janitor-mcp
Provides tools for Linux system health monitoring and cleanup, including reporting RAM/swap/tmpfs pressure, detecting and sweeping orphaned development workers, and removing age-gated stale sockets and scratch caches.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@janitor-mcpcheck RAM and /tmp pressure, then dry-run sweep orphaned workers"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
janitor-mcp
Linux system health, orphan-process sweeper and transient cache cleaner for agentic workspaces, exposed as a local MCP server (stdio, no network).
Reports RAM/swap//tmp tmpfs pressure, detects orphaned development workers
(headless browsers, dead agent runners, detached compilers), sweeps them behind
an immutable protected denylist (SIGTERM → 3s → SIGKILL, dry_run by default)
and removes age-gated stale sockets and scratch caches.
Run
python3 -m venv .venv && .venv/bin/pip install -e .
.venv/bin/python3 -m janitor.server # stdio MCP (same as the `janitor` script)Related MCP server: sweep-mcp
Test
.venv/bin/pip install -e . pytest
.venv/bin/python3 -m pytest tests/ -q
bash scripts/check-file-size.shInstalled console shim
~/.local/bin/janitor points at the isolated runtime
~/.local/share/janitor-mcp/runtime, independent of this checkout. It is
registered as janitor in ~/.orquestra/mcps.json; orquestra --mcp-deploy
compiles it into every harness config.
Storage rule
Never create files in /tmp/ (it is RAM-backed tmpfs here); all scratch must
live under /var/tmp/testing/.
License
MIT — see LICENSE.
Available Tools
5 toolsjanitor_clean_cachesA
Clean transient caches. targets: sockets (dead ~/.orquestra/*.sock), staging (.codex marketplace staging), testing_scratch (/var/tmp/testing). older_than_hours=6 gates every removal; dry_run=true (default) only reports.
| Name | Required | Description | Default |
|---|---|---|---|
| dry_run | No | ||
| targets | No | ||
| older_than_hours | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does well: it discloses that dry_run defaults to true (safe, report-only), that older_than_hours gates EVERY removal, and names the concrete paths affected. It omits privilege requirements and whether deletion is reversible, which keeps it short of a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three compact clauses, front-loaded with the purpose, then targets, then the two behavioral gates. Every fragment carries information; nothing is repeated from structured fields for padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need no explanation, and the description covers targets, the age gate, and the default dry-run behavior. It stops short of stating prerequisites or the relationship to sibling cleanup tools, but is otherwise sufficient for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% and the schema gives targets only as a free-form string array, so the description's enumeration (sockets, staging, testing_scratch) is the sole source of valid values. It also explains older_than_hours as a gating threshold and dry_run as report-only, fully covering all three parameters beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (clean) plus resource (transient caches) and enumerates exactly which caches, making it trivially distinguishable from janitor_scan_orphans and janitor_sweep_processes. An agent knows immediately this is the cache-reclamation tool, not a scanner or process tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the enumeration of targets and the dry-run default, so an agent can infer this is the tool for reclaiming stale cache files. However, it never states when to prefer this over siblings, nor any prerequisite conditions (permissions, when caches are safe to remove).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
janitor_oom_inspectA
Inspect oom_score and oom_score_adj for active agent runners to show kernel sacrifice priority under memory pressure, with recommendations.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it does disclose what is read (oom_score, oom_score_adj) and that it produces recommendations, which implies a non-mutating diagnostic. It says nothing about required privileges, whether it touches or restarts processes, or any side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence that names the operation, the metrics, the target, and the value delivered. No filler or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter read-only diagnostic with an output schema present, the description covers the goal and subject adequately; return-value details are handled by the output schema. Only the absence of any usage/permission framing keeps it from being fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so the baseline is 4; there is nothing for the description to clarify beyond the empty schema. No parameter-level detail is needed or missing.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb ("Inspect") and a precise resource ("oom_score and oom_score_adj for active agent runners"), plus the underlying goal (kernel sacrifice priority). It is clearly distinct from janitor_system_health and the sweep/clean siblings, though it never explicitly says so.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase "under memory pressure" implies the situation in which this is useful, but there is no explicit when-to-use guidance, no prerequisites, and no named alternative among the sibling janitor tools. Usage is only inferable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
janitor_scan_orphansA
Scan this user's processes for suspected orphaned development workers (PPID=1, dead parent, zombie): headless browsers, agent runners, detached compilers and python sub-workers.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It does define the detection heuristics (PPID=1, dead parent, zombie), which is genuinely useful, and "scan" implies a non-mutating read. It does not state that nothing is terminated, whether elevated permissions are needed, or how long the scan takes — notable gaps for a process tool with zero annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with the target class stated first and the concrete process categories packed into an efficient colon list. Every clause earns its place; no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter detector with an output schema available to explain return values, the description covers what to expect it to look for. The only shortfall is the unstated relationship to janitor_sweep_processes (i.e., that this tool reports but does not remediate), which an agent should not have to guess.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes no parameters and the schema description coverage is 100%, so the baseline is 4. The description correctly adds nothing about inputs because there are none.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a concrete verb ("scan") and resource ("this user's processes") plus the exact target class (suspected orphaned development workers) and enumerates the categories: headless browsers, agent runners, detached compilers, python sub-workers. It implicitly separates itself from janitor_sweep_processes (detection vs. action), but never names or contrasts with a sibling explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied rather than stated: the word "scan" and the qualifier "suspected" signal this is a detection-only step you run when you suspect leaked workers. There is no explicit when-to-use statement, no prerequisites, and no pointer to janitor_sweep_processes as the follow-up action tool, leaving the agent to infer the workflow.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
janitor_sweep_processesA
Terminate processes safely. Provide explicit pids and/or target_type='orphans'|'browsers'|'compilers'. dry_run=true (default) only reports; force=true allows SIGKILL after a 3s SIGTERM grace. systemd, compositors, sshd, shells and OrquestraAI are always refused.
| Name | Required | Description | Default |
|---|---|---|---|
| pids | No | ||
| force | No | ||
| dry_run | No | ||
| target_type | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations at all, the description carries the full burden and does so well: it discloses the default dry_run report-only behavior, the SIGTERM→SIGKILL escalation with a 3s grace window, and an explicit list of always-refused targets (systemd, compositors, sshd, shells, OrquestraAI). For a destructive tool these are exactly the traits an agent needs to reason about risk.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three dense sentences, front-loaded with the destructive action, then targeting, then safety escalation and refusals. Every clause carries distinct information; nothing is redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return-format detail is unnecessary and the description appropriately focuses on targeting, safety defaults, and refused targets. It is slightly thin on edge behavior (e.g., invalid pids, partial failures, platform assumptions), which keeps it from a 5 for a destructive four-parameter tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must compensate, and it does: it documents pids, enumerates the target_type values ('orphans'|'browsers'|'compilers') that the schema does not constrain at all, and explains the semantic effect of both booleans (dry_run reports only; force permits SIGKILL). Nearly every parameter gains meaning beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource combination ('Terminate processes safely'), which clearly separates it from the read-oriented siblings like janitor_scan_orphans and janitor_system_health. It never names a sibling or explicitly contrasts scope, so it stops short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It tells the agent how to invoke the tool (explicit pids and/or target_type, dry_run defaults to report-only), which is useful operational context. It gives no guidance on when to prefer this over janitor_scan_orphans or what prerequisites should be checked first, so usage is only implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
janitor_system_healthA
RAM/swap/tmpfs health: used/free RAM and swap, /tmp tmpfs utilization, CPU load and the top-5 processes by resident memory. alert=true past 85% RAM or 80% /tmp.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it does disclose the alert logic (alert=true past 85% RAM or 80% /tmp), which is genuinely non-obvious behavior an agent could not infer from the schema. It still never states outright that the tool is read-only and side-effect free, which is the one behavioral trait left unstated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two dense sentences, metrics front-loaded and the alert threshold trailing as a qualifier. No filler, no restatement of the name, every clause carries information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return-shape detail is not required here, and with zero params there are no input gaps. Coverage is essentially complete; only the read-only/no-side-effects guarantee is missing for a bare, annotation-free definition.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there is nothing for the description to disambiguate and no undocumented inputs to compensate for. The 4 baseline applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
It names a specific resource (system health: RAM/swap/tmpfs/CPU load) and enumerates exactly what is measured, including 'top-5 processes by resident memory'. It does not explicitly distinguish itself from the closest sibling janitor_oom_inspect, so it stops short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no statement of when to call this versus alternatives, even though janitor_oom_inspect and janitor_scan_orphans sit in the same diagnostic family. Context is only implied by the metrics listed, not by any explicit use condition or exclusion.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
5 tool updates
v0.1.0- First observed
janitor_clean_caches - First observed
janitor_oom_inspect - First observed
janitor_scan_orphans - First observed
janitor_sweep_processes - First observed
janitor_system_health
TDQS
Scored across 5 tools
Each tool has a fairly distinct role: health monitoring, orphan scanning, process termination, cache cleaning, and OOM inspection. The only mild overlap is between janitor_scan_orphans (read) and janitor_sweep_processes with target_type='orphans' (write), but the descriptions make the scan-vs-act split clear.
All five tools use a uniform janitor_ prefix followed by a snake_case verb_noun pattern (system_health, scan_orphans, sweep_processes, clean_caches, oom_inspect). The convention is consistent throughout with no style deviations.
Five tools is well-scoped for a system janitor: monitor, scan, terminate, clean, and inspect. Each tool earns its place with no redundant or filler operations.
The surface covers the core janitor lifecycle: observe health, find orphans, kill processes, clean caches, and assess OOM priority. Minor gaps exist, such as no general disk-usage reporting beyond tmpfs/swap or a way to list configured cache targets, but core workflows are covered.
Maintenance
Related MCP Connectors
Local checks for sudo, systemd, sshd, ufw, and secret leaks before an agent applies them.
41Read-only server insight: why a Linux server or K8s cluster is slow, failing or changed.
Observe and safely control sites, TLS, containers, traffic, databases and jobs with Hostwatch.
Stop your agent before it runs rm -rf /etc or emails your .env. Deterministic preflight checks.
Related MCP Servers
- AlicenseAqualityDmaintenanceEnables AI assistants to monitor and manage Linux infrastructure including services, logs, processes, disk, memory, ports, cron, nginx, Docker, and system health checks via the Model Context Protocol.10MIT
- AlicenseNot gradedqualityBmaintenanceEnables LLM agents to safely reclaim disk space by deleting build artifact directories like node_modules, .venv, and target, with strong guardrails to prevent accidental or malicious deletion.71 PyPIMIT
- FlicenseBqualityCmaintenanceEnables safe scanning and cleaning of macOS developer caches and temporary files, with dry-run support and strict refusal to delete non-whitelisted locations.3-
- AlicenseNot gradedqualityAmaintenanceEnables agents to capture task-scoped residue evidence during test and build workflows, exposing files, directories, processes, and ports for user-authorized cleanup and post-cleanup verification without deleting or modifying anything itself.Apache 2.0