Skip to main content
Glama
ellmos-ai

ellmos-servercommander-mcp

Official

ellmos-servercommander-mcp

Alpha Model Context Protocol (MCP) server for local-first server operations: deployment dry-runs, mail configuration status, access-log analysis, and resilient HTTP health checks.

German README: README_de.md

Part of the ellmos-ai family under the open-bricks open-source umbrella.

License: MIT npm version CI Pytest Python Node.js Platforms MCP Status: alpha Privacy: Local-First RunAsInvoker Third-Party: Level 1 SBOM Contributing: Guide Verified: 2026-10-02 Marketing: Log Security: Bilingual Policy Ecosystem: ellmos--ai open-bricks LLM--Ready: llms.txt

NOTE

Discoverability & AI Search: Published on npm as ellmos-servercommander-mcp, cataloged for MCP ecosystems in server.json, glama.json, and smithery.yaml, and indexed for AI/LLM search in llms.txt.


Quick Navigation

  1. Executive Summary & Core Identity

  2. Visual Architecture & System Topology

  3. Operations Lifecycle & Execution Sequence Flow

  4. Target Personas & High-Intent SEO Queries

  5. Comparative Matrix vs. Alternatives

  6. Key Capabilities & Safety Invariants

  7. Start Here & Quick Guidance

  8. Status & Protocol Support

  9. Installation & Prerequisites

  10. MCP Client Configuration & Deployment Modes

  11. Configuration & Profiles Specification

  12. Tools & Handlers Reference

  13. Search, Disambiguation & Discovery Keywords

  14. Sibling Ecosystem Matrix

  15. Third-Party Licenses & Level 1 SBOM

  16. Security Policy & Operational Limits (48h SLA)

  17. Development, Verification & CI Matrix

  18. Statutory Notice, Liability Limitation & License (§ 521 BGB)


Related MCP server: automation-health-mcp

1. Executive Summary & Core Identity

ellmos-servercommander-mcp is an authoritative, local-first Model Context Protocol (MCP) server engineered specifically for AI coding assistants and autonomous agent platforms (Claude Code, Cursor, Codex, Antigravity, Gemini). It enables agents to safely diagnose server health, analyze web server access logs, inspect mail readiness, and build dry-run deployment plans without exposing production infrastructure to unverified, destructive mutations or arbitrary shell execution.

Every operation is governed by strict local-first and zero-elevation guarantees:

  • 100% Local-First & Zero-Egress by Default: Diagnostic parsing and manifest hashing execute locally; zero telemetry and zero unverified outbound network requests.

  • Dry-Run & Staging First: Deployment operations calculate SHA-256 tree digests and check target profiles before any remote command is staged.

  • Unprivileged Execution (RunAsInvoker): Operates within standard unprivileged user space without requiring root or administrator elevation.


2. Visual Architecture & System Topology

The following diagram illustrates the decoupled layers of ServerCommander, from MCP host transport and Node.js process supervision to Python dispatching, operational engines, and local persistence sinks:

flowchart TD
    subgraph HostLayer ["1. MCP Host & AI Client Layer"]
        Host["MCP Host: Claude Desktop / Claude Code / Cursor"]
    end

    subgraph GatewayLayer ["2. Gateway & Process Supervision Layer"]
        NodeWrapper["Node.js CLI Wrapper (bin/ellmos-servercommander.js)"]
    end

    subgraph CoreLayer ["3. Python MCP Server Core Layer"]
        FastMCP["Python MCP Server (FastMCP Transport stdio)"]
        Dispatcher["Tool Dispatcher & Parameter Validator"]
        i18nEngine["i18n Translation Engine (en, de, es, zh, ja, ru)"]
    end

    subgraph OperationsLayer ["4. Operations & Diagnostics Engines"]
        HTTPProbe["HTTP Health Probe (sc_health_check)"]
        LogAnalyzer["Apache/Nginx Log Analyzer (sc_logs_analyze)"]
        DeployStaging["Deployment Staging & Manifest Planner (sc_deploy / sc_deploy_status)"]
        MailDiagnostics["IMAP/SMTP Safety Diagnostics (sc_mail_*)"]
    end

    subgraph SinkLayer ["5. Local Storage & Audit Sink Layer"]
        SQLiteHist[("Local SQLite Deploy History (deploy-history.db)")]
        JSONReports[("Sanitized JSON Log Reports")]
        AuditSink["Local Diagnostic Outputs & Stdout Stream"]
    end

    Host <-->|"stdio / JSON-RPC"| NodeWrapper
    NodeWrapper <-->|"Child Process Stdio"| FastMCP
    FastMCP --> Dispatcher
    Dispatcher <--> i18nEngine
    Dispatcher --> HTTPProbe
    Dispatcher --> LogAnalyzer
    Dispatcher --> DeployStaging
    Dispatcher --> MailDiagnostics
    DeployStaging -.->|"Optional opt-in persist"| SQLiteHist
    LogAnalyzer -.->|"Optional persist_report"| JSONReports
    HTTPProbe -.-> AuditSink
    MailDiagnostics -.-> AuditSink

ASCII Architectural Topology (Four-View Projection)

========================================================================================
             ellmos-servercommander-mcp: Four-View Architectural Topology
========================================================================================

[VIEW 1: COMPONENT STRUCTURE & TRANSPORT BOUNDARIES]
  +----------------------------------------------------------------------------------+
  | 1. MCP Host & AI Client (Claude Desktop / Claude Code / Cursor / Codex)          |
  |    - Stdio JSON-RPC transport protocol                                           |
  +----------------------------------------------------------------------------------+
                                           |
                                           | (JSON-RPC via stdio stream)
                                           v
  +----------------------------------------------------------------------------------+
  | 2. Gateway & Process Supervision (bin/ellmos-servercommander.js)                 |
  |    - Node.js CLI launcher & process supervisor (update-notifier checks)          |
  |    - Working directory isolation: PYTHONSAFEPATH=1 prevents rogue import hijack  |
  +----------------------------------------------------------------------------------+
                                           |
                                           | (Supervised child process stdio)
                                           v
  +----------------------------------------------------------------------------------+
  | 3. FastMCP Dispatcher & i18n Localization Engine (src/servercommander/)          |
  |    - FastMCP server lifecycle, tool schema generation & parameter validation     |
  |    - Multi-language localization engine (6 locales: en, de, es, zh, ja, ru)      |
  +----------------------------------------------------------------------------------+

[VIEW 2: OPERATIONAL ENGINES & DRY-RUN EXECUTION]
  +----------------------------------------------------------------------------------+
  | 4. Tool Handlers & Diagnostic Engines                                            |
  |    - sc_health_check: Non-blocking HTTP/HTTPS probe with timeout & batch error   |
  |    - sc_logs_analyze: Sanitized Apache/Nginx access-log parser & threat detector|
  |    - sc_deploy / sc_deploy_status: Fail-safe SHA-256 tree hashing & dry-run plan|
  |    - sc_mail_list / sc_mail_read / sc_mail_send: Dry-run IMAP/SMTP diagnostics  |
  +----------------------------------------------------------------------------------+

[VIEW 3: LOCAL PERSISTENCE & CONCURRENCY MODEL]
  +----------------------------------------------------------------------------------+
  | 5. Local Storage & Audit Sinks                                                   |
  |    - Local SQLite Deploy History (deploy-history.db) with explicit lease release |
  |    - Sanitized JSON diagnostic reports (optional persist_report)                 |
  |    - Thread-isolated HTTP GET workers preventing event-loop stalling             |
  +----------------------------------------------------------------------------------+

[VIEW 4: SECURITY BOUNDARY & ZERO-EGRESS PERIMETER]
  +----------------------------------------------------------------------------------+
  | 6. Governance & Defense Invariants (INV-LOCAL-01 through INV-SLA-10)             |
  |    - RunAsInvoker: 100% unprivileged user mode; zero root/sudo/UAC requirement   |
  |    - Zero-Egress by default: zero telemetry, zero unverified background outbound |
  |    - Safe Process Isolation: cwd package exclusion, sanitized error messages     |
  |    - 48h Response SLA & statutory liability limitation (§ 521 BGB)               |
  +----------------------------------------------------------------------------------+
========================================================================================

3. Operations Lifecycle & Execution Sequence Flow

The following sequence diagram demonstrates the lifecycle of operations dispatched by an AI agent through ServerCommander, showing concurrent HTTP probing, log parsing, and dry-run manifest calculation:

sequenceDiagram
    autonumber
    actor User as AI Assistant / User
    participant Host as MCP Host (Claude / Cursor)
    participant Wrapper as Node.js Wrapper
    participant Server as ServerCommander Server
    participant Handler as Operation Handler
    participant Disk as Local Disk / SQLite Sink
    participant Target as Network Endpoint

    User->>Host: "Check API health and prepare deploy manifest"
    Host->>Wrapper: JSON-RPC request (stdio)
    Wrapper->>Server: Forward request via child process
    Server->>Server: Parse parameters & validate config

    alt HTTP Health Probe
        Server->>Handler: Dispatch sc_health_check
        Handler->>Target: HTTP/HTTPS GET (async worker thread)
        Target-->>Handler: Status code + Latency response
        Handler-->>Server: Health result dictionary
    else Access Log Analysis
        Server->>Handler: Dispatch sc_logs_analyze
        Handler->>Disk: Read access.log & parse entries
        Handler->>Disk: Optional write structured JSON report
        Handler-->>Server: Aggregated log statistics
    else Deployment Staging
        Server->>Handler: Dispatch sc_deploy (dry_run=True)
        Handler->>Disk: Scan local_path & calculate SHA-256 tree
        Handler->>Disk: Optional insert record into deploy-history.db
        Handler-->>Server: Manifest digest & profile readiness
    end

    Server->>Server: Localize response messages (i18n engine)
    Server-->>Wrapper: JSON-RPC response
    Wrapper-->>Host: Formatted stdio output
    Host-->>User: Structured operations summary & next steps

4. Target Personas & High-Intent SEO Queries

ServerCommander MCP bridges the critical gap between hazardous raw shell execution and opaque hosting control panels. It equips AI agents with safe, structured diagnostic capabilities for system administration.

Target Personas

Persona ID

Target Persona

Key Challenges & Pain Points

ServerCommander MCP Solution

[PERSONA-01]

Autonomous AI Agent Engineers & Tooling Architects

High risk of destructive bash commands during agent exploration

Structured JSON-RPC MCP tools with strict non-destructive defaults

[PERSONA-02]

DevOps & Site Reliability Engineers (SREs)

Undetected file drifts, broken releases, and unsafe sync operations

Deterministic SHA-256 tree hashing and local dry-run deployment plans

[PERSONA-03]

Security-Conscious System Administrators & SecOps

Credential leakage, root elevation risks, and suspicious traffic bursts

Unprivileged RunAsInvoker execution, secret isolation & forensic log analysis

[PERSONA-04]

Solo Developers & Full-Stack Maintainers

Tedious manual health monitoring and repetitive log grepping

Instant HTTP health checks and automated bot/error analysis from IDE

High-Intent Search & SEO Queries

  • "mcp server operations tools"

  • "mcp deploy dry-run server"

  • "mcp access log analyzer"

  • "mcp http health check tool"

  • "local-first server management mcp"

  • "claude code server operations mcp"

  • "safe sftp deployment planning mcp"

  • "ai assistant server preflight checks"

  • "apache nginx log analysis mcp"

  • "resilient http health check mcp"

  • "sqlite deploy history mcp"


5. Comparative Matrix vs. Alternatives

The 10-dimension matrix below contrasts ServerCommander against common server administration approaches, mapped directly to its runtime and governance invariants (INV-LOCAL-01 through INV-SLA-10):

Dimension

Invariant

ServerCommander MCP

SSH / Raw Bash Scripts

Heavy Web Panels (cPanel)

Cloud SaaS APM (Datadog)

Generic Terminal MCP

1. AI-Native Tool Calling

INV-I18N-08

Direct stdio / JSON-RPC schemas

Requires fragile prompt glue

None / Web browser only

Custom API webhooks

Raw unstructured text

2. Safe Staging & Dry-Run

INV-DRY-02

Default dry_run=True + SHA-256 tree

High risk of destructive typo

Opaque web mutation

Read-only agent metrics

Arbitrary command danger

3. Local-First & Zero-Egress

INV-LOCAL-01

100% Local / Zero telemetry

Local / Direct remote

Remote host web portal

Constant outbound telemetry

Local shell execution

4. Privilege Requirements

INV-PRIV-06

Unprivileged RunAsInvoker

Often requires sudo / root

Full root system daemon

Root daemon / system agent

Inherits host shell rights

5. Forensic Log Analysis

INV-LOG-03

Regex token parsing + bot audit

Manual grep / awk / sed

Basic UI log viewer

Heavy proprietary agent

Raw grep output

6. Resilient HTTP Probes

INV-PROBE-04

Non-blocking thread + batch safe

curl loop (fails on 1st error)

Periodic polling check

Centralized external probe

curl CLI subprocess

7. Mail Safety Staging

INV-MAIL-05

Readiness check without send

Direct mail command risk

Webmail interface

Email alert service

Blind mailx invocation

8. Process & CWD Isolation

INV-SEC-07

PYTHONSAFEPATH=1 defense

Shell inherits rogue CWD

Fixed daemon user

Sandboxed system service

Inherits caller environment

9. Cloud-Sync Conflict Defense

INV-SYNC-09

Built-in gitignore & lock guards

None (git-only)

Database state only

Cloud-hosted dashboard

None

10. Security SLA & Governance

INV-SLA-10

48h/5d/30d SLA via security@ellmos.ai

Community / self-supported

Vendor commercial support

Enterprise commercial SLA

Unmaintained community


6. Key Capabilities & Safety Invariants

Invariant

Capability / Rule

Implementation Guarantee

Technical Details

INV-LOCAL-01

100% Local-First & Zero-Egress

Non-destructive diagnostic default

Diagnostics & dry-run planning run locally without unauthorized remote telemetry.

INV-DRY-02

Fail-Safe Deployment Staging

Default dry_run=True

Calculates SHA-256 tree digests and verifies profiles before touching targets.

INV-LOG-03

Sanitized Access-Log Analysis

Forensic read-only parsing

Regex token extraction detects errors, bots, and path traversal without secret leaks.

INV-PROBE-04

Resilient Health Probes

Non-blocking worker threads

HTTP probes execute via asyncio.to_thread; invalid endpoints never abort batches.

INV-MAIL-05

Dry-Run Mail Configuration Status

Safe non-executing staging

Validates IMAP/SMTP configuration and credentials without accidental dispatches.

INV-PRIV-06

Unprivileged RunAsInvoker

Zero root/sudo elevation (Non-Elevation)

Runs entirely within standard user permissions; zero administrator rights required.

INV-SEC-07

Safe Process & Package Isolation

Rogue package defense

Launcher enforces PYTHONSAFEPATH=1 to prevent cwd package hijacking.

INV-I18N-08

Native 6-Language i18n Engine

Comprehensive multilingual parity

Localized tool descriptions, schema arguments, and errors for en, de, es, zh, ja, ru.

INV-SYNC-09

Cloud-Sync Conflict Hardening

Multi-host gitignore defense

Hardened against OneDrive/Dropbox sync copies (*-conflict-*) and multi-agent locks (LOCK*).

INV-SLA-10

Bilingual Security SLA

48h/5d/30d guarantee

Vulnerability response within 48 hours, 5-day triage, and 30-day remediation commitment via security@ellmos.ai and security@open-bricks.org.


7. Start Here & Quick Guidance

Goal

Start with

Key Features

Add ServerCommander to Claude Desktop, Claude Code, Cursor, or another MCP host

MCP Client Configuration

Zero-friction global npm install or npx invocation

Check a public or internal HTTP endpoint before a deploy

sc_health_check

Concurrent non-blocking requests, latency timings, resilient batch error handling

Inspect Apache/Nginx access logs for errors, bots, referrers, and suspicious paths

sc_logs_analyze

Status code breakdown, byte transfer sums, bot markers, optional JSON reports

Build a deterministic dry-run deployment manifest before SFTP/SSH execution

sc_deploy and sc_deploy_status

Recursive SHA-256 tree hashing, symlink bypass protection, SQLite history

Wire mail operations later without accidental email dispatches today

sc_mail_list, sc_mail_read, sc_mail_send, sc_mail_search

Protocol readiness validation, credential inspection, safe alpha staging


8. Status & Protocol Support

  • Transport: Standard I/O (stdio) via the Python MCP SDK and Node.js process wrapper.

  • Package Status: Public alpha package under the ellmos-ai organization.

  • Current Core: MCP tool listing, tool dispatch, TOML configuration loader, HTTP health checks, richer access-log analysis with optional persisted JSON reports, and optional local dry-run deployment history.

  • Safe Alpha Handlers: sc_deploy builds local SHA-256 manifests, configuration diagnostics, and opt-in SQLite history records in dry-run mode; sc_mail_* reports protocol-specific IMAP/SMTP readiness without opening mail connections by default.

  • i18n Localization: Localized MCP tool descriptions, input-schema field descriptions, and unknown-tool errors for en, de, es, zh, ja, ru with automatic English fallback.


9. Installation & Prerequisites

The npm package contains a Node wrapper that starts the Python server. You still need Python 3.10+ and the Python package mcp>=1.0.0.

Option 1: Install From npm

npm install -g ellmos-servercommander-mcp@alpha
ellmos-servercommander

Option 2: Install From Source

git clone https://github.com/ellmos-ai/ellmos-servercommander-mcp.git
cd ellmos-servercommander-mcp
$env:PYTHONIOENCODING = "utf-8"
python -m pip install -e ".[dev]"
python -m pytest -q

Avoid creating a .venv inside cloud-synced folders if your sync client locks files. If you need an isolated environment, create it outside that folder.


10. MCP Client Configuration & Deployment Modes

Global npm Install

{
  "mcpServers": {
    "servercommander": {
      "command": "ellmos-servercommander"
    }
  }
}

npx Without Global Install

{
  "mcpServers": {
    "servercommander": {
      "command": "npx",
      "args": ["-y", "ellmos-servercommander-mcp@alpha"]
    }
  }
}

Direct Python Execution

{
  "mcpServers": {
    "servercommander": {
      "command": "python",
      "args": ["-m", "servercommander.server"],
      "env": {
        "PYTHONPATH": "C:/path/to/ellmos-servercommander-mcp/src",
        "SERVERCOMMANDER_CONFIG_PATH": "C:/path/to/config/servercommander.toml"
      }
    }
  }
}

11. Configuration & Profiles Specification

ServerCommander searches for configuration files in this hierarchical order:

  1. Environment variable SERVERCOMMANDER_CONFIG_PATH

  2. ./servercommander.toml

  3. ./config/servercommander.toml

  4. ~/.config/servercommander/servercommander.toml

An annotated template is included at config/servercommander.example.toml.

[server]
name = "servercommander"
log_level = "INFO"
language = "en"

[deploy.profiles.staging]
target = "sftp://staging.example.com/var/www/app"
local_path = "./dist"
protocol = "sftp"
dry_run = true
record_history = true

[mail]
execution_enabled = false
smtp_host = "smtp.example.com"
smtp_port = 587
imap_host = "imap.example.com"
imap_port = 993

Secrets should always be referenced through environment variables, for example $MAIL_PASSWORD or $SFTP_PASSWORD.


12. Tools & Handlers Reference

  • sc_health_check: Checks HTTP/HTTPS endpoints and reports status codes, response headers, and latency. Malformed endpoint URLs are captured gracefully as failed checks rather than aborting the batch.

  • sc_logs_analyze: Analyzes Apache/Nginx access logs from inline text or local files, reporting HTTP status classes (2xx/3xx/4xx/5xx), total bytes transferred, top referrers, 404/500 error paths, suspicious bot markers, and optional JSON report persistence via persist_report.

  • sc_deploy: Creates a dry-run deployment plan with a local SHA-256 manifest and profile diagnostics without performing remote mutations. Nested symbolic links are tracked as skipped_symlinks to prevent unexpected directory traversal.

  • sc_deploy_status: Displays configured deployment profiles, profile diagnostics, and recent dry-run deployment records retrieved from the local SQLite history database.

  • sc_mail_list, sc_mail_read, sc_mail_send, sc_mail_search: Safe alpha status responses with action-specific IMAP/SMTP readiness diagnostics. With [mail].execution_enabled = true, sc_mail_list executes a read-only IMAP reachability probe (connect + folder listing) by reusing the canonical mail-connector module without reimplementing an IMAP client.


13. Search, Disambiguation & Discovery Keywords

ServerCommander is the ellmos operations MCP server for local-first server administration workflows. Use this repository when searching for:

  • MCP server operations tools

  • MCP deploy dry-run server

  • MCP access log analyzer

  • MCP HTTP health check tool

  • local-first server management MCP

  • Claude Code server operations MCP

  • safe SFTP deployment planning MCP

  • AI assistant server preflight checks

  • Apache Nginx log analysis MCP

  • resilient HTTP health check MCP

  • SQLite deploy history MCP

It is not the GitHub MCP server, not a generic arbitrary shell-execution MCP server, not a cloud hosting provider control panel, and not an unverified production SFTP/IMAP auto-executor. The current alpha surface is intentionally diagnostic, dry-run first, and safe by default.


14. Sibling Ecosystem Matrix

This MCP server is an integral component of the ellmos-ai ecosystem and the open-bricks open-source software family.

MCP Server Family

Server

Tools

Primary Focus

npm Package

FileCommander

46

Filesystem operations, process supervision, sessions, cloud-lock handling

ellmos-filecommander-mcp

CodeCommander

22

Code analysis, AST inspection, JSON repair, imports, diffs, regex

ellmos-codecommander-mcp

Clatcher

12

File repair, encoding correction, format conversion, batch tools

ellmos-clatcher-mcp

n8n Manager

18

n8n workflow management, deployment, node exploration

n8n-manager-mcp

ControlCenter

20

MCP stack discovery, profile management, control plane routing

ellmos-controlcenter-mcp

Homebase

45

Local-first LLM memory, knowledge base, swarm orchestration

ellmos-homebase-mcp

ServerCommander

8

Server operations: health checks, log analysis, dry-run manifests

ellmos-servercommander-mcp

Blender Use

3

Headless Blender 3D asset QA and automated FBX reimport

ellmos-blender-use-mcp

Open Compute

10

Model-agnostic computer use: screen capture, safety-gated actions

open-compute-mcp

AI Infrastructure & Developer Tools

Project

Description

BACH

Local-first text-based OS for LLM agents — 113+ handlers, 550+ tools, SQLite memory

open-compute

Model-agnostic computer-use core powering Open Compute MCP

clutch

Provider-neutral LLM orchestration with auto-routing and budget tracking

rinnsal

Lightweight agent memory, connectors, and automation infrastructure

sqlite-transit-sync

Encrypted SQLite transit synchronization & additive read-replica engine

workflowhooker

Git-hook-driven workflow automation and execution safety boundaries

system-explorer

Local-first system composition, module introspection, and fleet verification

companion-for-agy

Antigravity developer companion & telemetry bridge

Desktop Software Suite

Our partner organization open-bricks provides desktop productivity applications built for the age of AI:


15. Third-Party Licenses & Level 1 SBOM

ellmos ServerCommander MCP is strictly built upon permissive open-source foundations. We maintain zero hidden telemetry, zero proprietary binary blobs, and zero unverified dynamic dependencies.

  • Direct Runtime: Python MCP SDK (mcp>=1.0.0, MIT License, Anthropic PBC), Python Standard Library (PSFL-2.0).

  • Node CLI Wrapper: update-notifier (BSD-2-Clause, Sindre Sorhus) for non-intrusive CLI update checks.

  • Optional Extensions: paramiko (LGPL-2.1) dynamically imported only when the optional [sftp] extra is explicitly installed.

  • Developer Tooling: pytest (MIT), pytest-asyncio (Apache-2.0), ruff (MIT/Apache-2.0), hatchling (MIT).

  • Audit Ledger & Level 1 SBOM: Comprehensive license disclosures, full copyright notices, and local-first compliance assurances are documented in THIRD_PARTY_LICENSES.md and plain-text companion THIRD_PARTY_LICENSES.txt. Formal repository attribution is preserved in NOTICE.


16. Security Policy & Operational Limits (48h SLA)

For vulnerability reporting, response SLAs, and local-first security invariant details, see our bilingual SECURITY.md.

  • Vulnerability Reporting: GitHub Security Advisories or email security@ellmos.ai / security@open-bricks.org.

  • Response SLA: Initial triage within 48 hours; status updates within 5 business days.


17. Development, Verification & CI Matrix

# Set UTF-8 encoding
$env:PYTHONIOENCODING = "utf-8"

# Run complete pytest test suite
python -m pytest -v

# Run Ruff linter
ruff check .

# Verify Node CLI smoke test
npm run smoke

# Verify npm packaging (dry-run)
npm pack --dry-run

For detailed contribution guidelines, Plan D local development workflow, and quality gates, see CONTRIBUTING.md.


18. Statutory Notice, Liability Limitation & License (§ 521 BGB)

Statutory Disclaimer (§ 521 BGB Gefälligkeitsrecht)

Dieses Open-Source-Softwareprodukt wird als unentgeltliche Schenkung im Sinne der §§ 516 ff. BGB bereitgestellt. Gemäß § 521 BGB ist die Haftung des Urhebers und der Beitragenden auf Vorsatz und grobe Fahrlässigkeit beschränkt. Ergänzend gelten die nachstehenden Haftungsausschlüsse der MIT-Lizenz.

Nutzung auf eigenes Risiko. Keine Wartungsverpflichtung, keine Verfügbarkeitszusicherung, keine Gewähr für Fehlerfreiheit oder Eignung für einen bestimmten Einsatzzweck.

English Summary

This project is an unpaid open-source donation. In accordance with § 521 of the German Civil Code (BGB), liability is restricted strictly to cases of intentional misconduct and gross negligence. Supplemental liability disclaimers are set forth in the MIT License below.

Use entirely at your own risk. No maintenance commitments, no availability guarantees, and no warranties regarding fitness for any particular purpose.

License & Attribution

Distributed under the terms of the MIT License. Copyright (c) 2026 Lukas Geiger. See LICENSE and NOTICE for full details. Third-party licenses and Level 1 SBOM notices are audited in THIRD_PARTY_LICENSES.md.

Available Tools

8 tools
sc_deployB

Build a safe deployment plan. Alpha only: execution requires dry_run=true.

ParametersJSON Schema
NameRequiredDescriptionDefault
dry_runNoBuild the plan without executing deployment.
profileNoDeployment profile name.
local_pathNoLocal source path.
remote_pathNoRemote target path.
record_historyNoPersist this dry-run deployment plan in the local history database.

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It mentions alpha status and a dry_run constraint, but does not disclose side effects such as record_history writing to a local database, permissions, or return behavior. The phrase "execution requires dry_run=true" is also ambiguous because dry_run=true means no execution per the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two compact sentences with no wasted words, and the core purpose is front-loaded before the alpha constraint.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The schema fully documents all five parameters, and the description adds the important alpha/dry_run limitation. However, with no annotations and no output schema, the description omits enough behavioral context (side effects, return values, alternatives) that the definition is only minimally complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the parameter meanings are already documented in the input schema. The description only repeats the dry_run requirement and adds no syntax, format, or interaction details beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: "Build a safe deployment plan." It distinguishes the tool from an actual deployment execution, and the alpha-only note further narrows scope. However, it does not explicitly differentiate itself from the sibling sc_deploy_status tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives a constraint ("Alpha only: execution requires dry_run=true") but no guidance on when to use this tool versus alternatives such as sc_deploy_status. There is no when-to-use or when-not-to-use context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sc_deploy_statusC

Show configured deployment profiles and alpha deployment-history status.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum number of results.
profileNoDeployment profile name.

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full disclosure burden. 'Show' implies read-only, but there is no mention of auth requirements, whether the profile filter is required or optional, what happens when no profile is given, or how the limit interacts with history versus profiles.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no waste. It is slightly compressed to the point of ambiguity ('alpha deployment-history status'), but it does not pad or bury the key information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a low-complexity read tool with two optional, fully documented params and no output schema, the description is minimally adequate. It still leaves the meaning of the returned deployment status and the 'alpha' qualifier unexplained, which an agent would need to interpret results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both parameters (limit, profile) are already documented. The description hints at their roles ('configured deployment profiles', 'deployment-history') but adds no syntax, defaults, or filtering semantics beyond what the schema states, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Show') and two concrete resources (configured deployment profiles, deployment-history status), so an agent understands it is a read/status query. It does not, however, differentiate itself from the sibling sc_deploy, and the qualifier 'alpha' is unexplained jargon that muddies what is actually being reported.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no statement of when to call this versus sc_deploy or the other siblings, and no prerequisites or exclusions. Usage is only inferable from the fact that it is a status-style read, which is weak guidance for an agent choosing among eight tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sc_health_checkB

Check HTTP endpoints and return status codes plus latency.

ParametersJSON Schema
NameRequiredDescriptionDefault
timeoutNoRequest timeout in seconds.
endpointsNoHTTP endpoint URLs to check.

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It usefully discloses the return shape (status codes plus latency) but says nothing about authentication, redirect handling, concurrency, or per-endpoint failure behavior. Adequate disclosure of outputs, silent on operating conditions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single tight sentence with the action and the two return values front-loaded. No filler, nothing to trim.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple two-parameter read tool with no output schema, stating that it returns status codes plus latency covers the main return-value gap. Deployment/auth context that would make it fully self-sufficient is absent, but nothing critical to invoking it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% – both 'timeout' (seconds, default 5) and 'endpoints' (URL list) are already documented in the schema. The description restates the purpose but adds no format, batching, or default details beyond the schema, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (check), resource (HTTP endpoints), and outputs (status codes plus latency), so the agent immediately knows what the tool does. It doesn't distinguish itself from siblings, but the siblings (sc_deploy, sc_mail_*, sc_logs_analyze) occupy unrelated domains, so cross-confusion risk is low.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use guidance, no prerequisites, and no alternatives named. The health-check intent is only implied by the tool name and the endpoint wording. Nothing tells the agent when this is preferable to reading logs via sc_logs_analyze.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sc_logs_analyzeB

Analyze Apache/Nginx access logs from inline text or a local file path.

ParametersJSON Schema
NameRequiredDescriptionDefault
formatNoLog format hint.
log_pathNoLocal access-log file path.
log_textNoInline access-log text.
top_pathsNoNumber of top paths to include.
report_nameNoOptional report filename stem.
persist_reportNoPersist the analysis summary as a JSON report.

TDQS

B3.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden, yet it discloses only the input sources. It says nothing about whether the tool writes anything to disk (relevant given persist_report and report_name), what permissions or file access are required, or how results are returned.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with zero waste; scope and input modes are stated immediately with no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With six optional parameters, no output schema, and no annotations, the description is only partially complete. It omits what the analysis yields and the side effect of persisting a report, but the schema covers the individual parameters so the gap is moderate rather than critical.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all six parameters including format, log_path, log_text, top_paths, report_name, and persist_report. The description only restates the two input modes and adds no new parameter semantics, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Analyze) and resource (Apache/Nginx access logs), plus the two input modes (inline text or local file path). This clearly distinguishes it from unrelated siblings like sc_deploy and sc_mail_send, though it does not describe what the analysis produces.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the tool name and the two accepted input sources, but there is no explicit when-to-use/when-not guidance or mention of preconditions. Adequate but leaves the agent to infer context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sc_mail_listC

Alpha mail status endpoint for listing an IMAP folder.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum number of results.
folderNoMail folder name.INBOX

TDQS

C2.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden, and it says almost nothing: 'listing' weakly implies read-only, but there is no mention of pagination, return format, ordering, or folder-must-exist behavior. An agent gets minimal signal about what happens on invocation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single short sentence is appropriately sized, but the front-loaded 'Alpha mail status endpoint' framing is noise that misdirects rather than informing. It is concise but not well-structured around the actual operation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No annotations and no output schema mean the description must explain behavior and results, and it does neither. For a list tool with defaults (limit=10, INBOX), an agent lacks the context needed to call it confidently or interpret the response.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and both parameters (limit, folder) are documented in the schema, so the baseline is 3. The description adds no extra meaning such as default pagination behavior or folder-name semantics beyond what the schema already states.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The verb 'listing' and resource 'IMAP folder' are present, so the core action is inferable. However, the lead phrase 'Alpha mail status endpoint' muddles the purpose (status vs. listing) and the description never distinguishes this from siblings like sc_mail_search or sc_mail_read.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this versus sc_mail_search (filtered retrieval) or sc_mail_read (single message). No prerequisites, no exclusions, nothing beyond an implied 'use this to list a folder'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sc_mail_readC

Alpha mail status endpoint for reading a message.

ParametersJSON Schema
NameRequiredDescriptionDefault
message_idNoMessage identifier.

TDQS

C2.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden, and it discloses almost nothing: it does not say the operation is read-only, what happens if the message_id is unknown, whether the caller needs authorization, or what the response contains. 'Status endpoint' hints at a return shape but never explains it.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

It is a single short sentence with no filler, which is structurally clean. The problem is under-specification rather than verbosity, and the most useful information (what it returns) is absent.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read tool with no annotations and no output schema, the description should at least characterize the returned data, but it only offers the ambiguous label 'status endpoint'. With one parameter required and zero required params declared, an agent cannot determine preconditions or expected output from this definition.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% for the single message_id parameter, so the schema already documents it. The description adds no format, source, or lookup guidance beyond that, making the baseline 3 the correct score.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a verb ('reading') and resource ('a message'), which loosely separates it from siblings like sc_mail_list, sc_mail_send, and sc_mail_search. However, the phrase 'Alpha mail status endpoint' is unexplained jargon that muddies whether this reads message content or fetches a delivery/status record, so the purpose is only partially pinned down.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no statement of when to use this tool versus sc_mail_list or sc_mail_search, both of which plausibly retrieve messages. The agent is left to infer that a known message_id is a prerequisite for this tool, and no exclusions or alternatives are given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

sc_mail_sendC

Alpha mail status endpoint for sending mail; does not send yet.

ParametersJSON Schema
NameRequiredDescriptionDefault
toYesEmail recipient.
bodyYesEmail body text.
subjectYesEmail subject.

TDQS

C2.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden, and it does disclose one important trait: the endpoint does not actually send yet, which prevents a false assumption of a side effect. However, it omits auth requirements, what the call returns (no output schema), and whether it errors or silently no-ops, leaving key behavior undefined.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

It is a single short sentence with no padding, and the caveat is placed immediately after the purpose. The only cost is that the phrasing itself is ambiguous rather than the length.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a three-required-parameter call with no annotations and no output schema, the description should clarify what the invocation returns or does. It only asserts the tool 'does not send yet,' leaving return behavior, error cases, and the resulting state entirely unspecified.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and all three required parameters (to, subject, body) carry their own descriptions, so the schema does the heavy lifting. The description adds nothing about parameter formats or constraints, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose2/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description is internally muddled: it calls itself a 'status endpoint' for 'sending mail' while also saying it 'does not send yet.' An agent cannot confidently tell whether this sends, checks status, or is a no-op, and the sibling set (sc_mail_list/read/search) offers no disambiguation. The verb+resource pair is stated but immediately undercut.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use, when-not-to-use, or alternative-tool guidance. The phrase 'does not send yet' hints the tool is a stub, but it never tells the agent when this tool should be preferred over other mail siblings or when to avoid it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 8 tool updatesv0.1.0-alpha.21
    • First observedsc_deploy
    • First observedsc_deploy_status
    • First observedsc_health_check
    • First observedsc_logs_analyze
    • First observedsc_mail_list
    • First observedsc_mail_read
    • First observedsc_mail_search
    • First observedsc_mail_send

TDQS

B3/5.0

Scored across 8 tools

Disambiguation4/5

Each tool targets a fairly distinct area: deploy vs deploy_status differ by planning versus status inspection, and the four mail tools split cleanly along list/read/send/search. The main risk is sc_deploy vs sc_deploy_status, which could be confused at a glance, but descriptions clarify the boundary.

Naming Consistency4/5

All tools share an sc_ prefix and snake_case, with mostly predictable noun_verb ordering (sc_mail_list, sc_health_check, sc_logs_analyze). sc_deploy is a bare verb outlier and the mail_* group reads as noun_action rather than verb_noun, but the scheme is readable and consistent overall.

Tool Count4/5

Eight tools is well within a sensible range for a server-commander surface spanning deploy, mail, logs, and health. No obvious redundancy or padding, though half the set is devoted to mail operations that are still alpha stubs.

Completeness3/5

Mail coverage (list/read/send/search) and deploy (plan + status) are reasonably complete, but several operations are explicitly non-functional alpha status endpoints (send 'does not send yet') and there is no log tailing/filtering beyond one-shot analysis. The server-commander domain lacks service restart, config, or process-management operations, leaving notable gaps.

Maintenance

ActivityActive
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    D
    maintenance
    MCP server for running infrastructure health checks with TIBET provenance. It enables users to define, execute, and audit process health checks with dependency chaining and drift tracking.
    6
    MIT
  • A
    license
    A
    quality
    C
    maintenance
    An MCP server for auditing automation health, finding failures, stale logs, and non-functional endpoints that report success while quietly failing.
    7
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    MCP server providing read-only operational tools (logs, metrics, traces, service health, config) for troubleshooting an environment, with one exception for toggling chaos scenarios.
    MIT