Skip to main content
Glama
alexcgodwin

OpsChugex LocalOps MCP

OpsChugex LocalOps MCP

CI License: MIT MCP

Local Infrastructure, Endpoint & Systems Intelligence

OpsChugex LocalOps MCP is a cross-platform Model Context Protocol server for safely inspecting local Windows and Linux systems. It is designed as the local/private-infrastructure counterpart to the Cloud DevOps MCP Server.

Version 2.2.0 adds an Investigation Hypothesis Ledger & Evidence Provenance while retaining v2.1 investigation-session memory, the v2 Operational Knowledge Graph, durable incident knowledge, search/clustering, Cross-Node Incident Correlation, Predictive Health Intelligence and the existing approval-gated remediation, topology, database and storage/backup capabilities. Each bounded investigation can track operator-authored hypotheses and normalized supporting, contradicting or context evidence with explicit provenance. Evidence-balance analysis reports conflicts and evidence gaps without declaring a hypothesis true, estimating causal probability or authorizing remediation.

Why this exists

Cloud operations tools can see cloud resources, deployments and managed services. They often cannot explain what is happening inside a workstation, private server or endpoint.

LocalOps starts at the operating-system layer:

  • host and operating-system discovery

  • CPU, memory and disk pressure

  • network interface inventory

  • bounded process inspection

  • Windows service and systemd service inspection

  • installed software and version inventory

  • local users, groups and administrator membership

  • startup program and scheduled-task metadata

  • certificate and certificate-expiry inventory

  • SSH key metadata without key contents

  • environment-variable names without values

  • local listening ports and active connection evidence

  • routing, DNS and firewall configuration summaries

  • adapter and ARP/neighbor-cache inventory

  • process-to-network mapping without packet contents

  • caller-baseline checks for unexpected listeners and outbound endpoints

  • bounded Windows Event Log and Linux journal evidence

  • login success/failure evidence where the host audit source permits it

  • service, account, privileged-group and scheduler change evidence

  • Microsoft Defender operational evidence on Windows

  • explicit evidence-gap reporting when permissions or audit configuration are insufficient

  • caller-baseline service-change detection

  • disabled-by-default controlled execution gateway

  • exact service allowlisting for service mutations

  • five-minute one-time approval tokens

  • post-action verification and in-memory audit records

  • bounded evidence bundles for private correlation

  • authenticated loopback-only private intelligence interface

  • process, service, identity, network and persistence correlation

  • chronological incident evidence timelines

  • evidence-backed probable-cause ranking

  • evidence-confidence scoring with source-limit penalties

  • root-cause evidence chains

  • read-only investigation paths

  • temporal change-trigger identification

  • local/evidence-based blast-radius analysis

  • advisory remediation recommendations with risk tiers

  • private evidence-based remediation workflow planning

  • ordered validation-before-mutation workflow gates

  • workflow-bound one-time approval tokens that cannot use the generic execution path

  • durable execution-audit correlation with workflow and step identifiers

  • post-action verification before a controlled remediation step is marked verified

  • R3+ remediation retained as manual-only workflow guidance

  • bounded per-node health history retained in memory for predictive analysis

  • CPU, memory and disk trend extrapolation over a 1-168 hour horizon

  • evidence-confidence scoring based on observation coverage rather than failure probability

  • explicit insufficient-data results instead of fabricated forecasts

  • warning/critical resource-threshold ETA without automatic remediation

  • cross-node correlation of repeated health, resource, service and security-change evidence

  • bounded fleet incident timeline anchored to snapshot capture times

  • shared-cause hypothesis ranking with evidence-confidence limits

  • incident-scope classification across affected nodes and common tags

  • bounded incident fingerprints retained for current-process case memory

  • incident-case comparison using normalized evidence overlap

  • possible/strong recurrence detection without causal claims

  • history summaries for repeated signals, tags and cause categories

  • optional durable incident persistence across LocalOps process restarts

  • structured operator-confirmed incident outcomes without command or free-form remediation storage

  • historical resolution-pattern summaries from resolved/mitigated cases

  • evidence-overlap resolution history for selected cases without prescriptive recommendations

  • structured incident knowledge search across signals, tags, severity, scope and recorded outcomes

  • nearest historical case retrieval using normalized fingerprint overlap

  • threshold-connected incident case clustering with bounded cluster summaries

  • bounded operational knowledge graphs across incident cases and normalized evidence entities

  • graph relationship tracing between current and historical incidents

  • exact entity-to-case lookup for signals, tags, causes, outcomes and resolution categories

  • guided non-mutating incident investigation plans built from current and historical evidence

  • bounded case-linked investigation sessions with checkpoint and question tracking

  • optional durable investigation-session metadata across LocalOps restarts

  • private investigation-progress analysis with documentation-coverage and historical-case context

  • bounded operator-authored hypothesis ledgers for investigation sessions

  • typed supporting, contradicting and context evidence links with explicit provenance

  • private hypothesis evidence-balance analysis with conflict and evidence-gap reporting

  • bounded local fleet snapshots without raw event-log storage

  • in-memory node registration and snapshot freshness tracking

  • fleet health and inventory summaries

  • explicit-baseline node comparison

  • configuration, software, patch, certificate and security drift

  • local Hyper-V, VirtualBox, Proxmox, libvirt and VMware CLI inventory where available

  • exact local VM-state lookup without mutation

  • local storage capacity and bounded storage-health evidence

  • local Windows battery/UPS or Linux UPower telemetry

  • private network-device health from caller-supplied snapshots

  • private topology components, isolated nodes, down links and articulation/dependency concentration

  • shortest dependency-path analysis across submitted private-infrastructure graphs

  • source-to-target single-link and intermediate-node redundancy analysis

  • topology failure-domain connectivity-loss analysis

  • bounded what-if network change-impact simulation without executing a change

  • named database profiles without credential exposure

  • PostgreSQL, MySQL/MariaDB, SQL Server and Redis read-only telemetry

  • normalized database inventory, connection, capacity, replication, lock and workload-pressure evidence

  • private database health, replication, contention and pressure reasoning

  • named local backup profiles without arbitrary MCP-supplied paths

  • bounded backup artifact inventory, age, size and recent-volume evidence

  • backup freshness and retention checks

  • non-destructive newest-artifact metadata/readability validation

  • point-in-time storage-growth comparison from a caller-supplied baseline

  • backup-root filesystem capacity evidence

  • RPO/RTO and restore-verification evidence

  • private backup snapshot health, recovery readiness and risk correlation

  • normalized Windows/Linux outputs

  • explicit R0-R2 safety boundaries with R3+ blocked

The long-term goal is evidence correlation across endpoints, private infrastructure, networking, storage and virtualization while keeping advanced OpsChugex intelligence proprietary.

Related MCP server: mcp-vpsobs

v2.2 tools

Tool

Purpose

system_info

Host, OS, architecture, CPU count and uptime

system_health

CPU, memory and disk pressure summary

cpu_status

Sample CPU utilization and processor metadata

memory_status

Physical memory usage

disk_status

Fixed-disk capacity and utilization

network_interfaces

Local adapters and assigned addresses

list_processes

Bounded process inventory without command lines

inspect_process

Inspect one process by PID

list_services

Windows services or systemd units

service_status

Inspect one validated service name

uptime

System uptime in seconds, hours and days

installed_software

Bounded installed-software inventory with versions

software_versions

Look up versions for requested installed software

software_changes

Compare current software with a caller-supplied baseline

local_users

Local account metadata without credentials

local_groups

Local group metadata and Linux group membership

local_admins

Built-in Windows administrators or common Linux admin groups

startup_programs

Startup registration metadata without command lines

scheduled_tasks

Scheduled-task/timer metadata without action commands

certificate_inventory

Certificate metadata without private key material

certificate_expiry

Expired or soon-to-expire certificate evidence

ssh_key_inventory

SSH-directory file metadata without key contents

environment_variables_summary

Environment-variable names and sensitivity flags without values

open_ports

Unique local TCP/UDP listening endpoints without remote scanning

listening_ports

Local TCP listeners and UDP endpoints with owner metadata

network_connections

Bounded local TCP/UDP socket state without packet capture

network_routes

Local routing table

dns_configuration

Configured DNS servers and search domains

dns_resolution

Resolve one validated host through the OS resolver

firewall_status

Local firewall provider/profile state

firewall_rules

Bounded read-only firewall-rule summary

network_adapters

Local adapter and link-state inventory

arp_neighbors

Local ARP/neighbor-cache evidence without active probing

process_network_map

Group observed sockets by owning process

unexpected_listening_ports

Compare listeners with a caller-supplied port baseline

unusual_outbound_connections

Compare active TCP remotes with caller-supplied expectations

windows_event_logs

Bounded Windows event evidence from an allowlisted log set

linux_journal_logs

Bounded Linux journal evidence with optional unit/priority filters

security_events

Supported security-relevant event evidence with audit limitations

login_events

Successful login/session evidence where available

failed_logins

Failed authentication evidence where available

service_install_events

Windows service-install or bounded Linux service-change evidence

account_creation_events

Local account-creation evidence

admin_group_changes

Privileged-group membership change evidence

process_creation_events

Audited Windows process-creation evidence; Linux remains unknown without an explicit audit source

task_scheduler_events

Scheduled-task/timer event evidence

defender_events

Microsoft Defender Operational evidence on Windows

recent_system_changes

Deterministic aggregation of supported system-change evidence

recent_security_changes

Deterministic aggregation of supported security-change evidence

detect_new_services

Compare current service names with a caller-supplied baseline

execution_status

Show execution enablement, allowlist and v0.5 risk-policy state

propose_execution

Run preflight and issue a five-minute one-time approval token without executing

execute_approved_action

Execute exactly the action bound to a valid approval token

execution_audit_log

Read recent in-memory execution audit records without approval tokens

remediation_workflow_status

Show v1.4 workflow safety state, current execution gates and retained workflow summaries

create_remediation_workflow

Build an ordered evidence-based remediation workflow without creating an approval or executing a change

remediation_workflow_details

Read one workflow's steps, gates, status and token-free event history

record_remediation_step

Record validation/manual completion or explicitly skip an eligible step without host mutation

prepare_remediation_step

Create a workflow-bound five-minute R2 approval proposal after earlier validation is resolved

execute_approved_remediation_step

Execute exactly one matching prepared R2 step through the existing controlled gateway and post-action verification

intelligence_status

Check whether the private loopback intelligence core is configured and reachable

correlate_process_activity

Correlate bounded process, event and network evidence through the private core

correlate_service_activity

Correlate service, process, event and network relationships

correlate_identity_activity

Correlate local identity, admin and authentication/change evidence

correlate_network_activity

Correlate process-to-remote-endpoint relationships without packet capture

correlate_persistence_signals

Correlate startup, scheduled-task, service, process and event evidence

build_incident_timeline

Build a chronological evidence timeline while preserving source limitations

rank_probable_causes

Rank evidence-backed operational hypotheses through the private core

calculate_confidence

Measure evidence coverage/confidence without treating it as compromise probability

build_evidence_chain

Build ordered supporting evidence chains for leading hypotheses

suggest_investigation_path

Generate an evidence-first, read-only investigation sequence

identify_change_trigger

Identify the earliest supported timestamped change as a temporal starting point

identify_blast_radius

Summarize local entities and observed network relationships tied to leading hypotheses

recommend_remediation

Return advisory risk-tiered remediation options without authorizing execution

capture_node_snapshot

Capture a bounded normalized snapshot of the current local host

register_node

Upsert one snapshot into the local in-memory fleet registry

list_nodes

List registered node metadata and snapshot freshness

node_health

Show health and freshness for one registered node

node_health_history

Return up to 96 retained in-memory CPU, memory and disk health observations for one node

node_predictive_health

Analyze one node's retained health trend over a bounded 1-168 hour horizon through the private core

fleet_predictive_health

Analyze retained health trends across registered nodes without triggering remediation

fleet_incident_correlation

Correlate repeated health, resource, service and security-change evidence across registered nodes

fleet_incident_timeline

Build a bounded cross-node snapshot timeline without claiming original event timestamps

fleet_shared_cause_analysis

Rank evidence-backed shared-cause hypotheses without treating confidence as causation probability

fleet_incident_scope

Classify observed impact as none, localized, multi-node or fleet-wide

capture_incident_case

Capture and retain a normalized incident fingerprint from the current registered fleet

list_incident_cases

List bounded metadata for incident cases retained by the current LocalOps process

incident_case_details

Read one stored incident fingerprint by case ID

compare_incident_cases

Compare two stored cases by normalized evidence overlap through the private core

incident_recurrence_analysis

Find possible or strong recurrence patterns across retained incident fingerprints

incident_history_summary

Summarize repeated incident signals, tags, cause categories, severity and scope

incident_memory_status

Show case/outcome counts and whether optional durable local incident persistence is enabled

record_incident_outcome

Store a structured operator-confirmed outcome category/status for one case

incident_resolution_patterns

Summarize historical outcome categories and repeated evidence patterns through the private core

incident_resolution_history

Find evidence-overlapping prior resolved/mitigated cases and show their recorded outcomes

incident_knowledge_search

Search retained cases with bounded structured evidence and outcome criteria

incident_case_neighbors

Rank nearest retained cases by normalized fingerprint overlap

incident_case_clusters

Group retained cases into bounded threshold-connected similarity clusters

operational_knowledge_graph

Build a bounded graph linking incident cases to normalized evidence and similarity relationships

incident_knowledge_trace

Trace bounded graph paths from one incident to related historical cases

incident_entity_cases

Find retained cases linked to one exact signal, tag, cause, outcome or resolution entity

guided_incident_investigation

Build an ordered read-only investigation plan from current and historical evidence

create_investigation_session

Create a bounded case-linked investigation session without changing host state

list_investigation_sessions

List investigation-session summaries, checkpoint counts and open-question counts

investigation_session_details

Read one session with bounded checkpoints and tracked questions

record_investigation_checkpoint

Record normalized evidence-review references in an open or paused session

add_investigation_question

Add one bounded investigation question for later resolution or deferral

update_investigation_question

Mark a tracked question open, resolved or deferred

set_investigation_session_status

Set a session open, paused or completed; completion blocks on open questions

investigation_session_status

Show session-memory bounds and optional persistence state

investigation_progress_analysis

Analyze documented review coverage, question state and similar historical cases

add_investigation_hypothesis

Add one bounded operator-authored hypothesis to an investigation session

list_investigation_hypotheses

List the hypothesis ledger with evidence-direction counts

investigation_hypothesis_details

Read one hypothesis and its normalized evidence links

update_investigation_hypothesis

Update operator-controlled hypothesis lifecycle state

link_hypothesis_evidence

Link supporting, contradicting or context evidence with explicit provenance

investigation_hypothesis_analysis

Analyze evidence balance, conflicts and provenance gaps without causal claims

fleet_health

Summarize health, stale snapshots and node states across the registry

fleet_inventory

Return bounded fleet metadata without raw event logs

compare_nodes

Compare two registered snapshots through the private core

configuration_drift

Compare host, service, startup and scheduler state against an explicit baseline

software_drift

Compare installed-software presence and versions against an explicit baseline

patch_drift

Compare Windows hotfix or Linux kernel/package patch markers

certificate_drift

Compare certificate presence and expiry metadata

security_drift

Compare local-admin and summarized security-change evidence

virtual_machine_inventory

Inspect locally available Hyper-V, VirtualBox, Proxmox, libvirt or VMware CLI inventory

vm_health

Inspect one exact local VM ID/name and report observed provider state

storage_capacity

Summarize local fixed-filesystem capacity and utilization

storage_health

Combine filesystem utilization with supported local physical-disk health evidence

ups_health

Read locally exposed Windows battery/UPS or Linux UPower telemetry

network_device_health

Analyze bounded caller-supplied private-device snapshots through the private core

private_network_topology

Analyze caller-supplied private-infrastructure nodes/links without discovery or probing

network_dependency_path

Find the shortest submitted non-down dependency path between two explicit devices

network_path_redundancy

Check source-to-target tolerance to one primary-path link or intermediate-node loss

network_failure_domains

Measure node and non-parallel active-link connectivity-loss impact across the submitted graph

network_change_impact

Run a bounded what-if connectivity simulation for explicitly unavailable nodes or endpoint-pair links

platform_status

Show v1.0 transport, process-bound identity/role, execution state, durable-audit state and private-core reachability

policy_status

Show RBAC permissions and the enforced R0-R3+ boundary

evaluate_policy

Evaluate one operation/risk tier without executing anything

production_readiness

Check runtime, RBAC, execution/audit coherence, data-directory safety and private-core reachability

production_audit_log

Read metadata-only durable execution audit records when enabled

database_profiles

List configured database profile metadata without password values or secret-environment names

database_snapshot

Collect a bounded normalized read-only snapshot using fixed engine telemetry queries

database_health

Analyze operational database health through the private intelligence core

database_capacity

Return database-size or memory-capacity evidence without inventing free-space risk

database_connection_summary

Return bounded active/total/max/blocked connection evidence

database_replication_health

Analyze replication role/state/lag evidence without assuming standalone databases are unhealthy

database_lock_summary

Analyze waiting-lock/blocked-connection contention without terminating transactions

database_query_pressure

Analyze connection utilization and workload-pressure evidence without collecting query text

backup_profiles

List named backup-profile metadata; arbitrary MCP-supplied paths are not accepted

backup_snapshot

Collect normalized backup inventory, freshness, retention, restore-point, capacity and recovery-objective evidence

backup_inventory

Return bounded backup file-count, size and age evidence without reading backup contents

backup_freshness

Compare the newest artifact with the configured expected interval and RPO

backup_restore_point_validation

Validate newest-artifact presence, non-zero size and read access without executing a restore

backup_retention

Report bounded artifacts older than the configured retention target without deleting them

backup_storage_growth

Compare current inventory totals with an explicit caller-supplied prior baseline

backup_snapshot_health

Analyze normalized backup health through the private intelligence core

backup_recovery_readiness

Analyze restore-point, RPO, RTO and restore-verification evidence without executing a restore

backup_risk_correlation

Correlate freshness, capacity, retention, restore-point and recovery-objective risk signals

Architecture

flowchart TD
    Client["MCP Client"] --> Server["OpsChugex LocalOps MCP"]
    Server --> Safe["Read-only tool boundary"]
    Safe --> Node["Node.js system APIs"]
    Safe --> Win["Windows adapter"]
    Safe --> Linux["Linux adapter"]
    Win --> PS["Fixed PowerShell/CIM reads"]
    Linux --> Proc["Fixed ps/df/systemctl reads"]
    Server --> Client2["Loopback Intelligence Client"]
    Client2 --> Core["Private OpsChugex LocalOps Intelligence Core"]

The public MCP owns protocol handling, safe collectors, normalized node/fleet/infrastructure/database/backup schemas, bounded topology/remediation/predictive/cross-node/incident-memory contracts, fixed read-only database adapters, bounded local backup metadata collection, local virtualization/storage/power adapters, the in-memory fleet registry, bounded node-health history and bounded normalized incident-case memory, process-bound RBAC/policy enforcement, workflow state, one-time execution approvals, optional durable audit storage, the loopback client and operator-facing tools. The private OpsChugex intelligence core owns correlation, root-cause ranking, fleet drift, cross-node incident correlation, incident fingerprinting, recurrence/similarity analysis, shared-cause ranking and scope analysis, private device-health/topology reasoning, dependency-path/redundancy/failure-domain/change-impact algorithms, database health/replication/contention/pressure analysis, backup snapshot-health/recovery-readiness/risk correlation, remediation workflow planning/gate reasoning, and predictive-health trend/threshold analysis.

Quickstart

Requirements:

  • Node.js 20 or newer

  • Windows 10/11 or a modern Linux distribution

  • PowerShell on Windows

  • ps, df and systemd tools for the relevant Linux collectors

Clone and run:

git clone https://github.com/alexcgodwin/localops-mcp.git
cd localops-mcp
npm install
npm run build
npm test
npm start

For development:

npm run dev

Optional private intelligence core

The correlation, root-cause, private fleet, private-infrastructure, database, backup, network-topology, remediation-planning, predictive-health, cross-node incident, recurrence, resolution and v1.9 knowledge-search/clustering tools require the private OpsChugex LocalOps Intelligence Core to be running locally. Configure the public MCP process with:

LOCALOPS_INTELLIGENCE_URL=http://127.0.0.1:43123
LOCALOPS_INTELLIGENCE_TOKEN=<private token of at least 32 characters>

The public client rejects non-loopback intelligence URLs. If the private core is not configured or running, local collection and policy/readiness tools continue to work and private-analysis tools report the limitation.

v1.0 production controls

The local stdio process uses process-bound RBAC:

LOCALOPS_ROLE=viewer|operator|maintainer|admin
LOCALOPS_OPERATOR_ID=<local operator/process identity>
LOCALOPS_AUDIT_PERSISTENCE=true|false
LOCALOPS_DATA_DIR=<optional absolute non-root directory>

The default role is viewer. operator may create R2 proposals, while maintainer and admin may execute an otherwise valid R2 approval. R3+ execution remains unavailable. Durable audit is optional for read-only deployments but production_readiness reports execution without durable audit as blocked.

v1.1 database profiles

Database tools use named profiles from LOCALOPS_DATABASE_PROFILES. Profiles contain connection metadata only. Password values are referenced through separate environment variables and are never accepted as MCP tool arguments.

Example:

LOCALOPS_DATABASE_PROFILES=[{"id":"pg-main","engine":"postgresql","host":"127.0.0.1","port":5432,"database":"app","user":"localops_reader","passwordEnv":"LOCALOPS_DB_PG_MAIN_PASSWORD","tls":true}]
LOCALOPS_DB_PG_MAIN_PASSWORD=<secret value>

Supported engines are postgresql, mysql (including MariaDB-compatible telemetry), sqlserver, and redis.

SQL Server may use "integratedAuth":true instead of a password environment variable. Database profile parsing is included in production_readiness.

v1.2 backup profiles

Storage and backup tools use named local roots from LOCALOPS_BACKUP_PROFILES. MCP callers provide only a profile ID; they cannot supply an arbitrary filesystem path.

Example:

LOCALOPS_BACKUP_PROFILES=[{"id":"app-nightly","rootPath":"/srv/backups/app","kind":"database-dump","extensions":[".bak",".zip"],"expectedIntervalHours":24,"retentionDays":30,"rpoHours":24,"rtoMinutes":120,"lastVerifiedRestoreAt":"2026-10-01T20:00:00Z","lastRestoreDurationMinutes":45}]

On Windows, use an absolute Windows path with valid JSON escaping. lastVerifiedRestoreAt and lastRestoreDurationMinutes are operator-supplied evidence from an earlier restore test. LocalOps does not execute a restore to populate them. Backup profile parsing is included in production_readiness.

v1.4 remediation workflows

A v1.4 remediation workflow is a bounded, in-memory orchestration record created from current LocalOps evidence and the current execution-policy state. Workflows expire after 30 minutes and at most 100 are retained.

The workflow sequence is intentionally split:

  1. create a plan from bounded evidence

  2. complete required validation steps

  3. prepare one fixed R2 step, which creates a five-minute one-time approval token

  4. execute that exact workflow/step only with confirmation="APPROVE"

  5. require post-action verification before the step is marked verified

Workflow execution requires LOCALOPS_EXECUTION_ENABLED=true, the existing role/allowlist checks, and LOCALOPS_AUDIT_PERSISTENCE=true. Raw approval tokens are never stored in workflow state or audit records. R3+ steps are guidance only and cannot be executed by LocalOps.

v1.5 predictive health

Every successful register_node call with health metrics contributes one timestamped observation to that node's bounded in-memory history. Duplicate capture timestamps replace the earlier observation, histories are capped at 96 entries per node, and all history disappears when the LocalOps process exits.

node_predictive_health and fleet_predictive_health send only the bounded normalized history to the loopback private core. The selected forecast horizon is restricted to 1-168 hours. At least three distinct observations spanning at least one hour are required; otherwise LocalOps returns insufficient-data.

The private core estimates linear CPU, memory and disk trends and compares them with the same LocalOps warning/critical resource thresholds. Evidence confidence measures history coverage only. It is not a probability of failure, hardware-health guarantee, capacity commitment, or authorization to remediate.

v1.6 cross-node incident correlation

fleet_incident_correlation, fleet_incident_timeline, fleet_shared_cause_analysis and fleet_incident_scope send only the bounded registered fleet snapshot bundle to the authenticated loopback private core. The core looks for repeated health pressure, shared service problem states, repeated security-change categories and common resource pressure across nodes.

The incident timeline is intentionally coarse: entries are anchored to each node's snapshot capture time because raw cross-node event streams are not stored in the fleet registry. Shared-cause outputs are hypotheses ranked by evidence coverage, not proof or probability of causation. Incident-scope results describe the current observed footprint only.

v1.7 incident memory and recurrence

capture_incident_case asks the private core to reduce the current registered fleet evidence into a normalized fingerprint, then retains that fingerprint in a bounded 200-case in-memory registry. The fingerprint contains signal IDs/categories, affected node IDs, common tags, cause categories, scope, severity and a stable signature. It does not contain raw event logs, packet contents, credentials, command output or approval tokens.

compare_incident_cases and incident_recurrence_analysis compare normalized fingerprint tokens. Similarity is expressed as evidence overlap and classified as none, weak, possible or strong. Those labels support investigation only; they are not probabilities and do not establish that two incidents share the same root cause.

incident_history_summary reports repeated signals, tags and cause categories plus bounded severity/scope counts. Without v1.8 persistence, incident memory remains process-local.

v1.8 durable incident knowledge and resolution intelligence

Set LOCALOPS_INCIDENT_PERSISTENCE=true to persist the bounded 200-case normalized registry to incident-memory.json under LOCALOPS_DATA_DIR (or the default LocalOps data directory). The file is written atomically and restrictive filesystem permissions are applied where supported. Persistence is disabled by default.

record_incident_outcome stores only fixed status/category metadata, verification state, operator ID and an optional bounded duration. It does not accept shell commands, arbitrary remediation text, credentials or approval tokens.

incident_resolution_patterns summarizes operator-confirmed resolved/mitigated cases by resolution category and repeated normalized evidence. incident_resolution_history finds prior resolved/mitigated cases with fingerprint overlap. Both are historical context only: they do not prescribe an action, prove causation or authorize execution.

v1.9 incident knowledge search and case clustering

incident_knowledge_search accepts only bounded structured criteria: signal IDs, tags, cause categories, severity, scope, outcome status and resolution category. It ranks retained cases by how much of the supplied query criteria each case covers. The match percentage is query coverage, not semantic confidence, probability or proof of causation.

incident_case_neighbors ranks the nearest historical cases to one selected case using Jaccard overlap of normalized fingerprint tokens. incident_case_clusters groups cases connected by a caller-selected 1-100 similarity threshold and returns bounded cluster summaries, common evidence and recorded outcome categories. Cluster membership is descriptive; threshold-connected groups can contain indirectly linked cases.

All v1.9 retrieval stays inside the authenticated loopback private core. No external vector database, embedding API, arbitrary text query, raw log search, packet inspection or new execution path is introduced.

v2.0 operational knowledge graph and guided investigation

operational_knowledge_graph links up to 200 supplied incident cases to normalized signal, tag, cause, outcome and resolution nodes, plus case-to-case similarity edges above a caller-selected threshold. The graph is bounded to at most 1,200 nodes and 4,000 edges and reports truncation when those limits are reached.

incident_knowledge_trace performs bounded graph traversal from one case to related historical cases with a maximum depth of four and at most 20 returned paths. incident_entity_cases performs exact normalized entity lookup for one signal, tag, cause, outcome or resolution value.

guided_incident_investigation creates an ordered five-step read-only investigation plan using the selected case, shared evidence and related historical outcomes. The plan never contains executable shell commands, never creates an approval token, and never authorizes remediation.

v2.1 investigation session memory and evidence checkpoints

Investigation sessions are linked to an existing stored incident case and are capped at 50 retained sessions, 100 checkpoints per session and 50 tracked questions per session. Checkpoints store a fixed review kind plus at most 20 normalized evidence references; they do not store raw event logs, packet contents, command output, credentials or approval tokens.

Set LOCALOPS_INVESTIGATION_PERSISTENCE=true to persist bounded session metadata to investigation-sessions.json under the existing LocalOps data directory. Persistence is disabled by default and uses atomic file replacement plus restrictive permissions where supported.

investigation_progress_analysis reports which checkpoint categories have been documented, open/resolved/deferred question counts, missing review areas and evidence-overlapping historical cases. Its coverage percentage measures recorded documentation categories only; it is not confidence, root-cause probability, remediation readiness or authorization.

v2.2 hypothesis ledger and evidence provenance

Each investigation session can retain at most 25 hypotheses, with at most 50 normalized evidence links per hypothesis. Evidence links are classified as supporting, contradicting or context and use one explicit provenance class: current case, historical case, checkpoint-derived or unverified reference.

The public MCP verifies that referenced stored cases and checkpoints exist before assigning validated provenance. The private core can then summarize evidence direction, conflicts and provenance gaps. That validation confirms the reference exists in the bounded LocalOps context; it does not prove that the underlying evidence is correct.

Hypothesis lifecycle states are operator-controlled. Analysis never automatically marks a hypothesis supported or rejected, never converts evidence counts into probability, and never creates an approval token or execution authority.

Safety model

v2.2 keeps the existing controlled-execution, remediation, predictive, cross-node, recurrence, durable-knowledge and graph boundaries while adding bounded investigation-session state and progress analysis. Session writes modify LocalOps metadata only and cannot authorize execution:

R0 READ                     allowed
R1 ANALYZE / EVIDENCE       allowed
R2 BOUNDED EXECUTION         disabled by default; explicit approval required
R3+ HIGHER-RISK EXECUTION    not exposed
PRIVATE INTELLIGENCE          loopback-only, authenticated, analysis-only
FLEET SNAPSHOTS               bounded, in-memory, no remote control
PRIVATE INFRASTRUCTURE         local reads + caller-supplied snapshots only
RBAC / POLICY                  process-bound, enforced for execution
DURABLE AUDIT                  optional generally; required for v1.4 workflow execution
DATABASE INTELLIGENCE          fixed read-only queries, named profiles only
STORAGE / BACKUP INTELLIGENCE  bounded metadata, named local profiles only
NETWORK TOPOLOGY INTELLIGENCE  bounded submitted graphs, analysis-only
REMEDIATION WORKFLOWS           ordered planning + approval orchestration; no auto-authorization
PREDICTIVE HEALTH                bounded in-memory history + private trend analysis; no execution
CROSS-NODE INCIDENT               bounded registered snapshots + private correlation; no execution
INCIDENT KNOWLEDGE                 max 200 normalized cases; optional local persistence; no raw logs or execution
OPERATIONAL KNOWLEDGE GRAPH         max 1200 nodes / 4000 edges; read-only relationship analysis
INVESTIGATION SESSION MEMORY         max 50 sessions / 100 checkpoints / 50 questions per session

Important controls:

  • no arbitrary command tool

  • no arbitrary PowerShell or shell input

  • no environment-variable values

  • no SSH key contents or private-key reads

  • no scheduled-task action commands

  • no startup command lines

  • no process command-line collection

  • no remote port scanning

  • no packet capture or packet payload inspection

  • no firewall changes

  • "unexpected", "outside baseline" and "new" mean only that caller-supplied expectations did not match

  • no event-log clearing or retention changes

  • no audit-policy changes

  • event messages are bounded and secret-like values are redacted

  • inaccessible logs and missing audit coverage are reported as evidence limitations rather than interpreted as clean

  • execution is disabled unless LOCALOPS_EXECUTION_ENABLED=true

  • least-privileged default role is viewer

  • R2 proposals require operator, maintainer, or admin

  • R2 execution requires maintainer or admin

  • durable audit records contain execution metadata only, never approval tokens or command output

  • production_readiness blocks a production-ready result when execution is enabled without durable audit

  • service actions require the exact service name in LOCALOPS_ALLOWED_SERVICES

  • proposals perform preflight but do not execute

  • approval tokens expire after five minutes and are one-time use

  • execution requires confirmation="APPROVE"

  • service allowlisting is checked again immediately before execution

  • temporary cleanup is restricted to old regular files inside the OS temp directory, with bounded age/count controls

  • R3+ actions are intentionally absent from the public server

  • private intelligence URL is restricted to explicit loopback addresses

  • private-core authentication requires a token of at least 32 characters

  • private API routes are allowlisted in the public client

  • correlation requests contain bounded normalized evidence, not arbitrary commands

  • private-core connection errors do not echo authentication material

  • correlation reports relationships and evidence gaps

  • root-cause rankings are hypotheses, not definitive verdicts

  • evidence confidence measures collection coverage/alignment, not compromise probability

  • change triggers are temporal starting points, not proof of causation

  • blast radius is bounded to observed local entities and network relationships

  • remediation recommendations never authorize execution

  • v1.4 workflow creation does not create an approval token or execute a host change

  • required validation steps cannot be skipped before a later controlled R2 step is prepared

  • v1.4 workflow execution requires durable audit persistence in addition to the existing execution/RBAC/allowlist gates

  • raw workflow approval tokens are never stored; workflow state keeps only a SHA-256 token binding

  • workflow-bound approval tokens can be consumed only through the matching workflow and step, not through the generic execution tool

  • each controlled workflow step still requires a fresh five-minute one-time token and exact APPROVE confirmation

  • a controlled workflow step is marked verified only after post-action verification succeeds

  • workflow state is in-memory, capped at 100 retained workflows and expires after 30 minutes

  • R3+ remediation stays manual and is never mapped to an executable workflow action

  • no workflow silently authorizes, chains or executes multiple host mutations

  • predictive health history is in-memory only, capped at 96 observations per node, and contains normalized health/resource metrics rather than raw event logs

  • predictive horizons are bounded to 1-168 hours

  • at least three distinct observations spanning at least one hour are required before a directional forecast is considered defensible

  • evidence confidence measures observation count/time-span coverage, not failure probability

  • predictive analysis uses linear trend extrapolation and explicitly reports that it does not model workload schedules, seasonality, deployments or hardware failure mechanisms

  • predictive results never authorize or trigger remediation

  • the private predictive API exposes analysis only; no predictive execution route exists

  • cross-node analysis uses only bounded registered snapshots and does not collect distributed traces, packet contents or synchronized raw event streams

  • repeated evidence across nodes is treated as correlation, not verified causation

  • shared-cause evidence confidence measures cross-node coverage and is not a probability that a hypothesis is the cause

  • cross-node timelines are anchored to snapshot capture time and explicitly disclose timing limitations

  • v1.6 cross-node routes are analysis-only and expose no execution endpoint

  • incident memory is capped at 200 normalized cases; persistence is disabled by default and enabled only with LOCALOPS_INCIDENT_PERSISTENCE=true

  • durable incident state is restricted to the LocalOps data directory and uses atomic replacement plus restrictive permissions where supported

  • incident fingerprints and outcomes exclude raw event logs, packet data, credentials, command output and approval tokens

  • outcome recording uses fixed status/category fields rather than arbitrary remediation commands or notes

  • incident similarity measures normalized evidence overlap and is not recurrence probability or causal proof

  • historical resolution patterns describe recorded outcomes and are not recommendations for a future incident

  • v1.8 private incident routes are authenticated, loopback-only, analysis-only and expose no execution endpoint

  • v1.9 search accepts only bounded structured criteria and does not expose arbitrary text, regex, SQL, shell or raw-log query input

  • v1.9 neighbor and cluster similarity uses normalized fingerprint overlap and is not probability or causal confidence

  • clustering is bounded to at most 200 supplied cases and returns at most 50 cluster summaries

  • threshold-connected clusters can include indirectly linked cases and explicitly disclose that limitation

  • no external embedding, vector database or third-party search service receives incident knowledge

  • v1.9 private retrieval routes are authenticated, loopback-only, analysis-only and expose no execution endpoint

  • v2.0 graph input is limited to the same bounded normalized incident cases already retained by LocalOps

  • v2.0 graph construction is bounded to 1,200 nodes and 4,000 edges and explicitly reports truncation

  • v2.0 tracing is bounded to depth 4 and 20 paths; graph paths are investigation aids, not causal proof

  • v2.0 entity lookup accepts one exact normalized value and returns at most 50 cases

  • guided investigation returns non-mutating evidence-review steps only and never returns executable commands or approval tokens

  • /v2/knowledge/execute is not allowlisted by the public client and no v2 knowledge execution endpoint exists

  • investigation sessions are capped at 50; each session is capped at 100 checkpoints and 50 questions

  • checkpoint evidence references are capped at 20 values per checkpoint and 128 characters per value

  • investigation persistence is disabled by default and, when enabled, stays under the LocalOps data directory

  • session metadata excludes raw event logs, packet data, credentials, command output, approval tokens and remediation scripts

  • completed sessions reject new checkpoints/questions and cannot be completed while questions remain open

  • review coverage counts documented checkpoint categories only and is not confidence or remediation readiness

  • /v2/investigations/progress is the only v2.1 private investigation route allowlisted by the public client; no investigation execution route exists

  • fleet snapshots contain summarized security-change categories/counts, not raw event messages

  • fleet registry is in-memory only and capped at 500 nodes

  • registering a snapshot records caller-supplied node evidence; it does not authenticate or attest the identity of that node

  • fleet drift requires an explicitly selected baseline node

  • stale snapshots and large capture-time skew are surfaced as evidence limitations

  • fleet drift means difference, not automatically error, unauthorized change or compromise

  • no SSH, WinRM, remote shell, credential storage or lateral execution

  • no automatic cross-node remediation

  • no subnet discovery, remote device login or credential collection

  • no SNMP writes or remote management mutation

  • no hypervisor VM start/stop/create/delete actions

  • no storage mutation, formatting or filesystem changes

  • private-infrastructure snapshots do not authenticate or attest device identity

  • topology is derived only from submitted nodes/links and is not active discovery

  • articulation nodes indicate dependency concentration in submitted topology, not guaranteed production single points of failure

  • v1.3 dependency paths use only submitted non-down links; unknown-state links may reduce certainty

  • path redundancy simulates one primary-path link or intermediate-node loss at a time and does not verify physical path diversity

  • failure-domain results describe graph connectivity impact, not guaranteed application outage

  • change-impact analysis is what-if only and does not execute network changes

  • endpoint-pair change simulation disables all submitted links between those endpoints

  • no subnet scanning, remote login, route mutation, firewall mutation, SNMP write, lateral execution or automatic network remediation is exposed

  • database tools accept profile IDs only, not connection strings or arbitrary SQL

  • database passwords are referenced through separate environment variables and are never returned in profile metadata

  • fixed database telemetry queries do not collect application query text

  • no INSERT, UPDATE, DELETE, DDL, transaction termination, failover or database-configuration mutation is exposed

  • database health is operational evidence, not proof of data integrity, application correctness or compromise

  • standalone or intentionally non-replicated databases are not automatically treated as unhealthy

  • capacity values do not invent free disk space or growth risk when the engine does not expose those facts

  • malformed database profile configuration is surfaced by production readiness

  • backup tools accept configured profile IDs only, not arbitrary filesystem paths

  • backup scans are bounded to 5,000 matching files and a maximum directory depth of 16

  • symbolic links are not followed by the backup collector

  • restore-point validation checks metadata, non-zero size and one-byte read access only; it does not execute or certify a restore

  • backup growth uses an explicit caller-supplied prior baseline; LocalOps does not invent or persist trend history

  • RPO/RTO results are evidence comparisons against configured objectives, not guarantees of recoverability

  • restore-verification timestamps and durations are operator-supplied evidence from prior restore testing

  • no backup restore, delete, prune, format or storage-mutation tool is exposed

  • malformed backup profile configuration is surfaced by production readiness

  • bounded list sizes

  • strict PID validation

  • strict service-name validation

  • fixed executable/argument paths

  • token/password/secret redaction in command errors and output

  • no administrator/root requirement for normal Node.js collectors

Some platform collectors may require local permission to inspect specific processes or services. Permission failures are returned as errors rather than bypassed.

Public/private boundary

This repository is the public implementation and portfolio-facing gateway.

The separate private OpsChugex LocalOps Intelligence Core implements correlation, root-cause intelligence, fleet drift, predictive-health trend/threshold analysis, cross-node incident correlation, incident fingerprinting, recurrence/similarity analysis, resolution-pattern and historical-resolution analysis, structured incident retrieval, nearest-case matching, similarity clustering, operational knowledge-graph construction, relationship tracing, guided-investigation reasoning, v2.1 investigation-progress analysis, shared-cause ranking and scope analysis, private device-health/topology reasoning, dependency-path/redundancy/failure-domain/change-impact analysis, database health/replication/contention/pressure analysis, backup snapshot-health/recovery-readiness/risk correlation, and remediation workflow planning.

The public repository contains safe collection, bounded snapshots, schemas, fixed read-only database adapters, bounded local backup metadata collectors, bounded topology/remediation/predictive/cross-node/incident-memory/search/knowledge-graph/investigation-session contracts, local infrastructure adapters, in-memory workflow/fleet/health-history state, optional durable normalized incident-case and investigation-session storage, structured outcome/checkpoint/question recording, policy enforcement, approval orchestration, audit integration and the loopback client. Proprietary correlation, incident fingerprinting, recurrence/similarity analysis, resolution-pattern analysis, structured retrieval ranking, neighbor matching, case clustering, knowledge-graph construction, relationship tracing, guided-investigation reasoning, investigation-progress analysis, shared-cause ranking, scope analysis, drift, topology, database-analysis, backup-risk, remediation-planning and predictive-health algorithms are not included in this MIT repository.

Roadmap

Version

Focus

0.1

System discovery, completed

0.2

Endpoint inventory, completed

0.3

Network intelligence, completed

0.4

Event and security evidence, completed

0.5

Approval-gated controlled execution, completed

0.6

Evidence correlation, completed

0.7

Root-cause intelligence, completed

0.8

Fleet intelligence, completed

0.9

Private infrastructure and virtualization, completed

1.0

Production LocalOps platform, completed

1.1

Database intelligence, completed

1.2

Storage and backup intelligence, completed

1.3

Network topology intelligence, completed

1.4

Automated remediation workflows, completed

1.5

Predictive health intelligence, completed

1.6

Cross-node incident correlation, completed

1.7

Incident memory and recurrence intelligence, completed

1.8

Durable incident knowledge and resolution intelligence, completed

1.9

Incident knowledge search and case clustering, completed

2.0

Operational knowledge graph and guided investigation, completed

2.1

Investigation session memory and evidence checkpoints, completed

2.2

Investigation hypothesis ledger and evidence provenance, completed

Development principles

  1. Prefer native OS APIs and fixed commands over generic shell execution.

  2. Treat missing evidence as unknown, not as proof of safety or failure.

  3. Keep collection separate from intelligence and remediation.

  4. Normalize Windows and Linux responses into stable MCP schemas.

  5. Require explicit policy and approval gates before future mutation features.

  6. Keep proprietary intelligence outside the public repository.

Relationship to Cloud DevOps MCP

Cloud DevOps MCP Server focuses on cloud infrastructure, Kubernetes, Terraform, CI/CD, observability and cloud operations.

OpsChugex LocalOps MCP focuses on the operating systems, endpoints, local servers and private infrastructure underneath them.

Together they form two separate operational planes rather than overlapping wrappers around the same services.

Author

Built and maintained by Alex C. Godwin under the OpsChugex product brand.

License

MIT. See LICENSE.

Available Tools

23 tools
certificate_expiryCertificate ExpiryB
Read-onlyIdempotent

Return certificates already expired or expiring within the requested window.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
withinDaysNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
certificatesYes

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare this as a read-only, idempotent, non-destructive, closed-world operation, so the safety profile is covered. The description adds useful behavioral scope by clarifying that only expired/expiring certificates are returned. It does not mention default behavior when `withinDays` is omitted or that `limit` caps results, so it adds moderate context beyond annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, front-loaded sentence that states the operation and its filter condition with no wasted words. It is appropriately sized for a simple query tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be described, and annotations cover the safety profile. However, with zero schema description coverage, the description leaves `limit` undefined and does not specify a default or behavior when `withinDays` is omitted, leaving a notable gap for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and only one parameter is loosely reflected in the description via 'requested window' (withinDays). The `limit` parameter is not addressed at all, and no defaults, units, or caps are explained. With low schema coverage, the description should compensate more fully but does not.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Return') and resource ('certificates') with a clear scope: expired or expiring within a window. It distinguishes the filtering behavior from a generic inventory, but does not name the sibling tool `certificate_inventory`, so sibling differentiation is implicit rather than explicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the description: use this to find certificates needing attention based on expiration. However, there is no explicit when-to-use or when-not-to-use guidance, and no mention of the related `certificate_inventory` sibling, leaving the agent to infer the distinction.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

certificate_inventoryCertificate InventoryA
Read-onlyIdempotent

Inventory bounded certificate metadata and expiry dates. Private key material is never read or returned.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
certificatesYes

TDQS

A3.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and destructiveHint=false, so the safety profile is covered structurally. The description adds genuinely new context by guaranteeing that private key material is never read or returned, which is a substantive security disclosure beyond annotations, plus the 'bounded' hint that results are capped.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, no waste, with the core purpose front-loaded and the security caveat immediately after. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists so return values need not be described, and the read-only nature is well covered by annotations plus the key-material guarantee. The only real gap is failing to clarify the limit parameter's bounds and the distinction from 'certificate_expiry'.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Only one optional parameter (limit) exists with 0% schema description coverage, and the description only gestures at it with the word 'bounded' without stating the default or the 300 maximum. It adds some meaning but leaves the parameter's behavior underspecified.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Inventory') and resource ('certificate metadata and expiry dates'), so the agent knows exactly what is returned. It does not, however, explicitly differentiate itself from the sibling 'certificate_expiry', which overlaps on the expiry-date concept.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no statement of when to use this tool versus the closely related 'certificate_expiry' or 'ssh_key_inventory' siblings. The agent must infer the distinction between a full inventory and an expiry-focused view.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

cpu_statusCPU StatusC
Read-onlyIdempotent

Sample CPU utilization and return processor metadata and load averages.

ParametersJSON Schema
NameRequiredDescriptionDefault
sampleMsNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
modelYes
speedMHzYes
loadAverageYes
logicalCoresYes
usagePercentYes

TDQS

C2.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare read-only, idempotent, non-destructive, closed-world behavior, so the safety profile is covered. The description adds that the tool samples utilization and returns metadata and load averages, but does not explain sampling duration, blocking behavior, or any auth/rate-limit context beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, front-loaded sentence with no wasted words. It is appropriately sized for a simple status tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter tool with rich annotations and an output schema, the description covers the basic purpose adequately. However, it omits usage guidance and parameter semantics, leaving meaningful gaps for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is one parameter (sampleMs) with 0% schema description coverage, and the description never mentions it or explains its effect on the sampling window. The description therefore fails to compensate for the schema coverage gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb + resource (sample CPU utilization) and enumerates return content (processor metadata, load averages). It is clearly distinct from siblings like memory_status and disk_status, though it does not explicitly differentiate itself from broader tools such as system_info or system_health.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided about when to use this tool versus alternatives. It implies a CPU-specific inspection context but gives no conditions, exclusions, or routing advice.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

disk_statusDisk StatusA
Read-onlyIdempotent

Inspect fixed local disk capacity and utilization using a bounded platform-specific command.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
disksYes

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, non-destructive, non-open-world behavior, so the safety profile is fully covered. The phrase 'bounded platform-specific command' adds a little context (it won't run unbounded, and results are platform-dependent) but says nothing about permissions, output variability across OSes, or failure modes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with the resource defined before the implementation note. No redundant or filler content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, return values need no explanation, and no parameters exist to document. The remaining gap is routing: the description does not say how this differs from system_info or system_health, which may also surface disk data, so an agent could still pick the wrong tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, which is the baseline-4 case under the rubric. There is nothing for the description to disambiguate, and the empty schema is consistent with a parameterless inspection call.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb (inspect) and a well-scoped resource: fixed local disk capacity and utilization. 'Fixed local disk' cleanly separates it from siblings like memory_status, cpu_status, and network_interfaces, though no sibling is named explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied — an agent can infer this is the tool for disk capacity, and the 'fixed local' qualifier hints that removable/network volumes are out of scope. There is no explicit when-to-use, when-not, or routing versus system_info/system_health, which plausibly overlap on disk data.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

environment_variables_summaryEnvironment Variables SummaryB
Read-onlyIdempotent

Return environment-variable names and a sensitive-name flag only. Values are never exposed.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
variablesYes
returnedCountYes
valuesExposedYes
variableCountYes

TDQS

B3.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare a full safe-read profile (readOnlyHint, idempotentHint, non-destructive), so the bar is lower. The description adds genuinely valuable context beyond them: only names plus a sensitive-name flag are returned and values are never exposed, which is a meaningful privacy/security guarantee. It does not cover pagination or how 'limit' truncates results.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences with zero filler. The most important constraint — names only, values never exposed — is front-loaded and unmistakable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return shape needn't be re-explained, and the description correctly summarizes what is returned. However, the tool's only parameter is undocumented in both schema and prose, leaving a real gap for a low-complexity read tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is a single 'limit' parameter with 0% schema description coverage, and the description never mentions it — no default, no max, no explanation of what gets limited. The schema alone would not tell an agent how to use it.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb and resource ('Return environment-variable names') and precisely bounds the scope with 'and a sensitive-name flag only. Values are never exposed.' This clearly separates it from siblings like system_info or installed_software, though it never names an alternative explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance, no mention of alternatives for inspecting environment data, and no stated prerequisites. Usage is only loosely implied by the returned content.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

inspect_processInspect ProcessA
Read-onlyIdempotent

Inspect one local process by numeric PID without returning its environment or command-line arguments.

ParametersJSON Schema
NameRequiredDescriptionDefault
pidYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
processYes

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent and non-destructive behavior, so the safety profile is covered. The description adds a genuinely useful negative guarantee, that environment and command-line arguments are NOT returned, plus a local-only scope. It stops short of describing what data is returned or any auth requirement.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single tight sentence front-loading the action and resource, with the output exclusion clause following. Every phrase earns its place; nothing is redundant with the schema or annotations.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, and annotations cover the safety profile. The negative output guarantee and local-only scope fill the remaining gaps for a single-param read tool; only the PID validity/error behavior is unstated.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With one parameter at 0% schema description coverage, the description must carry the load and it does: 'by numeric PID' clarifies the identifier type (a number, not a process name). It omits valid range or lookup-failure behavior, but adds the essential semantic.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (inspect) and resource (one local process) bounded by a numeric PID, which implicitly separates it from the plural list_processes sibling. It does not name the sibling explicitly, but the singular/targeted scope is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: an agent can infer this is for drilling into a single known PID rather than enumerating processes. There is no explicit when-to-use/when-not statement or named alternative such as list_processes.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

installed_softwareInstalled SoftwareA
Read-onlyIdempotent

Return a bounded installed-software inventory with versions and publisher metadata. Windows reads uninstall registry metadata; Linux uses the available package database.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
packagesYes
packageManagerYes

TDQS

A3.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, non-destructive and closed-world behavior, so the safety profile is covered. The description adds genuinely useful behavioral context beyond that: the platform-dependent data sources (Windows uninstall registry vs Linux package database), which tells an agent why results may differ across hosts and why some software may be missed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences with no filler; the core purpose and the platform data sources are front-loaded in that order.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return-value explanation is unnecessary, and the description covers the key cross-platform behavioral caveat. The remaining gap is the limit parameter's default/capping behavior, which matters for an agent deciding whether results are complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is a single parameter (limit) with 0% schema description coverage, so the schema carries no meaning. The description's word 'bounded' implies the inventory is capped by that limit, but it does not state the default value, the 500 maximum, or pagination/truncation behavior, leaving most of the parameter's semantics undocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource — returning an installed-software inventory — and adds that it includes versions and publisher metadata, which distinguishes it from the bare 'software_changes' sibling. It does not explicitly contrast with 'software_versions', so the boundary between those two inventory-style siblings is left to inference.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description never says when to use this tool instead of software_versions or software_changes, nor any precondition (e.g., permissions, platform requirements beyond the OS data sources). Usage must be inferred entirely from the one-line scope statement.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_processesList ProcessesA
Read-onlyIdempotent

List a bounded number of local processes with basic resource metadata. Command lines and environment variables are not returned.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
processesYes

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish readOnly, idempotent, non-destructive, and closed-world behavior, so the bar is lower. The description adds genuinely useful non-annotated detail: results are bounded and command lines/environment variables are deliberately excluded, which matters for both volume and sensitivity expectations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with the core action, and the exclusion statement earns its place by preventing a common misuse. No filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return format need not be explained, and annotations cover the safety profile. The description supplies the key scoping facts (bounded, no command lines/env vars). Only the parameter's default/meaning is left unaddressed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% and the single 'limit' parameter has no description beyond a 1-200 integer range. The word 'bounded' gestures at the cap but does not explain what limit controls (count of processes returned, default value, or behavior when omitted). Marginal value over the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('List ... local processes') plus the scope qualifier 'bounded number' and the metadata class ('basic resource metadata'). It does not explicitly name or contrast with the sibling inspect_process, which is the natural alternative for detailed process data, so it falls short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied rather than stated: the note that command lines and environment variables are not returned hints that inspect_process is the tool for that detail, but neither that sibling nor any when-to-use/when-not condition is named. An agent must infer the routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_servicesList ServicesA
Read-onlyIdempotent

List a bounded number of Windows services or systemd services and their states.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
servicesYes

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true and destructiveHint=false, so the safety profile is fully covered. The description adds useful context that the result is bounded and includes states, but does not disclose the default bound, pagination, or truncation behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single tight sentence with the key scoping adjectives ('bounded', 'their states') front-loaded. Nothing is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be described, and the cross-platform (Windows/systemd) scope is stated. The only real gap is the undocumented default for the limit parameter.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

One parameter with 0% schema description coverage, so the description must carry it. 'Bounded number' loosely maps to the 'limit' parameter (schema constrains it to 1-300) but no default value or practical cap guidance is given.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Names a specific verb ('List') and resource ('Windows services or systemd services and their states'), making the platform scope clear. It distinguishes itself from 'service_status' only implicitly (plural listing vs. single-service inspection), so sibling differentiation is not explicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies a bulk-enumeration use case but never states when to call this versus 'service_status' for a single service, nor any prerequisites. Usage is left to be inferred from the plural phrasing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

local_adminsLocal AdministratorsA
Read-onlyIdempotent

Identify members of the built-in Windows Administrators group or common Linux administrative groups without modifying membership.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
administratorsYes

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, and non-destructive, so the safety profile is covered; the description's 'without modifying membership' largely restates this. It does add useful context that results span built-in Windows and common Linux admin groups, which the annotations cannot convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence that front-loads the action and resource and ends with the read-only scope constraint. Nothing is wasted or buried.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With zero parameters, rich annotations, and an output schema present, the description does not need to explain return values. It supplies the cross-platform scope, though it could say more about which groups qualify on Linux.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so the description has no parameter semantics to explain and the schema is fully covering. Baseline 4 for a no-parameter tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (identify) and resource (members of Windows Administrators group / Linux admin groups) with cross-platform scope. It does not explicitly differentiate itself from close siblings like local_groups and local_users, so an agent must infer the distinction, but the purpose is unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance or mention of alternatives, despite siblings (local_groups, local_users) that overlap in domain. The 'without modifying membership' clause is a scope constraint, not usage routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

local_groupsLocal GroupsB
Read-onlyIdempotent

Return bounded local group metadata and Linux group membership where available.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
groupsYes

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false, and openWorldHint=false, so the safety profile is covered. The description adds the 'bounded' qualifier and the 'where available' platform caveat, but says nothing about permissions required to enumerate groups or how suppression/truncation behaves.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One compact sentence with no filler and the resource front-loaded. It is efficient, though it spends words on the 'where available' hedge rather than on the parameter it leaves unexplained.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be described, and annotations cover the read-only nature. However, for a tool with an undocumented limit parameter and no usage routing among the many sibling inventory tools, the description is only minimally adequate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the single 'limit' parameter (1-300) is undocumented in both schema and description. 'Bounded' loosely alludes to a size cap but gives no default, no maximum, and no statement of what happens when results exceed the limit; the description does not compensate for the coverage gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: it returns local group metadata and Linux group membership. This clearly distinguishes it from most siblings, though it never names the closest sibling (local_users) or explicitly contrasts group vs user data.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance, no prerequisites, and no mention of when to prefer local_groups over local_users or local_admins. The only usable context is the tool name itself.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

local_usersLocal UsersB
Read-onlyIdempotent

Return bounded local account metadata. Passwords, password hashes and credential material are never returned.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
usersYes

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, and non-destructive, so the safety profile is covered. The description does add real value beyond them by stating output is 'bounded' and that passwords/hashes/credentials are never returned, which is a security-relevant guarantee the annotations do not express. It still says nothing about ordering, pagination, or count of accounts.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short, front-loaded sentences with no filler; the credential-exclusion guarantee is stated immediately after the purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return-value detail is not required, and the credential exclusion is a useful addition. However, for a tool with a zero-documented, unbounded-looking parameter and no usage routing vs three neighbouring account tools, the description leaves clear gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% and the single 'limit' parameter (max 300) is only obliquely implied by the word 'bounded'. The description does not state the bound or the default, so the schema's maximum/minimum constraints carry the load.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Return bounded local account metadata'), which is clear enough to distinguish from local_groups and local_admins. It does not, however, explicitly name those siblings or say how the accounts differ (local vs domain, admin vs all).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use guidance at all: nothing tells the agent when to pick this over local_admins or local_groups, nor any prerequisites. Usage must be inferred entirely from the tool name.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

memory_statusMemory StatusA
Read-onlyIdempotent

Return total, used and available physical memory.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
freeBytesYes
usedBytesYes
totalBytesYes
usagePercentYes

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false, and openWorldHint=false, so the safety profile is covered. The description adds only return fields, which the output schema likely covers, and discloses no additional behavioral context such as permissions or rate limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence with no wasted words, front-loading the resource and returned metrics. It is appropriately sized for a simple status tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present and annotations covering the safety profile, the description is nearly sufficient for a zero-parameter read-only tool. It is clear enough to invoke correctly, though it could mention sibling alternatives like system_info for better routing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so the baseline is 4. The description does not need to explain parameter semantics, and it correctly adds no misleading input information.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: return total, used and available physical memory. Clear what it does. Does not explicitly differentiate from siblings like system_info, which may also expose memory details, so not a full 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the resource and sibling naming, but no when-to-use, when-not-to-use, or alternative guidance is provided. An agent can infer it for memory status, but must decide on its own versus system_info or system_health.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

network_interfacesNetwork InterfacesA
Read-onlyIdempotent

List local network interfaces and assigned addresses. No network probing is performed.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
interfacesYes

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false and openWorldHint=false, so the safety profile is covered. The description adds real value beyond that by disclosing that 'No network probing is performed' – an important scope guarantee that the tool only reads local configuration rather than scanning the network.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, the resource is front-loaded and the scope caveat follows immediately. No filler and nothing that fails to earn its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be documented, and annotations plus the description cover safety and scope. For a zero-parameter read tool this is nearly complete; only an explicit note on when to prefer it over system_info would add value.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so there is nothing for the description to disambiguate. Baseline 4 applies; the description correctly avoids inventing parameter semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('List') and resource ('local network interfaces and assigned addresses'), which is clear and distinct from generic siblings like system_info or system_health. It does not explicitly name a sibling it differs from, so it stops short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The context of use (inspecting local host configuration) is implied by the description but never stated, and no alternatives or exclusions are named among the many sibling system-inspection tools. Adequate but leaves routing to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scheduled_tasksScheduled TasksA
Read-onlyIdempotent

Inventory Windows scheduled tasks or Linux systemd timers and cron directory entries without returning task action commands.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
tasksYes

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint and non-destructive behavior, so the safety profile is covered. The description adds a genuinely useful behavioral detail beyond the annotations: task action commands are deliberately omitted from the results, which matters for both security sensitivity and what the agent can expect back.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One sentence, front-loaded with the verb and resources, followed by the redaction qualifier. Every clause earns its place with no padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present the description needn't explain return values, and the annotations cover the safety profile. It covers platforms, scope and the redaction caveat; only the limit parameter is unaddressed, which is a minor gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the description never mentions the single 'limit' parameter. However, the parameter is a trivial optional integer constrained by min/max, so it is largely self-explanatory from the schema alone; this lands at the baseline rather than below it.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (inventory) and the exact resources covered (Windows scheduled tasks, systemd timers, cron directory entries). It is clearly distinguishable from siblings like startup_programs and list_services, though it never names an alternative explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the scope — an agent can infer this is the tool for scheduled task/timer enumeration — but there is no explicit when-to-use or when-not-to-use guidance versus startup_programs or list_services.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

service_statusService StatusA
Read-onlyIdempotent

Inspect one Windows or systemd service. Service names are strictly validated before use.

ParametersJSON Schema
NameRequiredDescriptionDefault
serviceNameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
serviceYes

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, destructiveHint=false and openWorldHint=false, so the safety profile is fully covered structurally. The description adds the validation constraint ('service names are strictly validated before use'), which is genuinely new context, but says nothing about permissions, failure modes, or pagination.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with the action and resource; both sentences carry weight with no filler. Slightly terse rather than padded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need no explanation, and annotations cover the safety profile. For a single-parameter read tool the description is nearly complete; only the accepted name format and the validation rules remain unstated.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

One required parameter with 0% schema description coverage, so the schema supplies only minLength/maxLength with no semantics. The description adds that the name is strictly validated, which is useful, but never states the expected format (e.g. 'nginx' vs 'nginx.service') or what makes a name valid.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (inspect) and resource (a single Windows or systemd service), and the word 'one' implicitly contrasts with the sibling list_services. It stops short of naming that sibling, so it is clear but not fully disambiguated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The singular scope implies use when a specific service name is already known, versus listing all services, but no alternative is named and no conditions or prerequisites are stated. Usage is inferable rather than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

software_changesSoftware ChangesA
Read-onlyIdempotent

Compare the current bounded installed-software inventory with a caller-supplied baseline. The server does not persist a baseline or write to disk.

ParametersJSON Schema
NameRequiredDescriptionDefault
previousInventoryYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
addedYes
removedYes
limitationYes
currentCountYes
baselineCountYes
versionChangedYes

TDQS

A3.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, non-destructive, closed-world behavior, so the safety profile is covered. The description adds genuinely new behavior beyond that: no baseline persistence and no disk writes, which tells the agent the comparison is stateless and repeatable.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, zero padding, with the core comparison stated first and the stateless caveat second. Every sentence carries information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need no explanation, and the stateless behavior is disclosed. The gaps are the undocumented input shape (no schema descriptions) and thin guidance on matching semantics (name vs name+version) and behavior at the 500-item limit.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the description only labels the input as a 'caller-supplied baseline'. It omits the array-of-objects structure, the name/version fields, and the 500-item cap that the schema enforces, so it does not compensate for the coverage gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb (compare) plus resource (current installed-software inventory against a caller-supplied baseline), which is meaningfully distinct from the sibling inventory tools like installed_software and software_versions. It does not name those siblings explicitly, so the differentiation is inferred rather than stated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The statement that the server does not persist a baseline implies the caller must retain and supply their own, which is implied usage guidance. However, there is no explicit when-to-use, when-not-to-use, or routing advice versus installed_software / software_versions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

software_versionsSoftware VersionsA
Read-onlyIdempotent

Look up installed versions for up to 50 requested software names without launching or modifying the software.

ParametersJSON Schema
NameRequiredDescriptionDefault
namesYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
matchesYes
requestedYes
packageManagerYes

TDQS

A3.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish readOnlyHint=true, destructiveHint=false, and idempotentHint=true. The description adds useful behavioral context beyond those hints by stating it will not launch or modify the software, which clarifies that version detection is passive rather than execution-based.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, front-loaded sentence with no wasted words. The core action, scope, and non-invasive behavior are all delivered immediately.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The output schema exists, so return values need not be described, and the annotations carry the safety profile. However, for correct invocation, the description should clarify how software names are matched and how this differs from installed_software, both of which are missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% for the single required parameter 'names'. The description only restates that these are software names and repeats the 50-item limit already present in the schema; it does not explain matching rules, expected name format, case sensitivity, or how partial or unknown names are handled.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('look up'), resource ('installed versions'), and scope ('up to 50 requested software names'). It implies a focused query rather than a full inventory, but does not explicitly name the sibling tool installed_software, so sibling differentiation is left to inference.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context for using the tool with a bounded list of requested software names, but it does not say when to choose this over installed_software or software_changes. Usage is implied rather than explicitly framed with when-to-use and when-not-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_key_inventorySSH Key InventoryA
Read-onlyIdempotent

List metadata for files in the current user's SSH directory. Key contents, private key material and authorized key contents are never read or returned.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
keysYes
directoryYes

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, non-destructive and closed-world. The description adds genuinely valuable behavioral context beyond that: key contents, private key material and authorized_keys contents are never read or returned. It does not cover pagination behavior, but the privacy guarantee is a meaningful addition.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, zero waste, and the scope statement is front-loaded before the negative guarantee. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so field-level return detail is unnecessary, and the description correctly focuses on scope and privacy constraints. Only the undocumented 'limit' parameter leaves a small completeness gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is a single 'limit' parameter with 0% schema description coverage, and the description never mentions it, so it fails to compensate for the documentation gap. An agent gets no hint about what limit controls or its bounds from prose. The name is fairly self-explanatory, which keeps this from the bottom of the scale.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('List metadata') and resource ('files in the current user's SSH directory'), with the scope ('current user's') explicitly bounded. It is unambiguous what this tool returns and how it differs from system/certificate inventory siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the description's scope (listing SSH directory file metadata), but there is no explicit when/when-not guidance or named alternative. With no competing SSH-key sibling, the absence of routing is tolerable but still leaves guidance at an implied level.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

startup_programsStartup ProgramsA
Read-onlyIdempotent

Inventory Windows startup registrations or enabled Linux systemd/XDG startup entries. Startup command lines are intentionally not returned.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
startupProgramsYes

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare read-only, idempotent, non-destructive, closed-world behavior, so the safety profile is covered. The description adds a genuinely non-obvious behavioral disclosure: startup command lines are intentionally omitted, which tells the agent what data will be missing from the result.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no waste, scope front-loaded and the data-omission caveat placed second. Every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists so return shapes need not be explained, and annotations cover safety. Scope and the command-line omission are stated; the only real gap is that the limit parameter and its effect are left entirely undocumented.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single parameter (limit, max 300) has 0% schema description coverage and is not mentioned at all in the description. With low coverage the description should compensate, but it says nothing about pagination or result-size control.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (inventory) and resource (Windows startup registrations, Linux systemd/XDG startup entries), and disambiguates by platform. Clearly distinguishable from siblings like scheduled_tasks, list_services, and installed_software.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the platform-scoped resource but no explicit when-to-use or when-not-to-use guidance is given, and no alternative sibling is named for overlapping cases such as scheduled_tasks.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

system_healthSystem HealthA
Read-onlyIdempotent

Summarize CPU, memory and fixed-disk pressure without changing the host.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
healthYes
reasonsYes
hostnameYes
uptimeSecondsYes
cpuUsagePercentYes
memoryUsagePercentYes
maxDiskUsagePercentYes

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, and 'without changing the host' essentially restates that safety profile rather than extending it. The description adds no new behavioral context such as sampling window, refresh cost, or what the summary aggregates across. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence naming the verb, the three measured resources, and the non-mutating guarantee. No filler, no restatement of the name or title.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Output schema exists, so return values need not be described, and there are no parameters to document. The description usefully scopes 'fixed-disk' (excluding network/removable volumes) against a large sibling set, though it could say more about what the aggregate summary contains given how many granular siblings exist.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so the baseline is 4 and there is nothing for the description to disambiguate. The schema is empty and fully covered, leaving no parameter semantics gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (summarize) and explicit resource scope (CPU, memory, fixed-disk pressure), so an agent knows it is an aggregate read rather than a single-subsystem query. It does not explicitly name cpu_status/memory_status/disk_status as the granular alternatives, so sibling differentiation is only implied.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied: reach for this when a consolidated health snapshot is wanted rather than per-subsystem detail. There is no explicit statement of when to prefer this over cpu_status, memory_status, or disk_status, nor any exclusions or prerequisites.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

system_infoSystem InformationB
Read-onlyIdempotent

Return bounded operating-system and host metadata using Node.js system APIs.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
machineYes
releaseYes
versionYes
hostnameYes
platformYes
architectureYes
uptimeSecondsYes
logicalCpuCountYes
operatingSystemYes

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, openWorldHint=false and destructiveHint=false, so safety is covered. The description adds only the word 'bounded', hinting at a truncated/limited payload, but says nothing about what is truncated or how.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler. It is efficient, though its brevity comes at the cost of scope detail rather than being a model of informative concision.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, and annotations cover the safety profile for this zero-param read. The remaining gap is scope definition relative to the dense set of more specific sibling diagnostics.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so per the rubric the baseline is 4. Nothing about parameters needs documenting and the description does not need to compensate for any schema gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Return) and resource (operating-system and host metadata), which is clear on its own. However, with 22 siblings including uptime, cpu_status, memory_status, disk_status and network_interfaces, it does not say how it differs from those narrower tools or what 'bounded' scope actually covers.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use guidance, no exclusions, and no mention of any alternative among the many overlapping diagnostic siblings. The agent must guess whether to call this or the specific cpu/memory/disk tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

uptimeSystem UptimeA
Read-onlyIdempotent

Return system uptime in seconds, hours and days.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
uptimeDaysYes
uptimeHoursYes
uptimeSecondsYes

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, destructiveHint=false, and openWorldHint=false, so the safety and side-effect profile is fully covered by structured data. The description's only addition is the format of the returned value (seconds, hours, days), which is minor behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, front-loaded sentence that conveys the resource and the unit of the result with no waste. Nothing could be trimmed without losing information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, read-only tool with complete annotations and an output schema, the description is adequate; the return format is already covered by the output schema, so the brief description loses little. It could name its sibling boundary (e.g. vs system_info) but is otherwise sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so there is nothing to disambiguate; per the rubric, a parameter-free tool has a baseline of 4. The description correctly implies the tool is argument-free.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Return) and resource (system uptime) and even specifies the units returned (seconds, hours, days). It does not explicitly differentiate itself from the sibling system_info, which could plausibly include uptime, so it falls short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use, when-not-to-use, or alternative routing guidance. The tool's purpose is fairly self-evident from the name, but the description provides no explicit context for selecting it over system_info or system_health.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 23 tool updatesv0.2.0
    • First observedcertificate_expiry
    • First observedcertificate_inventory
    • First observedcpu_status
    • First observeddisk_status
    • First observedenvironment_variables_summary
    • First observedinspect_process
    • First observedinstalled_software
    • First observedlist_processes
    • First observedlist_services
    • First observedlocal_admins
    • First observedlocal_groups
    • First observedlocal_users
    • First observedmemory_status
    • First observednetwork_interfaces
    • First observedscheduled_tasks
    • First observedservice_status
    • First observedsoftware_changes
    • First observedsoftware_versions
    • First observedssh_key_inventory
    • First observedstartup_programs
    • First observedsystem_health
    • First observedsystem_info
    • First observeduptime

TDQS

B3.4/5.0

Scored across 23 tools

Disambiguation4/5

Most tools target distinct resources or actions, but the system health area has some overlap: system_health summarizes CPU, memory, and disk while cpu_status, memory_status, and disk_status provide detailed views of the same domains. Descriptions help distinguish them, but an agent could still hesitate between a summary tool and a detail tool.

Naming Consistency4/5

All names use snake_case, which is consistent, but the conventions vary between noun phrases (system_info, cpu_status, network_interfaces) and verb-led names (list_processes, inspect_process, list_services). The pattern is readable but not uniform verb_noun throughout.

Tool Count3/5

23 tools sits in the 16-25 range that the rubric calls borderline heavy for a server's scope. While many tools serve distinct read-only inspection needs, several could be consolidated with the summary tools, making the surface feel somewhat expansive.

Completeness4/5

Coverage is broad for local read-only system inspection: hardware, OS, processes, services, software, users, security artifacts, startup, and scheduled tasks are all represented. Minor gaps exist, such as network connection/port inspection and event log access, but agents can work around most of these.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • F
    license
    A
    quality
    D
    maintenance
    A secure, read-only MCP server for AI-powered system monitoring. It provides real-time OS metrics, config discovery, and safe log tailing to enable autonomous infrastructure audits without shell access risks.
    4
    1
    -
  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables read-only observability of a Linux host via MCP, exposing allowlisted systemd, docker, nginx, logs, disk, and cert info without shell access.
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    Read-only MCP server for observing Linux hosts (systemd, ZFS, Docker, VMs, network, hardware, NixOS) as a graph of objects with provenance. Provides seven tools to list hosts, get status, collections, objects, evidence, lookup, and changes.
    1
    GPL 3.0
  • F
    license
    A
    quality
    C
    maintenance
    Enables observation-only system inspection through MCP, exposing system identity, resources, process summary, and network summary without any mutation or command execution.
    4
    -