Universal AI Bridge
Allows running Docker commands (e.g., docker build) on the host in admin mode, with Docker access controlled by configuration.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Universal AI BridgeCreate a new Node.js project in my workspace and run npm install"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Universal AI Bridge
Um servidor MCP local que deixa qualquer IA que fale MCP — no navegador (ChatGPT, Claude.ai) ou local (Claude Desktop, Cursor, Gemini CLI) — programar no seu PC: criar/editar projetos, rodar terminal (inclusive tarefas longas e interativas) e, no modo admin, usar Docker. Com dois modos de segurança claramente separados.
Um código, dois transportes:
stdio → clientes MCP locais (sem rede, sem token).
Streamable HTTP → IAs no navegador, via túnel HTTPS (
cloudflared).
Arquitetura: IA → Auth → Policy Engine → Executor → Audit.
Sumário
Related MCP server: CodeAgent MCP
1. Modos de segurança
O modo é escolhido por BRIDGE_MODE.
Modo seguro (safe) — padrão
Workspace jaulado (nada sai da pasta configurada; symlinks para fora são bloqueados).
Shell desligado por padrão; liga só com
BRIDGE_ALLOW_SHELL=true.Docker sempre bloqueado.
Ações com efeito colateral passam por aprovação (
confirmoulocal).
Modo administrador (admin) — opt-in deliberado
Shell ligado por padrão; Docker liberável com
BRIDGE_ALLOW_DOCKER=true.Exige reconhecimento explícito:
BRIDGE_ADMIN_ACK=I_UNDERSTAND_FULL_PC_ACCESS. Sem essa frase exata, o servidor não sobe em modo admin (cai para safe/erro).Continua com workspace jaulado (o escopo é a raiz do workspace — amplie-a conscientemente se precisar).
⚠️ No modo administrador, qualquer pessoa que obtenha os tokens necessários poderá executar ações com os privilégios do processo no computador.
Recomendação: rode o modo admin em um usuário dedicado do sistema ou VM, e exponha o HTTP apenas atrás de VPN/Cloudflare Access — nunca por uma URL pública permanente.
2. Instalação
Requer Node.js 22+.
git clone https://github.com/LMPrado-DZ23/universal-ai-bridge.git
cd universal-ai-bridge
npm install
npm run buildNo Windows, um atalho faz install + build + gera o .env com token criptográfico:
powershell -ExecutionPolicy Bypass -File .\setup.ps13. Configuração .env
Copie env.example para .env. O servidor carrega o .env automaticamente
(via process.loadEnvFile, nativo do Node 22). Gere um token forte:
node -e "console.log(require('crypto').randomBytes(32).toString('hex'))"Variável | Efeito |
|
|
| Só admin: precisa ser |
| Token Bearer do HTTP. Sem ele, o HTTP não sobe. |
| Porta loopback (padrão 8787). |
| Origins permitidos (CSV) — anti DNS-rebinding. |
| Raiz jaulada. Vazio = |
|
|
|
|
|
|
4. Claude Desktop / Cursor / Gemini CLI (stdio)
Não precisa de túnel. Aponte o cliente para o transporte stdio.
Claude Desktop — claude_desktop_config.json:
{
"mcpServers": {
"universal-ai-bridge": {
"command": "node",
"args": ["C:\\caminho\\para\\universal-ai-bridge\\dist\\index.js", "--transport", "stdio"],
"env": {
"BRIDGE_WORKSPACE": "C:\\caminho\\para\\ai-workspace",
"BRIDGE_ALLOW_SHELL": "true"
}
}
}
}No Linux/macOS use caminhos POSIX (ex.:
/home/voce/universal-ai-bridge/dist/index.js). Gemini CLI: mesma estrutura em~/.gemini/settings.jsonsobmcpServers.
5. ChatGPT / Claude.ai no navegador (HTTP + túnel)
O navegador só conecta em MCP remoto (HTTPS).
npm run start:httpEscuta só em http://127.0.0.1:8787/mcp. Exponha com cloudflared:
cloudflared tunnel --url http://127.0.0.1:8787O cloudflared devolve uma URL https://...trycloudflare.com. Acrescente esse host
em BRIDGE_ALLOWED_ORIGINS e reinicie. O endpoint MCP é https://.../mcp.
ChatGPT (Settings → Connectors / modo desenvolvedor): adicione conector MCP com a URL
/mcpe headerAuthorization: Bearer <BRIDGE_TOKEN>.Claude.ai (Settings → Connectors → custom): mesma URL e header.
Cole o conteúdo de
SKILL.mdnas instruções do GPT/projeto.
Túnel público temporário serve para teste. Para uso permanente, prefira Cloudflare Access / VPN.
6. Terminal e tarefas longas
Disponível quando shell_enabled: true.
Comando curto:
run_commandexecuta e espera terminar.Tarefa longa / streaming:
run_jobretorna umjob_id;job_outputdevolve a saída incremental (passe os cursores retornados para acompanhar em tempo real).Interativo:
job_writeenvia texto ao stdin do processo.Cancelamento:
job_cancelencerra o job e toda a árvore de processos-filho (taskkill /Tno Windows, kill de grupo no POSIX).
Só binários da allowlist (config/policy.json) rodam; encadeamento e
redirecionamento (&& | ; > <) são bloqueados.
run_command/run_jobnão são uma sandbox. Rodam com os privilégios do processo; binários capazes de executar código (node, python) podem alcançar caminhos fora do workspace. Para isolamento real, use usuário/VM dedicados.
7. Docker (modo admin)
Bloqueado no modo safe. No admin, com BRIDGE_ALLOW_DOCKER=true, a ferramenta
docker roda docker <args> como job (ex.: docker build -t app .).
Acesso ao Docker do host costuma equivaler a root. Prefira Docker rootless ou um daemon/VM separada.
8. Tokens
O token do HTTP fica em
BRIDGE_TOKEN(no.env, que é git-ignored).Comparação em tempo constante (
timingSafeEqual); nunca é logado.Rotação: gere um novo token, atualize o
.env, reinicie o servidor e o conector. Sessões antigas param de valer.Nunca compartilhe o token nem o cole em páginas/repos.
9. Logs / auditoria
Auditoria append-only em
audit/audit-AAAA-MM-DD.jsonl.Registra ferramenta, decisão (allow/deny/executed/…), metadados e resultado — nunca conteúdo integral de arquivos nem segredos.
Falha de escrita do log não derruba a operação (é silenciosa).
10. Desligamento de emergência
Feche o processo do servidor (
Ctrl+C, ou encerre a janela/serviço).Ao receber
SIGINT/SIGTERM, o servidor mata todos os jobs (árvore de processos) e fecha as sessões HTTP antes de sair.Corte imediato do acesso remoto: pare o
cloudflared(o túnel some).Revogação: troque o
BRIDGE_TOKENe reinicie.
11. Recuperação após erro
Erros de rede/desconexão no HTTP são tratados e não derrubam o processo.
Sessões HTTP ociosas expiram (30 min) e são limpas automaticamente.
Rejeições não tratadas são apenas logadas em stderr.
Se um job travar, use
job_cancel; se o servidor cair, basta reiniciar (npm run start:httpou o cliente stdio) — o estado vive no disco (workspace).
12. Riscos de acesso total
Dar a uma IA acesso ao seu computador é poderoso e perigoso:
No modo admin, quem tiver o token pode agir com os privilégios do processo.
run_command/Docker não isolam o host.Um prompt malicioso ou uma sessão de navegador roubada pode disparar ações.
Mitigações: mantenha o modo safe por padrão; use aprovação local; rode admin
em usuário/VM dedicados; exponha só atrás de VPN/Access; gire tokens; revise o
audit/.
13. Multiplataforma
Windows: suportado (setup.ps1,
taskkill /Tpara matar árvore de processos).Linux / macOS: suportado (kill de grupo de processos via
detached). Use caminhos POSIX no.enve nas configs dos clientes; o token pode ser gerado comnode -e "console.log(require('crypto').randomBytes(32).toString('hex'))".Symlinks: a jaula resolve o caminho real em todos os SOs (no Windows, a criação de symlink pode exigir modo desenvolvedor — não afeta a proteção).
14. Ferramentas
Arquivos e busca: get_workspace_info, list_dir, read_file (parcial:
offset/limit/tail), read_multiple_files, get_file_info, write_file,
edit_file (regex / todas ocorrências), make_dir, move_path,
create_project, search_files, search_content (grep).
Terminal e processos: run_command, run_job, job_status, job_output,
job_write, job_cancel, list_processes, kill_process.
Docker (admin): docker.
Comparação com o Desktop Commander
O Desktop Commander é excelente, mas só fala stdio (clientes locais). O Universal AI Bridge cobre o mesmo terreno de arquivos/terminal e vai além:
Universal AI Bridge | Desktop Commander | |
IAs no navegador (ChatGPT/Claude.ai) | ✅ MCP remoto + túnel | ❌ só stdio |
Modos safe/admin + policy + audit + aprovação local | ✅ | parcial |
Instalador 1-clique (Windows) | ✅ | ❌ |
Arquivos (ler parcial, multi, info, editar regex) | ✅ | ✅ |
Busca por nome e conteúdo (grep) | ✅ | ✅ |
Jobs longos/interativos/cancel + processos | ✅ | ✅ |
Fluxo de uso detalhado em SKILL.md. Política em
config/policy.json.
Licença
MIT — veja LICENSE.
Available Tools
12 toolscreate_projectCriar esqueleto de projetoB
Cria uma pasta de projeto com múltiplos arquivos de uma vez. files = { 'caminho': 'conteúdo' }. Sujeito a aprovação.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Nome da pasta do projeto (dentro do workspace) | |
| files | Yes | Mapa caminho→conteúdo, relativo à pasta do projeto | |
| confirm_token | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description must carry the full burden. It discloses that the operation is a creation (mutating) and that it is 'subject to approval', which is helpful. However, it does not explain the confirm_token parameter, what happens if files already exist, whether the operation is overwrite-safe, or what the success response looks like. Significant behavioral gaps remain.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact (two sentences) and front-loads the core purpose. It includes the essential format example and the approval caveat without unnecessary filler. It is appropriately sized for a simple tool, though it omits some critical details that would make it more useful.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (3 parameters, nested object, no output schema), the description is incomplete. It does not explain the approval workflow, the purpose of confirm_token, potential overwrite behavior, or return values. An agent cannot fully understand how to call this tool correctly or what to expect, especially since the absence of an output schema places more burden on the description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 67% (name and files have descriptions, confirm_token does not). The description repeats the files format ('files = { 'caminho': 'conteúdo' }') which adds little beyond the schema's existing description ('Mapa caminho→conteúdo'). It does not explain the confirm_token at all, failing to compensate for the uncovered parameter. The value added over the schema is minimal.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific verb ('Cria' – creates), a resource ('pasta de projeto' – project folder), and a distinctive scope ('múltiplos arquivos de uma vez' – multiple files at once). This differentiates it from siblings like make_dir (single folder) and write_file (single file) without needing their schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for batch project scaffolding ('multiple files at once') and mentions an approval requirement, but it does not explicitly compare with alternatives like make_dir or write_file, nor does it state when NOT to use this tool. The usage context is inferable but not explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
edit_fileEditar arquivo (substituição)B
Substitui a primeira ocorrência exata de old_text por new_text num arquivo existente. Sujeito a aprovação.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| is_regex | No | Tratar old_text como expressão regular | |
| new_text | Yes | Novo trecho | |
| old_text | Yes | Trecho exato (ou regex, se is_regex) a substituir | |
| replace_all | No | Substituir todas as ocorrências | |
| confirm_token | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral burden and does add useful context: it only affects the first exact occurrence, only works on existing files, and is subject to approval. But it omits concrete behavioral details such as what happens when old_text is not found, how approval is granted, or how is_regex and replace_all alter behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded: the first sentence explains the core operation precisely, and the second sentence adds an important approval constraint. Every sentence earns its place with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutable file-editing tool with six parameters, no annotations, and no output schema, this description is too thin. It leaves out guidance on confirm_token, regex mode, replace_all behavior, failure cases, and when to prefer this over write_file, making the definition incomplete for reliable autonomous invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 67%, and the description clarifies old_text/new_text semantics ('exact first occurrence') and that the target file must already exist. However, it adds nothing about path expectations or confirm_token, which has no schema description, so the parameter guidance is only partially complete.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('Substitui a primeira ocorrência exata de old_text por new_text') on a specific resource ('num arquivo existente'), which is clear and goes well beyond the tool name. It does not explicitly name or contrast sibling tools like write_file, so it slightly misses the top score for sibling differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage context is implied: it edits an existing file rather than creating or moving one, which hints at when to choose it over write_file or move_path. However, it never directly says when to use this tool versus alternatives, nor does it mention situations like regex replacement or bulk replacement that the schema exposes.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_file_infoInfo de arquivo/pastaA
Metadados de um caminho: tipo, tamanho, datas de criação/modificação.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Caminho relativo ao workspace |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. It does disclose the type of data returned and implies a read-only operation, but it does not mention behavior for nonexistent paths, error conditions, or whether both files and folders are supported (though the title suggests file/pasta).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single concise sentence that front-loads the core concept ('metadados de um caminho') and enumerates the key data fields without filler. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a low-complexity tool with one parameter and no output schema, the description covers the main returned fields. However, it leaves edge-case behavior and exact return format implicit, so it is adequate but not fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, with 'path' already described as relative to the workspace. The description adds no deeper parameter semantics beyond linking the path to metadata, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool returns metadata for a path: type, size, creation/modification dates. This is specific enough to distinguish it from listing or workspace-level tools, though it does not explicitly name sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied: call this when you need metadata about a single path. There is no explicit when-to-use versus alternatives, nor any exclusions such as 'use list_dir for directory contents'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_workspace_infoInformações do workspaceA
Retorna raiz do workspace, modo (safe/admin), aprovação e se shell/docker estão habilitados. Chame primeiro.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. It discloses what information is returned (root, mode, approval, shell/docker enabled) but doesn't describe the return format, whether it makes network calls, or any side effects. For a read-only info tool, the disclosed behavior is adequate but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that lists the key return values and ends with a clear imperative instruction. Every word earns its place; no fluff or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, no-output-schema info tool, the description is nearly complete. It states what is returned and when to call it. The only minor gap is not describing the return format (e.g., JSON structure), but with no output schema, a bit more detail on the response shape could help. Still, the essential information is present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so there is no parameter semantics burden. The description adds value by explaining what the tool returns, which is the relevant semantic content for a parameterless tool. Baseline 4 for zero params is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool returns workspace root, mode (safe/admin), approval status, and whether shell/docker are enabled. It uses a specific verb ('Retorna') and resource ('workspace'), and the 'Chame primeiro' instruction distinguishes it as an initialization/inspection tool. It doesn't explicitly name a sibling alternative, but the sibling list shows this is the only workspace-level info tool, so differentiation is clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says 'Chame primeiro' (call first), which is a clear usage directive. It implies this should be called before other tools to understand workspace context. It doesn't explicitly state when not to use it or name alternatives, but for a zero-parameter info tool, the 'call first' guidance is sufficient context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_dirListar diretórioA
Lista arquivos e pastas de um diretório dentro do workspace.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Caminho relativo ao workspace | . |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full disclosure burden. It states only that it lists files and folders within the workspace, omitting details about recursion, output format, hidden-file handling, or sorting. This is minimal behavioral disclosure for a tool that would benefit from such context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with zero filler. Every word contributes to stating the core action and its workspace scope.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only listing tool with one optional, well-documented parameter, the description covers the essential purpose and workspace constraint. Details like return format and recursion are absent, but they are minor for basic correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter 'path' is fully documented in the schema with a default value and a description ('Caminho relativo ao workspace'), so schema coverage is 100%. The tool description adds no meaning beyond the schema's 'workspace' context, meeting the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Lista') and resource ('arquivos e pastas de um diretório'), clearly identifying the tool as a directory lister. This naturally distinguishes it from siblings like read_file (file content) and get_file_info (metadata), even without naming alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit when-to-use or when-not-to-use guidance is given. The workspace-scoping hint provides context, but the description relies on the agent to infer that this tool is for enumerating directory entries versus alternatives like search_files or read_file.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
make_dirCriar diretórioB
Cria um diretório (e pais) dentro do workspace.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| confirm_token | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It does disclose a key behavior—creating parent directories—and the workspace scope, but it does not explain what happens if the directory already exists, error conditions, or the role of confirm_token. Some behavior is covered, but significant gaps remain.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence with zero waste, front-loading the action and adding one key modifier (parents). Perfectly sized for the content provided.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no annotations, no output schema, and 0% parameter coverage, the description is too thin. It explains what it creates but not when confirm_token is needed, conflict behavior, or any error conditions. Agents may handle simple calls but will likely be uncertain in real-world usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description does not mention either parameter (path or confirm_token). It adds no meaning beyond the schema's type constraints, leaving the optional confirm_token completely unexplained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('cria' = creates) and resource ('diretório'), including a key modifier that parent directories are also created. This clearly distinguishes it from sibling tools like write_file or move_path.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The intended use (creating a directory) is implied by the name and description, but there is no explicit guidance about when to choose this over siblings, no exclusions, and no mention of prerequisites like confirm_token. The usage is implied but not elaborated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
move_pathMover / renomearA
Move ou renomeia um arquivo/pasta dentro do workspace. Sujeito a aprovação.
| Name | Required | Description | Default |
|---|---|---|---|
| to | Yes | ||
| from | Yes | ||
| confirm_token | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral transparency burden. It does disclose a meaningful trait: the operation is subject to approval. However, it omits important behavioral details such as what happens on destination conflicts, whether the source is removed after moving, how approval is granted, and what errors may occur.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a compact two-clause sentence with no filler. It front-loads the action and resource, then adds the approval caveat at the end. Every part earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a mutating tool with no annotations and no output schema, yet the description does not explain the approval flow, the confirm_token parameter, path constraints, or return/error behavior. The core purpose is covered, but an agent would not have enough information to invoke it reliably in non-trivial cases.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate, but it barely does. The from/to roles are inferable from the move/rename wording, yet the description never explains path formatting, required scope, or the purpose of confirm_token, which is especially problematic because the approval caveat hints at it but never connects it to the parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: moving or renaming a file/folder within the workspace. It is clearly differentiated from sibling tools like write_file, edit_file, and make_dir, all of which perform different operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The context is reasonably clear: use this tool when a file/folder needs to be moved or renamed inside the workspace. However, there is no explicit when-to-use vs. when-not-to-use guidance, no mention of alternatives, and no discussion of when the approval requirement activates beyond a brief warning.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_fileLer arquivoA
Lê um arquivo de texto do workspace. Suporta leitura parcial: offset_lines/limit_lines (fatia) ou tail_lines (últimas N linhas) para arquivos grandes.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Caminho relativo ao workspace | |
| tail_lines | No | Retorna as últimas N linhas | |
| limit_lines | No | Máximo de linhas a partir de offset_lines | |
| offset_lines | No | Linha inicial (0-based) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Sem anotações, a descrição carrega o peso do comportamento. Ela revela que a operação é de leitura de texto e explica os modos parciais, mas não detalha codificação, comportamento de erro ou formato de retorno. Não há contradição com anotações.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Duas frases objetivas, sem repetição do que já está no schema e com a informação principal (ler arquivo) posicionada primeiro. Nenhuma palavra desperdiçada.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Para uma ferramenta simples de leitura, a descrição cobre o essencial: recurso, parâmetros e caso de uso de arquivos grandes. A ausência de detalhes sobre retorno ou erros é aceitável, pois a operação é direta e o schema já documenta todos os parâmetros.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
O schema já cobre 100% dos parâmetros, mas a descrição agrupa offset_lines/limit_lines e tail_lines em modos de uso (fatia vs últimas linhas), adicionando significado relacional que auxilia o agente a escolher a combinação correta.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
A descrição usa o verbo 'Lê' e o recurso 'arquivo de texto', definindo claramente a operação. A menção a leitura parcial também ajuda a distingui-la de read_multiple_files e das ferramentas de busca.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
A descrição fornece contexto de uso claro para arquivos grandes, citando os modos de leitura parcial. Não menciona explicitamente alternativas como read_multiple_files, mas o escopo 'um arquivo' já fica implícito pelo nome e descrição.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_multiple_filesLer vários arquivosA
Lê vários arquivos de texto do workspace de uma vez.
| Name | Required | Description | Default |
|---|---|---|---|
| paths | Yes | Caminhos relativos ao workspace |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must carry the behavioral burden, and it does clearly indicate a read-only batch operation on workspace text files. However, it does not disclose behavior for missing paths, binary files, size limits, or error handling, and there is no output schema to clarify the return shape.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence conveys the core action, target, and scope with no filler. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple, with one well-documented parameter and no nested schema, so the description is mostly adequate. Still, because there is no output schema, the description could have clarified what the tool returns, and it omits practical constraints like maximum number of paths or handling of missing files.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%: the paths parameter is already described as 'Caminhos relativos ao workspace'. The description adds context that the files are text and multiple, but it does not add meaningful detail beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Lê'), a resource ('vários arquivos de texto do workspace'), and a distinguishing constraint ('de uma vez'). It clearly separates this tool from the sibling read_file, which handles a single file.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'de uma vez' implies batch reading, giving some usage context, but it does not explicitly tell the agent when to prefer this over read_file or mention any exclusions. Usage guidance is present only by implication.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_contentBuscar dentro de arquivos (grep)B
Procura texto/regex dentro dos arquivos do workspace e retorna arquivo:linha: trecho. Ignora .git/node_modules/dist e arquivos binários grandes.
| Name | Required | Description | Default |
|---|---|---|---|
| max | No | ||
| path | No | Diretório base, relativo ao workspace | . |
| query | Yes | Texto ou regex a procurar | |
| is_regex | No | ||
| ignore_case | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden and does add useful behavior: it excludes .git/node_modules/dist and large binary files and states the output format. It does not mention result limits, case-insensitivity, or how regex mode is activated, but those are partly encoded in the schema defaults.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences place the main verb, resource, output format, and key exclusions up front with no filler. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers purpose, return format, and ignored files, which is adequate for a simple search tool. However, it is incomplete for an agent choosing among siblings: it lacks alternative routing, undocumented parameter semantics, and any behavior about limits or matching options beyond the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 40%; max, is_regex, and ignore_case have no schema descriptions, and the tool description does not explain them. It only reinforces regex support and workspace scope, adding little parameter-level meaning beyond the schema's existing query/path descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific action ('Procura texto/regex dentro dos arquivos do workspace') and the concrete return format ('arquivo:linha: trecho'), which is clear. It does not explicitly contrast with sibling search_files, though the title's '(grep)' and 'dentro dos arquivos' make the content-search intent clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No statement explains when to choose this tool over search_files, list_dir, or read_file. The only usage signal is the implicit grep-style purpose; there are no exclusions or alternative tool recommendations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_filesBuscar arquivos por nomeB
Procura arquivos cujo nome contém o termo (recursivo, ignora .git/node_modules/dist).
| Name | Required | Description | Default |
|---|---|---|---|
| max | No | ||
| path | No | Diretório base, relativo ao workspace | . |
| query | Yes | Substring do nome do arquivo (case-insensitive) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden and does disclose important traits: recursion and ignored directories (.git/node_modules/dist). However, it does not describe the output format, behavior on nonexistent paths, whether directories are excluded entirely, or how the max parameter affects results.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single efficient sentence with a parenthetical for constraints. Every element earns its place: the action, the matching rule, the recursive behavior, and the exclusion list. There is no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple 3-parameter tool, the description gives the core invocation context (recursive, ignores common vendored directories), but omits return value shape, error behavior, and explicit differentiation from content search. Given no output schema and no annotations, these omissions leave noticeable gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already documents query as a case-insensitive filename substring and path as a workspace-relative directory, so the description adds little parameter-level meaning. The max parameter has no schema description and the description does not compensate for that gap, though its name and adjacent constraints provide some clarity.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a clear verb ('Procura') and a specific resource ('arquivos cujo nome contém o termo'), and adds recursive scope and an ignore list. It is unambiguous and conceptually distinct from search_content, though it does not explicitly name or contrast sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool over alternatives like list_dir or search_content. The phrase 'por nome' implies filename-based search rather than content search, but the selection logic is left entirely to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
write_fileEscrever arquivoA
Cria ou sobrescreve um arquivo de texto no workspace. Cria diretórios pais. Sujeito a política e aprovação.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Caminho relativo ao workspace | |
| content | Yes | Conteúdo completo do arquivo | |
| confirm_token | No | Token da etapa de confirmação |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full behavioral burden and does it well: it discloses destructive overwrite, the parent-directory creation side effect, and the policy/approval gate. This adds context that annotations would otherwise need to supply, though the confirm_token confirmation workflow is left unexplained.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences with the primary action front-loaded first, followed by the side effect and the constraint. Every sentence contributes a distinct fact and there is no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no annotations and no output schema, the description covers the essential operational facts: core action, destructive overwrite, directory side effect, and approval gate. The notable gap is that the confirm_token parameter implies a two-step confirmation workflow the description does not explain.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, placing the baseline at 3, but the description adds genuine semantic value to the path parameter by stating parent directories are auto-created — telling the agent it can supply a path in a non-existent directory. The schema conveys this nowhere.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('cria ou sobrescreve' — creates or overwrites) on a specific resource ('arquivo de texto no workspace'), which makes the tool's purpose unambiguous. The create-or-overwrite semantics immediately distinguish it from the closest sibling edit_file and from read_file.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit when-to-use or when-not-to-use guidance is given. The overwrite-vs-edit contrast with edit_file is only implied, and the note that parent directories are auto-created implies make_dir may be unnecessary, but no sibling is named and no exclusion conditions are stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
12 tool updates
v0.3.0- First observed
create_project - First observed
edit_file - First observed
get_file_info - First observed
get_workspace_info - First observed
list_dir - First observed
make_dir - First observed
move_path - First observed
read_file - First observed
read_multiple_files - First observed
search_content - First observed
search_files - First observed
write_file
TDQS
Scored across 12 tools
Each tool targets a distinct workspace operation: info, listing, reading, metadata, writing, editing, moving, project creation, and searching by name or content. Potential overlaps like read_file vs read_multiple_files are clearly separated by their singular/plural intent.
All tools use snake_case and follow a consistent verb_noun pattern (get_, list_, make_, read_, write_, edit_, move_, create_, search_). Minor variants like read_multiple_files still fit the pattern cleanly.
12 tools is well-scoped for a workspace/file-management server; each tool covers a distinct operation without bloat. The count supports common agent workflows without overwhelming selection.
The set covers create, read, update, move, search, and multi-file project creation, but lacks any delete/remove operation for files or directories, which is a notable gap in file lifecycle coverage. There is also no copy operation, though move and write can approximate some workflows.
Maintenance
Related MCP Connectors
- OctopadOAuthapp.octopad
The back-office workspace for your team's AIs: tasks, knowledge and context shared over MCP.
Nifty's MCP server — exposes tasks, projects, messages, and files as tools for AI agents.
Personal assistant MCP server with search, execute, packages, jobs, secrets, and integrations.
MCP server for AI agents to plan, verify, and deploy Cloudflare-native apps.
Related MCP Servers
- AlicenseNot gradedqualityAmaintenanceMCP server that gives any LLM a managed Docker workspace with live browser, terminal, code execution, document skills, and autonomous sub-agents.1,595 npm123MIT
- AlicenseAqualityBmaintenanceSelf-hosted MCP server that gives AI assistants a real Linux development environment: file editing, shell commands, tmux terminals, and browser screenshots, with bounded access through a project registry and write gates.39MIT
- AlicenseNot gradedqualityAmaintenanceEnables AI clients to securely operate isolated coding workspaces with file, command, Git, and deployment tools via authenticated remote MCP.9MIT
- AlicenseNot gradedqualityBmaintenanceGives any MCP-compatible AI chat or agent a safe, model-neutral coding runtime with file read/search, structured multi-file patches, command execution, interactive sessions, and git operations, all confined to a single workspace and gated by permission modes.Apache 2.0