Skip to main content
Glama

Codex Hermes Worker

Current release / 当前正式版本:1.1.0

English | 简体中文

English

A Windows-first, dual-mode MCP bridge that lets Codex delegate bounded work to Hermes Agent and a local Qwen model served through an OpenAI-compatible endpoint such as LM Studio.

Architecture

Codex
  -> project-local stdio MCP bridge
  -> Hermes Agent
  -> LM Studio / local Qwen
  -> restricted deterministic tools or explicitly authorized host tools

Codex remains responsible for planning, high-risk judgment, verification, and the final answer. Hermes and the local model handle repetitive, batch-oriented, and tool-heavy work.

Key capabilities

  • Eight high-level MCP tools for health, delegation, durable jobs, result summaries, bounded queries, cancellation, and explicitly authorized host work.

  • SQLite job state with WAL, JSONL exports, review manifests, and recovery.

  • Two-way restricted job concurrency against one shared local model.

  • restricted_batch for read-only research inputs and project-scoped outputs.

  • trusted_full for explicitly authorized terminal, file, code, browser, skill, memory, and delegation capabilities available in Hermes.

  • Windows PowerShell scripts for install, status, tests, and uninstall.

  • Unit, integration, live MCP, Hermes, and local-model capability tests.

Safety

restricted_batch is the default for untrusted or bulk input.

trusted_full is intentionally high risk. It can launch an unsandboxed host terminal and must never be selected automatically merely because restricted execution is inconvenient. Network access requires a separate opt-in.

Local secrets, generated Codex configuration, virtual environments, job data, SQLite databases, logs, and Hermes profiles are excluded from version control. See SECURITY.md before enabling host tools.

Quick start

Requirements:

  • Windows

  • Python 3.11+

  • Codex CLI or Desktop with local stdio MCP support

  • Hermes Agent

  • LM Studio or another OpenAI-compatible local model server

  • A tool-capable local model

git clone https://github.com/RANJIANG23/codex-hermes-worker.git
cd codex-hermes-worker
powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\scripts\install.ps1
powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\scripts\status.ps1

Start the local console:

powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\scripts\start.ps1

The browser opens http://127.0.0.1:8765/. The console provides live Hermes/Qwen health, job submission, queue and result views, cancellation, and an explicitly authorized trusted_full screen. Its Analytics page combines job status with input/output Token usage from both isolated Hermes profiles. The restricted queue can run two local Qwen jobs concurrently and reports partial completions separately from clean completions. The USD estimate reprices those direct worker tokens at GPT-5.6 Sol standard short-context rates ($5/M input and $30/M output, with the published cache rates) and applies a fixed 2.5 usage multiplier. Actual provider-reported API billing is displayed separately because local inference normally has no API charge. It is bound to the local loopback interface and is not a LAN service.

Run the complete validation flow:

powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\scripts\test.ps1

For configuration, first delegation examples, recovery, and uninstall instructions, read the Chinese guide.

License

MIT


Related MCP server: Agent Gateway MCP

简体中文

这是一个可运行、可测试、可供其他团队成员复用的 Windows 本地分层代理系统:

Codex / GPT-5.6
→ 项目级 stdio MCP Bridge
→ Hermes Agent
→ LM Studio / Qwen3.6 27B
→ 受限批处理工具或显式授权的完整 Hermes 工具

Codex 负责规划、复杂推理、冲突裁决和最终验收;Hermes/Qwen 负责批量、重复和本机工具密集型工作。

组件作用

  • Codex:上层主代理和最终决策者。

  • Bridge:提供 8 个高级 MCP 工具、参数校验、任务状态、摘要隔离和双模式权限。

  • Hermes:本地 Agent Loop,选择并调用工具。

  • Qwen:负责本地语义判断、分类、初筛、复核和工具规划。

  • SQLite/JSONL:持久保存任务、证据、结果和复核清单。

  • 受限任务队列:默认两路并发,共用同一个本地 Qwen 模型。

两种执行模式

restricted_batch(默认)

用于游戏研究数据、外部输入和批处理:

  • 无通用终端、无浏览器、无网络工具。

  • 只读 testdatawork/inputconfig/local.yaml 中明确加入的目录。

  • 只写本项目的 work 目录。

  • 通过专用工具执行哈希、字符串、二进制切片、FFprobe 和结构化查询。

trusted_full(显式授权)

用于你明确希望 Hermes/Qwen 像 Codex 一样执行的电脑任务:

  • 可选择 terminal、file、code_execution、browser、skills、memory、delegation、cronjob 和可用 MCP。

  • 必须传入 authorization="explicit_user_authorized"

  • 外部网络或可选第三方工具还必须传入 allow_network=true

  • 主机终端不是沙箱,可能修改文件或执行危险命令。不要对不可信网页、文档或批量输入默认使用。

完整能力和当前缺失依赖见 Hermes 完整工具报告

快速开始

环境要求:

  • Windows

  • Python 3.11+

  • 支持本地 stdio MCP 的 Codex CLI 或 Desktop

  • Hermes Agent

  • LM Studio 或其他兼容 OpenAI API 的本地模型服务

  • 支持工具调用的本地模型

git clone https://github.com/RANJIANG23/codex-hermes-worker.git
cd codex-hermes-worker
powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\scripts\install.ps1
powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\scripts\status.ps1

启动本地控制台:

powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\scripts\start.ps1

浏览器会打开 http://127.0.0.1:8765/。控制台可以查看 Hermes/Qwen 实时健康状态、提交任务、查看队列和结果、取消任务,并提供需要逐次明确授权的 trusted_full 页面。它只监听本机回环地址,不是局域网服务。

运行完整验证流程:

powershell.exe -NoProfile -ExecutionPolicy Bypass -File .\scripts\test.ps1

Bridge 是 stdio MCP,不监听常驻端口。Codex 会按任务需要启动它。

在 Codex 中确认 MCP

请调用 hermes_health,并只报告:
1. 总体状态;
2. Hermes 版本;
3. Qwen 模型 ID;
4. 默认执行模式;
5. trusted_full 是否启用。

命令行检查:

codex mcp get hermes_worker

第一个受限批处理任务

请先调用 hermes_health。

然后调用 submit_local_job:
- task_type: asset_classification
- instructions: 使用确定性元数据和字符串证据分类;不修改输入
- input_paths: ["testdata/assets.jsonl"]
- profile: asset_worker
- output_schema: asset_classification_v1
- max_steps: 8

只返回 job_id。随后轮询 get_local_job_status,完成后读取
get_local_job_summary。只在需要复核时调用 query_local_results,
不要把完整批次载入主上下文。

第一个完整工具任务

只在你明确接受风险时使用:

我明确授权本次任务使用 trusted_full,但不授权外部网络。

请调用 delegate_trusted_full_task:
- authorization: explicit_user_authorized
- working_directory: D:\WorkSpace
- toolsets: ["terminal", "file", "code_execution", "skills"]
- allow_network: false
- include_optional_tools: false
- max_steps: 20
- timeout_seconds: 600
- instructions: <具体任务>

完成后只返回结果摘要、修改文件列表和审计日志路径。

如确实需要浏览器或网络,必须在同一任务中明确授权并设置 allow_network: true

结果与配置

  • SQLite:work\database\jobs.db

  • 完整 JSONL:work\results\<job_id>.jsonl

  • 复核清单:work\review\<job_id>.jsonl

  • 受限工具审计:work\logs\tool-audit.jsonl

  • 完整模式审计:work\logs\trusted-full-audit.jsonl

本机目录配置保存在不会提交的 config\local.yaml 中。不要把原始游戏目录加入 writable_roots。本地密钥、生成的 Codex 配置、虚拟环境、任务数据、数据库和日志均已排除在版本控制之外。

安全与团队复用

restricted_batch 是处理不可信输入或批量数据时的默认模式。trusted_full 可以启动非沙箱主机终端,只能用于用户明确授权的可信任务。启用主机工具前请阅读 SECURITY.md

团队成员应复制源码和配置模板,不应复制 .venv.codex/config.tomlwork.env 或任何密钥。每个人都应在自己的电脑上运行安装器,形成:

成员自己的 Codex → 本机 Bridge → 本机 Hermes → 本机 Qwen

团队部署方法见 docs/team-deployment.md。当前版本不是无认证的远程 GPU 服务,不应直接开放到局域网。

更完整的安装、配置、恢复、故障排查和卸载说明见 中文详细指南

许可证

MIT

Available Tools

9 tools
extract_printable_stringsB

Extract bounded ASCII strings from a file without invoking a model.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes
limitNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description must disclose behavioral traits. It states the tool does not invoke a model, which is important context. However, it does not describe other behavioral aspects such as whether the extraction is bounded by length, how it handles non-printable characters, performance implications, or the structure of the output. The description adds some value but lacks depth.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with no waste, and the key differentiator ('without invoking a model') is front-loaded. It is concise and well-structured, though it could be slightly more informative without losing efficiency.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is relatively simple, with 2 parameters and no nested objects. The output schema exists, so return values are documented. However, the description does not clarify the meaning of 'bounded' (e.g., maximum string length) or the 'limit' parameter, leaving some ambiguity. For a low-level extraction tool, this is adequate but not complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate by explaining parameter meanings. It does not mention 'path' or 'limit' at all. The schema only provides titles and defaults, so an agent has to infer that 'limit' likely controls the maximum number of strings returned, but this is not stated. This is a significant gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific verb ('extract') and resource ('bounded ASCII strings from a file'), and explicitly distinguishes it from model-based extraction by adding 'without invoking a model'. This makes the purpose clear, but it does not directly reference any sibling tool to differentiate it beyond that.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies this tool should be used when you need to extract bounded ASCII strings from a file without using a model, but it does not explicitly state when to use it versus alternatives like read_binary_slice or read_text_excerpt. It gives context (low-level extraction) but no explicit exclusions or alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_file_metadataC

Return deterministic size, hash, magic, extension, MIME guess, and entropy.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

C2.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden of behavioral disclosure. It states that results are 'deterministic,' which is a useful trait, and lists the output fields. However, it omits any mention of error handling (e.g., nonexistent file), permission requirements, or side effects. For a read-only metadata operation, this is a moderate gap but not egregious.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that efficiently lists what the tool returns. There is no filler or redundant information, and the key action is front-loaded. It is appropriately concise for the tool's simplicity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one parameter) and the existence of an output schema (which covers return structure), the description is minimal but not entirely inadequate. However, because there are no annotations and no usage guidance, an agent might not know when to prefer this tool over others or what edge cases exist. The description is sufficient for basic comprehension but lacks completeness in behavioral and contextual aspects.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has a single parameter 'path' with no description and schema description coverage is 0%. The description does not mention the path parameter at all, leaving the agent without any guidance on path format, absolute vs relative paths, or file accessibility. The description entirely fails to compensate for the schema's lack of documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb 'Return' with a clear resource 'file metadata' and enumerates the output fields (size, hash, magic, extension, MIME guess, entropy). It is unambiguous about what the tool does, though it does not explicitly differentiate from sibling tools like read_text_excerpt or read_binary_slice; the distinction is implied by the nature of metadata retrieval.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. It does not mention scenarios like inspecting files before reading content, nor does it exclude cases where other tools are more appropriate. There are no prerequisites or conditions stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_workspace_filesC

List bounded file metadata under an allowed read root.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathNotestdata
limitNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses a bounded read scope ('allowed read root') but does not explain behavior such as recursion, sorting, hidden files, error handling, or whether the limit applies per directory. The description is too thin to fully inform an agent about the tool's behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence with no filler. It front-loads the action and resource. However, it is so brief that it sacrifices useful detail, though conciseness itself is not a flaw.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no annotations, 0% schema coverage, and an output schema present but not described, the description is incomplete. An agent cannot tell what the returned metadata looks like, how the limit behaves, or what path format is expected. The tool has 8 siblings, so more context is needed to route correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, but it only mentions 'file metadata' and 'allowed read root'. It does not explain the 'path' parameter semantics (e.g., relative vs absolute, directory vs file) or the 'limit' parameter behavior (e.g., max results, pagination). The description adds minimal meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('list') and resource ('file metadata') with a scope constraint ('under an allowed read root'). It is clear enough to distinguish from siblings like read_text_excerpt or get_file_metadata, though it does not explicitly name a sibling alternative.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'under an allowed read root' implies a sandboxed/workspace context and suggests the tool is for safe listing within permitted paths. However, it does not explicitly state when to use this tool versus search_file_names or get_file_metadata, nor does it mention any exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

query_mock_functionA

Query one test pseudocode record by address; never modifies a disassembler DB.

ParametersJSON Schema
NameRequiredDescriptionDefault
addressYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It clearly states the operation is read-only ('never modifies a disassembler DB'), which is valuable behavioral context. However, it does not disclose other behavioral traits such as what happens if the address is not found, whether it returns a single record or an array, or any error conditions. The read-only guarantee is helpful but incomplete.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with no wasted words. It front-loads the action and resource, then adds the read-only guarantee. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has one required parameter and an output schema, so the description doesn't need to explain return values. However, the description lacks context about address format, not-found behavior, and how this tool relates to the sibling tools. For a simple lookup tool, this is adequate but not complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It mentions 'by address' and the schema defines 'address' as a string, but the description does not add format details (e.g., hex, decimal, or file-relative addressing). The description adds minimal meaning beyond the schema, so a baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Query'), a resource ('one test pseudocode record'), and a key parameter ('by address'). It also distinguishes itself from the sibling tools by focusing on a single record lookup rather than file listing, text search, or metadata retrieval. However, it doesn't explicitly name a sibling alternative, so it falls just short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage: use this when you need a single test pseudocode record by address. It also notes that it 'never modifies a disassembler DB,' which hints at a safe read-only context. However, it does not explicitly state when to prefer this over siblings or when not to use it, leaving the agent to infer the appropriate context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

read_binary_sliceB

Read one bounded binary slice as hexadecimal.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes
lengthYes
offsetYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It communicates that the operation is a read and that the result is hexadecimal, which is useful, but it does not disclose edge-case behavior, unit assumptions, or error conditions such as out-of-bounds offset or length.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no filler. Every word adds meaning, and it is appropriately sized for a simple read operation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The output schema likely covers return values, so the description need not explain them. However, the tool has three required parameters with zero schema-level descriptionsтной and no annotations. The omission of explicit byte-unit semantics and file path meaning leaves the definition only minimally complete for a straightforward tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate for the missing parameter documentation. It does not explain that 'path' refers to a file path, that 'offset' is a byte offset, or that 'length' is a byte count. The word 'bounded' hints at the offset/length relationship but does not provide enough semantic detail.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Read'), a specific resource ('binary slice'), and the output format ('as hexadecimal'). The phrasing 'binary slice' clearly differentiates this from the sibling read_text_excerpt, so an agent can identify the tool's role without inspecting the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no guidance on when to use this tool versus alternatives such as read_text_excerpt or extract_printable_strings. There is no stated exclusion, prerequisite, or explicit preference, so the agent must infer usage solely from the tool name and brief phrase.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

read_text_excerptA

Read a bounded UTF-8 text chunk; use offset_chars to continue a large file.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes
max_charsNo
offset_charsNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description must carry the full burden of behavioral disclosure. It only mentions 'bounded' and the offset mechanism, but omits critical details such as what happens if offset exceeds file length, whether the file must already be UTF-8 or if it attempts conversion, error handling, and the effect of max_chars (e.g., hard cap, truncation behavior). These gaps leave an agent guessing about edge cases.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, tightly-worded sentence with no filler. The primary action is front-loaded, and the offset hint is appended as a concise usage note. Every word contributes value, and there is no redundancy or unnecessary detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having an output schema (so return format need not be explained), the description is incomplete for a tool with 3 parameters and no annotations. It fails to specify max_chars behavior (e.g., whether it returns fewer characters if the file is shorter), offset handling at file boundaries, encoding validation, or error conditions. An agent would need to experiment or assume defaults, which is risky in production workflows.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate for undocumented parameters. It only indirectly explains offset_chars ('continue a large file') but says nothing about the meaning or constraints of max_chars (default 4000, but is it a strict max?) or path (what kind of paths are acceptable). This under-specification forces the agent to rely on schema types alone, which is insufficient for correct invocation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb (read) and a precise resource (bounded UTF-8 text chunk), and the phrase 'use offset_chars to continue a large file' clarifies the intended use of paging. This distinguishes it from siblings like read_binary_slice (binary vs text) and extract_printable_strings (different extraction purpose), making its function unmistakable even without inspecting the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The instruction 'use offset_chars to continue a large file' provides clear, actionable context for a specific scenario (reading large files in bounded chunks). It doesn't explicitly name alternative tools or when not to use this one, but the purpose statement already implies it's for text reading, and the offset guidance is a concrete usage directive.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

run_ffprobeC

Run the fixed ffprobe metadata command on an allowed input path.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

C2.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It mentions 'fixed' implying a predetermined command and 'allowed' implying validation, but does not disclose error behavior, permissions, or what the output contains beyond the existence of an output schema. Minimal behavioral context is offered.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence with no redundant words. It is front-loaded with the action and resource, and does not waste space. However, it is so brief that it sacrifices necessary detail, which slightly reduces the score.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite the tool having only one parameter and an output schema, the description lacks essential context. It does not explain what ffprobe does (media metadata extraction), what the output looks like (even if schema covers structure, the semantics of 'metadata' are unclear), or what 'allowed' means in practice. The tool is under-specified for effective agent use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has only one parameter 'path' with 0% description coverage. The description adds only the qualifier 'allowed input path', which hints at restrictions but doesn't specify how to determine validity or what format the path should take. This is insufficient compensation for the missing schema documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific verb ('Run') and resource ('ffprobe metadata command') on a path. It distinguishes itself from siblings like get_file_metadata by naming the specific tool (ffprobe), but doesn't explicitly state that ffprobe extracts media metadata, leaving some ambiguity about the exact purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given on when to use this tool versus alternatives like get_file_metadata or read_binary_slice. The phrase 'allowed input path' implies restrictions, but there is no explanation of what constitutes an allowed path or when this tool is preferred over others.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_file_namesB

Find bounded filename matches; query may be text or a glob such as *.json.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes
limitNo
queryYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must carry behavioral disclosure. It adds useful traits (glob support and a bounded result set) but does not define what 'bounded' means, case sensitivity, or path traversal/recursion behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One front-loaded sentence with no filler. The term 'bounded' could be clarified, but the structure is appropriately brief.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple and an output schema exists, so return values need not be described. Still, the vague 'bounded' and missing path/limit semantics leave some invocation details under-specified for an agent with no other context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It adds meaning only for query (text or glob); path and limit are left to be inferred from their names and the schema default.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear search action over filenames and signals glob capability, which distinguishes it from content-based siblings like search_text. The word 'bounded' is ambiguous, however, so it does not fully earn a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The query format guidance ('text or a glob such as *.json') implies how to invoke it, and the filename focus implies a contrast with search_text. It never explicitly states when to prefer this tool over alternatives or when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_textB

Search one allowed text file or all eligible files below an allowed directory.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes
limitNo
queryYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

B3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It does not explain query matching semantics, whether searching is recursive, how the limit applies, or what 'allowed' and 'eligible' mean in practice, leaving important behavior unspecified.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence with no wasted words, front-loading the action and scope of the tool. It is highly concise while still conveying the primary distinction of the tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given three parameters, no annotations, and no parameter descriptions in the schema, the description is too thin to be complete. The output schema may define return shape, but the agent still lacks sufficient behavioral and parameter context to invoke the tool confidently.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description adds only minimal meaning to the parameters. It implies that path may point to a file or directory and that query is textual, but it does not clarify the format, interpretation, or interplay of path, query, and limit.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear verb and resource: searching text content within one file or all eligible files under a directory. It differentiates well from sibling tools like search_file_names and read_text_excerpt by scope, though it does not name them explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use the tool: when searching text inside an allowed file or files under an allowed directory. It gives context but provides no explicit guidance about when to prefer a sibling tool instead, and 'eligible' is left undefined, making the usage boundary somewhat vague.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 9 tool updatesv1.1.0
    • First observedextract_printable_strings
    • First observedget_file_metadata
    • First observedlist_workspace_files
    • First observedquery_mock_function
    • First observedread_binary_slice
    • First observedread_text_excerpt
    • First observedrun_ffprobe
    • First observedsearch_file_names
    • First observedsearch_text

TDQS

A3.5/5.0

Scored across 9 tools

Disambiguation5/5

Each tool maps to a clearly distinct operation: listing, reading text, reading binary, extracting strings, metadata, filename search, content search, ffprobe, and function-record query. Potential overlaps like list_workspace_files vs get_file_metadata are separated by scope (directory-level vs file-level detail).

Naming Consistency5/5

All tool names follow a consistent snake_case verb-first pattern such as list_, read_, get_, extract_, search_, run_, and query_. The object is always the target resource, and there are no mixed conventions or vague verbs.

Tool Count5/5

Nine tools is a well-scoped size for a read-only file/workspace inspection server. Each tool provides a distinct capability without redundancy, and the count is neither bloated nor too thin.

Completeness4/5

The read-only surface is broadly complete: listing, text and binary reads, metadata, strings, filename/content search, media probing, and function-record lookup are all covered. The main minor gap is the lack of a binary-content search, though bounded slices and string extraction provide workarounds.

Maintenance

ActivitySlowing
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers