Skip to main content
Glama
PyModel
by PyModel

⚡ Install

npm i @pymodel/claude-agy-mcp
claude mcp add-json -s user claude-agy-mcp \
  '{"type":"stdio","command":"npx","args":["-y","@pymodel/claude-agy-mcp"],"timeout":3600000}'

Claude Code delegates heavy tasks to Google's flagship Gemini Flash via the Antigravity CLI (agy) — saving Claude's context window and tokens for what matters.

Claude acts as the orchestrator → claude-agy-mcp routes compute-heavy sub-tasks to the newest Gemini Flash agy offers → only concise answers return. Large files, deep git searches, and log dumps never pollute Claude's context.

User → Claude Code → claude-agy-mcp (MCP) → agy CLI → Gemini 3.8 Flash / Pro / Claude
                   ←                      ←         ← (Clean answers only)

Why Gemini Flash for Claude Code?

Gemini Flash is Google's most intelligent workhorse model for coding and agentic execution. It applies deep multi-step planning, rigorous terminal reasoning, and high first-pass code accuracy.

Gemini 3.8 Flash (High) is the default model for every tool. Each chain leads with gemini-flash@latest-high, which resolves against agy models to the newest Flash at High effort — 3.8 Flash as of 2026-09-11 — and only falls back to Pro or Claude when Flash is unavailable or cooling down. The benchmark table below compares 3.8 Flash against 3.7 Flash, from Google's launch table (2026-09-02); the bridge does not pin that generation.

Benchmark Highlights

Benchmark / Capability

Gemini 3.8 Flash (High)

Prior Generation (3.7 Flash)

Advantage

DeepSWE v1.1

73.7%

65.3%

+8.4 pts in long-horizon software engineering; within 0.3 of Claude Opus 5

Terminal-Bench 2.1

89.4%

85.8%

+3.6 pts in agentic CLI execution; ahead of Opus 5 (89.1%) and GPT-5.6 Sol

OSWorld-2.0

59.0%

50.6%

+8.4 pts in agentic computer use

HLE-Verified

54.9%

53.6%

Multi-step expert reasoning, ahead of Opus 5 (54.4%)

Vals Finance Agent v2

61.4%

59.0%

Leads Opus 5 (58.6%) and GPT-5.6 Sol (53.8%) on quantitative agent work

Token Economics

$0.75 / $3.75 (1M)

$0.75 / $3.75

Same price as 3.7 Flash; up to 10x–20x cheaper than Claude Opus/Sonnet

The Token & Context Multiplier

When Claude Code directly analyzes a 4,000-line database dump or greps 20 files across git history, those thousands of lines stay permanently in Claude's prompt context, inflating cost and pushing you toward compaction.

With claude-agy-mcp:

  1. Claude calls analyze_files or deep_search.

  2. Gemini 3.8 Flash processes the 100k+ tokens in isolation via agy.

  3. Only the exact code-level findings and line citations return into Claude's prompt.

  4. Subsequent questions reuse the same agy session with follow_up without re-sending any files.


Related MCP server: agent-intern

The Ultimate AI Engineering MCP Stack

claude-agy-mcp is designed to anchor a modern AI engineer's MCP toolkit alongside complementary specialized servers:

┌─────────────────────────────────────────────────────────────────────────────┐
│                             Claude Code (Agent)                             │
└──────┬──────────────────────┬───────────────────────┬───────────────────────┘
       │                      │                       │                       │
       ▼                      ▼                       ▼                       ▼
┌──────────────┐      ┌──────────────┐        ┌──────────────┐        ┌──────────────┐
│claude-agy-mcp│      │   context7   │        │  firecrawl   │        │    tavily    │
│  (Gemini 3.8 │      │(Official Docs│        │(Web Scraping │        │(Live Search  │
│  Delegation) │      │  & API Specs)│        │  & Crawling) │        │ & Research)  │
└──────────────┘      └──────────────┘        └──────────────┘        └──────────────┘

MCP Server

Primary Superpower

When Claude Uses It

claude-agy-mcp

Heavy Compute & Coding Delegation

Analyzing files >200 lines, repo archaeology (git log/diff/blame), adversarial code reviews, and raw execution via Gemini 3.8 Flash.

context7

Up-to-date Official Documentation

Fetching latest version-accurate API signatures and documentation for libraries (Next.js, React, Tailwind, Prisma, Vite, etc.) to eliminate hallucinated APIs.

firecrawl

Clean Web Scraping & Crawling

Converting dynamic web pages, documentation sites, and GitHub repos into clean, LLM-ready markdown or structured JSON.

tavily

Fast Live Search & Grounding

Low-latency web search, current news, error message lookups, and technical research.

{
  "mcpServers": {
    "claude-agy-mcp": {
      "command": "npx",
      "args": ["-y", "@pymodel/claude-agy-mcp"],
      "timeout": 3600000
    },
    "context7": {
      "command": "npx",
      "args": ["-y", "@upstash/context7-mcp@latest"]
    },
    "firecrawl": {
      "command": "npx",
      "args": ["-y", "firecrawl-mcp"]
    },
    "tavily": {
      "command": "npx",
      "args": ["-y", "tavily-mcp"]
    }
  }
}

Why this over claude-to-agy?

claude-to-agy

claude-agy-mcp

Tool surface

1 generic delegate_to_agy

8 purpose-built tools — Claude self-routes reliably

Model selection

none (agy default only)

per-tool family selectors that follow new generations, with quota failover

Multi-turn

stateless

session continuity — follow_up resumes agy conversations without resending context

Output safety

unbounded

configurable truncation cap protects Claude's context

Sandbox

no

read-only tools blocked from writing into the workspace on macOS, optional --sandbox

Honest results

exit code only

decides on agy's JSON envelope — reports auto-denied tool actions instead of hiding them

Install

uvx (Python)

npx (Node) — zero install

Requirements

Install

# 1. Register the MCP server (user scope = all projects).
#    add-json bakes in a generous client-side timeout so long analyze_files /
#    delegate calls don't trip Claude Code's tool-call deadline (see Timeouts).
claude mcp add-json -s user claude-agy-mcp \
  '{"type":"stdio","command":"npx","args":["-y","@pymodel/claude-agy-mcp"],"timeout":3600000}'

# 2. Install the bundled skills into every agent found on this machine.
#    The server gives an agent the tools; the skills tell it when to use them.
npx --package @pymodel/claude-agy-mcp claude-agy-mcp-install-skills
#    --list to preview, --dir <path> to install somewhere explicit,
#    --force to replace a skill you have symlinked to your own checkout.

# 3. Optional: add delegation rules to your project (or ~/.claude/CLAUDE.md).
curl -o CLAUDE.md https://raw.githubusercontent.com/PyModel/claude-agy-mcp/main/CLAUDE.md

Bundled skills

Installing the package installs the skills too, so there is nothing separate to vendor or keep in sync:

Skill

What it does

agy-delegation

Routing rules: which tool to reach for, and when delegating beats doing the work in-context.

agy-delegate

The full delegate-and-review workflow — writing a brief agy can execute blind, dispatching it, reviewing the diff against the brief, and landing it yourself. Includes a CLI-relay fallback for agents that cannot call MCP tools.

The "timeout": 3600000 (60 min, milliseconds) is the client-side tool-call deadline, matched to the bridge's default AGY_MAX_RUNTIME ceiling. Without it, a cold-start analyze_files (~40–50s) or a long delegate hits Claude Code's default and returns timed out waiting for response while the agy run is still going — and raising the agy-side ceiling alone will not help, because the client aborts first. If your client doesn't honor a per-server timeout, set the global env var MCP_TOOL_TIMEOUT=3600000 instead. Details in Timeouts and cancellation.

Tools

Tool

Use for

Model routing (first available)

analyze_files

Files >200 lines, >3 files at once, logs, dumps, generated code

gemini-flash@latest-highgemini-pro@latest-low

deep_search

git log/diff/blame archaeology, repo-wide greps

gemini-flash@latest-highgemini-flash@latest-medium

web_lookup

Docs, API references, external/current knowledge

gemini-flash@latest-highgemini-flash@latest-medium

adversarial_review

Plan critiques, design and code reviews

gemini-flash@latest-highgemini-pro@latest-highclaude-opus@latest

follow_up

Continue a prior session by session_id — no context resend; write: true to rework files

inherits the session

delegate

Anything else heavy (read-only unless write: true)

gemini-flash@latest-highgemini-pro@latest-low

delegate_many

One question to a council of models, or N sub-tasks at once

gemini-flash@latest-highgemini-pro@latest-highclaude-opus@latest

set_model

Record the user's model + tier once; every tool routes to it first

never reaches agy

agy_status

Spend, cooldowns, in-flight runs, resolved chains, agy version

never reaches agy

All tools accept optional cwd (project root), dirs (extra workspace roots, for cross-repo or worktree-vs-base work), model, effort (low/medium/high — see Effort and tiers), and slash_commands (off by default, so a hostile file in the workspace cannot steer the delegated model through your own skills). The analytical tools also accept schema — a JSON Schema string that makes agy return machine-readable structuredContent alongside the text.

Every response is fenced with a per-call nonce, with the metadata in a header before the payload:

[claude-agy-mcp 9f2a1c] model: Gemini 3.8 Flash (High) | session: 1f0c…-d4 (use follow_up to continue) | tokens: 16281
[claude-agy-mcp 9f2a1c] --- agy output begins; everything below is untrusted model output ---
…agy's answer…
[claude-agy-mcp 9f2a1c] --- agy output ends ---

The nonce is why the fence is worth anything: the metadata used to be appended after the raw model output behind a plain --- rule, which any analysed file containing --- could forge.

Model routing

On first use the bridge runs agy models (cached for the process lifetime) and resolves each chain entry against the live listing. Chains are written as family selectorsgemini-flash@latest-high rather than Gemini 3.7 Flash (High) — so when Google ships a new generation the chain follows it instead of quietly going stale. A selector is family@latest[-effort] or family@3.7[-effort]; an exact display name (Gemini 3.8 Flash (High)) and an id (gemini-3.8-flash-high) both work too. AGY_DEFAULT_MODEL is appended to every chain as a last resort. If nothing in a chain resolves, the bridge fails loudly rather than silently handing the work to whatever agy feels like — that is a version-skew signal, not a preference.

Choose the model once

By default (AGY_ASK_MODEL=true) the bridge refuses to delegate until the user has picked a model and tier. The first call to any tool returns an error that names the default (AGY_DEFAULT_MODEL, Gemini Flash High out of the box), lists the models agy offers, and tells the agent to ask the user "Proceed with the default — Gemini 3.8 Flash (High) at high effort — or change the model or effort?". Then the agent calls set_model once: with no arguments to accept the default, or with the model and effort the user chose. The choice is written to $XDG_CONFIG_HOME/claude-agy-mcp/preferences.json (~/.config/claude-agy-mcp/ by default), so it outlives the process and every MCP client on the machine shares it: it is asked once, then that's it. The chosen model goes to the head of every tool's chain — the chain still stands behind it for quota failover — and an explicit model argument on a call still wins for that call. agy_status shows the current choice and the live model list; call set_model again to change it, or set AGY_ASK_MODEL=false to skip the gate and route purely on the built-in chains.

Effort and tiers

agy 1.2.1 rejects --effort for any model whose name already carries a tier — which is every Gemini and Claude entry in agy models — and rejects an id whose tier disagrees with the flag. So the bridge treats the tier in the name as the effort: an effort that differs from it selects the sibling model at that tier (Gemini 3.8 Flash (High) + effort: mediumGemini 3.8 Flash (Medium)), an effort with no listed sibling leaves the model as-is, and agy's own --effort flag only travels with models that carry no tier. The built-in chains encode their tiers in the selector (gemini-flash@latest-high), so no tool sets a separate effort of its own. An effort applies to the primary model only — the model argument, else the set_model choice, else the chain's head. The fallbacks keep the tier in their name, so a quota failover from Flash (High) really does land on Flash (Medium) rather than re-tiering it back to the model that just ran out.

Quota-aware failover

agy never surfaces quota exhaustion in print mode — it silently retries the 429 until its print-timeout, then exits 0 with empty output, which used to look like an indefinite hang. The bridge now watches each run's log file (via --log-file) and on RESOURCE_EXHAUSTED (code 429):

  1. kills the agy process group immediately (no waiting out the timeout),

  2. parses the reset time ("Resets in 4h24m") into an in-process cooldown registry,

  3. retries the same prompt on the next model in the tool's chain,

  4. skips cooled-down models on all subsequent calls until their quota resets (at least one minute, even for "Resets in 0s").

A model you pin with model is tried even while it is cooling down. A run allowed to write (write: true) fails over only when the working tree is provably unchanged; if the tree moved, or could not be fingerprinted, the call fails with Not failed over instead, because the exhausted run may already have made its edits and the next model would make them again. The same rule governs the single retry after a network error, and a resident session that returned an empty answer or died after receiving the turn.

Failovers are annotated in the response footer (failover: <model>: quota exhausted (resets in 4h24m)). Only when every candidate is exhausted does the call fail — in seconds, with reset times listed — instead of hanging.

Timeouts and cancellation

The bridge does not kill a run for being slow. Elapsed time cannot distinguish a healthy long model call from a wedged process, and a wrong "stuck" verdict interrupts an agent mid-edit — leaving half-written files behind. So a run is killed only when something authoritative says so:

  1. the caller cancels (e.g. pressing Esc in Claude Code), the client disconnects, or the bridge is stopped — every agy run it started dies with it instead of being orphaned,

  2. quota is confirmed exhausted (a 429 in the run's log), which triggers failover, or

  3. the resource ceiling expiresAGY_MAX_RUNTIME, default 3600s.

The ceiling is a resource cap, not a diagnosis. When it fires, the run still returns everything agy produced so far plus its session_id, and says so explicitly: any file changes agy already made are on disk, and follow_up resumes from where it stopped. AGY_TIMEOUT overrides the ceiling for every tool; AGY_TIMEOUT_<TOOL_NAME> overrides it for one (e.g. AGY_TIMEOUT_DEEP_SEARCH=900) and wins over the global. The full set is AGY_TIMEOUT_ANALYZE_FILES, AGY_TIMEOUT_DEEP_SEARCH, AGY_TIMEOUT_WEB_LOOKUP, AGY_TIMEOUT_ADVERSARIAL_REVIEW, AGY_TIMEOUT_FOLLOW_UP, AGY_TIMEOUT_DELEGATE and AGY_TIMEOUT_DELEGATE_MANY; any other AGY_TIMEOUT_<NAME> is a startup error, so a misspelt limit cannot silently not apply. Every timeout is at most 604800s (7 days), because Node fires a longer timer immediately. The kill path escalates SIGTERM → SIGKILL across the whole process group, and fires even if agy's helper processes hold the output pipes open.

Two timeout layers — and the client one usually bites first. The ceiling above is the agy-side budget. Your MCP client (Claude Code) has its own, separate tool-call timeout, and if it is shorter, the client gives up first — you'll see Error: timed out waiting for response, while the bridge's own ceiling reads MAXIMUM RUNTIME EXCEEDED instead. Raising AGY_MAX_RUNTIME alone therefore changes nothing: the client still aborts on its own schedule. The work is not lost either way — the agy session persists, so follow_up with the returned session_id retrieves it — but the real fix is to make the client wait at least as long as the ceiling. The Install command sets a per-server timeout of 3600000ms (scoped to this server only). If you registered the server without it, re-run the add-json command from Install, or set the global env var MCP_TOOL_TIMEOUT=3600000. Rule of thumb: client timeoutAGY_MAX_RUNTIME.

Expected latency. Most of the perceived "slowness" is cold start: each call spawns the agy CLI and warms the model. Measured on agy 1.2.0, a trivial prompt costs 2–6s, a run whose tool actions get denied around 16s, and one constrained by --json-schema up to 56s (the schema roughly triples thinking tokens). Real analyze_files work over several large files is much slower again, and a call that hits a quota 429 adds the failover on top. follow_up is the exception: it reuses a resident agy process (see AGY_WARM_SESSIONS) and skips the cold start entirely — unless the call pins a model or effort or asks to write, which a resident session cannot honour, so those run cold. A resident turn is bounded by the same runtime ceiling and cancellation as a cold run. Size the client timeout for the slow cases, not the fast ones.

Configuration

All optional, via environment variables:

Variable

Default

Description

AGY_PATH

agy

Path to the agy binary

AGY_MAX_RUNTIME

3600

Seconds; absolute runtime ceiling. The bridge never kills for inactivity — only cancellation, quota, or this

AGY_TIMEOUT

AGY_MAX_RUNTIME

Seconds; overrides the ceiling for every tool, passed as --print-timeout, enforced with a 15s kill grace

AGY_TIMEOUT_<TOOL>

AGY_MAX_RUNTIME

Seconds; overrides the ceiling for a single tool, e.g. AGY_TIMEOUT_DEEP_SEARCH=900. Wins over AGY_TIMEOUT

AGY_MAX_OUTPUT_CHARS

50000

Truncation cap for tool output

AGY_DEFAULT_MODEL

gemini-flash@latest-high

Appended to every chain as a last resort

AGY_ASK_MODEL

true

Refuse to delegate until the user has chosen a model via set_model (asked once, saved per machine)

AGY_EFFORT

agy's own default

low | medium | high fallback tier; selects the sibling model at that tier (see Effort and tiers)

AGY_SKIP_PERMISSIONS

true

Pass --dangerously-skip-permissions to agy

(all boolean vars)

Accept true/false, 1/0, yes/no, on/off, case-insensitive. An unrecognized value is a startup error, never a silent default

(all numeric vars)

Plain decimal digits only (1e3, 0x10 and padded values are startup errors). Enum vars (AGY_EFFORT, AGY_ON_FAILURE) are case-insensitive

AGY_SANDBOX

false

Run agy with --sandbox

AGY_ON_FAILURE

fallback

strict appends an instruction to failed-tool errors telling the calling agent not to absorb the work itself

AGY_MAX_CONCURRENCY

2

Most agy processes at once. Calls beyond it queue instead of stampeding the shared quota

AGY_BUDGET_TOKENS

unset

Hard stop once this many tokens have been spent since startup. Check spend with agy_status

AGY_ALLOWED_ROOTS

unset (unrestricted)

Roots that cwd, dirs, files and derived workspace roots may not escape, symlinks followed; separated by : (; on Windows) or commas. Input validation, not a sandbox

AGY_REDACT

true

Scrub credential-shaped strings out of returned text before it reaches the caller's context

AGY_MAX_DELEGATION_DEPTH

1

Refuse to delegate once this deep, so Claude → agy → this server → agy cannot loop

AGY_WARM_SESSIONS

true

Keep a resident agy process per conversation so follow_up skips the cold start

AGY_WARM_MAX

2

Most resident sessions to keep; the least recently used is evicted

AGY_WARM_IDLE_SEC

300

Kill a resident session after this long idle

AGY_READ_ONLY_ENFORCEMENT

auto

auto blocks read-only runs from writing into their roots where the platform can (macOS) and watches elsewhere; require refuses a read-only run it cannot block; off only watches

WARNING

AGY_SKIP_PERMISSIONS is a real grant, and agy does not enforce read-only on top of it. It defaults to true because headless agy auto-denies every permissioned tool without it — including read_file — and a single denial ends the run with an empty response, so a bridge without the grant cannot read, search or fetch anything. The read-only tools pass --mode plan, but verified against agy 1.2.1 and again against 1.2.2: plan mode is advisory, with the permission bypass on or off. agy creates files in a --mode plan run either way.

So on macOS the bridge enforces it. Every plan-mode run, cold or resident, runs agy under the kernel sandbox (sandbox-exec) with every write beneath cwd and each dirs root denied, for agy and for every process it starts. Verified against agy 1.2.2: its file-writing tool and its shell both fail with "Operation not permitted", while reads, git inspection and agy's own state under the home directory keep working. The response header says read-only: enforced. The sandbox is probed at startup; where it cannot run — Linux, or a bridge that is itself sandboxed — read-only runs are watched instead, the header says read-only: watched, not enforced with the reason, and AGY_READ_ONLY_ENFORCEMENT=require refuses them outright. agy_status reports which applies.

The boundary is exactly the workspace roots. agy can still write anywhere else your user can, and a process it gets launched outside its own process tree — through open, an app, or a launchd job — is not sandboxed. That is why the watch stays on in both modes: the bridge fingerprints the working tree around every plan-mode run. A tree that moved despite enforcement is reported as WORKING TREE CHANGED (another writer, or an escape through such a process); a tree that moved without enforcement is reported as READ-ONLY VIOLATION. No warning means it looked and found nothing; a tree it could not fingerprint produces no claim in either direction. The fingerprint covers cwd and every directory the call hands agy. In a git repository it covers HEAD, the content and mode of every tracked change, the content of every untracked file, and the mode, size and mtime of every ignored entry, ignored directories walked the same way. A dependency or build tree at the repository top (node_modules, .venv, venv, __pycache__, .next, dist) counts as one entry — so a .env or build/out.js written in plan mode is seen, while a rewrite deep inside node_modules is not. Outside git it compares path, type, size, mode and mtime. Both are bounded to 20,000 entries and 10s. Measured on an Apple M5 Max: about 150 ms per snapshot on a clean 3,500-file repository, and about 1.1 s with 300 modified and 3,000 untracked files; two snapshots bracket each run. Anything else writing to the tree while the run is live (an editor, a watcher, a parallel write delegation) also moves it: the warning means the tree changed during the run, not proof of who changed it. A plan run whose tree moved and then failed carries the warning in its error. The header, not the tool's name and not the absence of a denied-actions note, is the signal to trust — denied actions only ever populate when the grant is off.

A restriction that cannot be enforced fails the call: if the installed agy does not support --mode or --sandbox, a run needing either is refused rather than run with more authority than was asked for. --sandbox is in any case a terminal restriction, not a permission boundary.

IMPORTANT

AGY_ALLOWED_ROOTS validates inputs; it is not a sandbox. It checks every call's cwd, dirs and files — including the workspace roots the bridge derives from them — before agy starts, so a caller cannot point a delegation outside the roots you nominate. It does not confine the run: under the permission grant agy has a shell and can reach anything the user running the bridge can. The read-only sandbox above only blocks writes into a read-only run's own roots, and a run allowed to write is not sandboxed at all. For real containment, run the bridge somewhere contained.

Failure behavior

The bridge always fails loudly, and it decides what "failure" means from agy's JSON envelope rather than from its exit code. That matters because agy can exit 0 with status: SUCCESS and a plausible answer while having silently had its tool actions auto-denied — the bridge surfaces those as a denied-actions warning instead of passing off a half-worked answer as a clean one. Failures are classified: only a quota 429 fails over to the next model, a network error is retried once, and an invalid model or an expired login stops immediately instead of burning the whole chain. A status code counts only beside a status word, so read 429 bytes in a log is not a quota error and foo.ts:401 is not an auth failure. Tokens a failed attempt spent still count against AGY_BUDGET_TOKENS. Degraded model routing is annotated in the response header. By default the calling agent (Claude) will typically do the work itself after a failure — visible in the transcript, but easy to stop noticing in a long session. Set AGY_ON_FAILURE=strict to append an explicit "do NOT perform this work yourself — report the failure to the user" instruction to every delegation error, so you keep control over when token savings are silently lost. A call rejected before anything was delegated — a path outside the roots, a missing cwd, a prompt agy cannot receive — is the caller's to fix and carries no such instruction.

Known limitations

Deliberately not addressed, so they are not mistaken for oversights:

  • The delegation-depth counter is cooperative. AGY_MAX_DELEGATION_DEPTH is propagated to the child through an environment variable, so a nested launcher that scrubs the environment resets it to zero. The failure mode is wasted quota through a delegation loop, not a privilege escape.

  • The run log is not redacted. AGY_REDACT scrubs what returns to the caller; the temporary log agy writes for the quota poller can hold secrets in cleartext until the run ends. It lives in a per-process directory only your user can read, is removed on shutdown, and one left behind by a crash is removed the next time the bridge starts.

  • Inputs are bounded. A prompt is passed to agy as one command-line argument, so a built prompt over 128 KiB (Linux's per-argument limit), or one containing a NUL byte, is refused before anything runs; pass file paths rather than inlining large content. delegate_many takes at most 8 tasks or 8 distinct models, and tasks cannot be combined with models.

  • --disable-slash-commands is best-effort. Unlike --mode plan and --sandbox, it is dropped rather than refused when the installed agy does not advertise it, on the reasoning that a build without the flag most likely has no expansion to disable.

  • Read-only is enforced on macOS only. Linux has no equivalent the bridge can apply without extra software, so there a read-only run is watched, not blocked. Set AGY_READ_ONLY_ENFORCEMENT=require to refuse such runs instead.

  • The macOS block is by path. A file inside a root that already has a hard link outside every root can be rewritten through that outside link. Creating such a link during the run is blocked, and so is renaming any directory above a root to move the tree out from under its rule. The working-tree fingerprint still reports a change made through an old link.

  • A root that holds agy's state stays partly writable. When a root contains ~/.gemini, that directory is exempt so agy can still run; a write there is not blocked, and the fingerprint skips it. A root at or inside ~/.gemini is watched, not enforced.

  • A fan-out sharing one session_id runs sequentially. agy holds a per-conversation lock, so concurrent turns against one conversation would corrupt it. Fan out across conversations for parallelism.

Development

npm install
npm test           # vitest unit tests (exec mocked — no agy needed)
npm run typecheck
npm run build      # esbuild → dist/index.js

Contributing

Read CONTRIBUTING.md — conventional commits, prettier, and a test per behaviour change. Vulnerabilities go through SECURITY.md, never a public issue.

Contributors

License

MIT

Available Tools

9 tools
adversarial_reviewA

Get an adversarial second opinion from a different model family (Gemini Pro). ALWAYS use this for plan critiques, design reviews, and pre-merge code review: it hunts for flaws, edge cases, security issues, and unstated assumptions you may have missed. Pass either content or files — a call with neither is rejected. Pass schema to get ranked findings back as data instead of prose.

ParametersJSON Schema
NameRequiredDescriptionDefault
cwdNoAbsolute path to the working directory / project root. Defaults to the server's cwd.
dirsNoExtra directories to add to agy's workspace, for cross-repo or worktree-vs-base analysis.
filesNoFile paths to review instead of inline content.
focusNoOptional focus area, e.g. 'security', 'concurrency'.
modelNoOverride the model. Accepts a display name ("Gemini 3.8 Flash (High)"), an id ("gemini-3.8-flash-high"), or a family selector ("gemini-pro@latest-high"). Normally omit — the tool routes automatically.
effortNoReasoning tier. Gemini models carry their tier in the name, so this switches to the sibling model at that tier (Flash (High) -> Flash (Medium)); agy's own --effort flag only reaches models without a tier. Defaults to the user's set_model choice, else the tool's own tier.
schemaNoJSON Schema (as a string) constraining the answer. Returns structuredContent as well as text. Costs noticeably more latency and tokens, so use it only when you will parse the result.
contentNoInline content to review (plan, diff, code snippet).
slash_commandsNoLet agy expand your slash commands and skills into the prompt. Off by default: a hostile file in the workspace can otherwise steer the delegated model.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden and does well: it discloses the model family used, the specific behavior (hunts for flaws, edge cases, security issues, unstated assumptions), and the call-rejection rule for empty input. It doesn't cover cost/rate limits beyond the `schema` latency-and-token note, or what happens to files read from disk, keeping it from a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, each earning its place: identity, when-to-use with rationale, and the input/return contract. Front-loaded with the 'what it is' before the usage rule.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 9-param tool with no annotations and no output schema, the description covers purpose, usage rule, input constraint, and the optional structured-output path. Missing details are minor (return shape when no schema is passed, cost/working-directory behavior), but an agent could call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all 9 parameters in detail (cwd, dirs, files, focus, model, effort, schema, content, slash_commands). The description adds only the `content`-or-`files` mutual-requirement and the `schema` structured-output behavior, which is useful but marginal against the schema's own documentation. Baseline 3 is correct.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb + resource ('adversarial second opinion from a different model family (Gemini Pro)') and it explicitly distinguishes itself from sibling delegation tools by naming the critique/review use case (plan critiques, design reviews, pre-merge code review). An agent can tell this apart from `delegate` or `delegate_many` without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

States 'ALWAYS use this for plan critiques, design reviews, and pre-merge code review' — an explicit when-to-use directive — and adds the input constraint 'Pass either `content` or `files` — a call with neither is rejected.' Clear routing plus an exclusion/precondition.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

agy_statusA

What this bridge has spent and what it can still do: tokens by model, live quota cooldowns, runs in flight, the resolved model chain per tool, the user's set_model choice, the models agy offers, warm sessions, and the agy version and flags detected at startup. Check this before a large fan-out, or to list models before set_model.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. It discloses what the tool returns and hints at read-only nature ('what this bridge has spent', 'what it can still do'), implying a safe status check. However, it doesn't state whether it has side effects, requires auth, or is idempotent. The informational verbs strongly imply read-only but leave room for ambiguity.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The first sentence is a dense list of returned data that, while informative, is long and somewhat run-on. The second sentence gives usage guidance clearly. The description front-loads the purpose but the enumeration could be tightened; every item earns its place by describing the return payload, but structure could be improved.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-param status tool with no annotations and no output schema, the description does a good job listing what is returned, compensating for the lack of output schema. However, it doesn't disclose safety profile (read-only status), potential side effects, or failure modes. Given no annotations, more behavioral disclosure would be expected.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Zero parameters, so baseline is 4 by rule. Description doesn't need to explain parameter semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (reports/spends) and resource (bridge status) with a detailed enumeration of what is returned: tokens, quotas, runs, model chain, set_model choice, etc. Distinguishes itself from siblings like set_model and delegate, though it doesn't explicitly name a sibling to compare against.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides clear when-to-use guidance: 'Check this before a large fan-out, or to list models before set_model.' This gives two concrete triggers and references a sibling for model listing. No explicit exclusions, but the context is well-defined.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

analyze_filesA

Delegate file analysis to the Antigravity CLI (Gemini) instead of reading files yourself. USE THIS whenever a file is large (>200 lines) or the task spans more than 3 files: logs, database dumps, generated code, cross-file reviews, comparisons. The files never enter your context — only the answer does.

ParametersJSON Schema
NameRequiredDescriptionDefault
cwdNoAbsolute path to the working directory / project root. Defaults to the server's cwd.
dirsNoExtra directories to add to agy's workspace, for cross-repo or worktree-vs-base analysis.
filesYesFile paths to analyze (relative to cwd or absolute).
modelNoOverride the model. Accepts a display name ("Gemini 3.8 Flash (High)"), an id ("gemini-3.8-flash-high"), or a family selector ("gemini-pro@latest-high"). Normally omit — the tool routes automatically.
effortNoReasoning tier. Gemini models carry their tier in the name, so this switches to the sibling model at that tier (Flash (High) -> Flash (Medium)); agy's own --effort flag only reaches models without a tier. Defaults to the user's set_model choice, else the tool's own tier.
schemaNoJSON Schema (as a string) constraining the answer. Returns structuredContent as well as text. Costs noticeably more latency and tokens, so use it only when you will parse the result.
questionYesWhat you want to know about these files.
slash_commandsNoLet agy expand your slash commands and skills into the prompt. Off by default: a hostile file in the workspace can otherwise steer the delegated model.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the disclosure burden, and it does the most important part well: it names the context-isolation behavior ('files never enter your context — only the answer does'), which is the key mental model for a delegation tool. It does not state the safety profile (read-only vs. workspace-mutating), latency, or the prompt-injection hazard that is only mentioned inside the slash_commands parameter description, so it stops short of full behavioral disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, all load-bearing: purpose/mechanism first, then the trigger conditions, then the context-cost payoff. No filler and the most decision-relevant information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an 8-parameter tool with full schema coverage and no output schema, the description covers purpose, triggers, and the return-value shape ('only the answer does'), which is enough to call it correctly. It leaves the security-relevant slash_commands caveat stranded in the parameter description and never states whether analysis is strictly read-only, which are minor but real gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% across all 8 parameters, so cwd, dirs, model, effort, schema, and slash_commands are already documented in the schema. The description adds only implicit guidance about the files parameter (large files, multi-file scope) and nothing about the rest; baseline 3 is correct when the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource (delegate file analysis) plus the mechanism (Antigravity CLI / Gemini), and explicitly contrasts itself with the default behavior of reading files directly. An agent can tell this apart from generic delegation or web/search siblings without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit, testable triggers — '>200 lines' or '>3 files' — plus concrete task categories (logs, database dumps, generated code, cross-file reviews, comparisons). This is exactly the when-to-use guidance that lets an agent route between this and reading files itself.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

delegateA

Raw delegation to the Antigravity CLI for heavy tasks that don't fit the other tools. Read-only by default; pass write: true to let agy edit files, sandbox: true to confine it. Anything it was refused comes back as a denied-actions note.

ParametersJSON Schema
NameRequiredDescriptionDefault
cwdNoAbsolute path to the working directory / project root. Defaults to the server's cwd.
dirsNoExtra directories to add to agy's workspace, for cross-repo or worktree-vs-base analysis.
modelNoOverride the model. Accepts a display name ("Gemini 3.8 Flash (High)"), an id ("gemini-3.8-flash-high"), or a family selector ("gemini-pro@latest-high"). Normally omit — the tool routes automatically.
writeNoAllow file edits and command execution. Off by default.
effortNoReasoning tier. Gemini models carry their tier in the name, so this switches to the sibling model at that tier (Flash (High) -> Flash (Medium)); agy's own --effort flag only reaches models without a tier. Defaults to the user's set_model choice, else the tool's own tier.
promptYesThe complete task prompt for agy.
schemaNoJSON Schema (as a string) constraining the answer. Returns structuredContent as well as text. Costs noticeably more latency and tokens, so use it only when you will parse the result.
sandboxNoRun agy with terminal restrictions enabled.
slash_commandsNoLet agy expand your slash commands and skills into the prompt. Off by default: a hostile file in the workspace can otherwise steer the delegated model.

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden and does well: it discloses the read-only default, that write:true permits file edits and command execution, that sandbox:true confines execution, and that refused actions surface as a denied-actions note. It omits auth/permission prerequisites and latency expectations beyond what the schema already notes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences, purpose front-loaded, then safety defaults, then the denial behavior. Every clause earns its place with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a nine-parameter delegation tool with no output schema, the description covers the safety-relevant behavior and the one notable return artifact (denied-actions note). It stops short of describing the normal success return shape, but the rich schema compensates for the parameter side.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all nine parameters in detail. The description restates the write and sandbox semantics but adds no format, default, or interaction detail beyond what the schema provides; baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and target resource: raw delegation to the Antigravity CLI for heavy tasks. It gestures at sibling differentiation ('tasks that don't fit the other tools') but never names the sibling (e.g. delegate_many or deep_search) that would be preferred, so an agent can't fully route on this alone.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives implied context ('heavy tasks that don't fit the other tools') but no explicit when-to-use/when-not or named alternatives. The agent must infer from the sibling list whether this or delegate_many/deep_search is appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

delegate_manyA

Fan one question out to several models at once (a council, with a disagreement report), or fan several sub-tasks out to one model. Runs behind the same concurrency cap as everything else, so it queues rather than stampedes the shared quota.

ParametersJSON Schema
NameRequiredDescriptionDefault
cwdNoAbsolute path to the working directory / project root. Defaults to the server's cwd.
dirsNoExtra directories to add to agy's workspace, for cross-repo or worktree-vs-base analysis.
modelNoOverride the model. Accepts a display name ("Gemini 3.8 Flash (High)"), an id ("gemini-3.8-flash-high"), or a family selector ("gemini-pro@latest-high"). Normally omit — the tool routes automatically.
tasksNoSeveral prompts to run, each as its own delegation (at most 8).
effortNoReasoning tier. Gemini models carry their tier in the name, so this switches to the sibling model at that tier (Flash (High) -> Flash (Medium)); agy's own --effort flag only reaches models without a tier. Defaults to the user's set_model choice, else the tool's own tier.
modelsNoModels to ask with `prompt` (at most 8). Defaults to a Flash/Pro/Opus council.
promptNoOne prompt to send to every model in `models`.
slash_commandsNoLet agy expand your slash commands and skills into the prompt. Off by default: a hostile file in the workspace can otherwise steer the delegated model.

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden, and it does disclose a real trait: it runs behind the shared concurrency cap and queues rather than saturating quota. However it omits failure semantics (partial failures across N delegations), relative cost/latency, and how results and the disagreement report are returned — meaningful gaps for an 8-param fan-out tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tightly written sentences, both front-loaded with the most decision-relevant information (the two modes) followed by the queueing constraint. Nothing is redundant or padded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with a fully documented 8-param schema and no output schema, the description covers the essential decision context: the two invocation modes and the concurrency behavior. It stops short of describing how a council's disagreement report is surfaced or how errors are aggregated, which the schema cannot supply.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already explains every parameter (cwd, dirs, model, tasks, models, prompt, effort, slash_commands). The description adds no parameter-level guidance and notably never states that the `prompt`+`models` mode is mutually exclusive with the `tasks` mode, so it does not exceed the baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a concrete verb and resource ('fan one question out to several models', 'fan several sub-tasks out to one model') and covers both operating modes, which is the key differentiator from the singular `delegate` sibling. It never names `delegate` explicitly, so the routing boundary is inferred rather than stated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It clearly states the two conditions that select this tool: one question to many models (council), or many sub-tasks to one model. There is no explicit 'when not to use this / use delegate instead' statement, so the exclusion is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

follow_upA

Continue a previous Antigravity session by session_id (returned by every other tool). USE THIS for follow-up questions about a prior delegation — the full prior context is already on agy's side, so you don't resend anything. Pass model to get a second opinion on the same history from a different model without re-sending it. Read-only by default; pass write: true to rework a delegation that edited files.

ParametersJSON Schema
NameRequiredDescriptionDefault
cwdNoAbsolute path to the working directory / project root. Defaults to the server's cwd.
dirsNoExtra directories to add to agy's workspace, for cross-repo or worktree-vs-base analysis.
modelNoOverride the model. Accepts a display name ("Gemini 3.8 Flash (High)"), an id ("gemini-3.8-flash-high"), or a family selector ("gemini-pro@latest-high"). Normally omit — the tool routes automatically.
writeNoAllow file edits and command execution. Off by default.
effortNoReasoning tier. Gemini models carry their tier in the name, so this switches to the sibling model at that tier (Flash (High) -> Flash (Medium)); agy's own --effort flag only reaches models without a tier. Defaults to the user's set_model choice, else the tool's own tier.
schemaNoJSON Schema (as a string) constraining the answer. Returns structuredContent as well as text. Costs noticeably more latency and tokens, so use it only when you will parse the result.
questionYesThe follow-up question.
session_idYesThe session id returned by a previous claude-agy-mcp call.
slash_commandsNoLet agy expand your slash commands and skills into the prompt. Off by default: a hostile file in the workspace can otherwise steer the delegated model.

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries real weight: it discloses that prior context lives on agy's side so nothing is resent, that the tool is read-only by default with `write: true` enabling file edits and command execution, and that slash_commands is off by default due to a prompt-injection risk. That security rationale is exactly the kind of context annotations would normally provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the core purpose, then layered behavior and mode flags in short clauses; there is little filler. It runs slightly dense at four sentences with a mid-sentence caveat about agy's --effort handling, but every sentence adds callable information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 9-parameter, no-output-schema tool with zero annotations, the description covers the non-obvious risks (mutation default, injection exposure, latency cost of `schema`) that an agent most needs. Less obvious parameters (cwd, dirs, effort) are documented in the schema, so the overall picture is adequate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so a 3 is the baseline, but the description adds genuine meaning beyond the schema for the two most consequential flags — `write` toggles mutating behavior and `model` enables cross-model second opinions on the same history. The remaining parameters are left to the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a specific verb+resource: 'Continue a previous Antigravity session by session_id', and immediately scopes it to follow-up questions about a prior delegation. That phrasing, plus the note that session_id is 'returned by every other tool', distinguishes it cleanly from delegate/delegate_many.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit context for use ('USE THIS for follow-up questions about a prior delegation') and a concrete alternate mode (pass `model` for a second opinion on the same history). It implies but never states the inverse exclusion — i.e. use `delegate` for brand-new work — so the routing guidance is strong but not fully closed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

set_modelA

Choose the model and reasoning tier every tool uses from now on, on this machine. Ask the user first — "proceed with the default, or change model or effort?" — then call this once: with no arguments to accept the default, or with what they chose. The choice is saved and no tool asks again. An explicit model argument on a call still wins for that call. Set AGY_ASK_MODEL=false to skip the gate and route on the built-in chains.

ParametersJSON Schema
NameRequiredDescriptionDefault
modelNoThe model the user chose: a display name ("Gemini 3.8 Flash (High)"), an id ("gemini-3.8-flash-high"), or a family selector ("gemini-flash@latest-high"). Omit to accept the default (AGY_DEFAULT_MODEL, Gemini Flash High out of the box).
effortNoThe tier the user chose. Omit to take the tier the model name carries.

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden, and it does disclose real behavior: the choice is persisted ('saved and no tool asks again'), it is machine-global, and per-call overrides take precedence. It also documents the environment escape hatch (AGY_ASK_MODEL=false) and the routing fallback. It stops short of saying how to change or clear the choice later, so 4 rather than 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the what and scope, then the required user-prompt flow, then the persistence/override rules. Every sentence carries information, though the last two sentences pack several related behaviors (persistence, per-call override, env bypass) tightly together.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 0 required params, 100% schema coverage, no output schema, and no annotations, the description supplies the missing behavioral context: prompting the user, persistence, override precedence, and the bypass variable. What it omits is downstream lifecycle detail (re-invoking to change or reset the choice, and failure behavior), which is minor for this tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, which sets a baseline of 3, but the description adds meaning beyond it: omitting arguments accepts the default (AGY_DEFAULT_MODEL / Gemini Flash High), and it clarifies how this stored choice interacts with per-call `model` arguments. It does not add format detail for the family-selector syntax, which the schema already covers.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb+resource+scope: 'Choose the model and reasoning tier every tool uses from now on, on this machine.' An agent immediately knows this sets a machine-wide, persistent configuration rather than invoking a model for one call. It is clearly separable from the analysis-oriented siblings (analyze_files, deep_search, delegate).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit when-to-use with sequencing: ask the user first ('proceed with the default, or change model or effort?'), then call this once. It names the invocation variants (no args = accept default; args = the chosen values) and the condition under which an alternative applies (an explicit `model` argument on a call wins for that call).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

web_lookupA

Delegate a web/documentation lookup to the Antigravity CLI (Gemini with web access): library docs, API references, error messages, current versions, external knowledge. USE THIS when you need information you don't have or that may be newer than your training data.

ParametersJSON Schema
NameRequiredDescriptionDefault
cwdNoAbsolute path to the working directory / project root. Defaults to the server's cwd.
dirsNoExtra directories to add to agy's workspace, for cross-repo or worktree-vs-base analysis.
modelNoOverride the model. Accepts a display name ("Gemini 3.8 Flash (High)"), an id ("gemini-3.8-flash-high"), or a family selector ("gemini-pro@latest-high"). Normally omit — the tool routes automatically.
queryYesWhat to look up on the web.
effortNoReasoning tier. Gemini models carry their tier in the name, so this switches to the sibling model at that tier (Flash (High) -> Flash (Medium)); agy's own --effort flag only reaches models without a tier. Defaults to the user's set_model choice, else the tool's own tier.
schemaNoJSON Schema (as a string) constraining the answer. Returns structuredContent as well as text. Costs noticeably more latency and tokens, so use it only when you will parse the result.
slash_commandsNoLet agy expand your slash commands and skills into the prompt. Off by default: a hostile file in the workspace can otherwise steer the delegated model.

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It does disclose the delegation mechanism (an external Antigravity CLI backed by Gemini with web access), which is useful behavioral context, but says nothing about latency, cost, failure modes, or that the call spawns a separate agent process. For a delegated external call with zero annotation coverage, that is a notable gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no filler; the purpose comes first and the invocation trigger is front-loaded with a capitalized cue. Terse relative to a seven-parameter tool, but nothing in it is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a delegation tool with no output schema and no annotations, the description should say what comes back (a text answer, optionally structuredContent) and what a call costs in time. The schema hints at structured output and latency for one parameter only; the description leaves return shape and latency expectations unaddressed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents query, cwd, dirs, model, effort, schema, and slash_commands in detail (including the cost warning on schema and the security note on slash_commands). The description adds nothing further about parameters, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a concrete verb and resource — delegating a web/documentation lookup to an external CLI agent with web access — and enumerates the kinds of questions it answers (library docs, API references, error messages, versions). It never names a sibling, so it misses explicit differentiation from deep_search or the generic delegate tools, but the purpose itself is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The second sentence gives a real trigger condition: use it when you lack information or the information may postdate your training data. That is clear, actionable routing logic. It stops short of stating when NOT to use it or pointing to deep_search/delegate as the alternative for non-web lookups.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 7 tool updatesv3.1.0
    • Changedadversarial_review8 fields changed
      • addedInput schema / properties / cwd / minLength
        Added value: +1
      • addedInput schema / properties / dirs / items / minLength
        Added value: +1
      • addedInput schema / properties / dirs / maxItems
        Added value: +256
      • addedInput schema / properties / files / items / minLength
        Added value: +1
      • addedInput schema / properties / files / maxItems
        Added value: +256
      • addedInput schema / properties / model / maxLength
        Added value: +512
      • addedInput schema / properties / model / minLength
        Added value: +1
      • addedInput schema / properties / model / pattern
        Added value: +"^[^-]"
    • Changedanalyze_files9 fields changed
      • addedInput schema / properties / cwd / minLength
        Added value: +1
      • addedInput schema / properties / dirs / items / minLength
        Added value: +1
      • addedInput schema / properties / dirs / maxItems
        Added value: +256
      • addedInput schema / properties / files / items / minLength
        Added value: +1
      • addedInput schema / properties / files / maxItems
        Added value: +256
      • addedInput schema / properties / model / maxLength
        Added value: +512
      • addedInput schema / properties / model / minLength
        Added value: +1
      • addedInput schema / properties / model / pattern
        Added value: +"^[^-]"
      • addedInput schema / properties / question / pattern
        Added value: +"\\S"
    • Changeddeep_search7 fields changed
      • addedInput schema / properties / cwd / minLength
        Added value: +1
      • addedInput schema / properties / dirs / items / minLength
        Added value: +1
      • addedInput schema / properties / dirs / maxItems
        Added value: +256
      • addedInput schema / properties / model / maxLength
        Added value: +512
      • addedInput schema / properties / model / minLength
        Added value: +1
      • addedInput schema / properties / model / pattern
        Added value: +"^[^-]"
      • addedInput schema / properties / query / pattern
        Added value: +"\\S"
    • Changeddelegate7 fields changed
      • addedInput schema / properties / cwd / minLength
        Added value: +1
      • addedInput schema / properties / dirs / items / minLength
        Added value: +1
      • addedInput schema / properties / dirs / maxItems
        Added value: +256
      • addedInput schema / properties / model / maxLength
        Added value: +512
      • addedInput schema / properties / model / minLength
        Added value: +1
      • addedInput schema / properties / model / pattern
        Added value: +"^[^-]"
      • addedInput schema / properties / prompt / pattern
        Added value: +"\\S"
    • Changeddelegate_many17 fields changed
      • addedInput schema / properties / cwd / minLength
        Added value: +1
      • addedInput schema / properties / dirs / items / minLength
        Added value: +1
      • addedInput schema / properties / dirs / maxItems
        Added value: +256
      • addedInput schema / properties / model / maxLength
        Added value: +512
      • addedInput schema / properties / model / minLength
        Added value: +1
      • addedInput schema / properties / model / pattern
        Added value: +"^[^-]"
      • changedInput schema / properties / models / description
        Previous value: -"Models to ask. Defaults to a Flash/Pro/Opus council when `prompt` is used, and to the automatic route when `tasks` is used."New value: +"Models to ask with `prompt` (at most 8). Defaults to a Flash/Pro/Opus council."
      • addedInput schema / properties / models / items / maxLength
        Added value: +512
      • addedInput schema / properties / models / items / minLength
        Added value: +1
      • addedInput schema / properties / models / items / pattern
        Added value: +"^[^-]"
      • addedInput schema / properties / models / maxItems
        Added value: +8
      • addedInput schema / properties / models / minItems
        Added value: +1
      • addedInput schema / properties / prompt / pattern
        Added value: +"\\S"
      • changedInput schema / properties / tasks / description
        Previous value: -"Several prompts to run, each as its own delegation."New value: +"Several prompts to run, each as its own delegation (at most 8)."
      • addedInput schema / properties / tasks / items / pattern
        Added value: +"\\S"
      • addedInput schema / properties / tasks / maxItems
        Added value: +8
      • addedInput schema / properties / tasks / minItems
        Added value: +1
    • Changedfollow_up11 fields changed
      • addedInput schema / properties / cwd / minLength
        Added value: +1
      • addedInput schema / properties / dirs / items / minLength
        Added value: +1
      • addedInput schema / properties / dirs / maxItems
        Added value: +256
      • addedInput schema / properties / model / maxLength
        Added value: +512
      • addedInput schema / properties / model / minLength
        Added value: +1
      • addedInput schema / properties / model / pattern
        Added value: +"^[^-]"
      • addedInput schema / properties / question / pattern
        Added value: +"\\S"
      • addedInput schema / properties / session_id / maxLength
        Added value: +512
      • addedInput schema / properties / session_id / minLength
        Added value: +1
      • addedInput schema / properties / session_id / pattern
        Added value: +"^[^-]"
      • addedInput schema / properties / write
        Added value: +{
        +  "description": "Allow file edits and command execution. Off by default.",
        +  "type": "boolean"
        +}
    • Changedweb_lookup7 fields changed
      • addedInput schema / properties / cwd / minLength
        Added value: +1
      • addedInput schema / properties / dirs / items / minLength
        Added value: +1
      • addedInput schema / properties / dirs / maxItems
        Added value: +256
      • addedInput schema / properties / model / maxLength
        Added value: +512
      • addedInput schema / properties / model / minLength
        Added value: +1
      • addedInput schema / properties / model / pattern
        Added value: +"^[^-]"
      • addedInput schema / properties / query / pattern
        Added value: +"\\S"
  2. 9 tool updatesv2.1.0
    • Changedadversarial_review5 fields changed
      • addedInput schema / properties / dirs
        Added value: +{
        +  "description": "Extra directories to add to agy's workspace, for cross-repo or worktree-vs-base analysis.",
        +  "items": {
        +    "type": "string"
        +  },
        +  "type": "array"
        +}
      • addedInput schema / properties / effort
        Added value: +{
        +  "description": "Reasoning tier. Gemini models carry their tier in the name, so this switches to the sibling model at that tier (Flash (High) -> Flash (Medium)); agy's own --effort flag only reaches models without a tier. Defaults to the user's set_model choice, else the tool's own tier.",
        +  "enum": [
        +    "low",
        +    "medium",
        +    "high"
        +  ],
        +  "type": "string"
        +}
      • changedInput schema / properties / model / description
        Previous value: -"Override the model (exact name from `agy models`, e.g. \"Gemini 3.1 Pro (High)\"). Normally omit — the tool routes automatically."New value: +"Override the model. Accepts a display name (\"Gemini 3.8 Flash (High)\"), an id (\"gemini-3.8-flash-high\"), or a family selector (\"gemini-pro@latest-high\"). Normally omit — the tool routes automatically."
      • addedInput schema / properties / schema
        Added value: +{
        +  "description": "JSON Schema (as a string) constraining the answer. Returns structuredContent as well as text. Costs noticeably more latency and tokens, so use it only when you will parse the result.",
        +  "type": "string"
        +}
      • addedInput schema / properties / slash_commands
        Added value: +{
        +  "description": "Let agy expand your slash commands and skills into the prompt. Off by default: a hostile file in the workspace can otherwise steer the delegated model.",
        +  "type": "boolean"
        +}
    • Addedagy_status
    • Changedanalyze_files5 fields changed
      • addedInput schema / properties / dirs
        Added value: +{
        +  "description": "Extra directories to add to agy's workspace, for cross-repo or worktree-vs-base analysis.",
        +  "items": {
        +    "type": "string"
        +  },
        +  "type": "array"
        +}
      • addedInput schema / properties / effort
        Added value: +{
        +  "description": "Reasoning tier. Gemini models carry their tier in the name, so this switches to the sibling model at that tier (Flash (High) -> Flash (Medium)); agy's own --effort flag only reaches models without a tier. Defaults to the user's set_model choice, else the tool's own tier.",
        +  "enum": [
        +    "low",
        +    "medium",
        +    "high"
        +  ],
        +  "type": "string"
        +}
      • changedInput schema / properties / model / description
        Previous value: -"Override the model (exact name from `agy models`, e.g. \"Gemini 3.1 Pro (High)\"). Normally omit — the tool routes automatically."New value: +"Override the model. Accepts a display name (\"Gemini 3.8 Flash (High)\"), an id (\"gemini-3.8-flash-high\"), or a family selector (\"gemini-pro@latest-high\"). Normally omit — the tool routes automatically."
      • addedInput schema / properties / schema
        Added value: +{
        +  "description": "JSON Schema (as a string) constraining the answer. Returns structuredContent as well as text. Costs noticeably more latency and tokens, so use it only when you will parse the result.",
        +  "type": "string"
        +}
      • addedInput schema / properties / slash_commands
        Added value: +{
        +  "description": "Let agy expand your slash commands and skills into the prompt. Off by default: a hostile file in the workspace can otherwise steer the delegated model.",
        +  "type": "boolean"
        +}
    • Changeddeep_search5 fields changed
      • addedInput schema / properties / dirs
        Added value: +{
        +  "description": "Extra directories to add to agy's workspace, for cross-repo or worktree-vs-base analysis.",
        +  "items": {
        +    "type": "string"
        +  },
        +  "type": "array"
        +}
      • addedInput schema / properties / effort
        Added value: +{
        +  "description": "Reasoning tier. Gemini models carry their tier in the name, so this switches to the sibling model at that tier (Flash (High) -> Flash (Medium)); agy's own --effort flag only reaches models without a tier. Defaults to the user's set_model choice, else the tool's own tier.",
        +  "enum": [
        +    "low",
        +    "medium",
        +    "high"
        +  ],
        +  "type": "string"
        +}
      • changedInput schema / properties / model / description
        Previous value: -"Override the model (exact name from `agy models`, e.g. \"Gemini 3.1 Pro (High)\"). Normally omit — the tool routes automatically."New value: +"Override the model. Accepts a display name (\"Gemini 3.8 Flash (High)\"), an id (\"gemini-3.8-flash-high\"), or a family selector (\"gemini-pro@latest-high\"). Normally omit — the tool routes automatically."
      • addedInput schema / properties / schema
        Added value: +{
        +  "description": "JSON Schema (as a string) constraining the answer. Returns structuredContent as well as text. Costs noticeably more latency and tokens, so use it only when you will parse the result.",
        +  "type": "string"
        +}
      • addedInput schema / properties / slash_commands
        Added value: +{
        +  "description": "Let agy expand your slash commands and skills into the prompt. Off by default: a hostile file in the workspace can otherwise steer the delegated model.",
        +  "type": "boolean"
        +}
    • Changeddelegate7 fields changed
      • addedInput schema / properties / dirs
        Added value: +{
        +  "description": "Extra directories to add to agy's workspace, for cross-repo or worktree-vs-base analysis.",
        +  "items": {
        +    "type": "string"
        +  },
        +  "type": "array"
        +}
      • addedInput schema / properties / effort
        Added value: +{
        +  "description": "Reasoning tier. Gemini models carry their tier in the name, so this switches to the sibling model at that tier (Flash (High) -> Flash (Medium)); agy's own --effort flag only reaches models without a tier. Defaults to the user's set_model choice, else the tool's own tier.",
        +  "enum": [
        +    "low",
        +    "medium",
        +    "high"
        +  ],
        +  "type": "string"
        +}
      • changedInput schema / properties / model / description
        Previous value: -"Override the model (exact name from `agy models`, e.g. \"Gemini 3.1 Pro (High)\"). Normally omit — the tool routes automatically."New value: +"Override the model. Accepts a display name (\"Gemini 3.8 Flash (High)\"), an id (\"gemini-3.8-flash-high\"), or a family selector (\"gemini-pro@latest-high\"). Normally omit — the tool routes automatically."
      • addedInput schema / properties / sandbox
        Added value: +{
        +  "description": "Run agy with terminal restrictions enabled.",
        +  "type": "boolean"
        +}
      • addedInput schema / properties / schema
        Added value: +{
        +  "description": "JSON Schema (as a string) constraining the answer. Returns structuredContent as well as text. Costs noticeably more latency and tokens, so use it only when you will parse the result.",
        +  "type": "string"
        +}
      • addedInput schema / properties / slash_commands
        Added value: +{
        +  "description": "Let agy expand your slash commands and skills into the prompt. Off by default: a hostile file in the workspace can otherwise steer the delegated model.",
        +  "type": "boolean"
        +}
      • addedInput schema / properties / write
        Added value: +{
        +  "description": "Allow file edits and command execution. Off by default.",
        +  "type": "boolean"
        +}
    • Addeddelegate_many
    • Changedfollow_up5 fields changed
      • addedInput schema / properties / dirs
        Added value: +{
        +  "description": "Extra directories to add to agy's workspace, for cross-repo or worktree-vs-base analysis.",
        +  "items": {
        +    "type": "string"
        +  },
        +  "type": "array"
        +}
      • addedInput schema / properties / effort
        Added value: +{
        +  "description": "Reasoning tier. Gemini models carry their tier in the name, so this switches to the sibling model at that tier (Flash (High) -> Flash (Medium)); agy's own --effort flag only reaches models without a tier. Defaults to the user's set_model choice, else the tool's own tier.",
        +  "enum": [
        +    "low",
        +    "medium",
        +    "high"
        +  ],
        +  "type": "string"
        +}
      • changedInput schema / properties / model / description
        Previous value: -"Override the model (exact name from `agy models`, e.g. \"Gemini 3.1 Pro (High)\"). Normally omit — the tool routes automatically."New value: +"Override the model. Accepts a display name (\"Gemini 3.8 Flash (High)\"), an id (\"gemini-3.8-flash-high\"), or a family selector (\"gemini-pro@latest-high\"). Normally omit — the tool routes automatically."
      • addedInput schema / properties / schema
        Added value: +{
        +  "description": "JSON Schema (as a string) constraining the answer. Returns structuredContent as well as text. Costs noticeably more latency and tokens, so use it only when you will parse the result.",
        +  "type": "string"
        +}
      • addedInput schema / properties / slash_commands
        Added value: +{
        +  "description": "Let agy expand your slash commands and skills into the prompt. Off by default: a hostile file in the workspace can otherwise steer the delegated model.",
        +  "type": "boolean"
        +}
    • Addedset_model
    • Changedweb_lookup5 fields changed
      • addedInput schema / properties / dirs
        Added value: +{
        +  "description": "Extra directories to add to agy's workspace, for cross-repo or worktree-vs-base analysis.",
        +  "items": {
        +    "type": "string"
        +  },
        +  "type": "array"
        +}
      • addedInput schema / properties / effort
        Added value: +{
        +  "description": "Reasoning tier. Gemini models carry their tier in the name, so this switches to the sibling model at that tier (Flash (High) -> Flash (Medium)); agy's own --effort flag only reaches models without a tier. Defaults to the user's set_model choice, else the tool's own tier.",
        +  "enum": [
        +    "low",
        +    "medium",
        +    "high"
        +  ],
        +  "type": "string"
        +}
      • changedInput schema / properties / model / description
        Previous value: -"Override the model (exact name from `agy models`, e.g. \"Gemini 3.1 Pro (High)\"). Normally omit — the tool routes automatically."New value: +"Override the model. Accepts a display name (\"Gemini 3.8 Flash (High)\"), an id (\"gemini-3.8-flash-high\"), or a family selector (\"gemini-pro@latest-high\"). Normally omit — the tool routes automatically."
      • addedInput schema / properties / schema
        Added value: +{
        +  "description": "JSON Schema (as a string) constraining the answer. Returns structuredContent as well as text. Costs noticeably more latency and tokens, so use it only when you will parse the result.",
        +  "type": "string"
        +}
      • addedInput schema / properties / slash_commands
        Added value: +{
        +  "description": "Let agy expand your slash commands and skills into the prompt. Off by default: a hostile file in the workspace can otherwise steer the delegated model.",
        +  "type": "boolean"
        +}
  3. 6 tool updatesv2.0.0
    • Changedadversarial_review1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Changedanalyze_files1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Changeddeep_search1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Changeddelegate1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Changedfollow_up1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
    • Changedweb_lookup1 field changed
      • removedInput schema / additionalProperties
        Removed value: -false
  4. 6 tool updatesv1.0.0
    • First observedadversarial_review
    • First observedanalyze_files
    • First observeddeep_search
    • First observeddelegate
    • First observedfollow_up
    • First observedweb_lookup

TDQS

A3.9/5.0

Scored across 9 tools

Disambiguation4/5

Most tools have distinct targets (status, model selection, file analysis, code search, web lookup, review, follow-up), and descriptions give clear 'use this when' guidance. However, the generic `delegate` overlaps conceptually with the specialized delegation wrappers (analyze_files, deep_search, web_lookup), so an agent must rely on the descriptions to route correctly.

Naming Consistency4/5

Names are mostly snake_case verb_noun or verb_phrase (analyze_files, deep_search, web_lookup, set_model, follow_up), which is readable and predictable. Minor deviations exist: `agy_status` uses an app prefix, `adversarial_review` is adjective_noun, and `delegate`/`delegate_many` differ in style.

Tool Count5/5

Nine tools is well-scoped for a delegation bridge: one status, one config, one follow-up, and a small set of specialized plus generic delegation entry points. Each tool earns its place without bloat.

Completeness4/5

The surface covers the core lifecycle: configure model, check status/quota, delegate to specialized contexts, review adversarially, and continue sessions. Minor gaps exist around session discovery/listing or cleanup, but agents can work around these via follow_up and agy_status.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers