have noted that this is not a VM snapshot but a console capture, which would help differentiate from 'snap_take'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
file_pullA
Copy a file from the guest to the host.
| Name | Required | Description | Default |
|---|---|---|---|
| vm | Yes | VM name as registered in vms.yaml | |
| local | Yes | Host file, or a directory when it ends with a separator (absolute path) | |
| remote | Yes | Guest file path |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It only states the copy action and does not mention whether an existing local file is overwritten, whether directories are created, or what happens on failure. This is a meaningful gap for a mutating file operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single clear sentence with no filler. The essential direction and action are front-loaded, and every word contributes to understanding the tool's purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The purpose and all three required parameters are fully specified, which is adequate for a basic copy invocation. However, with no annotations and no output schema, the lack of behavioral details such as overwrite semantics and error handling leaves a small but real gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already defines vm, local, and remote with adequate descriptions. The tool description restates the guest/host mapping that is already present in the parameter descriptions and adds no new parameter-level detail, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb, 'Copy', and clearly identifies both source ('guest') and destination ('host'). This directionality distinguishes it from the sibling file_push, which is the reverse operation, so an agent can immediately understand what the tool does.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The 'from the guest to the host' phrasing provides clear operational context and implicitly separates this tool from file_push. However, it does not explicitly state when not to use it or mention alternatives, so it stops just short of full guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
file_pushA
Copy a file, directory or glob from the host into the guest and verify it.
| Name | Required | Description | Default |
|---|---|---|---|
| vm | Yes | VM name as registered in vms.yaml | |
| local | Yes | Host file, directory or glob (absolute path) | |
| remote | Yes | Guest path; a directory when local is several files | |
| verify | No | Compare SHA-256 after the copy |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden of behavioral disclosure. It explicitly states the verification step ('verify it' and the 'verify' parameter description 'Compare SHA-256 after the copy'), which is a positive behavioral detail. However, it doesn't mention potential side effects like overwriting existing files, permission requirements, or what happens on failure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is one sentence that efficiently communicates the core function and the verification aspect. No filler, front-loaded with the verb and resource, and immediately understandable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a copy tool with 4 parameters and full schema coverage, the description is mostly sufficient. It explains the operation and the verify flag, but lacks guidance on edge cases (e.g., glob expansion, directory behavior, error handling) and any prerequisite conditions (e.g., VM must be powered on) that an agent would need to know for successful invocation. The sibling tools list suggests a VM management context, but the description doesn't leverage that to add operational context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents each parameter (vm, local, remote, verify) adequately. The description adds slight nuance ('remote' as directory when local is several files) and the verify parameter's purpose is echoed in the description, but it doesn't add significant detail beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear action ('Copy') and the resources involved ('file, directory or glob from the host into the guest') with a verification step. It distinguishes itself from the sibling 'file_pull' which copies in the opposite direction, though it doesn't explicitly name that sibling.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage context: transferring files from host to guest. It does not explicitly state when to prefer this over file_pull or other tools, but the directionality makes it obvious. There's no mention of prerequisites (e.g., guest running) or constraints like needing the VM to be active.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
kd_attachB
Start kd.exe for the VM and (by default) wait until the target connects.
| Name | Required | Description | Default |
|---|---|---|---|
| vm | Yes | VM name as registered in vms.yaml | |
| key | No | Override the key | |
| port | No | Override the port | |
| timeout | No | Seconds to wait for the target | |
| symbol_path | No | Override host.symbol_path | |
| wait_for_target | No | Block until the target connects |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of behavioral disclosure. It does state the default blocking behavior ('by default wait until the target connects'), which is useful. However, it doesn't disclose what happens on timeout, whether the tool returns immediately after starting kd.exe, what side effects occur (e.g., does it modify VM state?), or whether it requires the VM to be running. The description is honest but thin.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that front-loads the core action and default behavior. It's efficient and doesn't waste words. It could add a bit more context, but for its length it's well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 6 parameters and no output schema, the description is somewhat thin. It doesn't explain what happens after the target connects, what the return value looks like, or what prerequisites exist (e.g., VM must be running, kd_setup_host/guest must have been run). The sibling tools suggest a workflow (kd_setup_host, kd_setup_guest, kd_attach, kd_break, kd_go), but the description doesn't situate itself in that workflow. However, the schema covers parameters well, and the core behavior is stated.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all 6 parameters. The description adds minimal value beyond the schema—it doesn't explain how parameters like key, port, or symbol_path override vms.yaml settings, or how timeout interacts with wait_for_target. Baseline 3 is appropriate since the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Start kd.exe') and resource ('for the VM'), and mentions the default wait behavior. It's clear enough to distinguish from siblings like kd_break or kd_go, though it doesn't explicitly name an alternative or elaborate on what 'attach' means in this context.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage: call this to start kd.exe and wait for the target. It doesn't explicitly state when to use this vs alternatives like kd_setup_host or kd_setup_guest, nor does it mention prerequisites like the VM needing to be running. The wait_for_target parameter is described in the schema, but the description doesn't add context about when you'd want to disable it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
kd_breakB
Break into the running target and wait for the kd> prompt.
| Name | Required | Description | Default |
|---|---|---|---|
| vm | Yes | VM name as registered in vms.yaml | |
| timeout | No | Seconds to wait for the prompt |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses the core behavior (halting the target and waiting for the prompt), but omits failure modes such as behavior when the target is not running, whether the break is idempotent if already at the prompt, what happens on timeout expiry, or whether detachment of the break is automatic.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence that states the action and the awaited outcome with zero filler. Every word earns its place for a tool of this simplicity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter debugger-break command with full schema coverage and no output schema, the description is reasonably complete: it states the action and the expected end state. Missing details like timeout failure behavior and prerequisite state (already attached vs. not) are minor given the tool's simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%: 'vm' and 'timeout' are both described in the schema. The description adds little parameter nuance beyond the schema, except that 'wait for the kd> prompt' reinforces what the timeout parameter measures. This meets the baseline for full schema coverage but adds no extra semantic value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Break into') with a clear resource ('the running target') and the expected outcome (the kd> prompt). The action is clear and the intent is distinguishable from siblings like kd_go (resume), kd_attach, and kd_detach, though it doesn't name which sibling it differs from.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. With siblings kd_go (resume execution), kd_attach, and kd_state, an agent would benefit from knowing that kd_break halts a running target and should later be paired with kd_go to resume. Nothing about prerequisites (e.g., must already be attached) or exclusions is given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
kd_detachA
Resume the target if needed and stop kd.exe.
| Name | Required | Description | Default |
|---|---|---|---|
| vm | Yes | VM name as registered in vms.yaml | |
| force | No | Kill kd.exe without resuming the target |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the behavioral burden. It does disclose the normal sequence—resume the target if needed, then stop kd.exe—and the force parameter documents the kill-without-resume path. However, it does not state whether force leaves the target suspended, what happens if no debugger is attached, or any permission or side-effect implications.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no filler. 'Resume the target if needed' and 'stop kd.exe' are both load-bearing, and the description is appropriately sized for a simple two-parameter tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter tool with no output schema, the inputs are fully covered by the schema and the description explains the primary action and normal behavior. It is not fully complete because it lacks explicit when-to-use context and leaves some force-path consequences to the parameter description rather than the main description, but it is adequate for correct invocation in most cases.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the vm and force parameters are already fully documented in the input schema. The tool description adds no additional parameter-level meaning beyond implying the conditional behavior of the non-force path, which is also covered by the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a concrete action—'stop kd.exe'—and adds the key conditional 'Resume the target if needed,' which clearly identifies this as the detach/cleanup operation. It distinguishes itself from sibling tools like kd_attach, kd_break, and kd_go without relying on the tool name alone.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The purpose is implied by 'stop kd.exe' and the sibling context, but the description does not explicitly say when to use this tool versus alternatives like kd_go or kd_break. There is no guidance on when the force option is appropriate or how this relates to the rest of the kd_* workflow.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
kd_execB
Run one or more debugger commands at the kd> prompt and return each command's output.
| Name | Required | Description | Default |
|---|---|---|---|
| vm | Yes | VM name as registered in vms.yaml | |
| cmd | No | One debugger command | |
| cmds | No | Several commands, run in order | |
| timeout | No | Seconds per command | |
| max_bytes | No | Cap on each command's output |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description bears the full burden of behavioral disclosurecars. It states that output is returned, but it does not disclose that debugger commands can mutate kernel/VM state, that commands may depend on an attached debugger session, or that timeout/size caps affect behavior. This is a meaningful gap for a generic command-execution tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with no filler. It states the action, the target environment, and the expected result immediately, earning every word.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The schema is rich and covers all parameters, and the description supplies the essential execution context. However, with no annotations and no output schema, the definition is incomplete for safe invocation: it omits side-effect warnings, prerequisites like an active attach, and any guidance about choosing kd_exec over shell execution. It is minimally viable for basic use but not fully robust.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds only the relationship between one or more commands and per-command output, which the schema's cmd/cmds descriptions already convey. No novel parameter-level meaning is added.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb ('Run'), a specific resource ('debugger commands at the kd> prompt'), and a clear result ('return each command's output'). It also distinguishes kd_exec from the specialized kd_* siblings by positioning it as the generic command execution entry point.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit when-to-use or when-not-to-use guidance, and no mention of alternatives such as kd_break, kd_go, or term_exec. The reader must infer that this tool is for arbitrary debugger commands rather than shell commands, and the description never directs the agent toward or away from sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
kd_goD
Resume the target (g).
| Name | Required | Description | Default |
|---|---|---|---|
| vm | Yes | VM name as registered in vms.yaml |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full responsibility. It only says 'Resume', implying a state change, but does not disclose side effects, prerequisites, required VM state, or whether it affects a debug session. No behavioral detail beyond the verb.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single brief sentence, which is concise. However, it lacks structure and clarity: 'target (g)' is cryptic, and the sentence does not front-load useful information. It is concise but not effective.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with one parameter and no output schema, the description is grossly incomplete. It does not explain what 'go' does, the expected VM state, or how it relates to other kd_* or vm_* tools. An agent would need to guess the purpose and usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has one parameter 'vm' with description 'VM name as registered in vms.yaml', which is clear and self-explanatory. Schema coverage is 100%, so the baseline is 3. The description adds nothing about the parameter beyond the schema, so it earns the baseline score.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Resume the target (g)' states a verb ('Resume') but the resource is vague: 'target (g)' could mean guest, but it's not explicit. It does not distinguish from sibling tools like vm_resume, which likely also resumes a VM. No clear resource or scope is defined, making it ambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool vs alternatives. The sibling list includes vm_resume, kd_attach, kd_break, etc., but the description offers no conditions or exclusions. An agent cannot determine whether to call kd_go or vm_resume without additional context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
kd_log_tailC
Last bytes of the kd.exe transcript.
| Name | Required | Description | Default |
|---|---|---|---|
| vm | Yes | VM name as registered in vms.yaml | |
| bytes | No | How many bytes from the end |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of explaining behavior. It implies a read-only operation but does not state whether it blocks, what happens if no transcript exists, whether the output is raw text or paginated, or whether it affects the debugging session in any way.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, tight sentence with no filler. It is appropriately sized for a simple tail operation, though it sacrifices useful structural elements such as an explicit return-value word or usage context.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter read tool, the description plus schema is minimally sufficient to understand invocation. However, with no output schema and no annotations, an agent is left to infer how the bytes are delivered, what encoding or format to expect, and what error conditions may occur.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and both 'vm' and 'bytes' are already described with defaults and constraints. The description adds the useful context that the target is the kd.exe transcript, but it does not materially enrich the meaning of the individual parameters beyond what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The phrase 'Last bytes of the kd.exe transcript' clearly identifies the resource being read (the kd.exe transcript) and the operation (retrieving its tail end). It is meaningful and distinct enough from kernel-debugging siblings like kd_state or kd_exec, though it lacks an explicit verb like 'read' or 'return'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives, no prerequisites, and no mention of whether it requires an attached or active kernel session. The sibling list shows many kd_* tools, but the description does not place kd_log_tail in that workflow.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
kd_setup_guestA
Enable kernel debugging in the guest with bcdedit over SSH (serial or KDNET per kd_transport) and store the KDNET port and key in vms.yaml.
| Name | Required | Description | Default |
|---|---|---|---|
| vm | Yes | VM name as registered in vms.yaml | |
| key | No | KDNET key; generated when omitted | |
| port | No | KDNET UDP port |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden and does a good job: it discloses the mutation ('Enable kernel debugging'), the mechanism ('bcdedit over SSH'), the transport alternatives, and a concrete side effect ('store the KDNET port and key in vms.yaml'). It does not mention prerequisites like SSH reachability or whether a reboot is required, but the core behavioral profile is clear.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single efficient sentence that front-loads the main verb and resource, then provides mechanism and persistence detail in order of importance. There is no filler or repetition of schema fields.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a setup tool with no annotations and no output schema, the description covers the main action, mechanism, and persistence, but omits operational prerequisites such as the guest being reachable over SSH, whether the debugger becomes active immediately, or how this interplays with kd_setup_host/kd_attach. It is adequate for basic selection but not fully complete for a safe, correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds value beyond the schema by explaining that key and port are KDNET parameters that get persisted to vms.yaml, which clarifies why the agent should care about them and how they relate to the overall setup flow. It does not add detail about the vm parameter, but the schema already describes it sufficiently.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific action and resource: 'Enable kernel debugging in the guest' via bcdedit over SSH. The 'guest' qualifier distinguishes this from the sibling kd_setup_host, and mentioning 'serial or KDNET per kd_transport' shows the transport modes it handles. This is specific and actionable, not a tautology.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is for guest-side kernel debugging setup and references kd_transport as the transport selector, but it does not explicitly say when to choose this over kd_setup_host or when not to use it. No alternative tactic or exclusion condition is given, so the agent must infer the intended context from sibling names.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
kd_setup_hostB
Prepare the host side of the kd transport: serial adds the named-pipe COM port to the vmx (VM must be off), net reports the one-time firewall step.
| Name | Required | Description | Default |
|---|---|---|---|
| vm | Yes | VM name as registered in vms.yaml |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral burden. It does disclose a real side effect: modifying the vmx by adding a COM port, plus the VM-off prerequisite. However, the net path is vague—'reports the one-time firewall step' could mean it merely prints instructions or that it actually performs a firewall change—and there is no mention of idempotency, permissions, or return behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is one dense sentence that front-loads the main purpose and then compresses the serial and net variants. It is reasonably concise, though the compact split between serial and net creates mild ambiguity about how the mode is selected.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter tool, the description includes the essential purpose, a concrete file modification, the VM-off prerequisite, and an output-like behavior for net. It is incomplete because it does not explain how the serial versus net path is chosen or whether the net step actually modifies the firewall or only reports the command, and there is no output schema or annotation to fill those gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already fully documents the single 'vm' parameter with 'VM name as registered in vms.yaml', so the description contributes no additional parameter-level meaning. With 100% schema coverage, the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states that this tool prepares the host side of the kd transportched and gives concrete detail for both serial ('adds the named-pipe COM port to the vmx') and net ('reports the one-time firewall step'). It is distinguishable from sibling kd_setup_guest because the host side is explicit, though the mode-dependent behavior could be spelled out more clearly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use it: host-side kd transport setup. It also discloses the important prerequisite that the VM must be off for the serial path. However, it does not explicitly name kd_setup_guest as the alternative or state when this tool should not be used, so the guidance is more implied than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
kd_stateC
Debugger state, transport, target info, last event and log path.
| Name | Required | Description | Default |
|---|---|---|---|
| vm | Yes | VM name as registered in vms.yaml |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It does not explicitly state that the tool is read-only, whether a debugger session must be attached, or what happens if the VM is not reachable. The listed fields imply a snapshot, but the ambiguity about side effects and prerequisites is a significant gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a short, front-loaded noun phrase with no filler words. It is concise and conveys the main topics immediately, but the verbless structure leaves just enough ambiguity that it falls short of a fully polished summary.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-required-parameter tool with no output schema, the description identifies the major content areas (state, transport, target info, event, log path) but does not explain the return shape or behavior when conditions change, such as when no debugger is active. It is minimally adequate for a simple read state but leaves the syntaxy details unspecified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% because the only parameter, vm, already has the description 'VM name as registered in vms.yaml'. The tool description adds no additional meaning about the parameter, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description lists the information the tool exposes: debugger state, transport, target info, last event, and log path. This clearly signals a query/status tool rather than an action tool, which helps differentiate it from siblings like kd_break or kd_go. It lacks an explicit verb such as 'get' or 'show', so it stops short of the ideal 'specific verb + resource' formulation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no explicit when-to-use or when-not-to-use guidance, and no sibcoproducts are mentioned. The intended use (query debugger info for a VM) is only implied by the tool name and noun-phrase description, so an agent gets no concrete criteria for choosing this over kd_log_tail, sys_state, or other read-oriented tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
kd_wait_eventC
Wait until the running target stops (bugcheck, breakpoint, ...) or the timeout expires.
| Name | Required | Description | Default |
|---|---|---|---|
| vm | Yes | VM name as registered in vms.yaml | |
| timeout | No | Seconds to wait for a break |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses that the tool blocks and may timeout, but does not mention side effects (e.g., whether it changes debugger state), whether multiple calls are safe, or how the timeout interacts with ongoing sessions. For a blocking operation, more explicit behavioral context is needed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One sentence, no filler, and the core action and condition are front-loaded. It is concise and to the point.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a blocking tool with no output schema and no annotations, the description is thin. It does not state what happens on return (e.g., reason for break), nor does it clarify prerequisites like being attached to a target. A more complete description would explain the return or typical usage flow.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and both parameters are described in the schema. The description's 'timeout expires' hints at the timeout parameter, but it adds no new meaning beyond what the schema already specifies. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Wait until') and resource ('the running target'), clarifying that it blocks until a debugger event or timeout. It does not explicitly distinguish it from siblings like kd_break or kd_go, but its purpose is clear enough for basic selection.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage (when you need to block until a break event), but provides no guidance on when to use this vs. alternatives like kd_break, kd_go, or kd_state. There is no mention of prerequisites (e.g., target must be attached) or conditions that would make it inappropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
snap_deleteA
Delete a snapshot (and optionally its children). Needs confirm=true.
| Name | Required | Description | Default |
|---|---|---|---|
| vm | Yes | VM name as registered in vms.yaml | |
| name | Yes | Snapshot name | |
| confirm | No | Set true to acknowledge a destructive operation | |
| children | No | Also delete the whole subtree | |
| allow_suspend | No | If deleting a memory snapshot of a running encrypted VM is refused by vmrun, suspend the VM, delete, then resume. Briefly pauses the guest, drops terminal sessions and reattaches the debugger afterwards. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of disclosing destructive behavior. It does say 'Delete' and 'Needs confirm=true,' which conveys that this is a destructive action requiring confirmation. However, it doesn't explicitly state irreversibility, that confirm=false means no deletion occurs, or the side effects mentioned in the allow_suspend parameter schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences with no filler. It front-loads the core action ('Delete a snapshot') and immediately gives the critical invocation requirement ('Needs confirm=true'). Every part is useful.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the rich input schema that documents every parameter, the description covers the essential purpose and the destructive confirmation gate. It doesn't mention return values or error behavior, but with no output schema and a clear destructive action, the missing pieces are minor and can be inferred from the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all five parameters. The description adds emphasis on 'confirm=true' and 'optionally its children,' but these map directly onto existing schema parameters and don't provide substantial new semantic detail.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Delete a snapshot (and optionally its children).' It clearly distinguishes this from sibling tools like snap_take, snap_revert, and snap_list by naming the deletion action and the optional subtree scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives such as snap_take or snap_revert. The mention of 'Needs confirm=true' is a prerequisite for invocation, not a usage rule that helps an agent choose between sibling snapshot tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
snap_listB
Snapshot tree of a VM plus the current snapshot and stored metadata.
| Name | Required | Description | Default |
|---|---|---|---|
| vm | Yes | VM name as registered in vms.yaml |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
There are no annotations, so the description carries the burden of behavioral disclosure. It communicates the read-oriented nature and the content returned (tree, current snapshot, stored metadata), but does not mention failure modes, output formatting, or any side effects. This is adequate but not highly detailed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that front-loads the resource and result components. It is compact and free of filler, though the phrasing 'Snapshot tree of a VM' is slightly awkward as an imperative.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter list tool, the description is mostly complete: it names the target VM and the expected output contents. However, there is no output schema and no explanation of return format or error conditions, leaving some gaps in what an agent should expect.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the vm parameter is already well-described as 'VM name as registered in vms.yaml'. The tool description adds no additional parameter semantics beyond confirming the operation is for a single VM, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool as returning the snapshot tree of a VM plus the current snapshot and stored metadata. It is distinguishable from sibling snapshot tools like snap_take, snap_revert, and snap_delete, though it lacks an explicit verb such as 'list'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is for viewing snapshot state for a specific VM, but it does not explicitly state when to prefer this tool over alternatives or mention any exclusions. Usage context is inferable from the tool name and sibling set, not directly stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
snap_revertA
Revert to a snapshot: detach kd, revert, start, reattach kd, reopen terminals.
| Name | Required | Description | Default |
|---|---|---|---|
| vm | Yes | VM name as registered in vms.yaml | |
| name | Yes | Snapshot name | |
| start | No | Power the VM on after the revert | |
| timeout | No | Seconds to wait for kd and ssh | |
| reattach_kd | No | Reattach the kernel debugger | |
| reopen_term | No | Reopen dropped terminal sessions |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full responsibility for behavioral disclosure. It does reveal the multi-step side-effect sequence: detach kd, revert, start, reattach kd, reopen terminals. However, it omits the destructive nature of reverting the VM state and the conditional behavior when start, reattach_kd, or reopen_term are set to false.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single compact sentence with a colon-separated workflow. It is front-loaded with the core action and contains no filler or redundant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 6-parameter mutation tool with no output schema and no annotations, the workflow summary is helpful but incomplete. It lacks guidance on failure/timeout behavior, what the return signals are, and how setting optional flags like start=false changes the workflow.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the input schema already explains each parameter. The description adds procedural context that loosely maps to parameters like reattach_kd and reopen_term, but it does not provide additional parameter-level detail beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific verb and resource ('Revert to a snapshot') and enumerates the concrete steps involved. This distinguishes it from snapshot-related siblings such as snap_take and snap_delete.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The purpose 'Revert to a snapshot' implies when to use the tool, but there is no explicit guidance about when not to use it or how it compares to alternatives like snap_delete or snap_list. The step list is procedural rather than decision-guiding.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
snap_takeA
Take a snapshot (memory included while running) and record description and kd state.
| Name | Required | Description | Default |
|---|---|---|---|
| vm | Yes | VM name as registered in vms.yaml | |
| name | Yes | Snapshot name | |
| description | No | Free text stored with the snapshot | |
| allow_suspend | No | If a live snapshot of a running encrypted VM is refused by vmrun, suspend the VM, snapshot the saved state (includes memory), then resume. Briefly pauses the guest, drops terminal sessions and reattaches the debugger afterwards. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It discloses that snapshots include memory while running, which is a key behavior. The allow_suspend parameter description reveals a significant behavior: it can suspend the VM, briefly pause the guest, drop terminal sessions, and reattach the debugger. This is excellent behavioral transparency for a mutation tool, going beyond just saying 'snapshot.'
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise, a single sentence. It is front-loaded with the main purpose. However, the sentence is somewhat terse and does not elaborate on the 'kd state' recording mentioned in the description; it says 'record description and kd state' but doesn't explain what kd state is or how it's recordedikuha, which could be confusing. It earns a 3 for being appropriately brief but not fully clarifying the tool's full scope.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (4 params, a special allow_suspend behavior, and a described side effect of reattaching the debugger), the description and schema together cover the essentials. There is no output schema, so the description doesn't need to explain return values. The allow_suspend behavior is fully explained in the schema. What's missing is a mention of the kd state recording specifics, but the tool is still sufficiently documented for an agent to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters. The description adds slight context: 'memory included while running' relates to the purpose of including memory, and the allow_suspend parameter is described in detail within the schema itself. However, the description above the schema does not add much beyond what the schema already explains, so a baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action: 'Take a snapshot' of a VM, and includes a key nuance: 'memory included while running.' This clearly distinguishes it from snapshot operations that might not include memory, and the context of sibling tools (snap_list, snap_revert, snap_delete) makes the purpose clear. However, it does not explicitly differentiate from a hypothetical 'snap_create' sibling, but given the listed siblings, it is sufficiently distinct.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use it: when you need a snapshot with memory while the VM is running. However, it does not explicitly state when not to use it or mention alternatives like snap_revert for reverting. The parameter 'allow_suspend' hints at a special case (encrypted VM refusal), providing some context, but there is no explicit guidance on choosing this tool over others.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sys_healthA
Check binaries, config and backend capabilities, then probe every VM: power, guest SSH port and the debugger transport on the host. Run this first.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It discloses the tool's scope (checking binaries, config, backend, VMs) and implies a read-only health check, but it doesn't state whether it has side effects, how long it might take, or what the output format is. The description is honest but not deeply transparent about behavior beyond the listed checks.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no filler. The first sentence lists the full scope of checks, and the second delivers a clear directive. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-argument health-check tool, the description is nearly complete: it tells the agent what will be checked and when to run it. It doesn't describe the return format or how to interpret results, but with no output schema and no annotations, a brief note on what the output contains would push it to 5. Still, the core context for invoking it correctly is present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and the schema already states 'Tool without arguments.' The description adds no parameter-specific meaning because there are none to document. Baseline 4 for zero params is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Check') and names the exact resources: binaries, config, backend capabilities, and every VM's power, guest SSH port, and debugger transport on the host. It clearly distinguishes itself from sibling tools like sys_state or vm_state by covering a broader health-check scope.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'Run this first' explicitly tells the agent when to use this tool, establishing it as the initial diagnostic step before other operations. This is strong usage guidance, though it doesn't explicitly name alternatives or exclusions, the directive is unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sys_stateA
VM power, debugger state, terminal sessions and last events in one answer.
| Name | Required | Description | Default |
|---|---|---|---|
| vm | No | Limit to one VM |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the transparency burden. It signals a non-mutating snapshot through 'state' and 'last events', but does not disclose output shape, freshness, limits, or how the optional vm filtering affects results. It provides modest but not rich behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One sentence, no filler, with the four data domains front-loaded before the 'one answer' payoff. Every word contributes to the description's purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool aggregates multiple subsystems and there is no output schema or annotations, so the description must carry more weight. It lists the included categories but does not explain how they are structured, whether the optional vm filter affects all categories, or what 'last events' covers. This is adequate for selection but leaves invocation details to inference.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the only parameter (vm) is already described as 'Limit to one VM'. The overall description adds no parameter-specific meaning beyond this baseline; it does reinforce that the result is an aggregate answer.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool as a consolidated read/state query returning VM power status, debugger state, terminal sessions, and recent events. The listed domains distinguish it from narrower sibling tools such as vm_state, kd_state, and term_list.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It implies use when a single consolidated state answer is desired ('in one answer'), but gives no explicit when-not conditions or pointers to alternatives. There are many overlapping sibling tools, and the description does not explain how sys_state relates to them.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
term_closeC
Close a session.
| Name | Required | Description | Default |
|---|---|---|---|
| session_id | Yes | Session id from term_open |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of disclosing behavior. It only states that a session is closed, leaving unspecified whether this kills the underlying process, invalidates the session_id, affects buffered output, or is idempotent. For a state-changing tool this is a meaningful gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single clear sentence with no wasted words. It is appropriately front-loaded, though its brevity is partly responsible for the missing behavioral detail penalized elsewhere.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter action, the description plus schema identify the input and the intended operation. However, the absence of annotations, output schema, and lifecycle context make it only minimally complete for an agent deciding when and how to call it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema fully documents the only parameter as 'Session id from term_open,' so the description does not need to repeat it. The tool description adds no parameter-level meaning, but the schema already provides complete coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a precise action ('Close') and a clear resource ('a session'), so an agent can tell it is the counterpart to term_open. It is less explicit about how it differs from other terminal lifecycle tools, but the verb-resource pair is sufficient for basic distinction.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No usage guidance is provided: it does not say to invoke this after term_open, whether it should precede other operations, or what conditions make closing appropriate. The lifecycle implication is present but left entirely to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
term_execB
Run one command in the session and return only its output and exit code.
| Name | Required | Description | Default |
|---|---|---|---|
| cmd | Yes | Command to run in the shell | |
| timeout | No | ||
| max_bytes | No | ||
| session_id | Yes | Session id from term_open |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must carry the behavioral burden. It does disclose the core behavior: runs one command and returns output and exit code, implying a non-interactive, synchronous execution. However, it does not mention blocking behavior, timeout effects, output truncation, or potential side effects on the session.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no filler. Every word contributes to understanding what the tool does and returns.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple, but the description omits any mention of timeout or max_bytes semantics, and there is no output schema to clarify the return format beyond 'output and exit code'. It also lacks guidance about appropriate use cases relative to siblings, leaving the agent to guess on edge cases.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 50%, with cmd and session_id documented in the schema but timeout and max_bytes not described in either schema or description. The description adds no parameter-level meaning and fails to compensate for the gaps in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('Run one command'), a resource ('in the session'), and the exact return ('only its output and exit code'). This clearly distinguishes it from sibling tools like term_send or term_read, which handle streaming or interactive I/O.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance on when to use this tool versus term_send, term_read, kd_exec, or other siblings. There is no mention of alternatives or conditions for choosing this tool, leaving the agent to infer usage from the name and schema alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
term_listC
List terminal sessions and their state.
| Name | Required | Description | Default |
|---|---|---|---|
| vm | No | Only sessions of this VM |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must carry the full burden. It states 'List terminal sessions and their state' which implies a read-only operation, but it doesn't disclose whether it's safe, whether it requires authentication, or what 'state' means (e.g., active, idle). The description adds minimal behavioral context beyond the obvious.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, concise and directly states the action. It's front-loaded with the verb. However, it is so short that it misses opportunities to provide useful context, but conciseness itself is good. It earns a 4 for brevity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool is a list operation with an optional filter, the description is minimal. It doesn't explain what 'state' includes, how to interpret the output, or typical use cases. With no output schema and no annotations, the description should provide more context to help the agent know what to expect, but it doesn't. It is functionally minimal but incomplete for a tool in a terminal context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has one optional parameter 'vm' with a description 'Only sessions of this VM', and schema coverage is 100%, so the schema already documents the parameter. The description doesn't add any additional meaning about the parameter (e.g., format, default behavior, or what happens if null). Given high coverage, a baseline of 3 might be expected, but the description adds no value beyond the schema, and the parameter is not explained in the description at all, so a 2 is more appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear verb and resource ('List terminal sessions and their state'), so the purpose is identifiable. However, it does not distinguish it from related terminal tools like term_open, term_close, term_read, etc., and the sibling set includes many session-related tools. It is minimally clear but lacks differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. It doesn't mention that it only lists sessions (not content or control) or that it can be filtered by VM. The distinction from term_read (which probably reads session output) or sys_state is not provided, leaving the agent to infer when to call it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
term_openB
Open a real-time PTY session (SSH) on the guest and return its session_id.
| Name | Required | Description | Default |
|---|---|---|---|
| vm | Yes | VM name as registered in vms.yaml | |
| cols | No | ||
| rows | No | ||
| shell | No | Shell to start; defaults to guest.shell from vms.yaml | |
| transport | No | Transport | auto |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It states the primary action and output, but omits important lifecycle consequences: the session persists until closed, consumes guest resources, and should be cleaned up with term_close. This makes the behavioral transparency incomplete for a stateful operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, focused sentence with no filler. The core action is front-loaded, and every remaining word contributes meaning, making it highly efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Because there is no output schema and no annotations, the description must cover more ground. It mentions the returned session_id but does not explain how to use it with sibling tools, that sessions remain open until term_close, or any guest/SSH prerequisites. This is a meaningful gap for an agent managing an interactive session lifecycle.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds some parameter context: 'SSH' clarifies the transport parameter and 'real-time PTY' implies that cols and rows are terminal dimensions. However, most parameter meaning is left to the schema, and the schema's transport description is only 'Transport' while cols/rows lack semantic descriptions, so the description only partially compensates.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Open'), names the resource ('real-time PTY session (SSH) on the guest'), and states a concrete return value ('session_id'). This clearly distinguishes it from sibling tools like term_close, term_send, term_read, term_exec, term_resize, and term_list, which act on an already-open session.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit usage guidance is provided. The description does not say when to prefer term_open over term_exec, that term_open should precede term_send/term_read/term_close, or mention prerequisites such as the VM being running and SSH being available. Usage context is only weakly implied by the word 'Open'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
term_readC
Read new output (delta), wait for a regex (until), or render the screen (mode=screen).
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | delta | |
| clean | No | Strip terminal control sequences | |
| until | No | Regex to wait for (delta mode) | |
| cursor | No | Absolute cursor; omit to continue | |
| timeout | No | Seconds to wait when until is set | |
| max_bytes | No | ||
| session_id | Yes | Session id from term_open |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It mentions waiting for a regex (implying blocking) but does not disclose cursor advancement, cleanup behavior, non-destructive nature, or what happens on timeout. The description is too terse to convey side effects or operational semantics.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that captures the core functionality with no redundant words. It is appropriately sized for a simple summary, though it sacrifices depth for brevity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (7 params, no output schema, no annotations), the description is incomplete. It omits return format, blocking behavior, cursor semantics, and when to use which mode. An agent would need to rely heavily on the schema and prior experience to use it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 71%, so the schema already documents most parameters. The description adds meaning by linking 'delta' and 'until' to modes, and 'screen' to rendering, which helps interpret mode and until. However, it does not explain cursor, timeout, or max_bytes beyond their schema descriptions, so it only partially compensates.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool reads new output (delta), waits for a regex (until), or renders the screen (mode=screen), giving a specific verb and resource. It distinguishes between three modes but does not explicitly tie it to a terminal session, though the name and session_id parameter imply it.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for reading terminal output but does not explain when to prefer this over siblings like term_list (list sessions) or term_send (write). No exclusions or alternative routing are provided, leaving an agent to infer when this is the appropriate tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
term_resizeD
Resize the PTY.
| Name | Required | Description | Default |
|---|---|---|---|
| cols | Yes | ||
| rows | Yes | ||
| session_id | Yes | Session id from term_open |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full responsibility for disclosing behavior. It only states 'Resize the PTY,' revealing nothing about side effects (e.g., changing terminal dimensions, possible disruption of output), permissions, or reversibility. For a mutation tool with no annotation safety signals, this is a critical gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with zero structural organization. While it is short, this is under-specification rather than conciseness—vital information about the session and effect is omitted. It is not front-loaded with key constraints or usage context.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (3 required params, no output schema, no annotations), the description is grossly incomplete. It omits the session dependency, the meaning of cols/rows, and any behavioral side effects. An agent cannot reliably invoke this tool correctly based solely on the definition.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema covers only session_id with a description, leaving cols and rows undocumented. The description 'Resize the PTY.' adds no meaning about what cols and rows represent or how they relate to the session. With schema coverage at 33% (below 50%), the description should compensate but fails entirely to explain parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Resize the PTY.' identifies a specific verb and resource, but it is extremely terse. It does not mention that this applies to an existing terminal session, nor does it distinguish from siblings like term_open or term_send. The verb is clear but the context is minimal, so an agent could guess the purpose but lacks precision.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives. No mention of prerequisites (e.g., a session from term_open), no exclusions, and no reference to sibling tools. The implication that it is for resizing an existing PTY is implicit at best, but the description leaves the agent without actionable context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
term_sendB
Type text and/or a burst of keys into a session. Tokens: {enter} {tab} {esc} {ctrl+c} {up}.
| Name | Required | Description | Default |
|---|---|---|---|
| keys | No | Burst of keys or text chunks | |
| text | No | Text to type; {tokens} like {ctrl+c} are expanded | |
| enter | No | Press Enter after the text | |
| session_id | Yes | Session id from term_open |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must fully disclose behavioral traits. It only says what the tool does and lists tokens; it does not mention side effects, failure modes, whether it blocks, or if it requires a prior open session. For a mutation operation, this is a significant gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One sentence with the action front-loaded, followed by a compact token list. No filler; every word contributes meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and no annotations, the description should explain return behavior and interaction between parameters (e.g., whether text and keys are combined, if enter defaults to true). It does not describe what happens when invoked or how the outcome is reported, leaving an agent uncertain about post-call behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters including the token expansion in 'text'. The description adds a token list, but that largely duplicates what the schema already states. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific action (type) and target (a session), and distinguishes from siblings by focusing on input rather than reading or resizing. The listed tokens clarify the input format. This is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit when-to-use or when-not-to-use guidance. It does not contrast with term_exec, term_read, or other siblings, nor does it mention prerequisites like an active session from term_open. The usage context is only implied by the description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
vm_listA
List registered VMs with power, debugger and terminal state.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must carry the behavioral burden. 'List' implies a read-only operation and the mention of state categories adds context, but it does not explicitly state that the tool is non-mutating, how 'registered' is defined, or what happens when no VMs exist. For a simple list tool this is acceptable but not fully transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The entire description is one short, front-loaded sentence that states the action, resource, and output scope without any filler. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a low-complexity, no-argument tool, and the description covers its main purpose and output categories. It lacks a stated return format or edge-case behavior, but for a tool this simple the missing details are unlikely to prevent correct invocation or interpretation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and 100% schema coverage, so there is no parameter information the description needs to add. The description appropriately focuses on what the tool returns, which is the only meaningful semantic content for this tool.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a clear verb ('List') with a specific resource ('registered VMs') and names the key output dimensions: power, debugger, and terminal state. This clearly differentiates it from sibling tools like vm_state or sys_state by indicating a multi-state listing behavior.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no explicit guidance on when to use vm_list versus sibling tools such as vm_state, vm_start, or sys_state. It implies a listing use case, but there are no exclusions, prerequisites, or alternative tool references, leaving the agent to infer routing from the name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
vm_rebootA
Reboot the guest (soft, hard or from the debugger) and bring kd and terminals back.
| Name | Required | Description | Default |
|---|---|---|---|
| vm | Yes | VM name as registered in vms.yaml | |
| mode | No | soft: shutdown /r in the guest; hard: hypervisor reset; kd: .reboot at kd> | soft |
| confirm | No | Set true to acknowledge a destructive operation | |
| timeout | No | Seconds to wait for the guest | |
| reattach_kd | No | Bring the debugger back after boot | |
| reopen_term | No | Reopen dropped terminal sessions |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It does clearly state the main action and that kd and terminals are restored, but it omits the destructive nature of hard reboots and the need to set confirm=true. The schema's confirm parameter hints at destructiveness, but the description itself remains thin on side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no filler. Every phrase contributes meaning, and it avoids repeating parameter names or schema details, making it an efficient and well-structured definition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a moderately complex tool with 6 parameters and no output schema, the description plus the well-detailed input schema is nearly complete. The core behavior is fully described, though explicit usage guidance and a destructive-action warning would make it fully self-sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds value beyond the schema by linking the mode options to soft/hard/kd and by framing reattach_kd and reopen_term as 'bring kd and terminals back,' providing useful semantic context that is not explicit in the parameter names alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Reboot'), the resource ('guest'), and enumerates the available modes ('soft, hard or from the debugger'). It also adds the distinctive effect of bringing kd and terminals back, which clearly differentiates it from sibling tools like vm_stop, vm_start, and vm_suspend.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no explicit guidance on when to use this tool over alternatives such as vm_stop/vm_start or kd_attach. There are no when-to-use or when-not-to-use instructions, nor any named alternatives, leaving the agent to infer usage context from the tool name and sibling list.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
vm_resumeB
Resume a suspended VM (same as vm_start).
| Name | Required | Description | Default |
|---|---|---|---|
| vm | Yes | VM name as registered in vms.yaml |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It states the action (resume) and equivalence to vm_start, but it does not disclose side effects, prerequisites, whether the VM must already be suspended, or what happens if the VM is not suspended. For a state-changing VM operation, this is a meaningful gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single short sentence with a useful parenthetical clarification. Every word earns its place, and the key action is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter tool with full schema coverage, the description is mostly complete. However, it lacks behavioral context such as whether the VM must be in a suspended state, whether the operation is asynchronous, or what errors might occur. The equivalence to vm_start helps, but the description could do more to make the tool safely invocable.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents the single 'vm' parameter as 'VM name as registered in vms.yaml'. The description adds no additional parameter meaning beyond the schema, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Resume a suspended VM', and it explicitly equates the behavior with vm_start, which helps distinguish it from other VM lifecycle tools. It is clear but relies on the parenthetical to differentiate it from vm_start rather than fully standing alone.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is for resuming a suspended VM, which gives clear context for when to use it. It does not explicitly state when not to use it or name alternatives beyond the parenthetical equivalence to vm_start, so usage guidance is adequate but not fully explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
vm_startC
Power on (or resume) a VM without the GUI by default.
| Name | Required | Description | Default |
|---|---|---|---|
| vm | Yes | VM name as registered in vms.yaml | |
| gui | No | Show the VMware console window |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of disclosing behavioral traits. It does convey the headless-by-default behavior, but it does not specify what happens if the VM is already running, whether the operation can fail due to VM state, or what output is returned. The 'or resume' hint is vague about state handling.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, compact sentence with the primary action front-loaded. It wastes no words, though it could have been slightly more informative about state behavior or sibling relationship without becoming verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple start tool, the description gives the core purpose, but it omits important contextual details: how to handle an already-running VM, the distinction from vm_resume, and any prerequisites beyond the schema-documented 'vm' parameter. Since there is no output schema and no annotations, these gaps leave the agent with material uncertainty.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both parameters (vm and gui) are already documented in the input schema. The description adds no new parameter-level detail beyond reinforcing that GUI is off by default, which is already encoded in the schema's default value. A baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: 'Power on (or resume) a VM'. It clearly indicates the tool's action, but the phrase '(or resume)' overlaps semantically with the sibling tool vm_resume, so differentiation from that sibling is not fully addressed.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies that this tool starts a VM headlessly, which is a clear usage context, but it provides no explicit guidance on when to use vm_start versus sibling tools like vm_resume, vm_stop, or vm_suspend. No exclusions or alternative conditions are given, leaving selection partly to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
vm_stateB
Power, debugger and terminal state of one VM.
| Name | Required | Description | Default |
|---|---|---|---|
| vm | Yes | VM name as registered in vms.yaml |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It only lists the data domains covered and does not explicitly state that the operation is read-only, whether a VM must be running, or what failure modes exist. A 'state' query is plausibly safe, but the agent must infer that from the name rather than from stated behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise phrase that front-loads the three state categories and contains no filler or repetition. It is appropriately sized for a one-parameter state inspection tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple, read-like tool with full schema coverage, the high-level scope is minimally viable. However, with no output schema or annotations, the agent still lacks information about the response format and any prerequisites such as VM power state or guest agent availability. The sibling tool names provide context but do not make the description self-sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already documents the single parameter vm as 'VM name as registered in vms.yaml,' giving 100% schema description coverage. The tool description adds no additional parameter-level meaning. With the schema fully covering the parameter, the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific resource ('one VM') and enumerates the three state aspects covered: 'Power, debugger and terminal state.' This distinguishes it from broader state tools like sys_state or kd_state. It lacks an explicit verb such as 'retrieves' or 'gets,' but the intent is still clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to use vm_state versus related siblings such as kd_state, term_list, sys_state, or vm_list. There are no exclusions, alternatives, or contexts mentioned. The only implied scoping is 'one VM,' which is insufficient for an agent to confidently route among the sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
vm_stopA
Shut the guest down (soft) or cut power (hard, needs confirm=true).
| Name | Required | Description | Default |
|---|---|---|---|
| vm | Yes | VM name as registered in vms.yaml | |
| mode | No | soft asks the guest to shut down; hard cuts power | soft |
| confirm | No | Set true to acknowledge a destructive operation |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the safety burden. It clearly discloses that soft asks the guest to shut down while hard cuts power, and that hard needs explicit confirmation. This is meaningful behavioral context, though it does not describe side effects like possible data loss from hard power-off or whether the call waits for shutdown completion.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, compact sentence that front-loads the main operation and packs the mode distinction and confirmation requirement into minimal words. No filler or redundant restatement.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a straightforward three-parameter tool with no output schema, the description provides enough context to invoke it correctly: the VM name comes from vms.yaml, mode is soft or hard, and confirm is required for hard. It does not explain return behavior, but that is not essential here.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds value by explicitly tying confirm=true to hard mode, a relationship the schema only implies through separate field descriptions. This helps an agent understand how the parameters interact.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Shut down' / 'cut power') against a clear resource (the guest VM) and distinguishes the two stopping modes. This separates it from sibling tools like vm_start, vm_reboot, and vm_suspend without needing to open the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives useful within-tool guidance: soft mode is a graceful shutdown, hard mode cuts power and requires confirm=true. However, it does not explicitly state when to prefer this tool over alternatives like vm_reboot or vm_suspend, or mention any preconditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
vm_suspendB
Suspend the VM to disk.
| Name | Required | Description | Default |
|---|---|---|---|
| vm | Yes | VM name as registered in vms.yaml |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. 'Suspend the VM to disk' does reveal that the VM's state is persisted to disk, which is useful, but it does not mention side effects like pausing execution, whether the operation is reversible, or whether it requires a subsequent vm_resume to restore operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single five-word sentence with no filler. It front-loads the action and the persistence detail, making it easy to parse and scan.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter lifecycle tool, the description is minimally adequate: it names the operation and the persistence behavior, and the schema supplies the parameter meaning. However, with no annotations, no output schema, and no mention of postconditions or consequences, it leaves some gaps that an agent must infer from the tool name and siblings.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already documents the only parameter, 'vm', as a name registered in vms.yaml, giving 100% schema description coverage. The tool description adds no extra parameter-level meaning, such as whether the VM must be in a particular state, so the baseline score of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Suspend') and the target ('the VM'), and 'to disk' adds meaningful specificity about persistence. It does not explicitly differentiate from vm_stop or vm_reboot by naming them, but 'suspend' is a well-defined lifecycle verb that separates it from those siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance about when to use this tool versus alternatives like vm_stop, vm_reboot, or vm_resume. The description also omits prerequisites, such as whether the VM must currently be running, so an agent has to infer the proper usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
33 tool updates
v0.1.0- First observed
con_screenshot - First observed
file_pull - First observed
file_push - First observed
kd_attach - First observed
kd_break - First observed
kd_detach - First observed
kd_exec - First observed
kd_go - First observed
kd_log_tail - First observed
kd_setup_guest - First observed
kd_setup_host - First observed
kd_state - First observed
kd_wait_event - First observed
snap_delete - First observed
snap_list - First observed
snap_revert - First observed
snap_take - First observed
sys_health - First observed
sys_state - First observed
term_close - First observed
term_exec - First observed
term_list - First observed
term_open - First observed
term_read - First observed
term_resize - First observed
term_send - First observed
vm_list - First observed
vm_reboot - First observed
vm_resume - First observed
vm_start - First observed
vm_state - First observed
vm_stop - First observed
vm_suspend
TDQS
Scored across 33 tools
Most tools are clearly separated by domain prefix (kd_, con_, file_, term_, vm_, snap_, sys_), and within each domain the action is distinct. The only mild ambiguity is vm_resume vs vm_start (explicitly noted as same) and kd_go vs kd_detach (both resume the target, but one detaches kd.exe).
The naming follows a consistent verb_noun pattern with domain prefixes (kd_*, term_*, vm_*, snap_*, sys_*). Minor deviations: kd_setup_host/kd_setup_guest use setup as a verb, and con_screenshot is the only con_* tool, but overall the pattern is predictable.
33 tools is on the heavy side, but the server covers a broad domain (VM lifecycle, terminal sessions, kernel debugging, snapshots, file transfer, health checks). Each tool has a specific purpose, though some consolidation (e.g., vm_state vs vm_list vs sys_state) could reduce the count.
The tool surface is remarkably complete for the stated purpose: VM lifecycle (start/stop/reboot/suspend/resume), snapshots (list/take/revert/delete), terminal sessions (open/send/read/exec/resize/list/close), kernel debugging (setup/attach/break/go/exec/wait/state/log), file transfer (push/pull), and system health/state. No obvious dead ends.
Maintenance
Related MCP Connectors
Operate Linux, macOS and Windows from your LLM. Every action runs through an auditable allowlist.
Securely control computers you explicitly pair through files, terminals, processes, screenshots, desktop UI/input, clipboard, browser automation, diagnostics, and document tools.
Persistent Linux microVMs for agents: root, internet, sub-second resume and a public URL.
Shared control plane for AI coding agents — tasks, memory, decisions, file locks. 12 tools.
Related MCP Servers
- AlicenseNot gradedqualityCmaintenanceEnables AI agents to interact with Windows operating systems through native UI automation, file navigation, application control, and system commands. Provides seamless integration between LLMs and Windows environments for tasks like clicking, typing, launching apps, and capturing desktop state.MIT
- AlicenseNot gradedqualityBmaintenanceAn MCP server that gives an LLM full control over a VMware-hosted Windows VM: lifecycle, snapshots, remote execution, file transfer, and kernel debugging.MIT
- FlicenseNot gradedqualityBmaintenanceEnables management of VMware Workstation virtual machines, including lifecycle and snapshot operations, through MCP tools accessible by AI assistants.-
- AlicenseNot gradedqualityBmaintenanceMCP server for building and driving VMware Workstation VMs from an AI agent, enabling unattended OS installs, guest command execution, file transfer, screenshots, and fleet management.29 npm1MIT