OpsChugex LocalOps MCP
Read-only, cross-platform local system and endpoint inspection for Windows and Linux hosts.
Host/OS info —
system_info(hostname, platform, OS, arch, CPU count, uptime) anduptime(seconds/hours/days).Resource pressure —
system_health(rolled-up CPU/memory/disk health + reasons),cpu_status(sampled utilization, load averages),memory_status,disk_status(per-filesystem capacity/utilization).Network inventory —
network_interfaces(adapters, addresses, CIDR, MAC) with no probing.Processes —
list_processes(bounded) andinspect_processby PID; command lines and environment variables are deliberately excluded.Services —
list_services(Windows services / systemd units) andservice_statusfor one validated service name.Software —
installed_software,software_versions(up to 50 names), andsoftware_changesto diff against a caller-supplied baseline.Identity —
local_users,local_groups,local_admins(no password or credential material).Persistence —
startup_programsandscheduled_tasksmetadata without action command lines.Certificates —
certificate_inventoryandcertificate_expiry(metadata and expiry only, no private keys).SSH —
ssh_key_inventorylists file metadata only; key contents are never read.Config privacy —
environment_variables_summaryreturns names and a sensitive-name flag, never values.Safety posture — every listed tool is read-only, idempotent, non-destructive, and non-open-world; no arbitrary command, shell, or mutation surface. (The README describes many further evidence, correlation, fleet, and approval-gated tools provided by the broader server.)
Provides read-only inspection and inventory of Linux systems, including host and OS discovery, system health, CPU/memory/disk status, network interfaces, processes, systemd services, installed software, local users/groups, startup programs, scheduled tasks, certificates, SSH key metadata, and environment variable names.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@OpsChugex LocalOps MCPcheck my local system health, CPU, memory and disk usage"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
OpsChugex LocalOps MCP
Local Infrastructure, Endpoint & Systems Intelligence
OpsChugex LocalOps MCP is a cross-platform Model Context Protocol server for safely inspecting local Windows and Linux systems. It is designed as the local/private-infrastructure counterpart to the Cloud DevOps MCP Server.
Version 2.2.0 adds an Investigation Hypothesis Ledger & Evidence Provenance while retaining v2.1 investigation-session memory, the v2 Operational Knowledge Graph, durable incident knowledge, search/clustering, Cross-Node Incident Correlation, Predictive Health Intelligence and the existing approval-gated remediation, topology, database and storage/backup capabilities. Each bounded investigation can track operator-authored hypotheses and normalized supporting, contradicting or context evidence with explicit provenance. Evidence-balance analysis reports conflicts and evidence gaps without declaring a hypothesis true, estimating causal probability or authorizing remediation.
Why this exists
Cloud operations tools can see cloud resources, deployments and managed services. They often cannot explain what is happening inside a workstation, private server or endpoint.
LocalOps starts at the operating-system layer:
host and operating-system discovery
CPU, memory and disk pressure
network interface inventory
bounded process inspection
Windows service and systemd service inspection
installed software and version inventory
local users, groups and administrator membership
startup program and scheduled-task metadata
certificate and certificate-expiry inventory
SSH key metadata without key contents
environment-variable names without values
local listening ports and active connection evidence
routing, DNS and firewall configuration summaries
adapter and ARP/neighbor-cache inventory
process-to-network mapping without packet contents
caller-baseline checks for unexpected listeners and outbound endpoints
bounded Windows Event Log and Linux journal evidence
login success/failure evidence where the host audit source permits it
service, account, privileged-group and scheduler change evidence
Microsoft Defender operational evidence on Windows
explicit evidence-gap reporting when permissions or audit configuration are insufficient
caller-baseline service-change detection
disabled-by-default controlled execution gateway
exact service allowlisting for service mutations
five-minute one-time approval tokens
post-action verification and in-memory audit records
bounded evidence bundles for private correlation
authenticated loopback-only private intelligence interface
process, service, identity, network and persistence correlation
chronological incident evidence timelines
evidence-backed probable-cause ranking
evidence-confidence scoring with source-limit penalties
root-cause evidence chains
read-only investigation paths
temporal change-trigger identification
local/evidence-based blast-radius analysis
advisory remediation recommendations with risk tiers
private evidence-based remediation workflow planning
ordered validation-before-mutation workflow gates
workflow-bound one-time approval tokens that cannot use the generic execution path
durable execution-audit correlation with workflow and step identifiers
post-action verification before a controlled remediation step is marked verified
R3+ remediation retained as manual-only workflow guidance
bounded per-node health history retained in memory for predictive analysis
CPU, memory and disk trend extrapolation over a 1-168 hour horizon
evidence-confidence scoring based on observation coverage rather than failure probability
explicit insufficient-data results instead of fabricated forecasts
warning/critical resource-threshold ETA without automatic remediation
cross-node correlation of repeated health, resource, service and security-change evidence
bounded fleet incident timeline anchored to snapshot capture times
shared-cause hypothesis ranking with evidence-confidence limits
incident-scope classification across affected nodes and common tags
bounded incident fingerprints retained for current-process case memory
incident-case comparison using normalized evidence overlap
possible/strong recurrence detection without causal claims
history summaries for repeated signals, tags and cause categories
optional durable incident persistence across LocalOps process restarts
structured operator-confirmed incident outcomes without command or free-form remediation storage
historical resolution-pattern summaries from resolved/mitigated cases
evidence-overlap resolution history for selected cases without prescriptive recommendations
structured incident knowledge search across signals, tags, severity, scope and recorded outcomes
nearest historical case retrieval using normalized fingerprint overlap
threshold-connected incident case clustering with bounded cluster summaries
bounded operational knowledge graphs across incident cases and normalized evidence entities
graph relationship tracing between current and historical incidents
exact entity-to-case lookup for signals, tags, causes, outcomes and resolution categories
guided non-mutating incident investigation plans built from current and historical evidence
bounded case-linked investigation sessions with checkpoint and question tracking
optional durable investigation-session metadata across LocalOps restarts
private investigation-progress analysis with documentation-coverage and historical-case context
bounded operator-authored hypothesis ledgers for investigation sessions
typed supporting, contradicting and context evidence links with explicit provenance
private hypothesis evidence-balance analysis with conflict and evidence-gap reporting
bounded local fleet snapshots without raw event-log storage
in-memory node registration and snapshot freshness tracking
fleet health and inventory summaries
explicit-baseline node comparison
configuration, software, patch, certificate and security drift
local Hyper-V, VirtualBox, Proxmox, libvirt and VMware CLI inventory where available
exact local VM-state lookup without mutation
local storage capacity and bounded storage-health evidence
local Windows battery/UPS or Linux UPower telemetry
private network-device health from caller-supplied snapshots
private topology components, isolated nodes, down links and articulation/dependency concentration
shortest dependency-path analysis across submitted private-infrastructure graphs
source-to-target single-link and intermediate-node redundancy analysis
topology failure-domain connectivity-loss analysis
bounded what-if network change-impact simulation without executing a change
named database profiles without credential exposure
PostgreSQL, MySQL/MariaDB, SQL Server and Redis read-only telemetry
normalized database inventory, connection, capacity, replication, lock and workload-pressure evidence
private database health, replication, contention and pressure reasoning
named local backup profiles without arbitrary MCP-supplied paths
bounded backup artifact inventory, age, size and recent-volume evidence
backup freshness and retention checks
non-destructive newest-artifact metadata/readability validation
point-in-time storage-growth comparison from a caller-supplied baseline
backup-root filesystem capacity evidence
RPO/RTO and restore-verification evidence
private backup snapshot health, recovery readiness and risk correlation
normalized Windows/Linux outputs
explicit R0-R2 safety boundaries with R3+ blocked
The long-term goal is evidence correlation across endpoints, private infrastructure, networking, storage and virtualization while keeping advanced OpsChugex intelligence proprietary.
Related MCP server: mcp-vpsobs
v2.2 tools
Tool | Purpose |
| Host, OS, architecture, CPU count and uptime |
| CPU, memory and disk pressure summary |
| Sample CPU utilization and processor metadata |
| Physical memory usage |
| Fixed-disk capacity and utilization |
| Local adapters and assigned addresses |
| Bounded process inventory without command lines |
| Inspect one process by PID |
| Windows services or systemd units |
| Inspect one validated service name |
| System uptime in seconds, hours and days |
| Bounded installed-software inventory with versions |
| Look up versions for requested installed software |
| Compare current software with a caller-supplied baseline |
| Local account metadata without credentials |
| Local group metadata and Linux group membership |
| Built-in Windows administrators or common Linux admin groups |
| Startup registration metadata without command lines |
| Scheduled-task/timer metadata without action commands |
| Certificate metadata without private key material |
| Expired or soon-to-expire certificate evidence |
| SSH-directory file metadata without key contents |
| Environment-variable names and sensitivity flags without values |
| Unique local TCP/UDP listening endpoints without remote scanning |
| Local TCP listeners and UDP endpoints with owner metadata |
| Bounded local TCP/UDP socket state without packet capture |
| Local routing table |
| Configured DNS servers and search domains |
| Resolve one validated host through the OS resolver |
| Local firewall provider/profile state |
| Bounded read-only firewall-rule summary |
| Local adapter and link-state inventory |
| Local ARP/neighbor-cache evidence without active probing |
| Group observed sockets by owning process |
| Compare listeners with a caller-supplied port baseline |
| Compare active TCP remotes with caller-supplied expectations |
| Bounded Windows event evidence from an allowlisted log set |
| Bounded Linux journal evidence with optional unit/priority filters |
| Supported security-relevant event evidence with audit limitations |
| Successful login/session evidence where available |
| Failed authentication evidence where available |
| Windows service-install or bounded Linux service-change evidence |
| Local account-creation evidence |
| Privileged-group membership change evidence |
| Audited Windows process-creation evidence; Linux remains unknown without an explicit audit source |
| Scheduled-task/timer event evidence |
| Microsoft Defender Operational evidence on Windows |
| Deterministic aggregation of supported system-change evidence |
| Deterministic aggregation of supported security-change evidence |
| Compare current service names with a caller-supplied baseline |
| Show execution enablement, allowlist and v0.5 risk-policy state |
| Run preflight and issue a five-minute one-time approval token without executing |
| Execute exactly the action bound to a valid approval token |
| Read recent in-memory execution audit records without approval tokens |
| Show v1.4 workflow safety state, current execution gates and retained workflow summaries |
| Build an ordered evidence-based remediation workflow without creating an approval or executing a change |
| Read one workflow's steps, gates, status and token-free event history |
| Record validation/manual completion or explicitly skip an eligible step without host mutation |
| Create a workflow-bound five-minute R2 approval proposal after earlier validation is resolved |
| Execute exactly one matching prepared R2 step through the existing controlled gateway and post-action verification |
| Check whether the private loopback intelligence core is configured and reachable |
| Correlate bounded process, event and network evidence through the private core |
| Correlate service, process, event and network relationships |
| Correlate local identity, admin and authentication/change evidence |
| Correlate process-to-remote-endpoint relationships without packet capture |
| Correlate startup, scheduled-task, service, process and event evidence |
| Build a chronological evidence timeline while preserving source limitations |
| Rank evidence-backed operational hypotheses through the private core |
| Measure evidence coverage/confidence without treating it as compromise probability |
| Build ordered supporting evidence chains for leading hypotheses |
| Generate an evidence-first, read-only investigation sequence |
| Identify the earliest supported timestamped change as a temporal starting point |
| Summarize local entities and observed network relationships tied to leading hypotheses |
| Return advisory risk-tiered remediation options without authorizing execution |
| Capture a bounded normalized snapshot of the current local host |
| Upsert one snapshot into the local in-memory fleet registry |
| List registered node metadata and snapshot freshness |
| Show health and freshness for one registered node |
| Return up to 96 retained in-memory CPU, memory and disk health observations for one node |
| Analyze one node's retained health trend over a bounded 1-168 hour horizon through the private core |
| Analyze retained health trends across registered nodes without triggering remediation |
| Correlate repeated health, resource, service and security-change evidence across registered nodes |
| Build a bounded cross-node snapshot timeline without claiming original event timestamps |
| Rank evidence-backed shared-cause hypotheses without treating confidence as causation probability |
| Classify observed impact as none, localized, multi-node or fleet-wide |
| Capture and retain a normalized incident fingerprint from the current registered fleet |
| List bounded metadata for incident cases retained by the current LocalOps process |
| Read one stored incident fingerprint by case ID |
| Compare two stored cases by normalized evidence overlap through the private core |
| Find possible or strong recurrence patterns across retained incident fingerprints |
| Summarize repeated incident signals, tags, cause categories, severity and scope |
| Show case/outcome counts and whether optional durable local incident persistence is enabled |
| Store a structured operator-confirmed outcome category/status for one case |
| Summarize historical outcome categories and repeated evidence patterns through the private core |
| Find evidence-overlapping prior resolved/mitigated cases and show their recorded outcomes |
| Search retained cases with bounded structured evidence and outcome criteria |
| Rank nearest retained cases by normalized fingerprint overlap |
| Group retained cases into bounded threshold-connected similarity clusters |
| Build a bounded graph linking incident cases to normalized evidence and similarity relationships |
| Trace bounded graph paths from one incident to related historical cases |
| Find retained cases linked to one exact signal, tag, cause, outcome or resolution entity |
| Build an ordered read-only investigation plan from current and historical evidence |
| Create a bounded case-linked investigation session without changing host state |
| List investigation-session summaries, checkpoint counts and open-question counts |
| Read one session with bounded checkpoints and tracked questions |
| Record normalized evidence-review references in an open or paused session |
| Add one bounded investigation question for later resolution or deferral |
| Mark a tracked question open, resolved or deferred |
| Set a session open, paused or completed; completion blocks on open questions |
| Show session-memory bounds and optional persistence state |
| Analyze documented review coverage, question state and similar historical cases |
| Add one bounded operator-authored hypothesis to an investigation session |
| List the hypothesis ledger with evidence-direction counts |
| Read one hypothesis and its normalized evidence links |
| Update operator-controlled hypothesis lifecycle state |
| Link supporting, contradicting or context evidence with explicit provenance |
| Analyze evidence balance, conflicts and provenance gaps without causal claims |
| Summarize health, stale snapshots and node states across the registry |
| Return bounded fleet metadata without raw event logs |
| Compare two registered snapshots through the private core |
| Compare host, service, startup and scheduler state against an explicit baseline |
| Compare installed-software presence and versions against an explicit baseline |
| Compare Windows hotfix or Linux kernel/package patch markers |
| Compare certificate presence and expiry metadata |
| Compare local-admin and summarized security-change evidence |
| Inspect locally available Hyper-V, VirtualBox, Proxmox, libvirt or VMware CLI inventory |
| Inspect one exact local VM ID/name and report observed provider state |
| Summarize local fixed-filesystem capacity and utilization |
| Combine filesystem utilization with supported local physical-disk health evidence |
| Read locally exposed Windows battery/UPS or Linux UPower telemetry |
| Analyze bounded caller-supplied private-device snapshots through the private core |
| Analyze caller-supplied private-infrastructure nodes/links without discovery or probing |
| Find the shortest submitted non-down dependency path between two explicit devices |
| Check source-to-target tolerance to one primary-path link or intermediate-node loss |
| Measure node and non-parallel active-link connectivity-loss impact across the submitted graph |
| Run a bounded what-if connectivity simulation for explicitly unavailable nodes or endpoint-pair links |
| Show v1.0 transport, process-bound identity/role, execution state, durable-audit state and private-core reachability |
| Show RBAC permissions and the enforced R0-R3+ boundary |
| Evaluate one operation/risk tier without executing anything |
| Check runtime, RBAC, execution/audit coherence, data-directory safety and private-core reachability |
| Read metadata-only durable execution audit records when enabled |
| List configured database profile metadata without password values or secret-environment names |
| Collect a bounded normalized read-only snapshot using fixed engine telemetry queries |
| Analyze operational database health through the private intelligence core |
| Return database-size or memory-capacity evidence without inventing free-space risk |
| Return bounded active/total/max/blocked connection evidence |
| Analyze replication role/state/lag evidence without assuming standalone databases are unhealthy |
| Analyze waiting-lock/blocked-connection contention without terminating transactions |
| Analyze connection utilization and workload-pressure evidence without collecting query text |
| List named backup-profile metadata; arbitrary MCP-supplied paths are not accepted |
| Collect normalized backup inventory, freshness, retention, restore-point, capacity and recovery-objective evidence |
| Return bounded backup file-count, size and age evidence without reading backup contents |
| Compare the newest artifact with the configured expected interval and RPO |
| Validate newest-artifact presence, non-zero size and read access without executing a restore |
| Report bounded artifacts older than the configured retention target without deleting them |
| Compare current inventory totals with an explicit caller-supplied prior baseline |
| Analyze normalized backup health through the private intelligence core |
| Analyze restore-point, RPO, RTO and restore-verification evidence without executing a restore |
| Correlate freshness, capacity, retention, restore-point and recovery-objective risk signals |
Architecture
flowchart TD
Client["MCP Client"] --> Server["OpsChugex LocalOps MCP"]
Server --> Safe["Read-only tool boundary"]
Safe --> Node["Node.js system APIs"]
Safe --> Win["Windows adapter"]
Safe --> Linux["Linux adapter"]
Win --> PS["Fixed PowerShell/CIM reads"]
Linux --> Proc["Fixed ps/df/systemctl reads"]
Server --> Client2["Loopback Intelligence Client"]
Client2 --> Core["Private OpsChugex LocalOps Intelligence Core"]The public MCP owns protocol handling, safe collectors, normalized node/fleet/infrastructure/database/backup schemas, bounded topology/remediation/predictive/cross-node/incident-memory contracts, fixed read-only database adapters, bounded local backup metadata collection, local virtualization/storage/power adapters, the in-memory fleet registry, bounded node-health history and bounded normalized incident-case memory, process-bound RBAC/policy enforcement, workflow state, one-time execution approvals, optional durable audit storage, the loopback client and operator-facing tools. The private OpsChugex intelligence core owns correlation, root-cause ranking, fleet drift, cross-node incident correlation, incident fingerprinting, recurrence/similarity analysis, shared-cause ranking and scope analysis, private device-health/topology reasoning, dependency-path/redundancy/failure-domain/change-impact algorithms, database health/replication/contention/pressure analysis, backup snapshot-health/recovery-readiness/risk correlation, remediation workflow planning/gate reasoning, and predictive-health trend/threshold analysis.
Quickstart
Requirements:
Node.js 20 or newer
Windows 10/11 or a modern Linux distribution
PowerShell on Windows
ps,dfand systemd tools for the relevant Linux collectors
Clone and run:
git clone https://github.com/alexcgodwin/localops-mcp.git
cd localops-mcp
npm install
npm run build
npm test
npm startFor development:
npm run devOptional private intelligence core
The correlation, root-cause, private fleet, private-infrastructure, database, backup, network-topology, remediation-planning, predictive-health, cross-node incident, recurrence, resolution and v1.9 knowledge-search/clustering tools require the private OpsChugex LocalOps Intelligence Core to be running locally. Configure the public MCP process with:
LOCALOPS_INTELLIGENCE_URL=http://127.0.0.1:43123
LOCALOPS_INTELLIGENCE_TOKEN=<private token of at least 32 characters>The public client rejects non-loopback intelligence URLs. If the private core is not configured or running, local collection and policy/readiness tools continue to work and private-analysis tools report the limitation.
v1.0 production controls
The local stdio process uses process-bound RBAC:
LOCALOPS_ROLE=viewer|operator|maintainer|admin
LOCALOPS_OPERATOR_ID=<local operator/process identity>
LOCALOPS_AUDIT_PERSISTENCE=true|false
LOCALOPS_DATA_DIR=<optional absolute non-root directory>The default role is viewer. operator may create R2 proposals, while maintainer and admin may execute an otherwise valid R2 approval. R3+ execution remains unavailable. Durable audit is optional for read-only deployments but production_readiness reports execution without durable audit as blocked.
v1.1 database profiles
Database tools use named profiles from LOCALOPS_DATABASE_PROFILES. Profiles contain connection metadata only. Password values are referenced through separate environment variables and are never accepted as MCP tool arguments.
Example:
LOCALOPS_DATABASE_PROFILES=[{"id":"pg-main","engine":"postgresql","host":"127.0.0.1","port":5432,"database":"app","user":"localops_reader","passwordEnv":"LOCALOPS_DB_PG_MAIN_PASSWORD","tls":true}]
LOCALOPS_DB_PG_MAIN_PASSWORD=<secret value>Supported engines are postgresql, mysql (including MariaDB-compatible telemetry), sqlserver, and redis.
SQL Server may use "integratedAuth":true instead of a password environment variable. Database profile parsing is included in production_readiness.
v1.2 backup profiles
Storage and backup tools use named local roots from LOCALOPS_BACKUP_PROFILES. MCP callers provide only a profile ID; they cannot supply an arbitrary filesystem path.
Example:
LOCALOPS_BACKUP_PROFILES=[{"id":"app-nightly","rootPath":"/srv/backups/app","kind":"database-dump","extensions":[".bak",".zip"],"expectedIntervalHours":24,"retentionDays":30,"rpoHours":24,"rtoMinutes":120,"lastVerifiedRestoreAt":"2026-10-01T20:00:00Z","lastRestoreDurationMinutes":45}]On Windows, use an absolute Windows path with valid JSON escaping. lastVerifiedRestoreAt and lastRestoreDurationMinutes are operator-supplied evidence from an earlier restore test. LocalOps does not execute a restore to populate them. Backup profile parsing is included in production_readiness.
v1.4 remediation workflows
A v1.4 remediation workflow is a bounded, in-memory orchestration record created from current LocalOps evidence and the current execution-policy state. Workflows expire after 30 minutes and at most 100 are retained.
The workflow sequence is intentionally split:
create a plan from bounded evidence
complete required validation steps
prepare one fixed R2 step, which creates a five-minute one-time approval token
execute that exact workflow/step only with
confirmation="APPROVE"require post-action verification before the step is marked verified
Workflow execution requires LOCALOPS_EXECUTION_ENABLED=true, the existing role/allowlist checks, and LOCALOPS_AUDIT_PERSISTENCE=true. Raw approval tokens are never stored in workflow state or audit records. R3+ steps are guidance only and cannot be executed by LocalOps.
v1.5 predictive health
Every successful register_node call with health metrics contributes one timestamped observation to that node's bounded in-memory history. Duplicate capture timestamps replace the earlier observation, histories are capped at 96 entries per node, and all history disappears when the LocalOps process exits.
node_predictive_health and fleet_predictive_health send only the bounded normalized history to the loopback private core. The selected forecast horizon is restricted to 1-168 hours. At least three distinct observations spanning at least one hour are required; otherwise LocalOps returns insufficient-data.
The private core estimates linear CPU, memory and disk trends and compares them with the same LocalOps warning/critical resource thresholds. Evidence confidence measures history coverage only. It is not a probability of failure, hardware-health guarantee, capacity commitment, or authorization to remediate.
v1.6 cross-node incident correlation
fleet_incident_correlation, fleet_incident_timeline, fleet_shared_cause_analysis and fleet_incident_scope send only the bounded registered fleet snapshot bundle to the authenticated loopback private core. The core looks for repeated health pressure, shared service problem states, repeated security-change categories and common resource pressure across nodes.
The incident timeline is intentionally coarse: entries are anchored to each node's snapshot capture time because raw cross-node event streams are not stored in the fleet registry. Shared-cause outputs are hypotheses ranked by evidence coverage, not proof or probability of causation. Incident-scope results describe the current observed footprint only.
v1.7 incident memory and recurrence
capture_incident_case asks the private core to reduce the current registered fleet evidence into a normalized fingerprint, then retains that fingerprint in a bounded 200-case in-memory registry. The fingerprint contains signal IDs/categories, affected node IDs, common tags, cause categories, scope, severity and a stable signature. It does not contain raw event logs, packet contents, credentials, command output or approval tokens.
compare_incident_cases and incident_recurrence_analysis compare normalized fingerprint tokens. Similarity is expressed as evidence overlap and classified as none, weak, possible or strong. Those labels support investigation only; they are not probabilities and do not establish that two incidents share the same root cause.
incident_history_summary reports repeated signals, tags and cause categories plus bounded severity/scope counts. Without v1.8 persistence, incident memory remains process-local.
v1.8 durable incident knowledge and resolution intelligence
Set LOCALOPS_INCIDENT_PERSISTENCE=true to persist the bounded 200-case normalized registry to incident-memory.json under LOCALOPS_DATA_DIR (or the default LocalOps data directory). The file is written atomically and restrictive filesystem permissions are applied where supported. Persistence is disabled by default.
record_incident_outcome stores only fixed status/category metadata, verification state, operator ID and an optional bounded duration. It does not accept shell commands, arbitrary remediation text, credentials or approval tokens.
incident_resolution_patterns summarizes operator-confirmed resolved/mitigated cases by resolution category and repeated normalized evidence. incident_resolution_history finds prior resolved/mitigated cases with fingerprint overlap. Both are historical context only: they do not prescribe an action, prove causation or authorize execution.
v1.9 incident knowledge search and case clustering
incident_knowledge_search accepts only bounded structured criteria: signal IDs, tags, cause categories, severity, scope, outcome status and resolution category. It ranks retained cases by how much of the supplied query criteria each case covers. The match percentage is query coverage, not semantic confidence, probability or proof of causation.
incident_case_neighbors ranks the nearest historical cases to one selected case using Jaccard overlap of normalized fingerprint tokens. incident_case_clusters groups cases connected by a caller-selected 1-100 similarity threshold and returns bounded cluster summaries, common evidence and recorded outcome categories. Cluster membership is descriptive; threshold-connected groups can contain indirectly linked cases.
All v1.9 retrieval stays inside the authenticated loopback private core. No external vector database, embedding API, arbitrary text query, raw log search, packet inspection or new execution path is introduced.
v2.0 operational knowledge graph and guided investigation
operational_knowledge_graph links up to 200 supplied incident cases to normalized signal, tag, cause, outcome and resolution nodes, plus case-to-case similarity edges above a caller-selected threshold. The graph is bounded to at most 1,200 nodes and 4,000 edges and reports truncation when those limits are reached.
incident_knowledge_trace performs bounded graph traversal from one case to related historical cases with a maximum depth of four and at most 20 returned paths. incident_entity_cases performs exact normalized entity lookup for one signal, tag, cause, outcome or resolution value.
guided_incident_investigation creates an ordered five-step read-only investigation plan using the selected case, shared evidence and related historical outcomes. The plan never contains executable shell commands, never creates an approval token, and never authorizes remediation.
v2.1 investigation session memory and evidence checkpoints
Investigation sessions are linked to an existing stored incident case and are capped at 50 retained sessions, 100 checkpoints per session and 50 tracked questions per session. Checkpoints store a fixed review kind plus at most 20 normalized evidence references; they do not store raw event logs, packet contents, command output, credentials or approval tokens.
Set LOCALOPS_INVESTIGATION_PERSISTENCE=true to persist bounded session metadata to investigation-sessions.json under the existing LocalOps data directory. Persistence is disabled by default and uses atomic file replacement plus restrictive permissions where supported.
investigation_progress_analysis reports which checkpoint categories have been documented, open/resolved/deferred question counts, missing review areas and evidence-overlapping historical cases. Its coverage percentage measures recorded documentation categories only; it is not confidence, root-cause probability, remediation readiness or authorization.
v2.2 hypothesis ledger and evidence provenance
Each investigation session can retain at most 25 hypotheses, with at most 50 normalized evidence links per hypothesis. Evidence links are classified as supporting, contradicting or context and use one explicit provenance class: current case, historical case, checkpoint-derived or unverified reference.
The public MCP verifies that referenced stored cases and checkpoints exist before assigning validated provenance. The private core can then summarize evidence direction, conflicts and provenance gaps. That validation confirms the reference exists in the bounded LocalOps context; it does not prove that the underlying evidence is correct.
Hypothesis lifecycle states are operator-controlled. Analysis never automatically marks a hypothesis supported or rejected, never converts evidence counts into probability, and never creates an approval token or execution authority.
Safety model
v2.2 keeps the existing controlled-execution, remediation, predictive, cross-node, recurrence, durable-knowledge and graph boundaries while adding bounded investigation-session state and progress analysis. Session writes modify LocalOps metadata only and cannot authorize execution:
R0 READ allowed
R1 ANALYZE / EVIDENCE allowed
R2 BOUNDED EXECUTION disabled by default; explicit approval required
R3+ HIGHER-RISK EXECUTION not exposed
PRIVATE INTELLIGENCE loopback-only, authenticated, analysis-only
FLEET SNAPSHOTS bounded, in-memory, no remote control
PRIVATE INFRASTRUCTURE local reads + caller-supplied snapshots only
RBAC / POLICY process-bound, enforced for execution
DURABLE AUDIT optional generally; required for v1.4 workflow execution
DATABASE INTELLIGENCE fixed read-only queries, named profiles only
STORAGE / BACKUP INTELLIGENCE bounded metadata, named local profiles only
NETWORK TOPOLOGY INTELLIGENCE bounded submitted graphs, analysis-only
REMEDIATION WORKFLOWS ordered planning + approval orchestration; no auto-authorization
PREDICTIVE HEALTH bounded in-memory history + private trend analysis; no execution
CROSS-NODE INCIDENT bounded registered snapshots + private correlation; no execution
INCIDENT KNOWLEDGE max 200 normalized cases; optional local persistence; no raw logs or execution
OPERATIONAL KNOWLEDGE GRAPH max 1200 nodes / 4000 edges; read-only relationship analysis
INVESTIGATION SESSION MEMORY max 50 sessions / 100 checkpoints / 50 questions per sessionImportant controls:
no arbitrary command tool
no arbitrary PowerShell or shell input
no environment-variable values
no SSH key contents or private-key reads
no scheduled-task action commands
no startup command lines
no process command-line collection
no remote port scanning
no packet capture or packet payload inspection
no firewall changes
"unexpected", "outside baseline" and "new" mean only that caller-supplied expectations did not match
no event-log clearing or retention changes
no audit-policy changes
event messages are bounded and secret-like values are redacted
inaccessible logs and missing audit coverage are reported as evidence limitations rather than interpreted as clean
execution is disabled unless
LOCALOPS_EXECUTION_ENABLED=trueleast-privileged default role is
viewerR2 proposals require
operator,maintainer, oradminR2 execution requires
maintaineroradmindurable audit records contain execution metadata only, never approval tokens or command output
production_readinessblocks a production-ready result when execution is enabled without durable auditservice actions require the exact service name in
LOCALOPS_ALLOWED_SERVICESproposals perform preflight but do not execute
approval tokens expire after five minutes and are one-time use
execution requires
confirmation="APPROVE"service allowlisting is checked again immediately before execution
temporary cleanup is restricted to old regular files inside the OS temp directory, with bounded age/count controls
R3+ actions are intentionally absent from the public server
private intelligence URL is restricted to explicit loopback addresses
private-core authentication requires a token of at least 32 characters
private API routes are allowlisted in the public client
correlation requests contain bounded normalized evidence, not arbitrary commands
private-core connection errors do not echo authentication material
correlation reports relationships and evidence gaps
root-cause rankings are hypotheses, not definitive verdicts
evidence confidence measures collection coverage/alignment, not compromise probability
change triggers are temporal starting points, not proof of causation
blast radius is bounded to observed local entities and network relationships
remediation recommendations never authorize execution
v1.4 workflow creation does not create an approval token or execute a host change
required validation steps cannot be skipped before a later controlled R2 step is prepared
v1.4 workflow execution requires durable audit persistence in addition to the existing execution/RBAC/allowlist gates
raw workflow approval tokens are never stored; workflow state keeps only a SHA-256 token binding
workflow-bound approval tokens can be consumed only through the matching workflow and step, not through the generic execution tool
each controlled workflow step still requires a fresh five-minute one-time token and exact
APPROVEconfirmationa controlled workflow step is marked verified only after post-action verification succeeds
workflow state is in-memory, capped at 100 retained workflows and expires after 30 minutes
R3+ remediation stays manual and is never mapped to an executable workflow action
no workflow silently authorizes, chains or executes multiple host mutations
predictive health history is in-memory only, capped at 96 observations per node, and contains normalized health/resource metrics rather than raw event logs
predictive horizons are bounded to 1-168 hours
at least three distinct observations spanning at least one hour are required before a directional forecast is considered defensible
evidence confidence measures observation count/time-span coverage, not failure probability
predictive analysis uses linear trend extrapolation and explicitly reports that it does not model workload schedules, seasonality, deployments or hardware failure mechanisms
predictive results never authorize or trigger remediation
the private predictive API exposes analysis only; no predictive execution route exists
cross-node analysis uses only bounded registered snapshots and does not collect distributed traces, packet contents or synchronized raw event streams
repeated evidence across nodes is treated as correlation, not verified causation
shared-cause evidence confidence measures cross-node coverage and is not a probability that a hypothesis is the cause
cross-node timelines are anchored to snapshot capture time and explicitly disclose timing limitations
v1.6 cross-node routes are analysis-only and expose no execution endpoint
incident memory is capped at 200 normalized cases; persistence is disabled by default and enabled only with
LOCALOPS_INCIDENT_PERSISTENCE=truedurable incident state is restricted to the LocalOps data directory and uses atomic replacement plus restrictive permissions where supported
incident fingerprints and outcomes exclude raw event logs, packet data, credentials, command output and approval tokens
outcome recording uses fixed status/category fields rather than arbitrary remediation commands or notes
incident similarity measures normalized evidence overlap and is not recurrence probability or causal proof
historical resolution patterns describe recorded outcomes and are not recommendations for a future incident
v1.8 private incident routes are authenticated, loopback-only, analysis-only and expose no execution endpoint
v1.9 search accepts only bounded structured criteria and does not expose arbitrary text, regex, SQL, shell or raw-log query input
v1.9 neighbor and cluster similarity uses normalized fingerprint overlap and is not probability or causal confidence
clustering is bounded to at most 200 supplied cases and returns at most 50 cluster summaries
threshold-connected clusters can include indirectly linked cases and explicitly disclose that limitation
no external embedding, vector database or third-party search service receives incident knowledge
v1.9 private retrieval routes are authenticated, loopback-only, analysis-only and expose no execution endpoint
v2.0 graph input is limited to the same bounded normalized incident cases already retained by LocalOps
v2.0 graph construction is bounded to 1,200 nodes and 4,000 edges and explicitly reports truncation
v2.0 tracing is bounded to depth 4 and 20 paths; graph paths are investigation aids, not causal proof
v2.0 entity lookup accepts one exact normalized value and returns at most 50 cases
guided investigation returns non-mutating evidence-review steps only and never returns executable commands or approval tokens
/v2/knowledge/executeis not allowlisted by the public client and no v2 knowledge execution endpoint existsinvestigation sessions are capped at 50; each session is capped at 100 checkpoints and 50 questions
checkpoint evidence references are capped at 20 values per checkpoint and 128 characters per value
investigation persistence is disabled by default and, when enabled, stays under the LocalOps data directory
session metadata excludes raw event logs, packet data, credentials, command output, approval tokens and remediation scripts
completed sessions reject new checkpoints/questions and cannot be completed while questions remain open
review coverage counts documented checkpoint categories only and is not confidence or remediation readiness
/v2/investigations/progressis the only v2.1 private investigation route allowlisted by the public client; no investigation execution route existsfleet snapshots contain summarized security-change categories/counts, not raw event messages
fleet registry is in-memory only and capped at 500 nodes
registering a snapshot records caller-supplied node evidence; it does not authenticate or attest the identity of that node
fleet drift requires an explicitly selected baseline node
stale snapshots and large capture-time skew are surfaced as evidence limitations
fleet drift means difference, not automatically error, unauthorized change or compromise
no SSH, WinRM, remote shell, credential storage or lateral execution
no automatic cross-node remediation
no subnet discovery, remote device login or credential collection
no SNMP writes or remote management mutation
no hypervisor VM start/stop/create/delete actions
no storage mutation, formatting or filesystem changes
private-infrastructure snapshots do not authenticate or attest device identity
topology is derived only from submitted nodes/links and is not active discovery
articulation nodes indicate dependency concentration in submitted topology, not guaranteed production single points of failure
v1.3 dependency paths use only submitted non-down links; unknown-state links may reduce certainty
path redundancy simulates one primary-path link or intermediate-node loss at a time and does not verify physical path diversity
failure-domain results describe graph connectivity impact, not guaranteed application outage
change-impact analysis is what-if only and does not execute network changes
endpoint-pair change simulation disables all submitted links between those endpoints
no subnet scanning, remote login, route mutation, firewall mutation, SNMP write, lateral execution or automatic network remediation is exposed
database tools accept profile IDs only, not connection strings or arbitrary SQL
database passwords are referenced through separate environment variables and are never returned in profile metadata
fixed database telemetry queries do not collect application query text
no INSERT, UPDATE, DELETE, DDL, transaction termination, failover or database-configuration mutation is exposed
database health is operational evidence, not proof of data integrity, application correctness or compromise
standalone or intentionally non-replicated databases are not automatically treated as unhealthy
capacity values do not invent free disk space or growth risk when the engine does not expose those facts
malformed database profile configuration is surfaced by production readiness
backup tools accept configured profile IDs only, not arbitrary filesystem paths
backup scans are bounded to 5,000 matching files and a maximum directory depth of 16
symbolic links are not followed by the backup collector
restore-point validation checks metadata, non-zero size and one-byte read access only; it does not execute or certify a restore
backup growth uses an explicit caller-supplied prior baseline; LocalOps does not invent or persist trend history
RPO/RTO results are evidence comparisons against configured objectives, not guarantees of recoverability
restore-verification timestamps and durations are operator-supplied evidence from prior restore testing
no backup restore, delete, prune, format or storage-mutation tool is exposed
malformed backup profile configuration is surfaced by production readiness
bounded list sizes
strict PID validation
strict service-name validation
fixed executable/argument paths
token/password/secret redaction in command errors and output
no administrator/root requirement for normal Node.js collectors
Some platform collectors may require local permission to inspect specific processes or services. Permission failures are returned as errors rather than bypassed.
Public/private boundary
This repository is the public implementation and portfolio-facing gateway.
The separate private OpsChugex LocalOps Intelligence Core implements correlation, root-cause intelligence, fleet drift, predictive-health trend/threshold analysis, cross-node incident correlation, incident fingerprinting, recurrence/similarity analysis, resolution-pattern and historical-resolution analysis, structured incident retrieval, nearest-case matching, similarity clustering, operational knowledge-graph construction, relationship tracing, guided-investigation reasoning, v2.1 investigation-progress analysis, shared-cause ranking and scope analysis, private device-health/topology reasoning, dependency-path/redundancy/failure-domain/change-impact analysis, database health/replication/contention/pressure analysis, backup snapshot-health/recovery-readiness/risk correlation, and remediation workflow planning.
The public repository contains safe collection, bounded snapshots, schemas, fixed read-only database adapters, bounded local backup metadata collectors, bounded topology/remediation/predictive/cross-node/incident-memory/search/knowledge-graph/investigation-session contracts, local infrastructure adapters, in-memory workflow/fleet/health-history state, optional durable normalized incident-case and investigation-session storage, structured outcome/checkpoint/question recording, policy enforcement, approval orchestration, audit integration and the loopback client. Proprietary correlation, incident fingerprinting, recurrence/similarity analysis, resolution-pattern analysis, structured retrieval ranking, neighbor matching, case clustering, knowledge-graph construction, relationship tracing, guided-investigation reasoning, investigation-progress analysis, shared-cause ranking, scope analysis, drift, topology, database-analysis, backup-risk, remediation-planning and predictive-health algorithms are not included in this MIT repository.
Roadmap
Version | Focus |
0.1 | System discovery, completed |
0.2 | Endpoint inventory, completed |
0.3 | Network intelligence, completed |
0.4 | Event and security evidence, completed |
0.5 | Approval-gated controlled execution, completed |
0.6 | Evidence correlation, completed |
0.7 | Root-cause intelligence, completed |
0.8 | Fleet intelligence, completed |
0.9 | Private infrastructure and virtualization, completed |
1.0 | Production LocalOps platform, completed |
1.1 | Database intelligence, completed |
1.2 | Storage and backup intelligence, completed |
1.3 | Network topology intelligence, completed |
1.4 | Automated remediation workflows, completed |
1.5 | Predictive health intelligence, completed |
1.6 | Cross-node incident correlation, completed |
1.7 | Incident memory and recurrence intelligence, completed |
1.8 | Durable incident knowledge and resolution intelligence, completed |
1.9 | Incident knowledge search and case clustering, completed |
2.0 | Operational knowledge graph and guided investigation, completed |
2.1 | Investigation session memory and evidence checkpoints, completed |
2.2 | Investigation hypothesis ledger and evidence provenance, completed |
Development principles
Prefer native OS APIs and fixed commands over generic shell execution.
Treat missing evidence as unknown, not as proof of safety or failure.
Keep collection separate from intelligence and remediation.
Normalize Windows and Linux responses into stable MCP schemas.
Require explicit policy and approval gates before future mutation features.
Keep proprietary intelligence outside the public repository.
Relationship to Cloud DevOps MCP
Cloud DevOps MCP Server focuses on cloud infrastructure, Kubernetes, Terraform, CI/CD, observability and cloud operations.
OpsChugex LocalOps MCP focuses on the operating systems, endpoints, local servers and private infrastructure underneath them.
Together they form two separate operational planes rather than overlapping wrappers around the same services.
Author
Built and maintained by Alex C. Godwin under the OpsChugex product brand.
License
MIT. See LICENSE.
Available Tools
23 toolscertificate_expiryCertificate ExpiryBRead-onlyIdempotent
Return certificates already expired or expiring within the requested window.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| withinDays | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| certificates | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare this as a read-only, idempotent, non-destructive, closed-world operation, so the safety profile is covered. The description adds useful behavioral scope by clarifying that only expired/expiring certificates are returned. It does not mention default behavior when `withinDays` is omitted or that `limit` caps results, so it adds moderate context beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence that states the operation and its filter condition with no wasted words. It is appropriately sized for a simple query tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be described, and annotations cover the safety profile. However, with zero schema description coverage, the description leaves `limit` undefined and does not specify a default or behavior when `withinDays` is omitted, leaving a notable gap for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and only one parameter is loosely reflected in the description via 'requested window' (withinDays). The `limit` parameter is not addressed at all, and no defaults, units, or caps are explained. With low schema coverage, the description should compensate more fully but does not.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Return') and resource ('certificates') with a clear scope: expired or expiring within a window. It distinguishes the filtering behavior from a generic inventory, but does not name the sibling tool `certificate_inventory`, so sibling differentiation is implicit rather than explicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the description: use this to find certificates needing attention based on expiration. However, there is no explicit when-to-use or when-not-to-use guidance, and no mention of the related `certificate_inventory` sibling, leaving the agent to infer the distinction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
certificate_inventoryCertificate InventoryARead-onlyIdempotent
Inventory bounded certificate metadata and expiry dates. Private key material is never read or returned.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| certificates | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint=false, so the safety profile is covered structurally. The description adds genuinely new context by guaranteeing that private key material is never read or returned, which is a substantive security disclosure beyond annotations, plus the 'bounded' hint that results are capped.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, no waste, with the core purpose front-loaded and the security caveat immediately after. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists so return values need not be described, and the read-only nature is well covered by annotations plus the key-material guarantee. The only real gap is failing to clarify the limit parameter's bounds and the distinction from 'certificate_expiry'.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one optional parameter (limit) exists with 0% schema description coverage, and the description only gestures at it with the word 'bounded' without stating the default or the 300 maximum. It adds some meaning but leaves the parameter's behavior underspecified.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Inventory') and resource ('certificate metadata and expiry dates'), so the agent knows exactly what is returned. It does not, however, explicitly differentiate itself from the sibling 'certificate_expiry', which overlaps on the expiry-date concept.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no statement of when to use this tool versus the closely related 'certificate_expiry' or 'ssh_key_inventory' siblings. The agent must infer the distinction between a full inventory and an expiry-focused view.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cpu_statusCPU StatusCRead-onlyIdempotent
Sample CPU utilization and return processor metadata and load averages.
| Name | Required | Description | Default |
|---|---|---|---|
| sampleMs | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| model | Yes | |
| speedMHz | Yes | |
| loadAverage | Yes | |
| logicalCores | Yes | |
| usagePercent | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare read-only, idempotent, non-destructive, closed-world behavior, so the safety profile is covered. The description adds that the tool samples utilization and returns metadata and load averages, but does not explain sampling duration, blocking behavior, or any auth/rate-limit context beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence with no wasted words. It is appropriately sized for a simple status tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter tool with rich annotations and an output schema, the description covers the basic purpose adequately. However, it omits usage guidance and parameter semantics, leaving meaningful gaps for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is one parameter (sampleMs) with 0% schema description coverage, and the description never mentions it or explains its effect on the sampling window. The description therefore fails to compensate for the schema coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb + resource (sample CPU utilization) and enumerates return content (processor metadata, load averages). It is clearly distinct from siblings like memory_status and disk_status, though it does not explicitly differentiate itself from broader tools such as system_info or system_health.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided about when to use this tool versus alternatives. It implies a CPU-specific inspection context but gives no conditions, exclusions, or routing advice.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
disk_statusDisk StatusARead-onlyIdempotent
Inspect fixed local disk capacity and utilization using a bounded platform-specific command.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| disks | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, non-destructive, non-open-world behavior, so the safety profile is fully covered. The phrase 'bounded platform-specific command' adds a little context (it won't run unbounded, and results are platform-dependent) but says nothing about permissions, output variability across OSes, or failure modes.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with the resource defined before the implementation note. No redundant or filler content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, return values need no explanation, and no parameters exist to document. The remaining gap is routing: the description does not say how this differs from system_info or system_health, which may also surface disk data, so an agent could still pick the wrong tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, which is the baseline-4 case under the rubric. There is nothing for the description to disambiguate, and the empty schema is consistent with a parameterless inspection call.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb (inspect) and a well-scoped resource: fixed local disk capacity and utilization. 'Fixed local disk' cleanly separates it from siblings like memory_status, cpu_status, and network_interfaces, though no sibling is named explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied — an agent can infer this is the tool for disk capacity, and the 'fixed local' qualifier hints that removable/network volumes are out of scope. There is no explicit when-to-use, when-not, or routing versus system_info/system_health, which plausibly overlap on disk data.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
environment_variables_summaryEnvironment Variables SummaryBRead-onlyIdempotent
Return environment-variable names and a sensitive-name flag only. Values are never exposed.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| variables | Yes | |
| returnedCount | Yes | |
| valuesExposed | Yes | |
| variableCount | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare a full safe-read profile (readOnlyHint, idempotentHint, non-destructive), so the bar is lower. The description adds genuinely valuable context beyond them: only names plus a sensitive-name flag are returned and values are never exposed, which is a meaningful privacy/security guarantee. It does not cover pagination or how 'limit' truncates results.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences with zero filler. The most important constraint — names only, values never exposed — is front-loaded and unmistakable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return shape needn't be re-explained, and the description correctly summarizes what is returned. However, the tool's only parameter is undocumented in both schema and prose, leaving a real gap for a low-complexity read tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is a single 'limit' parameter with 0% schema description coverage, and the description never mentions it — no default, no max, no explanation of what gets limited. The schema alone would not tell an agent how to use it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb and resource ('Return environment-variable names') and precisely bounds the scope with 'and a sensitive-name flag only. Values are never exposed.' This clearly separates it from siblings like system_info or installed_software, though it never names an alternative explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no mention of alternatives for inspecting environment data, and no stated prerequisites. Usage is only loosely implied by the returned content.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
inspect_processInspect ProcessARead-onlyIdempotent
Inspect one local process by numeric PID without returning its environment or command-line arguments.
| Name | Required | Description | Default |
|---|---|---|---|
| pid | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| process | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent and non-destructive behavior, so the safety profile is covered. The description adds a genuinely useful negative guarantee, that environment and command-line arguments are NOT returned, plus a local-only scope. It stops short of describing what data is returned or any auth requirement.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single tight sentence front-loading the action and resource, with the output exclusion clause following. Every phrase earns its place; nothing is redundant with the schema or annotations.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and annotations cover the safety profile. The negative output guarantee and local-only scope fill the remaining gaps for a single-param read tool; only the PID validity/error behavior is unstated.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With one parameter at 0% schema description coverage, the description must carry the load and it does: 'by numeric PID' clarifies the identifier type (a number, not a process name). It omits valid range or lookup-failure behavior, but adds the essential semantic.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (inspect) and resource (one local process) bounded by a numeric PID, which implicitly separates it from the plural list_processes sibling. It does not name the sibling explicitly, but the singular/targeted scope is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: an agent can infer this is for drilling into a single known PID rather than enumerating processes. There is no explicit when-to-use/when-not statement or named alternative such as list_processes.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
installed_softwareInstalled SoftwareARead-onlyIdempotent
Return a bounded installed-software inventory with versions and publisher metadata. Windows reads uninstall registry metadata; Linux uses the available package database.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| packages | Yes | |
| packageManager | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, non-destructive and closed-world behavior, so the safety profile is covered. The description adds genuinely useful behavioral context beyond that: the platform-dependent data sources (Windows uninstall registry vs Linux package database), which tells an agent why results may differ across hosts and why some software may be missed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences with no filler; the core purpose and the platform data sources are front-loaded in that order.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return-value explanation is unnecessary, and the description covers the key cross-platform behavioral caveat. The remaining gap is the limit parameter's default/capping behavior, which matters for an agent deciding whether results are complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is a single parameter (limit) with 0% schema description coverage, so the schema carries no meaning. The description's word 'bounded' implies the inventory is capped by that limit, but it does not state the default value, the 500 maximum, or pagination/truncation behavior, leaving most of the parameter's semantics undocumented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource — returning an installed-software inventory — and adds that it includes versions and publisher metadata, which distinguishes it from the bare 'software_changes' sibling. It does not explicitly contrast with 'software_versions', so the boundary between those two inventory-style siblings is left to inference.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description never says when to use this tool instead of software_versions or software_changes, nor any precondition (e.g., permissions, platform requirements beyond the OS data sources). Usage must be inferred entirely from the one-line scope statement.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_processesList ProcessesARead-onlyIdempotent
List a bounded number of local processes with basic resource metadata. Command lines and environment variables are not returned.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| processes | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish readOnly, idempotent, non-destructive, and closed-world behavior, so the bar is lower. The description adds genuinely useful non-annotated detail: results are bounded and command lines/environment variables are deliberately excluded, which matters for both volume and sensitivity expectations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the core action, and the exclusion statement earns its place by preventing a common misuse. No filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return format need not be explained, and annotations cover the safety profile. The description supplies the key scoping facts (bounded, no command lines/env vars). Only the parameter's default/meaning is left unaddressed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% and the single 'limit' parameter has no description beyond a 1-200 integer range. The word 'bounded' gestures at the cap but does not explain what limit controls (count of processes returned, default value, or behavior when omitted). Marginal value over the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('List ... local processes') plus the scope qualifier 'bounded number' and the metadata class ('basic resource metadata'). It does not explicitly name or contrast with the sibling inspect_process, which is the natural alternative for detailed process data, so it falls short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied rather than stated: the note that command lines and environment variables are not returned hints that inspect_process is the tool for that detail, but neither that sibling nor any when-to-use/when-not condition is named. An agent must infer the routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_servicesList ServicesARead-onlyIdempotent
List a bounded number of Windows services or systemd services and their states.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| services | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true and destructiveHint=false, so the safety profile is fully covered. The description adds useful context that the result is bounded and includes states, but does not disclose the default bound, pagination, or truncation behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single tight sentence with the key scoping adjectives ('bounded', 'their states') front-loaded. Nothing is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be described, and the cross-platform (Windows/systemd) scope is stated. The only real gap is the undocumented default for the limit parameter.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
One parameter with 0% schema description coverage, so the description must carry it. 'Bounded number' loosely maps to the 'limit' parameter (schema constrains it to 1-300) but no default value or practical cap guidance is given.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Names a specific verb ('List') and resource ('Windows services or systemd services and their states'), making the platform scope clear. It distinguishes itself from 'service_status' only implicitly (plural listing vs. single-service inspection), so sibling differentiation is not explicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies a bulk-enumeration use case but never states when to call this versus 'service_status' for a single service, nor any prerequisites. Usage is left to be inferred from the plural phrasing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
local_adminsLocal AdministratorsARead-onlyIdempotent
Identify members of the built-in Windows Administrators group or common Linux administrative groups without modifying membership.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| administrators | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, and non-destructive, so the safety profile is covered; the description's 'without modifying membership' largely restates this. It does add useful context that results span built-in Windows and common Linux admin groups, which the annotations cannot convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that front-loads the action and resource and ends with the read-only scope constraint. Nothing is wasted or buried.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With zero parameters, rich annotations, and an output schema present, the description does not need to explain return values. It supplies the cross-platform scope, though it could say more about which groups qualify on Linux.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so the description has no parameter semantics to explain and the schema is fully covering. Baseline 4 for a no-parameter tool.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (identify) and resource (members of Windows Administrators group / Linux admin groups) with cross-platform scope. It does not explicitly differentiate itself from close siblings like local_groups and local_users, so an agent must infer the distinction, but the purpose is unmistakable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance or mention of alternatives, despite siblings (local_groups, local_users) that overlap in domain. The 'without modifying membership' clause is a scope constraint, not usage routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
local_groupsLocal GroupsBRead-onlyIdempotent
Return bounded local group metadata and Linux group membership where available.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| groups | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false, and openWorldHint=false, so the safety profile is covered. The description adds the 'bounded' qualifier and the 'where available' platform caveat, but says nothing about permissions required to enumerate groups or how suppression/truncation behaves.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One compact sentence with no filler and the resource front-loaded. It is efficient, though it spends words on the 'where available' hedge rather than on the parameter it leaves unexplained.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be described, and annotations cover the read-only nature. However, for a tool with an undocumented limit parameter and no usage routing among the many sibling inventory tools, the description is only minimally adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the single 'limit' parameter (1-300) is undocumented in both schema and description. 'Bounded' loosely alludes to a size cap but gives no default, no maximum, and no statement of what happens when results exceed the limit; the description does not compensate for the coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: it returns local group metadata and Linux group membership. This clearly distinguishes it from most siblings, though it never names the closest sibling (local_users) or explicitly contrasts group vs user data.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no prerequisites, and no mention of when to prefer local_groups over local_users or local_admins. The only usable context is the tool name itself.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
local_usersLocal UsersBRead-onlyIdempotent
Return bounded local account metadata. Passwords, password hashes and credential material are never returned.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| users | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, and non-destructive, so the safety profile is covered. The description does add real value beyond them by stating output is 'bounded' and that passwords/hashes/credentials are never returned, which is a security-relevant guarantee the annotations do not express. It still says nothing about ordering, pagination, or count of accounts.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short, front-loaded sentences with no filler; the credential-exclusion guarantee is stated immediately after the purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return-value detail is not required, and the credential exclusion is a useful addition. However, for a tool with a zero-documented, unbounded-looking parameter and no usage routing vs three neighbouring account tools, the description leaves clear gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% and the single 'limit' parameter (max 300) is only obliquely implied by the word 'bounded'. The description does not state the bound or the default, so the schema's maximum/minimum constraints carry the load.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Return bounded local account metadata'), which is clear enough to distinguish from local_groups and local_admins. It does not, however, explicitly name those siblings or say how the accounts differ (local vs domain, admin vs all).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance at all: nothing tells the agent when to pick this over local_admins or local_groups, nor any prerequisites. Usage must be inferred entirely from the tool name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
memory_statusMemory StatusARead-onlyIdempotent
Return total, used and available physical memory.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| freeBytes | Yes | |
| usedBytes | Yes | |
| totalBytes | Yes | |
| usagePercent | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false, and openWorldHint=false, so the safety profile is covered. The description adds only return fields, which the output schema likely covers, and discloses no additional behavioral context such as permissions or rate limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence with no wasted words, front-loading the resource and returned metrics. It is appropriately sized for a simple status tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present and annotations covering the safety profile, the description is nearly sufficient for a zero-parameter read-only tool. It is clear enough to invoke correctly, though it could mention sibling alternatives like system_info for better routing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so the baseline is 4. The description does not need to explain parameter semantics, and it correctly adds no misleading input information.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: return total, used and available physical memory. Clear what it does. Does not explicitly differentiate from siblings like system_info, which may also expose memory details, so not a full 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the resource and sibling naming, but no when-to-use, when-not-to-use, or alternative guidance is provided. An agent can infer it for memory status, but must decide on its own versus system_info or system_health.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
network_interfacesNetwork InterfacesARead-onlyIdempotent
List local network interfaces and assigned addresses. No network probing is performed.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| interfaces | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false and openWorldHint=false, so the safety profile is covered. The description adds real value beyond that by disclosing that 'No network probing is performed' – an important scope guarantee that the tool only reads local configuration rather than scanning the network.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, the resource is front-loaded and the scope caveat follows immediately. No filler and nothing that fails to earn its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be documented, and annotations plus the description cover safety and scope. For a zero-parameter read tool this is nearly complete; only an explicit note on when to prefer it over system_info would add value.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there is nothing for the description to disambiguate. Baseline 4 applies; the description correctly avoids inventing parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('List') and resource ('local network interfaces and assigned addresses'), which is clear and distinct from generic siblings like system_info or system_health. It does not explicitly name a sibling it differs from, so it stops short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The context of use (inspecting local host configuration) is implied by the description but never stated, and no alternatives or exclusions are named among the many sibling system-inspection tools. Adequate but leaves routing to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
scheduled_tasksScheduled TasksARead-onlyIdempotent
Inventory Windows scheduled tasks or Linux systemd timers and cron directory entries without returning task action commands.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| tasks | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint and non-destructive behavior, so the safety profile is covered. The description adds a genuinely useful behavioral detail beyond the annotations: task action commands are deliberately omitted from the results, which matters for both security sensitivity and what the agent can expect back.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One sentence, front-loaded with the verb and resources, followed by the redaction qualifier. Every clause earns its place with no padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present the description needn't explain return values, and the annotations cover the safety profile. It covers platforms, scope and the redaction caveat; only the limit parameter is unaddressed, which is a minor gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the description never mentions the single 'limit' parameter. However, the parameter is a trivial optional integer constrained by min/max, so it is largely self-explanatory from the schema alone; this lands at the baseline rather than below it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (inventory) and the exact resources covered (Windows scheduled tasks, systemd timers, cron directory entries). It is clearly distinguishable from siblings like startup_programs and list_services, though it never names an alternative explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the scope — an agent can infer this is the tool for scheduled task/timer enumeration — but there is no explicit when-to-use or when-not-to-use guidance versus startup_programs or list_services.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
service_statusService StatusARead-onlyIdempotent
Inspect one Windows or systemd service. Service names are strictly validated before use.
| Name | Required | Description | Default |
|---|---|---|---|
| serviceName | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| service | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, destructiveHint=false and openWorldHint=false, so the safety profile is fully covered structurally. The description adds the validation constraint ('service names are strictly validated before use'), which is genuinely new context, but says nothing about permissions, failure modes, or pagination.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the action and resource; both sentences carry weight with no filler. Slightly terse rather than padded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need no explanation, and annotations cover the safety profile. For a single-parameter read tool the description is nearly complete; only the accepted name format and the validation rules remain unstated.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
One required parameter with 0% schema description coverage, so the schema supplies only minLength/maxLength with no semantics. The description adds that the name is strictly validated, which is useful, but never states the expected format (e.g. 'nginx' vs 'nginx.service') or what makes a name valid.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (inspect) and resource (a single Windows or systemd service), and the word 'one' implicitly contrasts with the sibling list_services. It stops short of naming that sibling, so it is clear but not fully disambiguated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The singular scope implies use when a specific service name is already known, versus listing all services, but no alternative is named and no conditions or prerequisites are stated. Usage is inferable rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
software_changesSoftware ChangesARead-onlyIdempotent
Compare the current bounded installed-software inventory with a caller-supplied baseline. The server does not persist a baseline or write to disk.
| Name | Required | Description | Default |
|---|---|---|---|
| previousInventory | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| added | Yes | |
| removed | Yes | |
| limitation | Yes | |
| currentCount | Yes | |
| baselineCount | Yes | |
| versionChanged | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, non-destructive, closed-world behavior, so the safety profile is covered. The description adds genuinely new behavior beyond that: no baseline persistence and no disk writes, which tells the agent the comparison is stateless and repeatable.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, zero padding, with the core comparison stated first and the stateless caveat second. Every sentence carries information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need no explanation, and the stateless behavior is disclosed. The gaps are the undocumented input shape (no schema descriptions) and thin guidance on matching semantics (name vs name+version) and behavior at the 500-item limit.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the description only labels the input as a 'caller-supplied baseline'. It omits the array-of-objects structure, the name/version fields, and the 500-item cap that the schema enforces, so it does not compensate for the coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb (compare) plus resource (current installed-software inventory against a caller-supplied baseline), which is meaningfully distinct from the sibling inventory tools like installed_software and software_versions. It does not name those siblings explicitly, so the differentiation is inferred rather than stated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The statement that the server does not persist a baseline implies the caller must retain and supply their own, which is implied usage guidance. However, there is no explicit when-to-use, when-not-to-use, or routing advice versus installed_software / software_versions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
software_versionsSoftware VersionsARead-onlyIdempotent
Look up installed versions for up to 50 requested software names without launching or modifying the software.
| Name | Required | Description | Default |
|---|---|---|---|
| names | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| matches | Yes | |
| requested | Yes | |
| packageManager | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish readOnlyHint=true, destructiveHint=false, and idempotentHint=true. The description adds useful behavioral context beyond those hints by stating it will not launch or modify the software, which clarifies that version detection is passive rather than execution-based.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence with no wasted words. The core action, scope, and non-invasive behavior are all delivered immediately.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The output schema exists, so return values need not be described, and the annotations carry the safety profile. However, for correct invocation, the description should clarify how software names are matched and how this differs from installed_software, both of which are missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% for the single required parameter 'names'. The description only restates that these are software names and repeats the 50-item limit already present in the schema; it does not explain matching rules, expected name format, case sensitivity, or how partial or unknown names are handled.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('look up'), resource ('installed versions'), and scope ('up to 50 requested software names'). It implies a focused query rather than a full inventory, but does not explicitly name the sibling tool installed_software, so sibling differentiation is left to inference.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for using the tool with a bounded list of requested software names, but it does not say when to choose this over installed_software or software_changes. Usage is implied rather than explicitly framed with when-to-use and when-not-to-use guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_key_inventorySSH Key InventoryARead-onlyIdempotent
List metadata for files in the current user's SSH directory. Key contents, private key material and authorized key contents are never read or returned.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| keys | Yes | |
| directory | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, non-destructive and closed-world. The description adds genuinely valuable behavioral context beyond that: key contents, private key material and authorized_keys contents are never read or returned. It does not cover pagination behavior, but the privacy guarantee is a meaningful addition.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, zero waste, and the scope statement is front-loaded before the negative guarantee. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so field-level return detail is unnecessary, and the description correctly focuses on scope and privacy constraints. Only the undocumented 'limit' parameter leaves a small completeness gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is a single 'limit' parameter with 0% schema description coverage, and the description never mentions it, so it fails to compensate for the documentation gap. An agent gets no hint about what limit controls or its bounds from prose. The name is fairly self-explanatory, which keeps this from the bottom of the scale.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('List metadata') and resource ('files in the current user's SSH directory'), with the scope ('current user's') explicitly bounded. It is unambiguous what this tool returns and how it differs from system/certificate inventory siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the description's scope (listing SSH directory file metadata), but there is no explicit when/when-not guidance or named alternative. With no competing SSH-key sibling, the absence of routing is tolerable but still leaves guidance at an implied level.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
startup_programsStartup ProgramsARead-onlyIdempotent
Inventory Windows startup registrations or enabled Linux systemd/XDG startup entries. Startup command lines are intentionally not returned.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| startupPrograms | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare read-only, idempotent, non-destructive, closed-world behavior, so the safety profile is covered. The description adds a genuinely non-obvious behavioral disclosure: startup command lines are intentionally omitted, which tells the agent what data will be missing from the result.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no waste, scope front-loaded and the data-omission caveat placed second. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists so return shapes need not be explained, and annotations cover safety. Scope and the command-line omission are stated; the only real gap is that the limit parameter and its effect are left entirely undocumented.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter (limit, max 300) has 0% schema description coverage and is not mentioned at all in the description. With low coverage the description should compensate, but it says nothing about pagination or result-size control.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (inventory) and resource (Windows startup registrations, Linux systemd/XDG startup entries), and disambiguates by platform. Clearly distinguishable from siblings like scheduled_tasks, list_services, and installed_software.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the platform-scoped resource but no explicit when-to-use or when-not-to-use guidance is given, and no alternative sibling is named for overlapping cases such as scheduled_tasks.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
system_healthSystem HealthARead-onlyIdempotent
Summarize CPU, memory and fixed-disk pressure without changing the host.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| health | Yes | |
| reasons | Yes | |
| hostname | Yes | |
| uptimeSeconds | Yes | |
| cpuUsagePercent | Yes | |
| memoryUsagePercent | Yes | |
| maxDiskUsagePercent | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, and 'without changing the host' essentially restates that safety profile rather than extending it. The description adds no new behavioral context such as sampling window, refresh cost, or what the summary aggregates across. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence naming the verb, the three measured resources, and the non-mutating guarantee. No filler, no restatement of the name or title.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Output schema exists, so return values need not be described, and there are no parameters to document. The description usefully scopes 'fixed-disk' (excluding network/removable volumes) against a large sibling set, though it could say more about what the aggregate summary contains given how many granular siblings exist.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so the baseline is 4 and there is nothing for the description to disambiguate. The schema is empty and fully covered, leaving no parameter semantics gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (summarize) and explicit resource scope (CPU, memory, fixed-disk pressure), so an agent knows it is an aggregate read rather than a single-subsystem query. It does not explicitly name cpu_status/memory_status/disk_status as the granular alternatives, so sibling differentiation is only implied.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied: reach for this when a consolidated health snapshot is wanted rather than per-subsystem detail. There is no explicit statement of when to prefer this over cpu_status, memory_status, or disk_status, nor any exclusions or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
system_infoSystem InformationBRead-onlyIdempotent
Return bounded operating-system and host metadata using Node.js system APIs.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| machine | Yes | |
| release | Yes | |
| version | Yes | |
| hostname | Yes | |
| platform | Yes | |
| architecture | Yes | |
| uptimeSeconds | Yes | |
| logicalCpuCount | Yes | |
| operatingSystem | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, openWorldHint=false and destructiveHint=false, so safety is covered. The description adds only the word 'bounded', hinting at a truncated/limited payload, but says nothing about what is truncated or how.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler. It is efficient, though its brevity comes at the cost of scope detail rather than being a model of informative concision.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and annotations cover the safety profile for this zero-param read. The remaining gap is scope definition relative to the dense set of more specific sibling diagnostics.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so per the rubric the baseline is 4. Nothing about parameters needs documenting and the description does not need to compensate for any schema gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Return) and resource (operating-system and host metadata), which is clear on its own. However, with 22 siblings including uptime, cpu_status, memory_status, disk_status and network_interfaces, it does not say how it differs from those narrower tools or what 'bounded' scope actually covers.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance, no exclusions, and no mention of any alternative among the many overlapping diagnostic siblings. The agent must guess whether to call this or the specific cpu/memory/disk tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
uptimeSystem UptimeARead-onlyIdempotent
Return system uptime in seconds, hours and days.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| uptimeDays | Yes | |
| uptimeHours | Yes | |
| uptimeSeconds | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, destructiveHint=false, and openWorldHint=false, so the safety and side-effect profile is fully covered by structured data. The description's only addition is the format of the returned value (seconds, hours, days), which is minor behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence that conveys the resource and the unit of the result with no waste. Nothing could be trimmed without losing information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, read-only tool with complete annotations and an output schema, the description is adequate; the return format is already covered by the output schema, so the brief description loses little. It could name its sibling boundary (e.g. vs system_info) but is otherwise sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there is nothing to disambiguate; per the rubric, a parameter-free tool has a baseline of 4. The description correctly implies the tool is argument-free.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Return) and resource (system uptime) and even specifies the units returned (seconds, hours, days). It does not explicitly differentiate itself from the sibling system_info, which could plausibly include uptime, so it falls short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use, when-not-to-use, or alternative routing guidance. The tool's purpose is fairly self-evident from the name, but the description provides no explicit context for selecting it over system_info or system_health.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
23 tool updates
v0.2.0- First observed
certificate_expiry - First observed
certificate_inventory - First observed
cpu_status - First observed
disk_status - First observed
environment_variables_summary - First observed
inspect_process - First observed
installed_software - First observed
list_processes - First observed
list_services - First observed
local_admins - First observed
local_groups - First observed
local_users - First observed
memory_status - First observed
network_interfaces - First observed
scheduled_tasks - First observed
service_status - First observed
software_changes - First observed
software_versions - First observed
ssh_key_inventory - First observed
startup_programs - First observed
system_health - First observed
system_info - First observed
uptime
TDQS
Scored across 23 tools
Most tools target distinct resources or actions, but the system health area has some overlap: system_health summarizes CPU, memory, and disk while cpu_status, memory_status, and disk_status provide detailed views of the same domains. Descriptions help distinguish them, but an agent could still hesitate between a summary tool and a detail tool.
All names use snake_case, which is consistent, but the conventions vary between noun phrases (system_info, cpu_status, network_interfaces) and verb-led names (list_processes, inspect_process, list_services). The pattern is readable but not uniform verb_noun throughout.
23 tools sits in the 16-25 range that the rubric calls borderline heavy for a server's scope. While many tools serve distinct read-only inspection needs, several could be consolidated with the summary tools, making the surface feel somewhat expansive.
Coverage is broad for local read-only system inspection: hardware, OS, processes, services, software, users, security artifacts, startup, and scheduled tasks are all represented. Minor gaps exist, such as network connection/port inspection and event log access, but agents can work around most of these.
Maintenance
Related MCP Connectors
Read-only MCP access to a documented IT fleet: state, changes, posture. 15 tools.
Official-source US business, permit, and WHOIS evidence via read-only MCP tools.
Read-only server insight: why a Linux server or K8s cluster is slow, failing or changed.
Remote MCP for Android CLI agent build gate, structured receipts, audit logs, and reviewer-ready evi
Related MCP Servers
- FlicenseAqualityDmaintenanceA secure, read-only MCP server for AI-powered system monitoring. It provides real-time OS metrics, config discovery, and safe log tailing to enable autonomous infrastructure audits without shell access risks.41-
- AlicenseNot gradedqualityCmaintenanceEnables read-only observability of a Linux host via MCP, exposing allowlisted systemd, docker, nginx, logs, disk, and cert info without shell access.MIT
- AlicenseNot gradedqualityBmaintenanceRead-only MCP server for observing Linux hosts (systemd, ZFS, Docker, VMs, network, hardware, NixOS) as a graph of objects with provenance. Provides seven tools to list hosts, get status, collections, objects, evidence, lookup, and changes.1GPL 3.0
- FlicenseAqualityCmaintenanceEnables observation-only system inspection through MCP, exposing system identity, resources, process summary, and network summary without any mutation or command execution.4-