ellmos-servercommander-mcp
OfficialA local-first MCP server that gives AI agents safe, non-destructive server-ops tooling — HTTP health checks, access-log analysis, dry-run deployment planning, and mail readiness status.
sc_health_check — probe HTTP/HTTPS endpoints; returns status codes and latency, with configurable timeout and batch-safe error handling.
sc_logs_analyze — parse Apache/Nginx access logs from inline text or a local file; status-class breakdown, top paths, with optional persisted JSON report.
sc_deploy — build a safe dry-run deployment plan (default
dry_run=true) with local manifest and profile diagnostics; optional SQLite history record.sc_deploy_status — list configured deployment profiles and recent dry-run history records.
sc_mail_list — alpha mail status/readiness endpoint for listing an IMAP folder (default
INBOX).sc_mail_read — alpha status endpoint for reading a message by
message_id.sc_mail_send — alpha status endpoint that validates send parameters (
to,subject,body) but does not actually send mail yet.sc_mail_search — alpha status endpoint for searching mail via a query string.
Runs unprivileged (no root/sudo), 100% local with zero telemetry, TOML profile config, and localized tool descriptions in 6 languages.
Analyzes Apache access logs to provide insights into status classes, error paths, referrers, suspicious request markers, and optional JSON report persistence.
Analyzes NGINX access logs to provide insights into status classes, error paths, referrers, suspicious request markers, and optional JSON report persistence.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@ellmos-servercommander-mcpCheck the HTTP health of our staging server before we deploy."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
ellmos-servercommander-mcp
Alpha Model Context Protocol (MCP) server for local-first server operations: deployment dry-runs, mail configuration status, access-log analysis, and resilient HTTP health checks.
German README: README_de.md
Part of the ellmos-ai family under the open-bricks open-source umbrella.
Discoverability & AI Search: Published on npm as ellmos-servercommander-mcp, cataloged for MCP ecosystems in server.json, glama.json, and smithery.yaml, and indexed for AI/LLM search in llms.txt.
Quick Navigation
Related MCP server: automation-health-mcp
1. Executive Summary & Core Identity
ellmos-servercommander-mcp is an authoritative, local-first Model Context Protocol (MCP) server engineered specifically for AI coding assistants and autonomous agent platforms (Claude Code, Cursor, Codex, Antigravity, Gemini). It enables agents to safely diagnose server health, analyze web server access logs, inspect mail readiness, and build dry-run deployment plans without exposing production infrastructure to unverified, destructive mutations or arbitrary shell execution.
Every operation is governed by strict local-first and zero-elevation guarantees:
100% Local-First & Zero-Egress by Default: Diagnostic parsing and manifest hashing execute locally; zero telemetry and zero unverified outbound network requests.
Dry-Run & Staging First: Deployment operations calculate SHA-256 tree digests and check target profiles before any remote command is staged.
Unprivileged Execution (
RunAsInvoker): Operates within standard unprivileged user space without requiring root or administrator elevation.
2. Visual Architecture & System Topology
The following diagram illustrates the decoupled layers of ServerCommander, from MCP host transport and Node.js process supervision to Python dispatching, operational engines, and local persistence sinks:
flowchart TD
subgraph HostLayer ["1. MCP Host & AI Client Layer"]
Host["MCP Host: Claude Desktop / Claude Code / Cursor"]
end
subgraph GatewayLayer ["2. Gateway & Process Supervision Layer"]
NodeWrapper["Node.js CLI Wrapper (bin/ellmos-servercommander.js)"]
end
subgraph CoreLayer ["3. Python MCP Server Core Layer"]
FastMCP["Python MCP Server (FastMCP Transport stdio)"]
Dispatcher["Tool Dispatcher & Parameter Validator"]
i18nEngine["i18n Translation Engine (en, de, es, zh, ja, ru)"]
end
subgraph OperationsLayer ["4. Operations & Diagnostics Engines"]
HTTPProbe["HTTP Health Probe (sc_health_check)"]
LogAnalyzer["Apache/Nginx Log Analyzer (sc_logs_analyze)"]
DeployStaging["Deployment Staging & Manifest Planner (sc_deploy / sc_deploy_status)"]
MailDiagnostics["IMAP/SMTP Safety Diagnostics (sc_mail_*)"]
end
subgraph SinkLayer ["5. Local Storage & Audit Sink Layer"]
SQLiteHist[("Local SQLite Deploy History (deploy-history.db)")]
JSONReports[("Sanitized JSON Log Reports")]
AuditSink["Local Diagnostic Outputs & Stdout Stream"]
end
Host <-->|"stdio / JSON-RPC"| NodeWrapper
NodeWrapper <-->|"Child Process Stdio"| FastMCP
FastMCP --> Dispatcher
Dispatcher <--> i18nEngine
Dispatcher --> HTTPProbe
Dispatcher --> LogAnalyzer
Dispatcher --> DeployStaging
Dispatcher --> MailDiagnostics
DeployStaging -.->|"Optional opt-in persist"| SQLiteHist
LogAnalyzer -.->|"Optional persist_report"| JSONReports
HTTPProbe -.-> AuditSink
MailDiagnostics -.-> AuditSinkASCII Architectural Topology (Four-View Projection)
========================================================================================
ellmos-servercommander-mcp: Four-View Architectural Topology
========================================================================================
[VIEW 1: COMPONENT STRUCTURE & TRANSPORT BOUNDARIES]
+----------------------------------------------------------------------------------+
| 1. MCP Host & AI Client (Claude Desktop / Claude Code / Cursor / Codex) |
| - Stdio JSON-RPC transport protocol |
+----------------------------------------------------------------------------------+
|
| (JSON-RPC via stdio stream)
v
+----------------------------------------------------------------------------------+
| 2. Gateway & Process Supervision (bin/ellmos-servercommander.js) |
| - Node.js CLI launcher & process supervisor (update-notifier checks) |
| - Working directory isolation: PYTHONSAFEPATH=1 prevents rogue import hijack |
+----------------------------------------------------------------------------------+
|
| (Supervised child process stdio)
v
+----------------------------------------------------------------------------------+
| 3. FastMCP Dispatcher & i18n Localization Engine (src/servercommander/) |
| - FastMCP server lifecycle, tool schema generation & parameter validation |
| - Multi-language localization engine (6 locales: en, de, es, zh, ja, ru) |
+----------------------------------------------------------------------------------+
[VIEW 2: OPERATIONAL ENGINES & DRY-RUN EXECUTION]
+----------------------------------------------------------------------------------+
| 4. Tool Handlers & Diagnostic Engines |
| - sc_health_check: Non-blocking HTTP/HTTPS probe with timeout & batch error |
| - sc_logs_analyze: Sanitized Apache/Nginx access-log parser & threat detector|
| - sc_deploy / sc_deploy_status: Fail-safe SHA-256 tree hashing & dry-run plan|
| - sc_mail_list / sc_mail_read / sc_mail_send: Dry-run IMAP/SMTP diagnostics |
+----------------------------------------------------------------------------------+
[VIEW 3: LOCAL PERSISTENCE & CONCURRENCY MODEL]
+----------------------------------------------------------------------------------+
| 5. Local Storage & Audit Sinks |
| - Local SQLite Deploy History (deploy-history.db) with explicit lease release |
| - Sanitized JSON diagnostic reports (optional persist_report) |
| - Thread-isolated HTTP GET workers preventing event-loop stalling |
+----------------------------------------------------------------------------------+
[VIEW 4: SECURITY BOUNDARY & ZERO-EGRESS PERIMETER]
+----------------------------------------------------------------------------------+
| 6. Governance & Defense Invariants (INV-LOCAL-01 through INV-SLA-10) |
| - RunAsInvoker: 100% unprivileged user mode; zero root/sudo/UAC requirement |
| - Zero-Egress by default: zero telemetry, zero unverified background outbound |
| - Safe Process Isolation: cwd package exclusion, sanitized error messages |
| - 48h Response SLA & statutory liability limitation (§ 521 BGB) |
+----------------------------------------------------------------------------------+
========================================================================================3. Operations Lifecycle & Execution Sequence Flow
The following sequence diagram demonstrates the lifecycle of operations dispatched by an AI agent through ServerCommander, showing concurrent HTTP probing, log parsing, and dry-run manifest calculation:
sequenceDiagram
autonumber
actor User as AI Assistant / User
participant Host as MCP Host (Claude / Cursor)
participant Wrapper as Node.js Wrapper
participant Server as ServerCommander Server
participant Handler as Operation Handler
participant Disk as Local Disk / SQLite Sink
participant Target as Network Endpoint
User->>Host: "Check API health and prepare deploy manifest"
Host->>Wrapper: JSON-RPC request (stdio)
Wrapper->>Server: Forward request via child process
Server->>Server: Parse parameters & validate config
alt HTTP Health Probe
Server->>Handler: Dispatch sc_health_check
Handler->>Target: HTTP/HTTPS GET (async worker thread)
Target-->>Handler: Status code + Latency response
Handler-->>Server: Health result dictionary
else Access Log Analysis
Server->>Handler: Dispatch sc_logs_analyze
Handler->>Disk: Read access.log & parse entries
Handler->>Disk: Optional write structured JSON report
Handler-->>Server: Aggregated log statistics
else Deployment Staging
Server->>Handler: Dispatch sc_deploy (dry_run=True)
Handler->>Disk: Scan local_path & calculate SHA-256 tree
Handler->>Disk: Optional insert record into deploy-history.db
Handler-->>Server: Manifest digest & profile readiness
end
Server->>Server: Localize response messages (i18n engine)
Server-->>Wrapper: JSON-RPC response
Wrapper-->>Host: Formatted stdio output
Host-->>User: Structured operations summary & next steps4. Target Personas & High-Intent SEO Queries
ServerCommander MCP bridges the critical gap between hazardous raw shell execution and opaque hosting control panels. It equips AI agents with safe, structured diagnostic capabilities for system administration.
Target Personas
Persona ID | Target Persona | Key Challenges & Pain Points | ServerCommander MCP Solution |
| Autonomous AI Agent Engineers & Tooling Architects | High risk of destructive bash commands during agent exploration | Structured JSON-RPC MCP tools with strict non-destructive defaults |
| DevOps & Site Reliability Engineers (SREs) | Undetected file drifts, broken releases, and unsafe sync operations | Deterministic SHA-256 tree hashing and local dry-run deployment plans |
| Security-Conscious System Administrators & SecOps | Credential leakage, root elevation risks, and suspicious traffic bursts | Unprivileged RunAsInvoker execution, secret isolation & forensic log analysis |
| Solo Developers & Full-Stack Maintainers | Tedious manual health monitoring and repetitive log grepping | Instant HTTP health checks and automated bot/error analysis from IDE |
High-Intent Search & SEO Queries
"mcp server operations tools""mcp deploy dry-run server""mcp access log analyzer""mcp http health check tool""local-first server management mcp""claude code server operations mcp""safe sftp deployment planning mcp""ai assistant server preflight checks""apache nginx log analysis mcp""resilient http health check mcp""sqlite deploy history mcp"
5. Comparative Matrix vs. Alternatives
The 10-dimension matrix below contrasts ServerCommander against common server administration approaches, mapped directly to its runtime and governance invariants (INV-LOCAL-01 through INV-SLA-10):
Dimension | Invariant | ServerCommander MCP | SSH / Raw Bash Scripts | Heavy Web Panels (cPanel) | Cloud SaaS APM (Datadog) | Generic Terminal MCP |
1. AI-Native Tool Calling |
| Direct stdio / JSON-RPC schemas | Requires fragile prompt glue | None / Web browser only | Custom API webhooks | Raw unstructured text |
2. Safe Staging & Dry-Run |
| Default | High risk of destructive typo | Opaque web mutation | Read-only agent metrics | Arbitrary command danger |
3. Local-First & Zero-Egress |
| 100% Local / Zero telemetry | Local / Direct remote | Remote host web portal | Constant outbound telemetry | Local shell execution |
4. Privilege Requirements |
| Unprivileged | Often requires sudo / root | Full root system daemon | Root daemon / system agent | Inherits host shell rights |
5. Forensic Log Analysis |
| Regex token parsing + bot audit | Manual grep / awk / sed | Basic UI log viewer | Heavy proprietary agent | Raw grep output |
6. Resilient HTTP Probes |
| Non-blocking thread + batch safe | curl loop (fails on 1st error) | Periodic polling check | Centralized external probe | curl CLI subprocess |
7. Mail Safety Staging |
| Readiness check without send | Direct mail command risk | Webmail interface | Email alert service | Blind mailx invocation |
8. Process & CWD Isolation |
|
| Shell inherits rogue CWD | Fixed daemon user | Sandboxed system service | Inherits caller environment |
9. Cloud-Sync Conflict Defense |
| Built-in gitignore & lock guards | None (git-only) | Database state only | Cloud-hosted dashboard | None |
10. Security SLA & Governance |
| 48h/5d/30d SLA via security@ellmos.ai | Community / self-supported | Vendor commercial support | Enterprise commercial SLA | Unmaintained community |
6. Key Capabilities & Safety Invariants
Invariant | Capability / Rule | Implementation Guarantee | Technical Details |
INV-LOCAL-01 | 100% Local-First & Zero-Egress | Non-destructive diagnostic default | Diagnostics & dry-run planning run locally without unauthorized remote telemetry. |
INV-DRY-02 | Fail-Safe Deployment Staging | Default | Calculates SHA-256 tree digests and verifies profiles before touching targets. |
INV-LOG-03 | Sanitized Access-Log Analysis | Forensic read-only parsing | Regex token extraction detects errors, bots, and path traversal without secret leaks. |
INV-PROBE-04 | Resilient Health Probes | Non-blocking worker threads | HTTP probes execute via |
INV-MAIL-05 | Dry-Run Mail Configuration Status | Safe non-executing staging | Validates IMAP/SMTP configuration and credentials without accidental dispatches. |
INV-PRIV-06 | Unprivileged RunAsInvoker | Zero root/sudo elevation (Non-Elevation) | Runs entirely within standard user permissions; zero administrator rights required. |
INV-SEC-07 | Safe Process & Package Isolation | Rogue package defense | Launcher enforces |
INV-I18N-08 | Native 6-Language i18n Engine | Comprehensive multilingual parity | Localized tool descriptions, schema arguments, and errors for |
INV-SYNC-09 | Cloud-Sync Conflict Hardening | Multi-host gitignore defense | Hardened against OneDrive/Dropbox sync copies ( |
INV-SLA-10 | Bilingual Security SLA | 48h/5d/30d guarantee | Vulnerability response within 48 hours, 5-day triage, and 30-day remediation commitment via |
7. Start Here & Quick Guidance
Goal | Start with | Key Features |
Add ServerCommander to Claude Desktop, Claude Code, Cursor, or another MCP host | Zero-friction global npm install or npx invocation | |
Check a public or internal HTTP endpoint before a deploy |
| Concurrent non-blocking requests, latency timings, resilient batch error handling |
Inspect Apache/Nginx access logs for errors, bots, referrers, and suspicious paths |
| Status code breakdown, byte transfer sums, bot markers, optional JSON reports |
Build a deterministic dry-run deployment manifest before SFTP/SSH execution |
| Recursive SHA-256 tree hashing, symlink bypass protection, SQLite history |
Wire mail operations later without accidental email dispatches today |
| Protocol readiness validation, credential inspection, safe alpha staging |
8. Status & Protocol Support
Transport: Standard I/O (
stdio) via the Python MCP SDK and Node.js process wrapper.Package Status: Public alpha package under the
ellmos-aiorganization.Current Core: MCP tool listing, tool dispatch, TOML configuration loader, HTTP health checks, richer access-log analysis with optional persisted JSON reports, and optional local dry-run deployment history.
Safe Alpha Handlers:
sc_deploybuilds local SHA-256 manifests, configuration diagnostics, and opt-in SQLite history records in dry-run mode;sc_mail_*reports protocol-specific IMAP/SMTP readiness without opening mail connections by default.i18n Localization: Localized MCP tool descriptions, input-schema field descriptions, and unknown-tool errors for
en,de,es,zh,ja,ruwith automatic English fallback.
9. Installation & Prerequisites
The npm package contains a Node wrapper that starts the Python server. You still need Python 3.10+ and the Python package mcp>=1.0.0.
Option 1: Install From npm
npm install -g ellmos-servercommander-mcp@alpha
ellmos-servercommanderOption 2: Install From Source
git clone https://github.com/ellmos-ai/ellmos-servercommander-mcp.git
cd ellmos-servercommander-mcp
$env:PYTHONIOENCODING = "utf-8"
python -m pip install -e ".[dev]"
python -m pytest -qAvoid creating a .venv inside cloud-synced folders if your sync client locks files. If you need an isolated environment, create it outside that folder.
10. MCP Client Configuration & Deployment Modes
Global npm Install
{
"mcpServers": {
"servercommander": {
"command": "ellmos-servercommander"
}
}
}npx Without Global Install
{
"mcpServers": {
"servercommander": {
"command": "npx",
"args": ["-y", "ellmos-servercommander-mcp@alpha"]
}
}
}Direct Python Execution
{
"mcpServers": {
"servercommander": {
"command": "python",
"args": ["-m", "servercommander.server"],
"env": {
"PYTHONPATH": "C:/path/to/ellmos-servercommander-mcp/src",
"SERVERCOMMANDER_CONFIG_PATH": "C:/path/to/config/servercommander.toml"
}
}
}
}11. Configuration & Profiles Specification
ServerCommander searches for configuration files in this hierarchical order:
Environment variable
SERVERCOMMANDER_CONFIG_PATH./servercommander.toml./config/servercommander.toml~/.config/servercommander/servercommander.toml
An annotated template is included at config/servercommander.example.toml.
[server]
name = "servercommander"
log_level = "INFO"
language = "en"
[deploy.profiles.staging]
target = "sftp://staging.example.com/var/www/app"
local_path = "./dist"
protocol = "sftp"
dry_run = true
record_history = true
[mail]
execution_enabled = false
smtp_host = "smtp.example.com"
smtp_port = 587
imap_host = "imap.example.com"
imap_port = 993Secrets should always be referenced through environment variables, for example $MAIL_PASSWORD or $SFTP_PASSWORD.
12. Tools & Handlers Reference
sc_health_check: Checks HTTP/HTTPS endpoints and reports status codes, response headers, and latency. Malformed endpoint URLs are captured gracefully as failed checks rather than aborting the batch.sc_logs_analyze: Analyzes Apache/Nginx access logs from inline text or local files, reporting HTTP status classes (2xx/3xx/4xx/5xx), total bytes transferred, top referrers, 404/500 error paths, suspicious bot markers, and optional JSON report persistence viapersist_report.sc_deploy: Creates a dry-run deployment plan with a local SHA-256 manifest and profile diagnostics without performing remote mutations. Nested symbolic links are tracked asskipped_symlinksto prevent unexpected directory traversal.sc_deploy_status: Displays configured deployment profiles, profile diagnostics, and recent dry-run deployment records retrieved from the local SQLite history database.sc_mail_list,sc_mail_read,sc_mail_send,sc_mail_search: Safe alpha status responses with action-specific IMAP/SMTP readiness diagnostics. With[mail].execution_enabled = true,sc_mail_listexecutes a read-only IMAP reachability probe (connect + folder listing) by reusing the canonicalmail-connectormodule without reimplementing an IMAP client.
13. Search, Disambiguation & Discovery Keywords
ServerCommander is the ellmos operations MCP server for local-first server administration workflows. Use this repository when searching for:
MCP server operations tools
MCP deploy dry-run server
MCP access log analyzer
MCP HTTP health check tool
local-first server management MCP
Claude Code server operations MCP
safe SFTP deployment planning MCP
AI assistant server preflight checks
Apache Nginx log analysis MCP
resilient HTTP health check MCP
SQLite deploy history MCP
It is not the GitHub MCP server, not a generic arbitrary shell-execution MCP server, not a cloud hosting provider control panel, and not an unverified production SFTP/IMAP auto-executor. The current alpha surface is intentionally diagnostic, dry-run first, and safe by default.
14. Sibling Ecosystem Matrix
This MCP server is an integral component of the ellmos-ai ecosystem and the open-bricks open-source software family.
MCP Server Family
Server | Tools | Primary Focus | npm Package |
46 | Filesystem operations, process supervision, sessions, cloud-lock handling | ||
22 | Code analysis, AST inspection, JSON repair, imports, diffs, regex | ||
12 | File repair, encoding correction, format conversion, batch tools | ||
18 | n8n workflow management, deployment, node exploration | ||
20 | MCP stack discovery, profile management, control plane routing | ||
45 | Local-first LLM memory, knowledge base, swarm orchestration | ||
8 | Server operations: health checks, log analysis, dry-run manifests | ||
3 | Headless Blender 3D asset QA and automated FBX reimport | ||
10 | Model-agnostic computer use: screen capture, safety-gated actions |
AI Infrastructure & Developer Tools
Project | Description |
Local-first text-based OS for LLM agents — 113+ handlers, 550+ tools, SQLite memory | |
Model-agnostic computer-use core powering Open Compute MCP | |
Provider-neutral LLM orchestration with auto-routing and budget tracking | |
Lightweight agent memory, connectors, and automation infrastructure | |
Encrypted SQLite transit synchronization & additive read-replica engine | |
Git-hook-driven workflow automation and execution safety boundaries | |
Local-first system composition, module introspection, and fleet verification | |
Antigravity developer companion & telemetry bridge |
Desktop Software Suite
Our partner organization open-bricks provides desktop productivity applications built for the age of AI:
File Management: ProFiler, ExplorerPro, CloudLockFixer
Document Processing: DokuZen, PDFtoPDFocr, FormularErstellen
Developer Tools: DevCenter, CodeBox, automizer-for-claude-desktop
15. Third-Party Licenses & Level 1 SBOM
ellmos ServerCommander MCP is strictly built upon permissive open-source foundations. We maintain zero hidden telemetry, zero proprietary binary blobs, and zero unverified dynamic dependencies.
Direct Runtime: Python MCP SDK (
mcp>=1.0.0, MIT License, Anthropic PBC), Python Standard Library (PSFL-2.0).Node CLI Wrapper:
update-notifier(BSD-2-Clause, Sindre Sorhus) for non-intrusive CLI update checks.Optional Extensions:
paramiko(LGPL-2.1) dynamically imported only when the optional[sftp]extra is explicitly installed.Developer Tooling:
pytest(MIT),pytest-asyncio(Apache-2.0),ruff(MIT/Apache-2.0),hatchling(MIT).Audit Ledger & Level 1 SBOM: Comprehensive license disclosures, full copyright notices, and local-first compliance assurances are documented in THIRD_PARTY_LICENSES.md and plain-text companion THIRD_PARTY_LICENSES.txt. Formal repository attribution is preserved in NOTICE.
16. Security Policy & Operational Limits (48h SLA)
For vulnerability reporting, response SLAs, and local-first security invariant details, see our bilingual SECURITY.md.
Vulnerability Reporting: GitHub Security Advisories or email
security@ellmos.ai/security@open-bricks.org.Response SLA: Initial triage within 48 hours; status updates within 5 business days.
17. Development, Verification & CI Matrix
# Set UTF-8 encoding
$env:PYTHONIOENCODING = "utf-8"
# Run complete pytest test suite
python -m pytest -v
# Run Ruff linter
ruff check .
# Verify Node CLI smoke test
npm run smoke
# Verify npm packaging (dry-run)
npm pack --dry-runFor detailed contribution guidelines, Plan D local development workflow, and quality gates, see CONTRIBUTING.md.
18. Statutory Notice, Liability Limitation & License (§ 521 BGB)
Statutory Disclaimer (§ 521 BGB Gefälligkeitsrecht)
Dieses Open-Source-Softwareprodukt wird als unentgeltliche Schenkung im Sinne der §§ 516 ff. BGB bereitgestellt. Gemäß § 521 BGB ist die Haftung des Urhebers und der Beitragenden auf Vorsatz und grobe Fahrlässigkeit beschränkt. Ergänzend gelten die nachstehenden Haftungsausschlüsse der MIT-Lizenz.
Nutzung auf eigenes Risiko. Keine Wartungsverpflichtung, keine Verfügbarkeitszusicherung, keine Gewähr für Fehlerfreiheit oder Eignung für einen bestimmten Einsatzzweck.
English Summary
This project is an unpaid open-source donation. In accordance with § 521 of the German Civil Code (BGB), liability is restricted strictly to cases of intentional misconduct and gross negligence. Supplemental liability disclaimers are set forth in the MIT License below.
Use entirely at your own risk. No maintenance commitments, no availability guarantees, and no warranties regarding fitness for any particular purpose.
License & Attribution
Distributed under the terms of the MIT License. Copyright (c) 2026 Lukas Geiger. See LICENSE and NOTICE for full details. Third-party licenses and Level 1 SBOM notices are audited in THIRD_PARTY_LICENSES.md.
Available Tools
8 toolssc_deployB
Build a safe deployment plan. Alpha only: execution requires dry_run=true.
| Name | Required | Description | Default |
|---|---|---|---|
| dry_run | No | Build the plan without executing deployment. | |
| profile | No | Deployment profile name. | |
| local_path | No | Local source path. | |
| remote_path | No | Remote target path. | |
| record_history | No | Persist this dry-run deployment plan in the local history database. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It mentions alpha status and a dry_run constraint, but does not disclose side effects such as record_history writing to a local database, permissions, or return behavior. The phrase "execution requires dry_run=true" is also ambiguous because dry_run=true means no execution per the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two compact sentences with no wasted words, and the core purpose is front-loaded before the alpha constraint.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The schema fully documents all five parameters, and the description adds the important alpha/dry_run limitation. However, with no annotations and no output schema, the description omits enough behavioral context (side effects, return values, alternatives) that the definition is only minimally complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the parameter meanings are already documented in the input schema. The description only repeats the dry_run requirement and adds no syntax, format, or interaction details beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: "Build a safe deployment plan." It distinguishes the tool from an actual deployment execution, and the alpha-only note further narrows scope. However, it does not explicitly differentiate itself from the sibling sc_deploy_status tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives a constraint ("Alpha only: execution requires dry_run=true") but no guidance on when to use this tool versus alternatives such as sc_deploy_status. There is no when-to-use or when-not-to-use context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sc_deploy_statusC
Show configured deployment profiles and alpha deployment-history status.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of results. | |
| profile | No | Deployment profile name. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full disclosure burden. 'Show' implies read-only, but there is no mention of auth requirements, whether the profile filter is required or optional, what happens when no profile is given, or how the limit interacts with history versus profiles.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no waste. It is slightly compressed to the point of ambiguity ('alpha deployment-history status'), but it does not pad or bury the key information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a low-complexity read tool with two optional, fully documented params and no output schema, the description is minimally adequate. It still leaves the meaning of the returned deployment status and the 'alpha' qualifier unexplained, which an agent would need to interpret results.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both parameters (limit, profile) are already documented. The description hints at their roles ('configured deployment profiles', 'deployment-history') but adds no syntax, defaults, or filtering semantics beyond what the schema states, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Show') and two concrete resources (configured deployment profiles, deployment-history status), so an agent understands it is a read/status query. It does not, however, differentiate itself from the sibling sc_deploy, and the qualifier 'alpha' is unexplained jargon that muddies what is actually being reported.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no statement of when to call this versus sc_deploy or the other siblings, and no prerequisites or exclusions. Usage is only inferable from the fact that it is a status-style read, which is weak guidance for an agent choosing among eight tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sc_health_checkB
Check HTTP endpoints and return status codes plus latency.
| Name | Required | Description | Default |
|---|---|---|---|
| timeout | No | Request timeout in seconds. | |
| endpoints | No | HTTP endpoint URLs to check. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It usefully discloses the return shape (status codes plus latency) but says nothing about authentication, redirect handling, concurrency, or per-endpoint failure behavior. Adequate disclosure of outputs, silent on operating conditions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single tight sentence with the action and the two return values front-loaded. No filler, nothing to trim.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter read tool with no output schema, stating that it returns status codes plus latency covers the main return-value gap. Deployment/auth context that would make it fully self-sufficient is absent, but nothing critical to invoking it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% – both 'timeout' (seconds, default 5) and 'endpoints' (URL list) are already documented in the schema. The description restates the purpose but adds no format, batching, or default details beyond the schema, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (check), resource (HTTP endpoints), and outputs (status codes plus latency), so the agent immediately knows what the tool does. It doesn't distinguish itself from siblings, but the siblings (sc_deploy, sc_mail_*, sc_logs_analyze) occupy unrelated domains, so cross-confusion risk is low.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance, no prerequisites, and no alternatives named. The health-check intent is only implied by the tool name and the endpoint wording. Nothing tells the agent when this is preferable to reading logs via sc_logs_analyze.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sc_logs_analyzeB
Analyze Apache/Nginx access logs from inline text or a local file path.
| Name | Required | Description | Default |
|---|---|---|---|
| format | No | Log format hint. | |
| log_path | No | Local access-log file path. | |
| log_text | No | Inline access-log text. | |
| top_paths | No | Number of top paths to include. | |
| report_name | No | Optional report filename stem. | |
| persist_report | No | Persist the analysis summary as a JSON report. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden, yet it discloses only the input sources. It says nothing about whether the tool writes anything to disk (relevant given persist_report and report_name), what permissions or file access are required, or how results are returned.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with zero waste; scope and input modes are stated immediately with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With six optional parameters, no output schema, and no annotations, the description is only partially complete. It omits what the analysis yields and the side effect of persisting a report, but the schema covers the individual parameters so the gap is moderate rather than critical.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all six parameters including format, log_path, log_text, top_paths, report_name, and persist_report. The description only restates the two input modes and adds no new parameter semantics, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Analyze) and resource (Apache/Nginx access logs), plus the two input modes (inline text or local file path). This clearly distinguishes it from unrelated siblings like sc_deploy and sc_mail_send, though it does not describe what the analysis produces.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the tool name and the two accepted input sources, but there is no explicit when-to-use/when-not guidance or mention of preconditions. Adequate but leaves the agent to infer context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sc_mail_listC
Alpha mail status endpoint for listing an IMAP folder.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of results. | |
| folder | No | Mail folder name. | INBOX |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden, and it says almost nothing: 'listing' weakly implies read-only, but there is no mention of pagination, return format, ordering, or folder-must-exist behavior. An agent gets minimal signal about what happens on invocation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single short sentence is appropriately sized, but the front-loaded 'Alpha mail status endpoint' framing is noise that misdirects rather than informing. It is concise but not well-structured around the actual operation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No annotations and no output schema mean the description must explain behavior and results, and it does neither. For a list tool with defaults (limit=10, INBOX), an agent lacks the context needed to call it confidently or interpret the response.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and both parameters (limit, folder) are documented in the schema, so the baseline is 3. The description adds no extra meaning such as default pagination behavior or folder-name semantics beyond what the schema already states.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The verb 'listing' and resource 'IMAP folder' are present, so the core action is inferable. However, the lead phrase 'Alpha mail status endpoint' muddles the purpose (status vs. listing) and the description never distinguishes this from siblings like sc_mail_search or sc_mail_read.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this versus sc_mail_search (filtered retrieval) or sc_mail_read (single message). No prerequisites, no exclusions, nothing beyond an implied 'use this to list a folder'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sc_mail_readC
Alpha mail status endpoint for reading a message.
| Name | Required | Description | Default |
|---|---|---|---|
| message_id | No | Message identifier. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden, and it discloses almost nothing: it does not say the operation is read-only, what happens if the message_id is unknown, whether the caller needs authorization, or what the response contains. 'Status endpoint' hints at a return shape but never explains it.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is a single short sentence with no filler, which is structurally clean. The problem is under-specification rather than verbosity, and the most useful information (what it returns) is absent.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read tool with no annotations and no output schema, the description should at least characterize the returned data, but it only offers the ambiguous label 'status endpoint'. With one parameter required and zero required params declared, an agent cannot determine preconditions or expected output from this definition.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% for the single message_id parameter, so the schema already documents it. The description adds no format, source, or lookup guidance beyond that, making the baseline 3 the correct score.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a verb ('reading') and resource ('a message'), which loosely separates it from siblings like sc_mail_list, sc_mail_send, and sc_mail_search. However, the phrase 'Alpha mail status endpoint' is unexplained jargon that muddies whether this reads message content or fetches a delivery/status record, so the purpose is only partially pinned down.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no statement of when to use this tool versus sc_mail_list or sc_mail_search, both of which plausibly retrieve messages. The agent is left to infer that a known message_id is a prerequisite for this tool, and no exclusions or alternatives are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sc_mail_searchC
Alpha mail status endpoint for searching mail.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of results. | |
| query | Yes | Search query. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It does not say whether this is a read-only operation, how results are ordered or paginated, or any auth constraints. 'Status endpoint' is vague and arguably misleading for a search tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is a single short sentence, so it is not bloated, but the phrase 'Alpha mail status endpoint' is filler that occupies the front-loaded position where useful routing information should be. Efficient in length, poor in information density.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a search tool sitting among several mail siblings with no annotations and no output schema, the description is far too thin. It should at minimum explain how search differs from list, what the query matches, and what results look like.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% with only two simple parameters (query, limit), so the schema already documents everything needed. The description adds no syntax, format, or matching-semantics detail beyond the schema, which is the baseline 3 case.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States the verb (searching) and resource (mail), so the general purpose is recoverable. However, the phrase 'Alpha mail status endpoint' is muddled and adds no meaning, and nothing distinguishes it from the sibling sc_mail_list, which could plausibly be mistaken for the same capability.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this versus sc_mail_list or sc_mail_read, no mention of prerequisites, and no indication of what a search query should look like. The agent is left to guess the routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sc_mail_sendC
Alpha mail status endpoint for sending mail; does not send yet.
| Name | Required | Description | Default |
|---|---|---|---|
| to | Yes | Email recipient. | |
| body | Yes | Email body text. | |
| subject | Yes | Email subject. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it does disclose one important trait: the endpoint does not actually send yet, which prevents a false assumption of a side effect. However, it omits auth requirements, what the call returns (no output schema), and whether it errors or silently no-ops, leaving key behavior undefined.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is a single short sentence with no padding, and the caveat is placed immediately after the purpose. The only cost is that the phrasing itself is ambiguous rather than the length.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a three-required-parameter call with no annotations and no output schema, the description should clarify what the invocation returns or does. It only asserts the tool 'does not send yet,' leaving return behavior, error cases, and the resulting state entirely unspecified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and all three required parameters (to, subject, body) carry their own descriptions, so the schema does the heavy lifting. The description adds nothing about parameter formats or constraints, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description is internally muddled: it calls itself a 'status endpoint' for 'sending mail' while also saying it 'does not send yet.' An agent cannot confidently tell whether this sends, checks status, or is a no-op, and the sibling set (sc_mail_list/read/search) offers no disambiguation. The verb+resource pair is stated but immediately undercut.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use, when-not-to-use, or alternative-tool guidance. The phrase 'does not send yet' hints the tool is a stub, but it never tells the agent when this tool should be preferred over other mail siblings or when to avoid it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
8 tool updates
v0.1.0-alpha.21- First observed
sc_deploy - First observed
sc_deploy_status - First observed
sc_health_check - First observed
sc_logs_analyze - First observed
sc_mail_list - First observed
sc_mail_read - First observed
sc_mail_search - First observed
sc_mail_send
TDQS
Scored across 8 tools
Each tool targets a fairly distinct area: deploy vs deploy_status differ by planning versus status inspection, and the four mail tools split cleanly along list/read/send/search. The main risk is sc_deploy vs sc_deploy_status, which could be confused at a glance, but descriptions clarify the boundary.
All tools share an sc_ prefix and snake_case, with mostly predictable noun_verb ordering (sc_mail_list, sc_health_check, sc_logs_analyze). sc_deploy is a bare verb outlier and the mail_* group reads as noun_action rather than verb_noun, but the scheme is readable and consistent overall.
Eight tools is well within a sensible range for a server-commander surface spanning deploy, mail, logs, and health. No obvious redundancy or padding, though half the set is devoted to mail operations that are still alpha stubs.
Mail coverage (list/read/send/search) and deploy (plan + status) are reasonably complete, but several operations are explicitly non-functional alpha status endpoints (send 'does not send yet') and there is no log tailing/filtering beyond one-shot analysis. The server-commander domain lacks service restart, config, or process-management operations, leaving notable gaps.
Maintenance
Related MCP Connectors
An MCP server that provides email capabilities, hosted on Alpic platform
An MCP server that provides email capabilities, hosted on Alpic platform
An MCP server that provides email capabilities, hosted on Alpic platform
Hosted MCP server for inbox health, reporting, and warmup operations.
Related MCP Servers
- AlicenseAqualityDmaintenanceMCP server for running infrastructure health checks with TIBET provenance. It enables users to define, execute, and audit process health checks with dependency chaining and drift tracking.6MIT
- AlicenseAqualityCmaintenanceAn MCP server for auditing automation health, finding failures, stale logs, and non-functional endpoints that report success while quietly failing.7MIT
- FlicenseBqualityBmaintenanceA production-ready MCP server offering text analysis tools, an in-memory key-value store, and system info resources with support for both stdio and HTTP transports.4-
- AlicenseNot gradedqualityBmaintenanceMCP server providing read-only operational tools (logs, metrics, traces, service health, config) for troubleshooting an environment, with one exception for toggling chaos scenarios.MIT