Skip to main content
Glama
huaqing0
by huaqing0

Claude Tools Native Gateway

一句话:让网页版 ChatGPT 成为唯一主脑,驱动本机真实的 Claude Code 原生 Session 完成受控读取、修改、验证与恢复。

公开仓库只包含源码和测试,不包含本机密钥、Tunnel 配置或 state/ 会话状态。

架构

Gateway 现在只有 Native V2 一套执行引擎:

当前 ChatGPT Chat(唯一主脑)
  ↔ Claude Tools Native MCP(六个 Session 控制工具)
      ↔ 本地模型回合桥(127.0.0.1)
          ↔ 隔离的 Claude Code 原生 Session
              → 原生 Agent loop
              → 网关自有的受控工具 Executor

Gateway 自己完成 MCP 初始化、工具清单和调用分发,不再启动或代理 V1 的 claude mcp serve 工具服务器。只有创建 Native Session 后,才会启动该 Session 专属的 Claude Code 进程。

原 V1 Agent Session、顶层 Read/Edit/Write/Bash、本地任务工具、旧 DeepSeek 委派和 ChatGPT Bridge 已从运行入口与代码树移除。保留下来的是 V2 仍需要的共用底层设施:原子状态写入、凭据路径保护、进程身份验证和 macOS 沙箱规则。旧 V1 状态文件不会被自动删除,但 Native Gateway 不会读取或执行它们。

Related MCP server: localterminal-lite

MCP 控制面

网页版只看到六个工具:

  • native_session_start

  • native_session_continue

  • native_session_recover

  • native_session_reply_and_wait

  • native_session_status

  • native_session_stop

任何 V1 工具名、顶层文件工具、Bash、旧 DeepSeek 工具或其他 MCP 方法都会在服务端拒绝,而不是仅从工具列表隐藏。

Claude Code Session 能力

Session 有三个明确档位,创建后不能升降级或换根目录:

  • read_only:Read、FindFiles、SearchText 和只读 RunCommand;读取范围是整台电脑,受保护状态/凭据路径与 macOS 权限除外。

  • direct_write:在全电脑读取能力上增加 Edit、Write、NotebookEdit,只直接修改用户明确选择的真实目录。只有用户明确要求修改真实文件时才应选择此档位。

  • worktree_write:工具集与 direct_write 相同,但修改的是 Gateway 创建并保留的独立 Git worktree,源 checkout 不变。

这些是 Claude Code 原生 Agent loop 中模型可调用的逻辑工具,但执行器归 Gateway 所有。未经监管的 Claude Code 内建文件工具和 Bash 仍关闭,避免绕过动作授权、哈希、恢复和审计账本。

读取与搜索

  • Read 可读取电脑上任意未受保护的普通 UTF-8 文件,不再被写入目录限制。

  • FindFiles 可从任意绝对目录做有界文件枚举。

  • SearchText 只做 UTF-8 字面匹配,不接受正则或 glob。

  • 搜索不跟随符号链接,跳过 .git、受保护路径和外部硬链接。

  • 单次搜索结果和完整动作回执都限制在 64 KiB 内。

  • 所有档位都可以检查不同磁盘和目录;working_directory 只是默认搜索位置、命令 CWD 和写档位的写入边界。macOS TCC/文件权限仍可能拒绝 Desktop、Documents 或其他受系统保护的位置。

文件与 Notebook 修改

  • direct_write 下,Edit、Write 和 NotebookEdit 修改 Session 绑定的真实目录;worktree_write 下只修改受管 worktree。

  • Write 可以在授权根目录内按需创建缺失的父目录,再原子创建目标文件;不会借此越过根目录、符号链接、.git 或受保护路径。

  • NotebookEdit 支持按 cell ID 替换、插入和删除单元格,但不执行 Notebook。

  • 每个写动作都保存写前和写后 SHA-256,并使用准备、CAS、原子落盘和持久回执。

  • 进程崩溃后会核对真实文件状态,不能确定时停止恢复,不会盲目重复写入。

  • direct_write 没有文件删除工具,也不会因为只读检查命令而写文件;它仍可能按用户明确指令覆盖或修改目标文件。

  • worktree_write 中源 checkout 的文件、HEAD、tree、index 和工作区状态保持不变;Git common dir 会登记保留式 worktree。

验证命令

RunCommand 接受已安装的系统命令和 Session 目录内的可执行文件,不再维护容易误伤正常开发工具的静态命令白名单。参数仍以精确 argv 传入,不会由 Gateway 自动拼成 shell 字符串:

  • 命令视角下的 Session 根文件系统只读;

  • 网络、进程信号、Keychain/XPC 和模型 CLI 被 macOS Seatbelt 阻断;

  • sudo、直接删除/移动、系统控制、find -delete/-exec、rg --pre、模型 CLI 等入口仍被明确拒绝;

  • 普通项目里的符号链接、硬链接或文件数量不会再导致命令在启动前整仓拒绝;真正访问时由 Seatbelt、受保护路径和 macOS 权限约束;

  • 输出、运行时间和子进程组回收均有边界;

  • 结果先进入同一动作账本,再交给下一次 GPT 回合。

它用于可信仓库验证,不是对抗同一 macOS 账号恶意进程的容器。Session 运行时不要用其他编辑器或进程并发修改受管 worktree。

主模型、网页搜索与 DeepSeek

主路由固定为 chatgpt-main,不接受 model、provider、endpoint、API key 或 fallback 参数。当前 ChatGPT 回合停止时,Claude Code 会停在 waiting_for_gpt;不会私自切换到 Claude、DeepSeek 或 Codex 继续思考。

网页搜索继续由网页版 ChatGPT 完成。Claude Code 的 WebSearch/WebFetch 不开放,因此不会出现 GPT 搜索与 Claude 自己搜索相互冲突或来源失控。

默认 subagent_policy: "none",不会创建 DeepSeek。只有 worktree_write 明确选择 deepseek_explicit 后,GPT 才能在主循环中使用:

  • deepseek_subagent_start

  • deepseek_subagent_get

  • deepseek_subagent_stop

委派必须先进入主 Session 的持久动作账本,随后才放行隔离子 Session。子任务期间主 Session 不能并发 Edit、Write、NotebookEdit、RunCommand 或启动第二个子任务。路由固定为 Sonnet/Opus → Flash、Fable → Pro,失败不会回退到 Claude、Codex、OpenAI 或另一档 DeepSeek。

Skill 上下文

native_session_start 可以接收最多八个由 ChatGPT 明确选择的 skill_contexts。它们不是 Claude Code 原生 Skill 运行时:

  • 只提取并冻结经过校验的指令正文;

  • 不加载脚本、资源、插件、Hook、Slash Command 或额外工具;

  • 每个允许项同时固定 skill ID 和规范化完整 SKILL.md 的 SHA-256;

  • 首次启动和后续 resume 使用同一份持久快照;

  • 完整正文只在 0600 私有状态与当前 GPT 必需的模型上下文中出现。

允许清单示例:

CLAUDE_TOOLS_NATIVE_SKILL_ALLOWLIST_JSON='[{"skill_id":"personal:review","content_sha256":"<64位小写SHA-256>"}]' \
npm start

哈希按去掉 UTF-8 BOM、把 CRLF/CR 统一为 LF 后的完整文本计算。

隔离与恢复

  • 每个 Session 使用独立 HOME、Claude 配置目录、运行目录和进程组。

  • Claude Code 使用 --bare、空 setting sources、严格 MCP 配置和精确工具集合。

  • 主 Claude 进程只能访问精确的本地 Broker/Executor 回环端口。

  • 凭据目录、Gateway 状态、.git、符号链接和外部硬链接均 fail closed;普通系统/用户路径能否访问由 Session 根、macOS TCC 和文件权限共同决定。

  • ChatGPT 回复和每个获准动作先原子落盘,再释放给运行进程。

  • 租约到期会停止 Runner 并留下可检查状态。

  • Gateway 重启不会杀死仍属于 Session 的 Runner;native_session_recover 验证所有权、轮换租约并继续同一个 Claude Code Session。

  • Runner 已不存在时不会伪装恢复,也不会重复已完成动作。

Claude Code 2.1.247 没有已验证的“只启用 Hooks,同时继续禁用 keychain、插件和自动记忆”的独立开关,因此原生 Hooks、原生 Skill/Slash、Agent、Workflow、Web 和未经动作账本监管的第三方 MCP 保持关闭。

运行

npm start

Native Gateway 不再需要 CLAUDE_TOOLS_NATIVE_V2 或 CLAUDE_TOOLS_NATIVE_V2_ONLY 开关;Native-only 是唯一运行模式。

状态默认保存在 state/,可通过绝对路径环境变量 CLAUDE_TOOLS_STATE_DIR 修改。Claude Code 默认路径为 $HOME/.npm-global/bin/claude,可用 CLAUDE_BIN 覆盖。

长期运行的 Tunnel/Connector 在源码更新后需要重启。ChatGPT 可能缓存已连接工具 schema;如果新会话没有看到六个 native_session_*,请刷新或重连 Claude Tools Connector。

验证

npm test
npm run test:native:installed
npm run test:native:installed:write
npm run test:native:installed:direct-write
npm run test:native:installed:deepseek
npm run test:native:installed:skills

自动测试覆盖:

  • Native-only MCP 直接初始化、精确六工具、V1 工具和未知方法拒绝;

  • 回合与动作账本、回复幂等、租约、进程所有权、停止与恢复;

  • Read/FindFiles/SearchText 的全电脑读取、受保护路径、大小、排序、字面匹配和竞态边界;

  • Edit/Write/NotebookEdit 的 direct real-directory 写入、worktree 隔离、CAS、哈希和崩溃恢复;

  • RunCommand 的宽松开发命令入口、Session 本地可执行文件、只读文件系统、零网络、敏感服务阻断和超时回收;

  • Skill 的 ID/正文哈希固定、start/resume 一致性和私有状态边界;

  • DeepSeek 显式委派的启动屏障、单任务写锁、路由验真、Gateway 重启恢复和停止;

  • 公开 MCP/Session/history 不泄露授权 ID、Runner token、PID、内部路径或模型凭据。

Installed 测试使用本机 Claude Code 2.1.247 和 localhost 脚本 GPT,不连接真实模型:

  • test:native:installed:以 / 为只读根执行 FindFiles → 字面 SearchText → Read → final,以及 Gateway 断开后恢复同一 Runner/Claude Session。

  • test:native:installed:write:Read → Edit → Write → NotebookEdit → RunCommand → resume → Read。

  • test:native:installed:direct-write:同一套真实 Claude Code 回合直接修改测试夹具中的真实目录,再 resume 并验证持久结果。

  • test:native:installed:deepseek:使用本地假 DeepSeek CLI 验证显式委派、结果验真、活动写锁、重启恢复与停止。

  • test:native:installed:skills:验证两个哈希固定的纯指令 Skill 在 start/resume 使用同一快照。

这些本地脚本测试不消耗真实 ChatGPT、Claude 或 DeepSeek 模型额度。真实 DeepSeek 最小烟雾测试仍需用户单独授权。

Available Tools

6 tools
native_session_continueA
Idempotent

Continue the same durable native Claude Code session without changing its immutable capability profile or filesystem root. ChatGPT remains the sole main model. A direct_write Session continues to address the same real directory; a worktree_write Session continues in its retained managed worktree. A Session created with deepseek_explicit may inspect or stop its explicitly started DeepSeek subagent; the subagent never takes over the main loop.

ParametersJSON Schema
NameRequiredDescriptionDefault
promptYesNew user prompt to continue the same native session.
lease_idYesCurrent lease id for the native session.
wait_secondsNoSeconds to wait for the next pending turn, from 0 to 50. Defaults to 30.
idempotency_keyYesStable retry id. Reusing it with different input is rejected.
native_session_idYesNative session id returned by native_session_start.

Output Schema

ParametersJSON Schema
NameRequiredDescription
routeYes
replayYes
statusYes
fallbackYes
lease_idYes
revisionYes
terminalNo
workspaceYes
current_runYes
last_resultNo
launch_errorNo
pending_turnYes
stop_requestNo
session_labelYes
deepseek_routeYes
recovery_tokenNo
skill_snapshotYes
subagent_policyYes
lease_expires_atYes
network_boundaryYes
runtime_attachedYes
source_directoryYes
claude_session_idYes
native_session_idYes
recovery_requiredYes
working_directoryYes
capability_profileYes
deepseek_subsessionsYes
active_deepseek_subsession_idYes

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark this as idempotent and non-destructive, and the description adds meaningful behavioral invariants: the capability profile and filesystem root stay unchanged, ChatGPT remains the sole main model, worktree behavior depends on session type, and a DeepSeek subagent cannot take over the main loop. These details go beyond what annotations or schema convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded with the core purpose, then adds behavior details about session types and the DeepSeek subagent. Each sentence contributes useful information, though the session-type sentences could be seen as elaborating what the first sentence already implies.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the 100% schema coverage, the presence of an output schema, and annotations covering idempotency and safety, the description supplies enough behavioral context for an agent to invoke the tool correctly. The only notable gap is the lack of explicit routing guidance against sibling continuation-related tools.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all five parameters thoroughly. The description adds high-level session context but does not add parameter-specific semantics beyond what is already present in the input schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states the action: continue the same durable native session while preserving its capability profile, filesystem root, and main model. This distinguishes it from starting a new session, though it does not explicitly differentiate it from siblings like native_session_recover or native_session_reply_and_wait.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies this tool is for resuming an existing durable session rather than starting a new one, but it never explicitly names alternatives or states when to prefer this over native_session_recover or native_session_reply_and_wait. The guidance is contextual but not directive.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

native_session_recoverB
Idempotent

Reconnect ChatGPT to a durable native Claude Code session and rotate its lease. ChatGPT remains the sole main model. Any DeepSeek access remains limited to the Session's original explicit subagent policy; a write session is accepted only after its original direct directory or retained managed worktree binding is verified.

ParametersJSON Schema
NameRequiredDescriptionDefault
recovery_idYesStable retry id for this recovery and lease rotation.
wait_secondsNoSeconds to wait for the recovered state or pending turn, from 0 to 50. Defaults to 0.
recovery_tokenYesOpaque recovery token returned when the native session was created.
native_session_idYesNative session id to recover.

Output Schema

ParametersJSON Schema
NameRequiredDescription
routeYes
replayYes
statusYes
fallbackYes
lease_idYes
revisionYes
terminalNo
workspaceYes
current_runYes
last_resultNo
launch_errorNo
pending_turnYes
stop_requestNo
session_labelYes
deepseek_routeYes
recovery_tokenNo
skill_snapshotYes
subagent_policyYes
lease_expires_atYes
network_boundaryYes
runtime_attachedYes
source_directoryYes
claude_session_idYes
native_session_idYes
recovery_requiredYes
working_directoryYes
capability_profileYes
deepseek_subsessionsYes
active_deepseek_subsession_idYes

TDQS

B3.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already convey idempotency and non-destructiveness; the description adds meaningful context by stating that ChatGPT remains the sole main model, that DeepSeek access is limited by the original subagent policy, and that a write session requires verification of its directory or worktree binding. This goes beyond the annotations and helps an agent understand important constraints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is reasonably concise and front-loaded with the primary action. The second and third sentences add important behavioral constraints, though the third sentence is dense and slightly harder to parse. Overall, no sentence feels purely redundant.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the core purpose and key constraints, and the output schema likely handles return-value expectations. However, it lacks explicit usage guidance, does not differentiate from sibling tools, and does not state what happens when verification fails or the lease cannot be rotated. These are meaningful gaps for a recovery operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all four parameters. The description does not add parameter-level meaning beyond the schema, such as the relationship between wait_seconds and lease rotation or the origin of the recovery token. Per baseline for high schema coverage, a 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Reconnect ChatGPT to a durable native Claude Code session and rotate its lease.' This clearly conveys the core action. It does not explicitly name or contrast sibling tools, so it stops short of fully distinguishing itself from tools like native_session_continue.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit guidance on when to use this tool versus siblings such as native_session_continue, native_session_status, or native_session_reply_and_wait. The word 'Reconnect' loosely implies a recovery scenario, but no conditions, alternatives, or exclusions are stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

native_session_reply_and_waitA
DestructiveIdempotent

Submit ChatGPT's response for one exact pending native turn. ChatGPT is always the sole main model. Every profile permits bounded whole-computer Read, FindFiles, literal SearchText, and a network-blocked, filesystem-read-only RunCommand except on protected credential/state paths. direct_write permits gateway-authorized Edit, Write, and NotebookEdit only inside the selected real write root. worktree_write permits the same mutations only inside its retained managed worktree. A Session created with deepseek_explicit may additionally start, inspect, or stop one explicit DeepSeek subagent; start must be the only call in that response.

ParametersJSON Schema
NameRequiredDescriptionDefault
textNoOptional assistant text for this turn.
turn_idYesPending turn id being answered.
lease_idYesLease id returned by native_session_start.
reply_idYesStable idempotency id for this reply.
tool_callsNoOptional gateway-authorized calls. The Session profile and fixed subagent policy decide which calls are accepted. DeepSeek start must be the sole call. Text plus all calls must stay within a 768 KiB aggregate reply budget.
native_session_idYesNative session id returned by native_session_start.

Output Schema

ParametersJSON Schema
NameRequiredDescription
routeYes
replayYes
statusYes
fallbackYes
lease_idYes
revisionYes
terminalNo
workspaceYes
current_runYes
last_resultNo
launch_errorNo
pending_turnYes
stop_requestNo
session_labelYes
deepseek_routeYes
recovery_tokenNo
skill_snapshotYes
subagent_policyYes
lease_expires_atYes
network_boundaryYes
runtime_attachedYes
source_directoryYes
claude_session_idYes
native_session_idYes
recovery_requiredYes
working_directoryYes
capability_profileYes
deepseek_subsessionsYes
active_deepseek_subsession_idYes

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations mark the call as destructive and idempotent; the description adds substantial behavioral context by enumerating per-profile permissions (network-blocked read-only RunCommand, direct_write vs worktree_write roots) and the deepseek_explicit subagent exception. It does not explicitly describe the waiting/blocking behavior implied by the name, but the policy detail goes well beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is roughly 130 words and opens with the core action in the first sentence. Each following sentence covers a distinct policy area without significant redundancy, making it dense but not bloated.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool this complex, the description covers the essential constraints: exact turn targeting, sole main-model ownership, per-profile permissions, and subagent limitations. The wait behavior is only hinted at by the tool name, and the description does not state what happens after submission, though an output schema exists to fill return-value gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds a useful summary of which tool_calls are permitted and restates the sole-call rule for DeepSeek start, but it does not individually explain native_session_id, lease_id, turn_id, or reply_id beyond what the schema already documents.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence states a specific action: 'Submit ChatGPT's response for one exact pending native turn.' It identifies the verb, the resource, and the exactness constraint, which clearly separates it from the session lifecycle siblings. The 'ChatGPT is always the sole main model' line further clarifies its role in the session.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the required condition—'one exact pending native turn'—and gives operational rules for tool_calls, such as 'DeepSeek start must be the only call.' However, it never explicitly contrasts this tool with siblings like native_session_continue or states when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

native_session_startA
Idempotent

Start an isolated native Claude Code session with the current ChatGPT conversation as the sole main model. subagent_policy defaults to none. All profiles may use Read, FindFiles, literal SearchText, and a network-blocked, filesystem-read-only RunCommand across the computer except protected credential/state paths. working_directory remains the command CWD and, for write profiles, the only write root. read_only never writes. When the user explicitly asks to modify the actual files in working_directory, choose direct_write; it works for Git and non-Git directories. Choose worktree_write only for an isolated copy of a clean Git repository. deepseek_explicit remains available only with worktree_write; DeepSeek never becomes the main model.

ParametersJSON Schema
NameRequiredDescriptionDefault
promptYesTask to start in the native session.
wait_secondsNoSeconds to wait for the first pending turn, from 0 to 50. Defaults to 30.
session_labelNoOptional short label for the owning ChatGPT conversation.
skill_contextsNoOptional explicit, allowlisted SKILL.md contexts selected by ChatGPT for this immutable Session. They add instructions only and cannot grant tools or change providers.
idempotency_keyYesStable retry id. Reusing it with different input is rejected.
subagent_policyNoOptional subagent boundary. Defaults to none. deepseek_explicit requires worktree_write; ChatGPT remains the sole main model.
working_directoryYesAbsolute command CWD and write root. Read, FindFiles, and SearchText may inspect other absolute paths across the computer except protected state/credential paths. direct_write modifies this directory in place and does not require Git. worktree_write requires the clean top level of a Git repository.
capability_profileNoExecution boundary. Defaults to read_only. If the user explicitly requested in-place changes to actual files, use direct_write, including for non-Git directories. Use worktree_write only when an isolated retained copy of a clean Git repository is desired.

Output Schema

ParametersJSON Schema
NameRequiredDescription
routeYes
replayYes
statusYes
fallbackYes
lease_idYes
revisionYes
terminalNo
workspaceYes
current_runYes
last_resultNo
launch_errorNo
pending_turnYes
stop_requestNo
session_labelYes
deepseek_routeYes
recovery_tokenNo
skill_snapshotYes
subagent_policyYes
lease_expires_atYes
network_boundaryYes
runtime_attachedYes
source_directoryYes
claude_session_idYes
native_session_idYes
recovery_requiredYes
working_directoryYes
capability_profileYes
deepseek_subsessionsYes
active_deepseek_subsession_idYes

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With annotations already marking idempotentHint=true and destructiveHint=false, the description adds rich behavioral context: isolated session, subagent_policy default, restricted tool capabilities (network-blocked, filesystem-read-only RunCommand), protected credential/state paths, working_directory as the only write root for write profiles, and read_only never writes. This gives the agent a clear model of side effects and boundaries.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose in the first sentence and every subsequent sentence carries meaningful constraint information. It is a dense paragraph rather than structured bullets, and a couple of details (subagent_policy defaults to none) duplicate the schema, but it is appropriately concise for a tool with this many behavior-affecting choices.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the rich input schema, output schema, and annotations, the description covers all invocation-critical decisions: profile selection, subagent policy, working directory semantics, tool restrictions, and write behavior. Nothing needed to call the tool correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3. The description adds useful decision semantics on top: capability_profile selection guidance (read_only never writes, direct_write works for Git/non-Git, worktree_write only for clean Git), the write-root constraint, and the deepseek_explicit-worktree coupling. Some of this duplicates schema text, but 'only write root' and 'read_only never writes' add meaning beyond the param descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening sentence states the exact action: start an isolated native Claude Code session with the current ChatGPT conversation as sole main model. This is a specific verb + resource and distinguishes native_session_start from the continue/recover/reply_and_wait/status/stop siblings by the 'start' action.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly tells when to choose direct_write (explicit user request to modify actual files, Git or non-Git) and worktree_write (isolated copy of a clean Git repo), and ties deepseek_explicit to worktree_write. It does not explicitly name sibling tools or state when to use start over continue/recover, so it falls short of full alternative routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

native_session_statusA
Read-onlyIdempotent

Read native-session state without advancing it or invoking a model. ChatGPT remains the sole main model. Safe summaries of any explicitly enabled DeepSeek subagent and the retained managed-worktree location are returned when present.

ParametersJSON Schema
NameRequiredDescriptionDefault
lease_idYesLease id returned by native_session_start.
wait_secondsNoSeconds to wait for a state change, from 0 to 50. Defaults to 0.
native_session_idYesNative session id returned by native_session_start.

Output Schema

ParametersJSON Schema
NameRequiredDescription
routeYes
replayYes
statusYes
fallbackYes
lease_idYes
revisionYes
terminalNo
workspaceYes
current_runYes
last_resultNo
launch_errorNo
pending_turnYes
stop_requestNo
session_labelYes
deepseek_routeYes
recovery_tokenNo
skill_snapshotYes
subagent_policyYes
lease_expires_atYes
network_boundaryYes
runtime_attachedYes
source_directoryYes
claude_session_idYes
native_session_idYes
recovery_requiredYes
working_directoryYes
capability_profileYes
deepseek_subsessionsYes
active_deepseek_subsession_idYes

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, and non-destructive behavior, and the description adds meaningful context beyond those flags: it explicitly states no session advancement and no model invocation, and clarifies that only safe summaries of enabled DeepSeek subagents and the managed-worktree location are returned. This substantially helps an agent predict side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences with no filler. The most decision-relevant facts—reading state, not advancing, not invoking a model—are front-loaded, and the second sentence adds precise return-value context without unnecessary length.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the output schema, 100% parameter coverage, and annotations that already define safety characteristics, the description supplies the remaining context an agent needs: the tool is side-effect-free, returns safe summaries when present, and preserves ChatGPT as the sole main model. Nothing essential is missing for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the input schema already documents all parameter meanings. The description does not add significant parameter-level detail beyond what the schema provides, so the baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Read') with a clear resource ('native-session state') and adds a key distinguisher: the operation does not advance the session or invoke a model. It also names exactly what information is returned, making the tool's purpose unmistakable relative to its siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'without advancing it or invoking a model' clearly establishes this as a non-mutating status-check tool, implying use when state is needed without side effects. It does not explicitly name alternatives like native_session_continue, so there is some room for inference, but the intended context is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

native_session_stopA
DestructiveIdempotent

Stop the isolated native-session process and preserve durable state and any managed worktree for inspection. ChatGPT remains the sole main model. Any active Session-owned DeepSeek subagent must be safely stopped and durably observed before the Session can finalize.

ParametersJSON Schema
NameRequiredDescriptionDefault
reasonNoOptional concise reason for stopping the session.
lease_idYesLease id returned by native_session_start.
request_idYesStable retry id for this stop request.
native_session_idYesNative session id returned by native_session_start.

Output Schema

ParametersJSON Schema
NameRequiredDescription
routeYes
replayYes
statusYes
fallbackYes
lease_idYes
revisionYes
terminalNo
workspaceYes
current_runYes
last_resultNo
launch_errorNo
pending_turnYes
stop_requestNo
session_labelYes
deepseek_routeYes
recovery_tokenNo
skill_snapshotYes
subagent_policyYes
lease_expires_atYes
network_boundaryYes
runtime_attachedYes
source_directoryYes
claude_session_idYes
native_session_idYes
recovery_requiredYes
working_directoryYes
capability_profileYes
deepseek_subsessionsYes
active_deepseek_subsession_idYes

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint and idempotentHint, but the description adds valuable context: durable state and worktree are preserved for inspection, the main ChatGPT model is untouched, and Session-owned DeepSeek subagents must be safely stopped. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and front-loaded with the primary action. The second sentence about ChatGPT remaining the sole main model is slightly tangential but adds context; overall every sentence is short and purposeful.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the core purpose, a prerequisite, and the side-effect guarantee of preservation. With a full output schema and complete parameter schema, nothing critical is missing; retry semantics are already implied by the idempotentHint annotation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline of 3 applies. The description itself does not add meaning beyond the schema, but each parameter is already fully documented in the schema with origin, format, and purpose.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: it stops the isolated native-session process and preserves durable state and managed worktree for inspection. It also clarifies the tool's relationship to the main model, making the action unambiguous. This clearly distinguishes it from the sibling start/continue/recover/status tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when the tool should be used by stating that active subagents must be safely stopped and durably observed 'before the Session can finalize.' However, it does not explicitly name alternative tools or give explicit when-not-to-use guidance, so it stops short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 6 tool updatesv0.8.0
    • First observednative_session_continue
    • First observednative_session_recover
    • First observednative_session_reply_and_wait
    • First observednative_session_start
    • First observednative_session_status
    • First observednative_session_stop

TDQS

A4.1/5.0

Scored across 6 tools

Disambiguation4/5

Each tool maps to a distinct lifecycle action such as start, continue, recover, reply, status, or stop. The only mild ambiguity is between continue and recover, since both involve reconnecting to an existing session, though the descriptions differentiate them by lease rotation and capability immutability.

Naming Consistency5/5

All tool names follow the same native_session_ prefix with an imperative verb or verb phrase. The naming pattern is uniform and predictable, making the tool set easy to navigate.

Tool Count5/5

Six tools is well-scoped for a session gateway: creation, continuation, recovery, interaction, status inspection, and shutdown. Each tool has a clear role without redundancy.

Completeness5/5

The tool set covers the full lifecycle of a native session: start it, continue or recover it, send replies, check status, and stop it. Stop preserves durable state rather than losing it, so the workflows do not end in a dead end.

Maintenance

ActivitySlowing
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    C
    maintenance
    Provides comprehensive session management for Claude Code with automatic initialization/cleanup, quality checkpoints, and local conversation memory with semantic search for capturing learnings across coding sessions.
    6
    452 PyPI
    4
    BSD 3-Clause
  • A
    license
    Not graded
    quality
    B
    maintenance
    Bridges ChatGPT with local computer for controlled file and project management, featuring session-based collaboration and diff tracking.
    4
    Apache 2.0
  • A
    license
    Not graded
    quality
    C
    maintenance
    Bridges Claude Code terminal sessions with Claude Chat by exposing session logs as tools, enabling seamless context transfer and two-way communication via a cooperative inbox and optional Google Drive sync.
    36 npm
    1
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    A secure, local-first MCP coding and computer-use harness for ChatGPT and Codex, enabling guarded file operations, durable terminals, Git review, local skills, and macOS computer control.
    142 npm
    MIT