Lizard MCP
OfficialLizard MCP lets an MCP client manage Lizard cloud resources, deployments, Git repositories, and sandboxes through bearer-token/OAuth-authenticated tools.
Inspect account, workspaces, projects, regions, billing, workspace limits, and resale pricing.
Create, configure, scale, pause/resume, rename, delete, restart, and redeploy services; provision addons; deploy templates; manage serverless sleep and container ports.
Read logs and metrics; manage secrets, custom domains/DNS, and persistent volumes; apply bulk config-as-code.
Connect/check GitHub deployments and switch a service's deploy branch.
Use Lizard Git: list/create/show/delete repos, browse/read files, commit changes, inspect commits, open/merge pull requests, and view CI runs.
Create and operate sandboxes: execute commands, read/write/list files, pause/resume, snapshot/fork, expose ports, set timeouts, and delete.
Allows connecting a GitHub account, checking GitHub connection status and tracked repositories/branches, and deploying GitHub repositories as Lizard services.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Lizard MCPDeploy the frontend service from the latest commit on main"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Lizard MCP
An MCP server that lets ChatGPT, Claude and other MCP clients deploy and manage apps, run code in Lizard Sandboxes and work with Lizard Git repositories on Lizard (lizard.build).
Connect it once, then ask your assistant to ship a service, read logs, set secrets, scale replicas, attach a domain, run a script in a sandbox or open a pull request — in plain words.
Connect a client
The server speaks Streamable HTTP at POST /mcp, and stdio for clients that
spawn a local process instead (below). A hosted instance
runs at:
https://lizard.build/mcpEvery request carries a bearer token. A client that speaks OAuth gets one
itself — the server advertises where, so there is nothing to paste. Clients
that only send headers use a liz_ API key instead:
lizard keys create my-mcp-keyThe dashboard creates the same thing under Sandboxes → Get started → New API key. Either way the key is shown once.
Claude Code
claude mcp add --transport http lizard https://lizard.build/mcpClaude Code runs the OAuth flow on first use. To skip it and use a key:
claude mcp add --transport http lizard https://lizard.build/mcp \
--header "Authorization: Bearer liz_your_key"Cline
Follow the Cline installation guide to connect the hosted
server with a bearer token. Use Cline's streamableHttp transport, keep tool
approval on, then check the connection with whoami. No local build is needed.
Cursor and other clients configured by JSON
{
"mcpServers": {
"lizard": {
"url": "https://lizard.build/mcp",
"headers": { "Authorization": "Bearer liz_your_key" }
}
}
}ChatGPT
ChatGPT connects to a URL and runs OAuth itself — no key to paste. It needs developer mode and a registered connection; see Publishing to Codex / ChatGPT below.
Against a local server
Run it as described in the next section, then use http://localhost:3000/mcp
in place of the hosted URL.
Check the connection
curl -sS -X POST https://lizard.build/mcp \
-H "Authorization: Bearer liz_your_key" \
-H "Content-Type: application/json" \
-H "Accept: application/json, text/event-stream" \
-d '{"jsonrpc":"2.0","id":1,"method":"tools/list"}'Without a token the same call returns 401 and a WWW-Authenticate header
pointing at the OAuth metadata. That is the server working, not failing.
Related MCP server: PlugLayer MCP Server
Run it
npm install
npm run build
npm startFor development with reload:
npm run devRun it over stdio
npm start serves HTTP. To have a client spawn the server instead, point it at
dist/stdio.js:
{
"mcpServers": {
"lizard": {
"command": "node",
"args": ["/path/to/lizard-mcp/dist/stdio.js"],
"env": { "LIZARD_TOKEN": "liz_your_key" }
}
}
}A spawned process has no browser to run OAuth in, so the token comes from the environment and binds the process to one user. Without it the server still starts and lists its tools — calling one then returns a message asking for a key.
Configuration
Variable | Default | What it does |
|
| Port to listen on (HTTP only) |
|
| The URL clients reach this server on. Sets the OAuth resource identifier, so it must match the real address in production. |
|
| The Lizard API this server talks to |
| — | API key for stdio mode, where there is no OAuth handshake. |
Tools
Area | Tools |
Account |
|
Workspace limits |
|
Services |
|
Deploys |
|
Functions |
|
Templates |
|
Logs and metrics |
|
Secrets |
|
Domains |
|
Volumes |
|
GitHub connection |
|
Lizard Git |
|
Sandboxes |
|
Config as code |
|
Tool names use snake_case (not the MCP spec's permitted dots) to match OpenAI's function-name pattern ^[a-zA-Z0-9_-]{1,64}$, which some ChatGPT/Codex surfaces enforce directly.
Every tool includes a title in both title and annotations.title. Read tools set readOnlyHint: true; all write tools set destructiveHint: true so clients can ask before changing resources. Shell access to app services is unavailable, so the server exposes no service-shell tool. Use sandbox_exec to run commands in Lizard Sandboxes.
Destructive tools — project_delete, workspace_delete, service_delete, secrets_delete, domain_delete, volume_delete, sandbox_delete, sandbox_snapshot_delete, repo_delete, and domain_dns_update with remove — require an explicit confirmation argument, so a client cannot delete anything or run arbitrary commands by accident.
project_delete puts the project's services and databases in trash for 3 days, but deletes its sandboxes, their volumes and snapshots at once.
billing_status is read-only: it shows the plan (Pro at $19/month with $19 of usage included each month, Pro 5x at $99 with $99, Pro 20x at $499 with $499, the trial, prepaid credits until November 1, 2026, or enterprise), the tier and the Billing link. Starting, changing tier, paying for and cancelling Pro happen in the browser. When the account has to pay before it can create something, the tool error gives the platform's sentence with the page to open on its last line, and structuredContent.error carries the code (PAYMENT_REQUIRED), paymentStatus and the links.
What the Lizard CLI has and this server does not
test/parity/cli-coverage.json maps every Lizard CLI command to the tools that cover it, or says why none does. The main gaps, on purpose:
lizard upand other commands that read local files: a remote server never sees them. Deploy from a GitHub or Lizard Git repo instead, or commit files withrepo_commit.API keys (
lizard keys), payments (lizard billingchanges), agent credentials (lizard agents): they handle secrets or money and belong in the browser or a terminal.Lizard Git admin (webhooks, branch rules, collaborators, CI secrets and environments, releases, labels, issues): the Lizard CLI and Lizard SDK cover them.
Interactive tools: sandbox shell, VNC and desktop streams, live log streams.
Bought domains: an API key can read their DNS records but not change them. Changes (domain_dns_update, domain_attach on a bought domain) need a client connected with OAuth.
Lizard Git
repo_*, pr_* and ci_* reach Lizard Git (lizard.build/git) with the caller's own token, as Authorization: Bearer. Lizard Git refuses API keys with scopes. Every commit is made on the server with repo_commit; there is no clone. To deploy a repository, call service_create with repoUrl set to lizard:owner/name. LIZARD_GIT_URL points the server at another Lizard Git (default <PLATFORM_URL>/git).
Sandbox workflow
Lizard (lizard.build) provides Lizard Sandboxes for short-lived code execution. These resources are separate from app services. Start with project_list, then call sandbox_create with the chosen project and confirm: true. Keep the returned sandboxId for later calls.
{"name":"sandbox_create","arguments":{"project":"YOUR_PROJECT_ID","lifetimeMs":300000,"confirm":true}}Use sandbox_write_file to write a script, sandbox_exec to run it, and sandbox_read_file to read its results. Finish with sandbox_delete. Create, execute, write, and delete need the user's approval before the client sets confirm: true. The MCP server does not open a confirmation dialog.
Sandboxes use the interpreter template and size small unless template and size say otherwise, with /workspace as the default path. They expire after five minutes by default; lifetimeMs accepts 60,000–86,400,000 milliseconds (a day), and sandbox_set_timeout changes it later. Expiry or deletion loses all files except those on an attached volume. Creation uses billed cloud resources. Host files, environment variables, and access tokens stay out of the sandbox.
sandbox_pause saves memory, processes and files and stops the sandbox; sandbox_resume continues it. sandbox_snapshot saves a running sandbox to start new ones from (sandbox_create with snapshotId), and sandbox_fork starts live copies. sandbox_expose_port gives a port an HTTPS URL that carries its access token (other clients send it as X-Lizard-Access-Token). Pause, resume and snapshot wait up to two minutes for the platform to finish.
Commands run as root within the sandbox, default to a 60-second timeout, and accept up to 120 seconds. Cancellation, timeout, or an uncertain command request destroys the whole sandbox to stop remote work. The confirm field covers this loss of files. Use a sandbox created for the task; keep needed files elsewhere first. A normal nonzero exit code preserves the sandbox. Access or input rejection does not delete it. The server never retries commands automatically.
Text reads and writes accept up to 64 KiB of UTF-8. Each output stream is capped at 64 KiB and includes a truncation flag. All paths refer to the sandbox. sandbox_show and sandbox_list help check an uncertain result before retrying. sandbox_delete treats a sandbox that is already gone as a successful no-op.
Service and sandbox metadata responses mask connection credentials, environment values and build-log snippets, including create, update, pause and resume responses. Credential query parameters in URLs are masked too. Values inside environment and connection maps become strings (***), including numeric and boolean values; explicit reveal returns the original values and types. For credentials, call service_show or sandbox_show with reveal: true only when the user asks for them. secrets_list also masks values unless reveal: true is set. Port tools return access credentials when the user asks to expose a sandbox port.
The HTTP server handles each call with its caller's Bearer token, including OAuth tokens and API keys. It keeps no shared sandbox handles or global SDK credentials. A disconnected client must reconnect to delete its sandbox; its finite lifetime remains the cleanup backstop.
Auth
The server speaks OAuth 2.1 as an MCP protected resource (RFC 9728). It holds no secrets of its own: every request carries a bearer token, and Lizard decides whether that token is valid. Both OAuth-issued tokens and liz_ API keys work.
Each request builds a fresh server bound to the caller's token, so one process serves many users without sharing state.
Over stdio there is no OAuth and no per-request token — the key comes from the environment and the process serves one user, as described above.
Tests
npm test # unit and MCP transport tests, docs and CLI parity checks
npm run typecheck
npm run build
npm run audit:cli # every Lizard CLI command mapped? (needs the CLI on PATH)npm run audit:live calls every tool against the real platform: it creates a workspace named mcp-audit-<time>, works only inside it, deletes it at the end and writes a report to audit-report.json. It needs LIZARD_TOKEN (an API key with no scopes) and uses billed resources for about half an hour. Pass --only sandbox,volume to run some groups.
To test real sandbox resources, set LIZARD_API_KEY, LIZARD_PROJECT_ID, and LIZARD_LIVE_TESTS=1, then run npm exec -- vitest run test/live/sandboxes.test.ts. The test uses stdio MCP to create a sandbox, run shell and file tools, check timeout cleanup, and delete it. It uses billed resources; it does not deploy the MCP server.
test/manual/mcp-inspector.md covers end-to-end checks against a stub platform and a live one.
Use it as a package
Every new version in package.json is released on main as
@lizard-build/mcp (a GitHub release with the npm pack file attached, see
.github/workflows/release.yml). The package exports getServer(token), which
builds the MCP server for one caller, and setPlatformUrl(url) for a host that
runs it in-process. dragonlabs-platform installs it to serve the tools at
https://lizard.build/mcp: to ship a tool change there, bump the version
here, then point the platform's server/package.json at the new release.
Deployed instance
Since 2026-11 the hosted server is part of the Lizard platform, at
https://lizard.build/mcp: dragonlabs-platform installs this package (see
above) and serves it from server/src/routes/mcp.ts. There is no separate
service to deploy.
The first address, https://employ-woman-g1q2.us-east-1.onlizard.com/mcp,
still works: the platform answers on it with that address as the resource, so
connectors added with it keep their sign-in.
Publishing to Codex / ChatGPT
.codex-plugin/plugin.json is in place. This is a hosted remote MCP server (not
a bundled stdio one), so it's wired via .app.json + a registered connection,
not .mcp.json. That last step needs a human in a real ChatGPT session — it
isn't scriptable:
In ChatGPT: Settings → Security and login → Developer mode (turn it on).
Go to ChatGPT Plugins → + → enter the MCP server URL above → complete the connection.
Copy the resulting
plugin_asdk_app_...ID from the browser URL.Add
.app.jsonat the repo root:{ "app": { "id": "plugin_asdk_app_..." } }Add
"apps": "./.app.json"to.codex-plugin/plugin.json.Test locally via a marketplace entry (
@plugin-creator, or hand-write~/.agents/plugins/marketplace.json), then submit through the plugin submission portal for public review.
License
MIT
Available Tools
89 toolsaddon_createCreate addonADestructiveInspect
Use this when the user wants to provision a managed database or storage addon (Postgres, Redis, or S3) in a Lizard project. Calling this again creates another addon, even with the same name — it does not update an existing one.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | Stable reference key for ${{name.KEY}} templates | |
| type | Yes | ||
| region | Yes | Deployment region code — call region_list first if unsure of valid values, do not guess | |
| project | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and idempotentHint=false, so the safety profile is covered. The description adds real value beyond that by spelling out the concrete consequence — calling again silently creates a duplicate with the same name — which is exactly the failure mode an agent would otherwise hit. It omits cost implications and whether the addon can be removed later.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the trigger condition, and every clause earns its place — including the duplicate-creation warning, which is the highest-value line in the definition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
A destructive, non-idempotent provisioning call with no output schema and 50% param coverage warrants more: how the agent retrieves connection details afterward (secrets_refs? service_show?), what happens on partial failure, and whether duplicates can be cleaned up are all unaddressed. The trigger and duplicate warning are solid, but the post-creation story is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 50%: name and region are documented in-schema (region even includes a 'call region_list first, do not guess' directive), while project is undocumented. The description only restates the type enum values and adds nothing about project scoping or name reuse rules — one sentence on what 'project' accepts would have compensated for the gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb + resource: 'provision a managed database or storage addon (Postgres, Redis, or S3) in a Lizard project.' That clearly separates it from nearby siblings like volume_create and service_create, though it never names those alternatives explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Use this when the user wants to provision...' gives a clear trigger condition, and the second sentence rules out a tempting misuse ('it does not update an existing one'). No named alternative for updating or looking up an existing addon, so it stops short of a full when/when-not map.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
billing_statusGet plan and billing statusARead-onlyIdempotentInspect
Use this when a tool fails with PAYMENT_REQUIRED, or the user asks about their plan, trial or bill. Returns the account's plan (none, pro, payg = old prepaid credits until November 1, 2026, enterprise), the Pro status (trialing, active, past_due, canceled), trial days and trial credits left, this month's credits used of the included $19 and the overage, the next charge, a pending cancel, an unpaid invoice link, and billingUrl. Pro is $19/month, taxes included, with $19 of credits each month. Starting Pro, paying and cancelling happen in the browser at billingUrl; give the user the link. With workspaceId, reads that workspace owner's plan.
| Name | Required | Description | Default |
|---|---|---|---|
| workspaceId | No | Read the plan of this workspace's owner instead of your own |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare a safe read (readOnlyHint/idempotentHint true, destructiveHint false, closed-world), and the description adds substantial context beyond them: mutations (starting Pro, paying, cancelling) must be done by the user in the browser at billingUrl, and the agent should hand over that link. It also explains the deprecated 'payg' value and the $19 pricing model, which no structured field conveys.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The trigger condition is front-loaded, followed by return values, pricing, and the action handoff — a sensible order with no filler sentences. It is somewhat dense, particularly the long enumeration of returned fields inside one sentence, but every clause carries information an agent needs given there is no output schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description carries the burden of describing returns and does so thoroughly: plan enum values, Pro status values, trial days/credits, monthly usage and overage, next charge, pending cancel, unpaid invoice link, and billingUrl. Combined with the annotation-covered safety profile and the explained workspaceId behavior, an agent has everything needed to call and interpret it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the single optional workspaceId is already documented in the schema. The description's 'With workspaceId, reads that workspace owner's plan' restates that meaning without adding new syntax, defaults, or edge cases beyond what the schema provides, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource (returns the account's plan and billing status) and enumerates the fields returned, so an agent knows exactly what it gets. It does not, however, distinguish this from the sibling billing_summary, which an agent could easily confuse with this tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Clear trigger conditions are given: use it when a tool fails with PAYMENT_REQUIRED, or when the user asks about plan, trial or bill. What's missing is the alternative — the sibling billing_summary is never mentioned, so there is no guidance on which of the two to choose.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
billing_summaryGet billing summaryBRead-onlyIdempotentInspect
Use this when the user wants a cost/billing summary for a Lizard workspace, including current usage and live spend.
| Name | Required | Description | Default |
|---|---|---|---|
| workspaceId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false and openWorldHint=false, so safety behavior is fully covered by structured data. The description adds the useful detail that the result reflects live spend and current usage (not cached/invoiced totals), but says nothing about permissions, freshness, or data sources beyond that.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that front-loads the usage trigger before the scope and payload description. No filler, though the trailing 'including current usage and live spend' is slightly loose wording.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only, single-parameter tool with rich annotations, the description covers the essentials of what the call returns. It still omits any mention of the sibling 'billing_status' distinction and any statement about what the summary actually includes (line items, period, currency), which would matter when choosing between the two.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must explain the single workspaceId parameter. It only alludes to it via 'for a Lizard workspace', never stating that workspaceId identifies which workspace to bill or what format the ID takes, so the parameter's meaning is inferred rather than documented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb+resource combination: a cost/billing summary for a workspace, plus what it contains (current usage and live spend). It is clearly distinct from most siblings, but it never distinguishes itself from the adjacent 'billing_status' tool, so an agent cannot disambiguate the two from the text alone.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The opening clause ('Use this when the user wants a cost/billing summary') gives a usable trigger condition. However, there are no exclusions or prerequisites, and the obvious alternative 'billing_status' is never mentioned, leaving the agent to guess which billing tool to pick.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ci_run_listList CI runsBRead-onlyIdempotentInspect
List recent CI runs of a Lizard Git repository (workflows in .lizard/workflows, GitHub Actions syntax), newest first; filter by branch, pull request number or status.
| Name | Required | Description | Default |
|---|---|---|---|
| pr | No | ||
| repo | Yes | Lizard Git repository as "owner/name" (repo_list) | |
| branch | No | ||
| status | No | e.g. queued, running, success, failure, cancelled |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, non-destructive and scoped (openWorldHint=false), so the safety profile is covered. The description usefully adds the sort order and the fact that runs come from .lizard/workflows, but says nothing about result limits, defaults, or pagination behavior for a 'recent' list.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence that packs resource, location, ordering, and filters without filler. The clause about GitHub Actions syntax is slightly tangential but clarifies what 'workflows' means.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only list tool with full annotation coverage and no output schema, the description covers what is being listed and how it is ordered. It omits the size/shape of the result set ('recent' is unbounded) and default behavior when no filters are passed, which an agent needs to reason about the response.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With schema description coverage at 50%, the description does add meaning for the undocumented 'pr' parameter by identifying it as a pull request number, and confirms branch/status as filters. It still gives no format or matching semantics (exact vs. prefix branch match, how many results returned), so it only partially compensates.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('List recent CI runs') plus scope (a Lizard Git repository, workflows under .lizard/workflows, GitHub Actions syntax) and ordering (newest first). The singular/plural split from the sibling ci_run_show is inferable but not explicitly called out.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Filter dimensions (branch, pull request number, status) imply the discovery use case, giving some context for when to call it. However, there is no explicit guidance on when to prefer it over ci_run_show for a single run's details, nor on prerequisites like repo access.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ci_run_showShow CI runARead-onlyIdempotentInspect
Read one CI run of a Lizard Git repository with its jobs and steps. logs: true adds each job's log (the last 64 KiB of each, where failures usually are).
| Name | Required | Description | Default |
|---|---|---|---|
| logs | No | ||
| repo | Yes | Lizard Git repository as "owner/name" (repo_list) | |
| number | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, destructiveHint=false and openWorldHint=false, so behavior beyond that is largely covered. The description still adds real value by disclosing that logs are truncated to 64 KiB per job and where in the log failures tend to appear – a non-obvious cost/quality trait.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two dense sentences with the primary purpose front-loaded and the optional-parameter caveat immediately after. Nothing is padded or repeated from the title.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple 3-parameter read tool with full annotation coverage, the description covers what is needed to invoke it correctly. Without an output schema, it never sketches the returned run/job/step structure, which is the only remaining ambiguity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is only 33%, so the description must compensate and it does for `logs` – explaining exactly what true adds and its truncation limit, which the schema does not. `repo` is documented in the schema (owner/name, pointing at repo_list); `number` is left implicit but is self-evident as a CI run identifier bounded to >=1.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource (read one CI run of a Lizard Git repository) plus the payload scope (its jobs and steps). That implicitly separates it from the sibling ci_run_list, which returns many runs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Clearly establishes the context (fetch a single run, presumably when you already have a run number) and gives a concrete usage rule for the logs flag: set true to pull job logs, which are truncated to the last 64 KiB where failures usually are. It does not name ci_run_list as the way to discover run numbers, so no explicit alternative routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
config_applyApply bulk configADestructiveInspect
Use this when the user wants to apply a bulk, config-as-code style configuration to a Lizard project in one request (multiple services/addons/secrets at once), rather than changing one field at a time. The config body is passed through verbatim and can overwrite or remove existing fields — prefer the narrower service./secrets. tools for single-field changes.
| Name | Required | Description | Default |
|---|---|---|---|
| config | Yes | Arbitrary config:apply request body — passed through verbatim, validated server-side | |
| project | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and idempotentHint=false, but the description adds the concrete consequence: the body 'is passed through verbatim and can overwrite or remove existing fields'. That tells the agent what actually gets destroyed rather than just that the call is destructive. It stops short of covering failure/validation behavior or result shape, so not a full 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no filler. The usage trigger and scope come first, the destructive warning and alternative follow — front-loaded in the order an agent needs to make a decision.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive tool taking an unconstrained nested object with no output schema, the definition covers when-to-use and the overwrite risk, but leaves the agent with no notion of the expected body shape or what the call returns. Adequate for routing, thinner for actually constructing a correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is only 50%: the 'config' object is documented as an arbitrary verbatim body validated server-side, while 'project' has no description at all. The description reinforces the config semantics with the overwrite/removal warning but says nothing about what the config body should contain or what 'project' expects, so it only partially compensates for the coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb and resource ('apply a bulk, config-as-code style configuration to a Lizard project in one request') and explicitly scopes it to multi-resource edits ('multiple services/addons/secrets at once'). It distinguishes itself cleanly from the single-field siblings by naming 'service.*/secrets.* tools', so an agent can route correctly without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives an explicit trigger ('when the user wants to apply a bulk... configuration') and an explicit exclusion with the alternative named ('prefer the narrower service.*/secrets.* tools for single-field changes'). Both the when and the when-not are stated rather than inferred.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
deploy_eventsGet deploy historyARead-onlyIdempotentInspect
Use this when the user wants to see recent deploy/build history and current replica status for a Lizard service.
| Name | Required | Description | Default |
|---|---|---|---|
| project | Yes | ||
| service | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, non-destructive, closed-world, so safety is covered. The description adds genuinely new information by disclosing what is returned (deploy/build history plus current replica status), which matters since there is no output schema. It does not say how far back 'recent' goes or whether results are limited/paginated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with the usage trigger first and the payload second. No filler or repetition of the title.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter read tool with full annotation coverage, it conveys the job and the return content adequately. The missing piece is parameter meaning (what 'project'/'service' identifiers look like) and any notion of result window or size.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and both parameters (project, service) are required but never mentioned. The phrase 'for a Lizard service' vaguely hints at the service param, but project is entirely undocumented, so the description does not compensate for the schema gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('see') and two concrete resources: deploy/build history and replica status for a Lizard service. It is clearly a read operation, distinguishing it implicitly from deploy_redeploy/deploy_restart, though it never names those siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The opening 'Use this when the user wants to see...' gives an explicit trigger condition. There are no when-not conditions or named alternatives, but the positive guidance is clear enough for an agent to route correctly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
deploy_redeployRedeploy serviceADestructiveInspect
Use this when the user wants to trigger a new deployment of an existing Lizard service (rebuild and redeploy current source). Returns immediately once the build is triggered — use deploy_events to check progress. Each call starts another build, even if called again immediately.
| Name | Required | Description | Default |
|---|---|---|---|
| project | Yes | ||
| service | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Adds genuinely non-obvious behavior beyond the annotations: the call returns immediately after the build is triggered (async), and every call starts another build even if repeated immediately – reinforcing the idempotentHint=false and destructiveHint=true declarations rather than contradicting them. It stops short of saying what happens to the currently running instance during the rebuild, which would complete the destructive picture.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences: purpose, return/async semantics, and follow-up tool. Front-loaded with the when-to-use clause and no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The async behavior and progress-check path are covered, but with no output schema the agent is not told what the immediate return contains (build ID? status object?) or how much time to wait before polling. Combined with entirely undocumented parameters, the definition is adequate but leaves meaningful gaps for a mutating deploy tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% for two required parameters, so the description carries the full burden – but it never mentions 'project' or 'service' at all, and gives no hint whether these are names, slugs, or IDs. The parameter names are somewhat self-descriptive, which prevents a 1, but the gap is real.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Uses a specific verb+resource ('trigger a new deployment of an existing Lizard service') and clarifies the scope as 'rebuild and redeploy current source', which meaningfully separates it from a plain restart. It does not explicitly contrast with the sibling deploy_restart, which is the most confusable alternative.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives a clear triggering condition ('when the user wants to trigger a new deployment of an existing Lizard service') and routes the agent to deploy_events for progress tracking. It omits any explicit exclusion or comparison against deploy_restart, so the main ambiguity an agent faces is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
deploy_restartRestart serviceADestructiveInspect
Use this when the user wants to restart a running Lizard service without rebuilding it. Returns immediately. Each call restarts it again, even if called again immediately.
| Name | Required | Description | Default |
|---|---|---|---|
| project | Yes | ||
| service | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and idempotentHint=false. The description adds useful behavior beyond that: it says the call returns immediately and that repeated calls restart the service again, clarifying the non-idempotent runtime effect.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three tight sentences: usage condition first, then immediate-return behavior, then repeated-call semantics. Every sentence adds distinct information with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Annotations cover the destructive and non-idempotent safety profile, and the description covers timing and repeat behavior. However, for a destructive mutation tool it omits parameter explanations, prerequisites, and what 'destructive' means in practice, such as downtime or dropped in-flight requests.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% for two required parameters, project and service. The description provides no meaning for either parameter, so it does not compensate for the missing schema documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: restart a running Lizard service. It also distinguishes the action from rebuild-based deploys by saying 'without rebuilding it', which helps separate it from deploy_redeploy.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives a clear condition for use: when the user wants to restart a running service without rebuilding. It does not explicitly name alternatives such as deploy_redeploy for rebuilds or service_resume for stopped services, so it stops short of full when/when-not guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
domain_attachAttach domainADestructiveInspect
Every app already gets a *.onlizard.com domain automatically on its first deploy (check service_show's domain field before calling this — do not invent or guess a hostname). Only call this tool when the user explicitly wants to attach their own custom domain (pass hostname), or when service_show shows no domain yet (e.g. the service was created with skipInitialDeploy and never deployed) and they want one generated. Calling this again without hostname generates another subdomain rather than returning the existing one. For a domain bought on Lizard (domain_owned_list) or a subdomain of it, the DNS records are set for you; if that would replace records that point elsewhere, the call refuses and lists them, and force: true replaces them. Otherwise the response lists the DNS records the user must add, then domain_verify.
| Name | Required | Description | Default |
|---|---|---|---|
| port | No | ||
| force | No | Move the domain here if it's attached to another of your services; on a bought domain, also replace records that point elsewhere | |
| project | Yes | ||
| service | Yes | ||
| hostname | No | Custom hostname to attach; omit to generate a default subdomain |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Although annotations already flag destructiveHint=true and idempotentHint=false, the description adds real behavioral detail the annotations cannot convey: the refused-and-listed conflict case, force:true as the override, that DNS is auto-configured for Lizard-owned domains but returned as manual records otherwise, and that the call mints a fresh subdomain when repeated without hostname. It also tells the agent what the response contains, which matters because there is no output schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single dense paragraph, but front-loaded with the fact that changes the decision (the domain already exists) before the when-to-call rules, the conflict behavior, and the follow-up step. No filler sentences; every clause carries decision-relevant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive, non-idempotent mutation with no output schema, the description covers the safety-critical cases (refusal, force override, DNS side effects, verification follow-up) and even summarizes response contents. The remaining gap is `port`, which neither description nor schema explains, so an agent cannot tell when to supply it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is only 40%, so the description carries extra burden. It meaningfully explains hostname (custom vs. generated) and force (replace conflicting records), but `port` is completely undocumented anywhere, and project/service are only implied by the required-parameter list. Partial compensation for the coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource (attach a domain) and immediately scopes it against the automatic *.onlizard.com domain that every app already has. It distinguishes itself cleanly from siblings like domain_verify, domain_delete, and domain_dns_update by describing both the custom-hostname and the generate-subdomain modes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit when/when-not: only call when the user explicitly wants a custom domain, or when service_show shows no domain at all, and it tells the agent to read service_show's `domain` field first rather than guessing a hostname. It also names the downstream alternative (domain_verify) for the manual-DNS path and warns that repeat calls without hostname create yet another subdomain instead of returning the existing one.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
domain_deleteDelete domainBDestructiveInspect
Use this when the user wants to remove a custom domain from a Lizard service. This is destructive and requires explicit confirmation.
| Name | Required | Description | Default |
|---|---|---|---|
| confirm | Yes | Must be true to proceed; there is no interactive confirmation in MCP | |
| project | Yes | ||
| service | Yes | ||
| hostname | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and readOnlyHint=false, so the description's "This is destructive" largely restates structured data. It does add one piece of real context: confirmation must be explicit because there is no interactive prompt, reinforcing the confirm param. It says nothing about what happens to DNS records, whether the operation is reversible, or prerequisite verification.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the triggering condition and followed by the safety note. No filler; the only slight redundancy is the destructiveness claim, which annotations already carry.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive 4-required-param tool with no output schema, the description covers intent and the confirmation gate but leaves the three identifier parameters undocumented and doesn't say what the result of a successful delete looks like. Adequate to call safely, incomplete to call precisely.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 25% – just confirm is documented. The description does not explain project, service, or hostname at all, so an agent has no help on whether hostname must be an attached domain, whether project/service accept slugs or IDs, or format expectations. With low coverage the description needed to compensate and does not.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: remove a custom domain from a Lizard service. This clearly separates it from domain_attach, domain_verify, and the domain_*_list siblings. It could be a touch sharper about scope (e.g. that the domain's DNS records go with it), but the core purpose is unmistakable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
"Use this when the user wants to remove a custom domain" gives an explicit triggering intent, which is more than most siblings offer. There is no when-not guidance or named alternative (e.g. detach vs delete), so it stops short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
domain_dns_listList DNS recordsARead-onlyIdempotentInspect
Read the DNS records of a domain bought on Lizard: name (@ for the domain itself), type, value, TTL and MX priority.
| Name | Required | Description | Default |
|---|---|---|---|
| domain | Yes | A domain from domain_owned_list, e.g. example.com |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already declare readOnlyHint=true, destructiveHint=false, and idempotentHint=true. The description adds valuable context beyond annotations by listing the returned record fields (name, type, value, TTL, MX priority) and clarifying that '@' represents the domain itself. It does not mention pagination or error behavior, but for a simple read-only list tool the added return-field detail is useful.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single well-structured sentence that front-loads the tool's action and then lists the returned fields. Every clause earns its place with no wasted text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only tool with full parameter schema coverage and rich annotations, the description is largely complete. It enumerates the returned record fields even though no output schema exists. Minor gaps include no mention of error cases (e.g., domain not owned) or whether results are limited.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the domain parameter is documented as 'A domain from domain_owned_list, e.g. example.com'. The description adds only that the domain must be 'bought on Lizard' and that '@' denotes the domain in record names, which is marginal beyond the schema. Baseline 3 is appropriate when the schema already fully documents the single parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Read the DNS records of a domain bought on Lizard.' It also enumerates the record fields returned, making the tool's purpose clear. It does not explicitly differentiate from the sibling domain_dns_update, but the read-only framing distinguishes it naturally.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by 'Read the DNS records' and by the domain parameter referencing domain_owned_list, but the description never states when to use this tool versus domain_dns_update or domain_verify. No explicit exclusions or alternatives are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
domain_dns_updateChange a DNS recordADestructiveInspect
Change one DNS record of a domain bought on Lizard. set replaces every record with that name and type; add keeps the others (several MX or TXT); remove deletes the records that match name, and type and value when given. Types: A, AAAA, CNAME, ALIAS, MX, TXT, URL301 (redirect), URL (302 redirect), FRAME (masked redirect). To point a name at a Lizard app, use domain_attach instead. Needs a signed-in user: an API key can read records but not change them. Changes reach most resolvers within minutes. Get the user's approval before remove.
| Name | Required | Description | Default |
|---|---|---|---|
| ttl | No | Seconds, default 1800 | |
| name | Yes | @ for the domain itself, a label like api, or a full name like api.example.com | |
| type | No | Required for set and add | |
| value | No | Required for set and add | |
| action | Yes | ||
| domain | Yes | A domain from domain_owned_list | |
| confirm | No | Required for remove | |
| priority | No | MX only, default 10 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds substantial context beyond the annotations: set is a full replacement, remove deletes matching records, propagation usually takes minutes, and user approval should be obtained before remove. This meaningfully expands on destructiveHint=true and idempotentHint=false.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with purpose, then action semantics, type notes, alternative tool, auth, propagation, and approval guidance. Every sentence carries useful information, with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive DNS mutation with eight parameters, the description covers the essential invocation semantics, auth constraints, propagation expectations, and the key alternative tool. The remaining details, such as confirm and TTL, are already documented in the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is high, but the description adds real meaning for the action enum by explaining set/add/remove behavior and clarifies record-matching semantics for remove. It also explains redirect type variants, though TTL and priority are left entirely to the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Change one DNS record of a domain bought on Lizard.' It clearly distinguishes this from domain_attach by saying that pointing a name at a Lizard app should use domain_attach instead.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It explains the three actions explicitly: set replaces matching records, add keeps others, and remove deletes matching records. It also gives the key alternative for Lizard apps and states that a signed-in user is required, with API keys limited to reading.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
domain_owned_listList bought domainsARead-onlyIdempotentInspect
List the domains the user bought on Lizard (lizard.build/domains): domain, status (registered once ready), expiry and whether one points at an app. Needs a signed-in user or an API key with no scopes.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, non-destructive behavior. The description adds valuable context beyond annotations: it requires a signed-in user or API key with no scopes, and it explains return fields including status and whether a domain points at an app.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded. It states the purpose first, then summarizes returned fields and auth requirements without wasting space.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only list tool with no parameters, rich annotations, and no output schema, the description is complete enough. It explains what is listed, what fields are returned, and the authentication needed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and an empty input schema, so there are no parameter semantics to clarify. The baseline for zero parameters is 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'List the domains the user bought on Lizard.' It adds useful scope with returned fields, but it does not explicitly distinguish this from sibling tools like domain_dns_list or domain_attach.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The auth prerequisite is stated, but there is no explicit guidance on when to use this tool versus alternatives such as domain_dns_list, domain_verify, or domain_attach. Usage is implied by 'domains the user bought' rather than spelled out.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
domain_verifyVerify domain DNSCDestructiveIdempotentInspect
Use this when the user wants to verify DNS configuration for a custom domain attached to a Lizard service.
| Name | Required | Description | Default |
|---|---|---|---|
| project | Yes | ||
| service | Yes | ||
| hostname | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare destructiveHint=true and readOnlyHint=false for a tool whose name and description both sound like a passive check, and the description does nothing to explain that mismatch or what state could actually be altered. With annotations present the bar is lower, but this gap is exactly the kind of surprise (a 'verify' that is destructive) an agent needs disclosed, plus there is no mention of required auth or rate limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler or redundancy. It is efficient, though the brevity is partly under-specification rather than discipline given the tool's complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, so the description must explain what verification produces (a pass/fail result? per-record diagnostics?) and it does not. Combined with three fully undocumented parameters and destructive annotations that are never acknowledged, an agent lacks what it needs to call this confidently.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% for all three required parameters, so the description must compensate and it does not — it never mentions project, service, or hostname individually. At best the phrase 'custom domain attached to a service' hints that the parameters identify a project/service/hostname triple, which is marginal value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (verify) and resource (DNS configuration for a custom domain attached to a Lizard service), which is enough to tell it apart from the list/update siblings like domain_dns_list and domain_dns_update. It stops short of saying what 'verify' actually does (check records? trigger re-validation?), so it is clear but not fully pinning down the operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The sentence 'Use this when the user wants to verify DNS configuration' is an explicit trigger condition, which is better than nothing. However, it offers no guidance on when NOT to use it, and does not route the agent to the obvious alternatives (domain_dns_list to inspect records, domain_dns_update to fix them, domain_owned_list to see which domains exist).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
git_checkoutSwitch deploy branchADestructiveInspect
Use this when the user wants to switch which branch a Lizard service deploys from (GitHub or Lizard Git source), and redeploy it on that branch. Returns immediately once the redeploy is triggered. Each call starts another build, even if called again immediately.
| Name | Required | Description | Default |
|---|---|---|---|
| branch | Yes | ||
| project | Yes | ||
| service | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already flag destructiveHint=true and idempotentHint=false, but the description adds substantive context: the call triggers a redeploy as a side effect, returns before the build completes, and that every invocation starts a new build. That concretizes the non-idempotency in operational terms. It still does not say what happens to the old deployment or traffic during the redeploy.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with the trigger condition, then the side effect, then the async-return caveat. Nothing is redundant or padded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With a minimal three-param schema, no output schema, and clear annotations, the description covers the essential call-time facts: what it does, that it redeploys, and that it returns before completion. Only the post-call path (how to observe the resulting build, e.g. deploy_events) and impact on the existing deployment are unstated.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the description never explains project, service, or branch beyond the passing hint that the branch comes from a GitHub or Lizard Git source. Required parameter formats and any branch-name expectations are left entirely to the agent.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (switch the branch a service deploys from) and resource (a Lizard service's deploy branch, GitHub or Lizard Git source), and explicitly disambiguates from a local git checkout by scoping it to deploy configuration. An agent can tell from this alone that it is not a repo/VCS operation like git_status or repo_commit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
"Use this when the user wants to switch which branch a Lizard service deploys from" gives a clear trigger condition. What is missing is an explicit exclusion or sibling pointer — e.g. that plain redeploys on the same branch belong to deploy_redeploy — so the agent must infer the boundary.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
git_connectGet GitHub connect URLARead-onlyIdempotentInspect
Use this when the user wants to connect their GitHub account to Lizard, e.g. to deploy a private GitHub repo. Returns an install URL the user must open in a browser themselves — this cannot complete automatically. Lizard Git repositories need no connection.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish that this is a read-only, non-destructive, idempotent operation. Beyond that, the description adds important behavioral detail: it returns an install URL that the user must open in a browser, and the flow cannot complete automatically. This is exactly the kind of context an annotations-only reading would miss.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, each doing distinct work: trigger condition, return/manual behavior, and exclusion case. The most important operational detail—that the URL must be opened by the user—is front-loaded after the trigger condition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter tool with no output schema, the description supplies the necessary return-value context: an install URL. It also explains the manual browser step and the case where the tool is unnecessary, leaving no meaningful gap for invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes no parameters, so there is no parameter semantics to explain. A baseline of 4 is appropriate; the description correctly does not invent parameter details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action and resource: connecting a GitHub account to Lizard and returning an install URL. It is clearly distinct from repository-operation siblings like git_checkout, git_status, and repo_create, so an agent can identify its role without inspecting schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The opening sentence gives an explicit trigger condition: 'Use this when the user wants to connect their GitHub account to Lizard, e.g. to deploy a private GitHub repo.' It also names a clear when-not condition: 'Lizard Git repositories need no connection.'
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
git_statusGet GitHub connection statusARead-onlyIdempotentInspect
Use this when the user wants to see the account's GitHub connection status and the repo/branch each service in a Lizard project is tracking. For repositories hosted on Lizard Git use repo_list / repo_show.
| Name | Required | Description | Default |
|---|---|---|---|
| project | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, destructiveHint=false and openWorldHint=false, so the safety profile is covered. The description adds useful scope context (it spans account-level GitHub connection state and per-service tracking). It says nothing about what the response contains or whether the call can be slow/expensive against GitHub, and there is no output schema to cover that gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no filler, with the primary trigger front-loaded and the alternative-route note trailing where it belongs. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only status tool with strong annotations and one parameter, the call itself is safe to make. However, an agent cannot predict the shape of the result (connection state vs. per-service repo/branch list) and gets no format hint for the project argument, both of which matter for a status-reporting tool with no output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% for the single required 'project' parameter. The description implies that scope ('each service in a Lizard project') but never states whether the value is a project name, slug, or ID, nor what happens if the project has no GitHub-linked services. Partial compensation only.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states the resource precisely: the account's GitHub connection status plus the repo/branch each service in a Lizard project tracks. That is more specific than the title alone and lets an agent distinguish it from the git/repo siblings. It reads as a return-value statement rather than a crisp verb, so it stops short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit trigger ('Use this when the user wants to see...') plus an alternative route: for Lizard-hosted repos use repo_list / repo_show. That is clear when-to-use and where-else-to-go guidance. It does not state an explicit exclusion (e.g. 'do not use this to check out or connect repos'), so it is not full when/when-not coverage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
logs_tailTail logsARead-onlyIdempotentInspect
Use this when the user wants to see recent log output from a Lizard service or a specific build. Returns a bounded snapshot, not a live stream.
| Name | Required | Description | Default |
|---|---|---|---|
| build | No | Fetch build logs instead of runtime logs | |
| level | No | Filter runtime logs by level | |
| limit | No | ||
| buildId | No | Specific build ID; defaults to the most recent build | |
| project | Yes | ||
| service | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, non-destructive, so the safety profile is covered. The description adds real value beyond that by clarifying the output is a 'bounded snapshot, not a live stream' — an important expectation-setting detail an agent would otherwise have to guess from the paging limit.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, zero waste, with the trigger condition front-loaded and the key caveat second. Nothing is repeated from the title or annotations.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only tool with no output schema, the description covers the trigger and the snapshot nature, but says nothing about log line format, ordering, or what happens when no logs exist. Adequate to call correctly, but an agent must infer the return shape.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 50% schema description coverage, three params (build, level, buildId) are documented in the schema, while project/service are self-evident strings and limit carries default/min/max. The description mentions service and build conceptually but adds no syntax, defaults, or filtering semantics beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource — showing recent log output from a Lizard service or build — which is clearly distinct from siblings like deploy_events or metrics_get. It does not explicitly name a sibling, but the resource is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'Use this when the user wants to see recent log output' gives a concrete trigger condition, and the build qualifier narrows it further. It stops short of naming alternatives (deploy_events, ci_run_show) or exclusion cases, so it's clear context without routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
metrics_getGet metricsARead-onlyIdempotentInspect
Use this when the user wants CPU, memory, or network metrics for a Lizard app or addon over a time range.
| Name | Required | Description | Default |
|---|---|---|---|
| range | No | 24h | |
| project | Yes | ||
| service | No | Omit for project-level live metrics |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, non-destructive and closed-world, so the safety profile is covered. The description adds the metric scope and time-range framing but says nothing about return format, granularity, or rate limits, leaving it adequate rather than rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence that leads with the triggering condition and no wasted words. It could be marginally tighter but is well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only tool with no output schema and thin parameter documentation, the description explains what it fetches and over what window but omits what the response contains and how project/service resolve. Sufficient to invoke, but not fully self-contained.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With only 33% schema description coverage, the description should carry more weight. It does hint at the time-range concept and the app-vs-addon distinction (mapping loosely to project/service), but it doesn't clarify the range enum values, the default, or the required project parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (get metrics) and resource (CPU, memory, network metrics) scoped to a Lizard app or addon over a time range. This clearly separates it from siblings like logs_tail or service_show, though it doesn't explicitly name a competing tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The 'Use this when the user wants...' phrasing gives a clear triggering condition tied to metric types and time range. It stops short of naming alternatives or exclusions (e.g., when to use logs_tail instead), so it lacks full routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pr_createOpen pull requestADestructiveInspect
Open a pull request in a Lizard Git repository from head (a branch, or owner:branch of a fork) into base (default branch if omitted). draft: true opens it as a draft.
| Name | Required | Description | Default |
|---|---|---|---|
| base | No | ||
| body | No | ||
| head | Yes | ||
| repo | Yes | Lizard Git repository as "owner/name" (repo_list) | |
| draft | No | ||
| title | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already flag this as a non-idempotent, destructive write, so the description doesn't need to restate that. It does add value by defining the fork syntax ('owner:branch') and the draft switch, but it omits what happens when a PR already exists for the same head/base — the key risk for a non-idempotent create.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, no filler. The core action and the head→base direction come first, with the draft detail trailing as a secondary note.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a six-parameter create tool with no output schema, the description covers the semantically hard parameters well. A minor gap remains around the failure mode for duplicate PRs and whether the created PR's identifier is returned, but the essentials for a correct call are present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is only 17% (just repo), so the description must compensate — and it does: head accepts a branch or 'owner:branch' of a fork, base defaults to the default branch when omitted, and draft:true creates a draft. Only title and body, which are self-explanatory, are left undocumented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Open a pull request in a Lizard Git repository') and immediately scopes it with the head→base direction. The verb alone separates it from pr_list, pr_show, and pr_merge without needing to name them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It clarifies the head/base relationship and the default for base, which tells the agent how to invoke it, but never says when to use this versus pr_merge or pr_show, nor what precondition (an existing branch with commits) must hold. Usage is implied by the verb rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pr_listList pull requestsBRead-onlyIdempotentInspect
List pull requests of a Lizard Git repository (state open by default; closed, all).
| Name | Required | Description | Default |
|---|---|---|---|
| repo | Yes | Lizard Git repository as "owner/name" (repo_list) | |
| query | No | ||
| state | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, destructiveHint=false and openWorldHint=false, so the safety profile is covered. The description adds one genuinely useful behavior the schema cannot express: that results default to open PRs only unless state is overridden. It says nothing about ordering, result limits, or pagination, which is the main remaining gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single compact sentence with the scope stated first and the filter behavior in a parenthetical. The clipped "closed, all" phrasing is terse to the point of being slightly telegraphic, costing a little clarity for its brevity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description carries some burden for return expectations, and it discloses neither the fields returned per PR nor any ordering/limit behavior. For a straightforward read-only list tool it is minimally sufficient, but an agent cannot predict result size or shape.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 33%: repo is documented in the schema and state's default is clarified in the description, but the `query` parameter is a bare string with no documentation anywhere — the agent cannot tell whether it matches title, body, author, or branch. With coverage this low the description needed to compensate and does not.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb and resource ("List pull requests") scoped to a Lizard Git repository, which separates it from pr_create/pr_show/pr_merge by intent. It stops short of naming those siblings explicitly, so an agent must infer the list-vs-show boundary.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the enumeration tool and the state filter, but there is no explicit when-to-use guidance such as "use pr_show for a single PR" or any note about paging through large result sets. The default-state note is closer to parameter guidance than selection guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pr_mergeMerge pull requestADestructiveInspect
Merge a Lizard Git pull request: method merge (default), squash or rebase; deleteBranch removes the head branch afterwards. The base branch moves, which can start a deploy or CI. Get the user's go-ahead first.
| Name | Required | Description | Default |
|---|---|---|---|
| repo | Yes | Lizard Git repository as "owner/name" (repo_list) | |
| method | No | ||
| number | Yes | ||
| message | No | ||
| deleteBranch | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Adds substantial context beyond annotations: the base branch moves, which can trigger a deploy or CI, and deleteBranch removes the head branch afterward. These side effects are critical for an agent to understand before invoking a destructive, non-idempotent tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tightly written sentences with zero waste. The merge method details are front-loaded, followed by the important CI/deploy warning and user-consent requirement.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the critical destructive side effects and consent requirement well. However, with five parameters and low schema description coverage, it could do more to explain the optional message parameter and confirm the role of repo/number.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 20%, so the description must compensate. It explains the method options and the default, plus the effect of deleteBranch, but it omits meaning for message, number, and repo beyond what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: 'Merge a Lizard Git pull request'. It clearly distinguishes itself from sibling tools like pr_create, pr_list, pr_show, and repo_commit by focusing on the merge action.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear guidance to get the user's go-ahead first, which is important for a destructive operation. It does not explicitly compare against alternatives, but merge is a distinct action and no close sibling overlaps exist.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
project_createCreate projectADestructiveInspect
Use this when the user wants to create a brand-new empty Lizard project to hold services. Calling this again creates another project, even with the same name — it does not update an existing one.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Project name | |
| workspaceId | Yes | Workspace to create the project in |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already flag non-idempotency and destructiveness, but the description adds concrete consequence: calling again creates another project even with the same name. That is useful elaboration beyond the hint, though it doesn't explain the destructiveHint=true profile (a create tool) or what happens to the workspace on failure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences with the triggering condition front-loaded and the duplicate-creation warning immediately after. No filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter, fully described create tool with no output schema, this is nearly sufficient. It would be stronger if it told the agent what is returned (e.g., project ID) for chaining into service_create.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for both parameters, so the schema carries parameter meaning. The description adds only the notion that the project is empty and name may duplicate, not format or scoping detail. Baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('create a brand-new empty Lizard project to hold services') and distinguishes creation from update semantics. It does not name a sibling alternative, but no other create-a-project tool exists, so the differentiation gap is minor.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Use this when the user wants to create a brand-new empty Lizard project' gives a clear triggering condition. It also warns that repeat calls make duplicates rather than updating, which is a when-not-to-use hint, though it doesn't point at a specific alternative tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
project_deleteMove project to trashADestructiveInspect
Delete a project when its owner explicitly asks. Its services and databases stop and stay in trash for 3 days; its sandboxes, their volumes and snapshots are deleted at once and cannot be recovered. Tell the user both parts before asking. Requires the user's confirmation; do not call this to delete only one service.
| Name | Required | Description | Default |
|---|---|---|---|
| confirm | Yes | Set only after the user approves deleting this project | |
| project | Yes | Project name, slug, or ID; use an ID if names are ambiguous |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Even though annotations already flag destructiveHint=true, the description discloses the actual blast radius: services and databases stop and linger in trash for 3 days, while sandboxes, their volumes, and snapshots are destroyed immediately with no recovery. It also prescribes telling the user both parts before asking, which annotations can't express.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four short sentences, front-loaded with the action and its precondition, then the consequences, then the confirmation rule. Nothing repeats the name or title and no sentence is filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive, non-idempotent, closed-world two-parameter tool with no output schema, the description covers selection, preconditions, irreversible consequences, and user-confirmation obligations. Nothing an agent needs in order to call it safely is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so both the project identifier and the confirm const are already documented in the schema. The description reinforces the confirmation gating but adds no new syntax or formatting detail beyond the schema. Baseline 3 applies when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource (delete a project) and immediately scopes it against the tempting wrong target: 'do not call this to delete only one service,' which distinguishes it from service_delete. An agent can pick this over service_delete or workspace_delete from the description alone.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit precondition ('when its owner explicitly asks'), an explicit exclusion ('do not call this to delete only one service'), and a gating requirement ('Requires the user's confirmation'). Both when-to-call and when-not-to-call are stated outright.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
project_listList projectsARead-onlyIdempotentInspect
Use this when the user wants to see their Lizard projects, optionally filtered to one workspace.
| Name | Required | Description | Default |
|---|---|---|---|
| workspaceId | No | Filter to this workspace ID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, destructiveHint=false and openWorldHint=false, so safety is fully covered. The description adds only the optional-workspace scoping note, with nothing about result limits, ordering, or pagination.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One front-loaded sentence with the trigger condition first and the filter scope second; no filler at all.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-required-parameter, read-only list tool with full annotation coverage and no output schema, this is close to sufficient. The only omission is any hint of what a project record contains or how results are ordered.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is a single parameter with 100% schema description coverage ('Filter to this workspace ID'), so the schema already carries the semantics. The description's 'optionally filtered to one workspace' merely restates it, which is the baseline case.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('see their Lizard projects') plus the filtering scope, so the agent can tell it lists projects rather than creating/deleting them. It does not explicitly distinguish itself from the adjacent workspace_list sibling, which is the only plausible confusion.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Use this when the user wants to see their projects' gives a clear triggering intent but names no alternatives or exclusions — an agent deciding between project_list, workspace_list, and domain_owned_list gets no routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
project_pausePause projectADestructiveIdempotentInspect
Use this when the user wants to stop every service of a Lizard project without deleting anything: each app and database scales to 0, keeping its URL, host, port, password, settings and volumes. Returns what was paused and what was skipped, with why. Undo with project_resume.
| Name | Required | Description | Default |
|---|---|---|---|
| project | Yes | Project name, slug, or ID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the annotations by enumerating exactly what is preserved (URL, host, port, password, settings, volumes) and by disclosing that the result is partial-success aware ("what was paused and what was skipped, with why"). It adds real context to destructiveHint=true without contradicting it — scaling to 0 is disruptive but not data-destroying.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences, front-loaded with the trigger condition, then effect, then return semantics, then undo path. No sentence is filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter mutation with no output schema, the description covers trigger, effect, persistence guarantees, return shape, and undo path. An agent has everything needed to call it correctly and to explain the outcome to a user.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% for the single `project` parameter, so the schema already carries the meaning. The description refers to "a Lizard project" but adds no format or scoping detail beyond what the schema states, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ("stop every service of a Lizard project") plus the crucial scope qualifier "without deleting anything," which distinguishes it from project_delete. The mechanism ("each app and database scales to 0") makes the effect concrete rather than a restatement of the name.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
"Use this when the user wants to stop every service... without deleting anything" gives an explicit trigger condition, and "Undo with project_resume" names the reverse action. It does not explicitly route to service_pause for single-service stopping, which is the main remaining ambiguity in a very crowded sibling set.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
project_resumeResume projectADestructiveIdempotentInspect
Use this when the user wants to start again the services of a Lizard project that they paused. Services paused by a billing freeze stay paused until the account is paid. Returns what was resumed and what was skipped, with why.
| Name | Required | Description | Default |
|---|---|---|---|
| project | Yes | Project name, slug, or ID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes beyond the annotations by disclosing the billing-freeze exception and the return shape ('what was resumed and what was skipped, with why'), which is genuine partial-success behavior an agent needs. It does not explain why destructiveHint=true (e.g. resumed services incur billing) or whether resuming already-running services is a no-op despite idempotentHint.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with the trigger condition, then the exception, then the return value. No filler, though the 'with why' phrasing at the end is slightly informal.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description usefully tells the agent the result reports resumed vs skipped items and reasons, and warns about the billing-blocked case. Missing only sibling differentiation and the rationale for the destructive annotation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one parameter, and the schema documents it fully (name, slug, or ID at 100% coverage). The description mentions 'a Lizard project' but adds no syntax or format guidance beyond the schema, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb+resource: 'start again the services of a Lizard project' clearly scopes a project-level bulk resume. It implicitly contrasts with service_resume/workspace_resume by operating on all services of a project, but never names those siblings, so an agent must infer the granularity distinction.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Use this when the user wants to start again the services of a Lizard project that they paused' gives a clear triggering condition, and the billing-freeze sentence states a case where the tool will not fully succeed. No explicit alternative routing (e.g. to service_resume for a single service) is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pr_showShow pull requestARead-onlyIdempotentInspect
Read a Lizard Git pull request with its conversation, head commit, whether it can merge and what branch rules still need (approvals, checks).
| Name | Required | Description | Default |
|---|---|---|---|
| repo | Yes | Lizard Git repository as "owner/name" (repo_list) | |
| number | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the safety profile (readOnlyHint, idempotent, non-destructive, closed-world), so the description only needs to add what the call actually does. It does so by disclosing that the response aggregates conversation, head commit, mergeability, and pending branch-rule requirements — context an agent could not get from annotations alone.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One front-loaded sentence that names the action first and then the returned facets, with no filler. Every clause carries distinct information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description must convey what comes back — it names conversation, head commit, merge status, and outstanding branch rules, which is the core of what a reviewer needs. It omits basic PR metadata (title, author, state) but is otherwise sufficient for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 50%: "repo" is documented in schema as "owner/name", but "number" carries no schema description and the tool description says nothing about either parameter. "number" is reasonably inferable as the PR identifier, but the description does not compensate for the coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ("Read a Lizard Git pull request") and enumerates the payload: conversation, head commit, mergeability, unmet branch rules. That payload detail distinguishes it from pr_list (enumeration) and pr_merge (mutation), though it never names those siblings explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The word "Read" implies inspection of a single existing PR, so the use case is inferable, but there is no explicit when-to-use framing, no prerequisites, and no pointer to pr_list or pr_merge as alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
region_listList regionsARead-onlyIdempotentInspect
Use this when the user needs to know which deployment regions are available before creating a service or addon.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false, and openWorldHint=false, so the safety profile is fully covered structurally. The description adds only the discovery-before-mutation context; it says nothing about whether the region list is static or dynamic, cached, or how it relates to existing deployed services.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence, front-loaded with the usage trigger ('Use this when...') and ending with the concrete downstream actions. Nothing extraneous.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a no-parameter, read-only discovery tool with rich annotations and no output schema, the description covers the essential purpose and timing. The one remaining gap is that it doesn't hint at the return contents (region identifiers), which matters because no output schema exists to document them.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there is nothing for the description to disambiguate; baseline applies. No misleading parameter language is present.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description makes clear this returns the set of available deployment regions, which is a specific verb+resource rather than a restatement of the name. It doesn't explicitly state the shape of what comes back (names vs. slugs), so it falls short of a 5, but an agent can distinguish it from siblings like service_list or template_list without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives an explicit trigger — call this before creating a service or addon — which ties the tool to concrete downstream siblings. There is no explicit exclusion or statement about when it's unnecessary (it is safe and idempotent, so it could be called freely), leaving that to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
repo_commitCommit files to Lizard GitADestructiveInspect
Commit changes to a branch of a Lizard Git repository, made on the server (no clone needed): each file is new text content, delete: true, or a rename with moveFrom. createFrom makes the branch from that ref when it doesn't exist yet. With expect (the commit you based the change on), a branch that moved meanwhile is merged by the server and only a real conflict fails (409, with the paths). Pass an idempotencyKey to make a retry safe. A commit to a branch a service deploys from starts a deploy, and to a branch with .lizard/workflows starts CI. Uses the Lizard Git API; docs: https://lizard.build/docs/.
| Name | Required | Description | Default |
|---|---|---|---|
| repo | Yes | Lizard Git repository as "owner/name" (repo_list) | |
| files | Yes | ||
| branch | Yes | ||
| expect | No | ||
| message | Yes | ||
| createFrom | No | ||
| idempotencyKey | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the annotations by disclosing side effects an agent could not otherwise predict: a commit to a deployed branch starts a deploy, a commit to a branch with .lizard/workflows starts CI, and a conflicting expect produces a 409 listing the conflicting paths. It also explains the merge-on-move semantics and the idempotencyKey retry behavior, which is consistent with (not contradictory to) idempotentHint=false.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Dense but front-loaded, with the core operation first and conditional behaviors after. The single packed paragraph makes the several distinct modes (createFrom, expect, idempotencyKey, deploy/CI triggers) harder to scan than a short clause list would be, but no sentence is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive, 7-parameter mutation with no output schema, it covers conflict handling, retries, and downstream triggers thoroughly. The one gap is that it does not say what the call returns (commit sha, merged result, deploy/CI identifiers), which the agent must guess despite there being no output schema to consult.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is only 14%, so the description has to carry the load and does: it defines the three file entry modes (new text content, delete: true, rename via moveFrom), explains createFrom as branch-creation-from-ref, and defines expect as 'the commit you based the change on'. Only branch and message are left implicit, and those are self-evident.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Commit changes to a branch of a Lizard Git repository') and immediately scopes it with 'made on the server (no clone needed)', which separates it from git_checkout/git_status-style siblings. An agent can tell from the first clause exactly what operation this performs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear situational guidance: use it when you don't want a clone, pass idempotencyKey for safe retries, pass createFrom when the branch may not exist, and pass expect to get server-side merge instead of a failure. It does not, however, compare against alternatives like pr_create or sandbox_write_file for editing repository content, so routing between those paths is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
repo_commitsList repository commitsARead-onlyIdempotentInspect
List recent commits of a Lizard Git repository at a ref (default branch if omitted), optionally only those touching path. Uses the Lizard API; docs: https://lizard.build/docs/.
| Name | Required | Description | Default |
|---|---|---|---|
| ref | No | ||
| page | No | ||
| path | No | ||
| repo | Yes | Lizard Git repository as "owner/name" (repo_list) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly/idempotent/non-destructive/closed-world, so safety is covered. The description adds useful defaults (ref omitted -> default branch) and the optional path filter, but says nothing about ordering ('recent' is undefined), page size, or pagination behavior despite a page parameter.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences, front-loaded with the core action and scope. The docs URL is minor overhead but reasonable; nothing is redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only listing tool with annotations carrying the safety profile, the description covers the essential calling semantics (ref default, path filter). Gaps remain around the undocumented page parameter and the shape/ordering of returned commit entries, since no output schema exists.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 25% (only repo documented), so the description has to compensate. It does explain ref (defaults to default branch) and path (only commits touching it), but the page parameter is never mentioned in either schema or description — a real documentation hole.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('List recent commits of a Lizard Git repository') with clear scope modifiers (at a ref, optionally restricted to a path). This distinguishes it in practice from siblings like repo_commit and repo_show, though it never names an alternative explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implies when to use it via the ref/path scoping, and clarifies the default-branch fallback when ref is omitted. But it never says when to prefer repo_show, repo_commit, or another history tool, nor any exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
repo_createCreate Lizard Git repositoryADestructiveInspect
Create a Lizard Git repository. Private by default. readme: true starts it with a README (otherwise it is empty until the first repo_commit). workspace (a workspace slug) makes that workspace's members its collaborators. To deploy it, service_create with repoUrl lizard:owner/name; every commit to its branch then deploys.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | ||
| readme | No | ||
| private | No | ||
| workspace | No | Workspace slug | |
| description | No | ||
| defaultBranch | No | Default main |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare destructive/non-idempotent/non-readonly, and the description adds real behavior beyond them: default privacy, empty repo until first repo_commit unless readme:true, and collaborator inheritance from workspace. It does not disclose failure modes such as name collisions or permission requirements, keeping it short of a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four dense sentences, front-loaded with the core action and default behavior, then options, then the deployment follow-up. No filler; every clause carries actionable information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema and 6 parameters at 33% coverage, so the description should do more. It covers the main options and the post-create deploy path but omits return values, name-format constraints, and the meaning of defaultBranch/description.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 33%, so the description must compensate. It meaningfully explains readme and workspace semantics, but leaves defaultBranch and description unexplained, and the name pattern is only in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Create a Lizard Git repository'), clearly distinct from sibling read tools like repo_show/repo_list. It does not explicitly contrast with other create tools (workspace_create, service_create), but the verb+resource is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives concrete selection guidance: private by default, readme:true to seed content, workspace to grant collaborators, and explicit next-step routing ('To deploy it, service_create with repoUrl lizard:owner/name'). It lacks explicit when-not-to-use or alternatives for repo creation itself.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
repo_deleteDelete Lizard Git repositoryADestructiveInspect
Permanently delete a Lizard Git repository with its branches, issues, pull requests and CI runs. Services deploying from it stop getting new deploys. Owner or admin only. Get the user's approval first; this cannot be undone.
| Name | Required | Description | Default |
|---|---|---|---|
| repo | Yes | Lizard Git repository as "owner/name" (repo_list) | |
| confirm | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already flag destructiveHint=true, but the description adds real value beyond them: the exact collateral damage (branches, issues, pull requests, CI runs), the downstream consequence (services deploying from it stop getting new deploys), the privilege bar, and irreversibility. That is exactly the context an agent needs before an irreversible write.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with the destructive scope, then consequences, then preconditions. Every sentence carries distinct information and none repeat structured fields.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter irreversible delete with no output schema, the description covers blast radius, side effects, permissions, and consent. Nothing material an agent needs to call this safely is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 50%: 'repo' is documented with a pattern and a repo_list reference, while 'confirm' only carries const:true. The description never mentions either parameter, though 'Get the user's approval first' loosely maps to the confirm gate. It neither adds format guidance nor compensates for the undocumented confirm flag.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a precise verb and resource ('Permanently delete a Lizard Git repository') and enumerates the cascaded contents. This clearly distinguishes it from sibling deletion tools that target projects, services, workspaces, volumes, or sandboxes rather than Git repositories.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an actionable precondition ('Owner or admin only') and an approval requirement ('Get the user's approval first'). It lacks an explicit contrast with adjacent destructive siblings such as project_delete or service_delete, so the agent must infer which resource type is being removed.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
repo_filesList repository filesARead-onlyIdempotentInspect
List a folder of a Lizard Git repository (path, default the root) at a ref (branch, tag or commit; default branch if omitted). recursive: true lists every file path instead. Uses the Lizard API; docs: https://lizard.build/docs/.
| Name | Required | Description | Default |
|---|---|---|---|
| ref | No | ||
| path | No | ||
| repo | Yes | Lizard Git repository as "owner/name" (repo_list) | |
| recursive | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly/idempotent/non-destructive, so the bar is lower. The description adds real context beyond them: default root path, ref accepts branch/tag/commit and falls back to the default branch, and the recursive behavior switch. It notes the backing API and docs link but omits return shape or pagination.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core action, then defaults and the recursive flag, all in one dense sentence plus a docs pointer. Efficient, though the nested parentheticals make it slightly packed.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description should ideally hint at what a listing looks like; it doesn't. Otherwise, for a 4-param read tool with annotations already covering safety, it supplies enough to call correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is only 25% (just repo), so the description carries the burden and largely does: it explains path defaults to root, ref accepts branch/tag/commit with branch fallback, and recursive lists all file paths. Only the repo param itself is not covered here, but the schema documents it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb and resource: 'List a folder of a Lizard Git repository ... at a ref', with the recursive variant named. An agent can tell it apart from repo_read_file by the folder-listing framing, though no sibling is named explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It states defaults (path defaults to root, ref defaults to branch) and that recursive:true changes the result to every file path, which is usage-relevant. But there is no guidance on when to use this versus repo_read_file, repo_commits, or repo_show.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
repo_listList Lizard Git repositoriesARead-onlyIdempotentInspect
List Lizard Git repositories (lizard.build/git — Lizard's own git hosting, not GitHub): by default the user's own and the ones they collaborate on. owner narrows to one owner's; query searches names and descriptions. Lizard Git refuses API keys with scopes.
| Name | Required | Description | Default |
|---|---|---|---|
| owner | No | ||
| query | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, non-destructive, closed-world behavior, so the description's job is to add beyond that — and it does: the default result set (owned + collaborated repos) and the auth constraint that 'Lizard Git refuses API keys with scopes'. Neither is derivable from annotations or schema. Return shape and pagination remain undisclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three compact sentences with no filler, and the platform clarification plus default scope come first. The semicolon-chained parameter clauses are dense but readable and each sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-optional-parameter list tool with no output schema and full annotation coverage, the description covers platform, default scope, filtering, and an auth caveat. Missing only pagination/result-size behavior, which is a minor gap at this complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must carry the parameters, and it explains both: owner narrows to a single owner, query searches names and descriptions. It stops short of saying whether the two combine or how matching works, so it is good but not exhaustive compensation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource (list Lizard Git repositories) and explicitly disambiguates the platform from GitHub, which matters given the sibling set spans domains, services, and sandboxes. It does not name a sibling alternative such as repo_show, so it falls short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The default scoping ('the user's own and the ones they collaborate on') implies when this tool is the right entry point, but there is no explicit statement of when to prefer repo_show or pr_list instead, and no exclusions. Usage is inferable rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
repo_read_fileRead repository fileARead-onlyIdempotentInspect
Read a text file from a Lizard Git repository at a ref (default branch if omitted), up to 64 KiB. Binary or larger files return their size without content. Uses the Lizard API; docs: https://lizard.build/docs/.
| Name | Required | Description | Default |
|---|---|---|---|
| ref | No | ||
| path | Yes | ||
| repo | Yes | Lizard Git repository as "owner/name" (repo_list) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare read-only, idempotent, non-destructive, closed-world behaviour, so the safety profile is covered. The description adds real context beyond that: the 64 KiB truncation threshold and the fact that binary or oversized files return size only, which an agent cannot learn from annotations. Return format for partial reads is still unstated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two compact sentences, front-loaded with the core action and the ref default, followed by the size/binary caveat and a docs pointer. Nothing is redundant, though the trailing API/docs sentence is low value for an agent already in the tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 3-parameter read tool with full annotation coverage and no output schema, the essentials are present: default ref behaviour, size ceiling, and binary handling. Missing guidance on which sibling to use and on 'path' formatting keeps it short of complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is only 33% – just 'repo' is documented (owner/name with a reference to repo_list). The description partially compensates by explaining that 'ref' defaults to the default branch when omitted, but 'path' semantics (leading slash, directory rejection, encoding) are undocumented in both places.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource ('Read a text file from a Lizard Git repository at a ref') and pins the scope with the 64 KiB cap and binary fallback. It implicitly distinguishes itself from the listing sibling (repo_files) by emphasizing single-file content retrieval, but never names that alternative outright.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: an agent can infer this is the way to fetch file contents rather than list them. There is no explicit 'use this when…' or routing to repo_files / repo_commits / sandbox_read_file, so the choice among near-neighbours is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
repo_showShow Lizard Git repositoryARead-onlyIdempotentInspect
Read a Lizard Git repository's details: default branch, visibility, the user's role, whether it is empty, branch and open issue/pull request counts.
| Name | Required | Description | Default |
|---|---|---|---|
| repo | Yes | Lizard Git repository as "owner/name" (repo_list) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint and non-destructive, so the safety profile is covered. The description adds real value by disclosing what the response contains (role, visibility, empty flag, counts), which is the main behavioral fact an agent needs and which annotations cannot convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One compact sentence, front-loaded with the verb and resource, then the payload fields. No filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Since there is no output schema, naming the returned fields in the description is exactly the right compensation and makes the tool callable without guesswork. Only minor gaps remain: error behavior for missing/inaccessible repos is unstated.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the single 'repo' parameter is documented with the 'owner/name' pattern plus a pointer to repo_list. The description adds no further syntax or format meaning, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Read') and resource ('a Lizard Git repository's details') and enumerates the concrete fields returned: default branch, visibility, user role, empty flag, branch and issue/PR counts. This makes it clearly the single-repo detail reader, distinct from repo_list/repo_files/pr_list siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: it takes an owner/name identifier, so an agent infers it is for inspecting one known repo. There is no explicit when-to-use vs repo_list/repo_files, no note about access requirements for private repos, and no mention of behavior on a nonexistent repo.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sandbox_createCreate sandboxADestructiveInspect
Create a sandbox (a Firecracker microVM) in an explicit project. Uses billed cloud resources and returns its ID. Defaults: template interpreter, size small (2 vCPU / 4 GB), a 5-minute lifetime; expiry deletes its files unless a volume is attached. Other templates: base, codex, claude, opencode, pi, prime, desktop (the server checks the name). Sizes: small, medium (4 vCPU / 8 GB), large (8 vCPU / 16 GB). Pass snapshotId to start from a saved snapshot (it keeps the snapshot's size, so leave size out) and volume to mount a persistent volume. No host files, environment variables, or API key are copied into it. Get the user's approval before creating it; do not retry an uncertain response blindly.
| Name | Required | Description | Default |
|---|---|---|---|
| size | No | Default small; not with snapshotId | |
| region | No | Region code (region_list); default us-east-1, or the volume's or snapshot's region | |
| volume | No | Persistent volume name or ID in the same project (volume_list) | |
| confirm | Yes | ||
| project | Yes | ||
| template | No | Template name; default interpreter | |
| lifetimeMs | No | Lifetime in ms, 60,000 to 86,400,000 (a day); extend later with sandbox_set_timeout | |
| snapshotId | No | Snapshot ID from sandbox_snapshot or sandbox_snapshot_list |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the annotations: billed cloud resources, the 5-minute default lifetime and that expiry deletes files unless a volume is attached, that no host files/env vars/API key are copied in, and that the server validates template names. The destructiveHint=true annotation is corroborated and explained by the lifetime-deletion behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with definition, defaults, and options in a compact sequence; every sentence carries information. It is dense to the point of being slightly packed (parenthetical template list mid-sentence), but there is no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an 8-parameter, non-idempotent, billed mutation with no output schema, it covers cost, lifetime, deletion semantics, isolation, approval gating, and return value (the ID). Minor gaps remain: it does not describe behavior on name conflicts or how a failed creation affects volume/snapshot state.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Adds meaning the schema alone lacks: the enumerated valid template names, the meaning of each size in vCPU/RAM, the interaction rule that snapshotId keeps the snapshot's size so size must be omitted, and that region defaults to the volume's or snapshot's region. Schema coverage is 75%, and the description fills the remaining gaps rather than restating enum values.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource and immediately defines the resource: "Create a sandbox (a Firecracker microVM) in an explicit project." It also distinguishes it from sibling creation paths by noting snapshotId starts from a saved snapshot (as opposed to sandbox_snapshot/sandbox_fork) and that it returns an ID.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives concrete selection guidance: pass snapshotId to start from a snapshot (and then leave size out), pass volume to mount a persistent volume, plus defaults for template and size. It also states a real precondition ("Get the user's approval before creating it") and a caution ("do not retry an uncertain response blindly"). It does not explicitly name sibling alternatives such as sandbox_fork for cloning an existing sandbox, which keeps it from a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sandbox_deleteDelete sandboxADestructiveIdempotentInspect
Permanently destroy one sandbox and all its files (an attached volume stays). Get the user's approval before calling. Use this to clean up a sandbox created for a task. Does not delete its project or any app services.
| Name | Required | Description | Default |
|---|---|---|---|
| confirm | Yes | ||
| sandboxId | Yes | Exact sandbox ID from sandbox_create or sandbox_list |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already flag destructiveHint=true, but the description adds the details an agent actually needs: permanence, that all files inside the sandbox are destroyed, that an attached volume survives, and that a human approval step is required first. That is meaningful context beyond the annotation flags.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four short sentences, front-loaded with the destructive scope, then the approval requirement, then the use case, then the exclusions. No filler and no repetition of the title.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 2-parameter destructive tool with rich annotations, this covers destruction scope, surviving resources, and the approval prerequisite, which is what an agent needs before calling. The only omission is any mention of the required confirm flag or what the call returns on success/failure.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 50%: sandboxId is documented in-schema with its source, while 'confirm' is only a const true with no prose. The description never mentions the confirm gate, which is the one non-obvious argument, so it adds nothing over the schema. Baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Permanently destroy one sandbox and all its files') and immediately bounds the blast radius with '(an attached volume stays)'. It also distinguishes itself from project_delete and service_delete by saying it does not delete the project or app services.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit when-to-use ('clean up a sandbox created for a task') plus an explicit when-not ('Does not delete its project or any app services'), which implicitly routes project-level teardown to project_delete. It doesn't name that sibling tool outright, keeping it just short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sandbox_execRun sandbox commandADestructiveInspect
Run a shell command inside an existing sandbox, as root. Requires the user's approval. Cancellation, timeout, or a failed command request destroys the whole sandbox and all its files to stop remote code. A nonzero command exit code preserves it. Use an ephemeral sandbox created for this task. Output is capped at 64 KiB per stream; do not blindly retry a failed command.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | /workspace | |
| envs | No | Environment variables for this command only | |
| command | Yes | ||
| confirm | Yes | User approved the command and loss of sandbox files if cancellation, timeout, or request failure requires cleanup | |
| sandboxId | Yes | Exact sandbox ID from sandbox_create or sandbox_list | |
| timeoutMs | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the destructiveHint=true annotation by spelling out exactly what is destroyed (the whole sandbox and all its files), which triggers it (cancellation, timeout, failed request) versus which does not (a nonzero exit code), that approval is required, and the 64 KiB per-stream output cap. This is unusually complete disclosure for a destructive tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads what the tool does, then each subsequent sentence carries a distinct load-bearing fact: approval, destruction rules, sandbox selection, output cap, retry caution. No filler or restatement of the title.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a six-parameter destructive tool with no output schema, the description covers the critical risks and the output cap, which implies stdout/stderr streams. It leaves the return shape (exit code field, truncation indicator) and the cwd/envs parameters unaddressed, which is a modest but real gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 50%, and the description compensates for confirm (approval implies sandbox loss) and timeoutMs (timeout destroys the sandbox), plus the sandboxId scoping via 'existing sandbox'. But cwd and envs — including the nested-object env var pattern constraints — get no mention in either the schema or the description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: run a shell command, as root, inside an *existing* sandbox. That scope wording separates it from sandbox_create and the file-oriented siblings (sandbox_read_file, sandbox_write_file) without the agent needing to open any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives a clear operating condition — 'Use an ephemeral sandbox created for this task' — and a caution against blind retries after failure. It stops short of explicitly naming which sibling to use for non-shell file operations or when a fork/snapshot is preferable, so alternatives are only implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sandbox_expose_portExpose sandbox portADestructiveIdempotentInspect
Give a port inside a running sandbox an HTTPS URL, e.g. to show the user a web app the sandbox runs (it must listen on 0.0.0.0). The port stays private: the returned url carries an access token, so a browser opens it once and then keeps a cookie; other clients send accessToken in the X-Lizard-Access-Token header. Anyone with the url or token can reach the port, so share it only with the user. Remove it with sandbox_unexpose_port.
| Name | Required | Description | Default |
|---|---|---|---|
| port | Yes | ||
| sandboxId | Yes | Exact sandbox ID from sandbox_create or sandbox_list |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the annotations (destructiveHint=true, openWorldHint=true) by explaining the security model: the URL carries an access token, browsers get a cookie, non-browser clients send X-Lizard-Access-Token, and anyone holding the URL or token can reach the port. The 'share it only with the user' warning aligns with and gives substance to the destructive and open-world hints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the action and use case, then layered: prerequisite, token semantics, sharing warning, teardown pointer. Every sentence carries distinct operational information with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, yet the description explains what is returned (a URL plus accessToken) and how it is consumed. Combined with the precondition and the teardown sibling, an agent has everything needed to call this correctly and safely.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With only 50% schema coverage (sandboxId is documented, port is not), the description partly compensates by stating the port must be listening on 0.0.0.0 – a real success precondition tied to the parameter. It doesn't explain anything further about port selection or reuse of an already-exposed port, so it stops short of fully covering the gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Give a port inside a running sandbox an HTTPS URL') and immediately clarifies the intent with a concrete use case (showing the user a web app). It also names the sibling tool that reverses the operation, so it is distinguishable from sandbox_unexpose_port without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly frames when to use it ('to show the user a web app the sandbox runs'), states the precondition that the process must listen on 0.0.0.0, and names the alternative for teardown (sandbox_unexpose_port). Nothing about routing is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sandbox_forkFork sandboxADestructiveInspect
Start live copies of a running sandbox: memory, processes and files. The source pauses for a moment and keeps running. Each copy is a new billed sandbox and counts toward the running-sandbox limits, so near a limit only some may start: the result has one entry per copy, a sandbox or an error. Copies live as long as the source unless lifetimeMs is given. Get the user's approval first.
| Name | Required | Description | Default |
|---|---|---|---|
| count | No | ||
| confirm | Yes | ||
| sandboxId | Yes | Exact sandbox ID from sandbox_create or sandbox_list | |
| lifetimeMs | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the destructiveHint/readOnlyHint annotations: the source pauses momentarily but survives, each copy is separately billed and limit-counted, partial success is possible with one entry per copy ('a sandbox or an error'), and copies inherit the source lifetime unless lifetimeMs is set. That is exactly the mutation side-effect detail an agent needs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Five short sentences, all load-bearing, with the core action front-loaded and the safety gate (user approval) placed last as a final check. Dense but never padded; only slight cost is the packing of billing and limit behavior into one sentence.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description supplies the return shape (one entry per copy, sandbox or error), plus billing, lifetime, and limit semantics. Minor gaps remain – no cost guidance for large counts and no statement of what state a fork starts in – but an agent can invoke this correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 25%, so the description carries weight; it does explain lifetimeMs (inherits source lifetime unless given) and hints at count through 'one entry per copy' and 'only some may start'. However, count is never explicitly stated as the number of copies to create and confirm is only obliquely covered by 'Get the user's approval first', leaving half the parameters under-documented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource – 'Start live copies of a running sandbox: memory, processes and files' – which cleanly separates it from sandbox_snapshot (state capture) and sandbox_create (blank sandbox). The 'live copies ... memory, processes and files' phrasing tells an agent exactly what is duplicated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear preconditions: source must be running, the user must approve first, and copies count against running-sandbox limits so bulk forks may partially fail. It does not name the alternative tools (snapshot vs. create) an agent might pick instead, but the operational context is unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sandbox_listList sandboxesBRead-onlyIdempotentInspect
List Lizard Sandboxes in an explicit project. Use the returned IDs with sandbox tools; these resources are separate from app services.
| Name | Required | Description | Default |
|---|---|---|---|
| project | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint and destructiveHint=false, so the safety profile is fully covered by structured data. The description adds useful context (separate resource domain, IDs reusable by other sandbox tools) but says nothing about pagination, ordering, or result volume for what could be a large list.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the action and scope, then the follow-on usage note. No filler and nothing buried.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, and the description adequately implies the return shape (a list of sandboxes whose IDs feed other sandbox tools). The only real gap is the unexplained project identifier format, which is a parameter-level rather than contextual omission.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must carry the parameter burden and largely fails to. 'In an explicit project' signals that project scoping is mandatory but never says whether the value is a name, slug, or ID, nor gives format or an example. The agent is left to guess the identifier form from sibling tools.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('List Lizard Sandboxes') plus a scope ('in an explicit project'), so the agent knows exactly what the call returns. It also pre-empts confusion with the service_* family by noting these resources are separate from app services, though it doesn't distinguish itself from near-siblings like sandbox_snapshot_list or sandbox_list_files.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Use the returned IDs with sandbox tools' gives a clear next-step workflow, which is genuine usage guidance. However, there is no statement of when to prefer this over sandbox_show or the other listing tools, and no prerequisites or exclusions beyond the services distinction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sandbox_list_filesList sandbox filesARead-onlyIdempotentInspect
List one directory inside a sandbox: name, path, type and size of each entry. Relative paths start at /workspace. Uses the Lizard API; docs: https://lizard.build/docs/.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | /workspace | |
| sandboxId | Yes | Exact sandbox ID from sandbox_create or sandbox_list |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false, and openWorldHint=false, so the safety profile is covered. The description adds useful scope and return-entry details, but does not disclose error behavior, pagination, hidden-file handling, or symlink behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two compact sentences with no wasted text. The core action and scope are front-loaded, followed by path resolution and documentation context.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only listing tool with rich annotations and no output schema, the description covers the key return fields and path semantics. It could be slightly more complete by noting whether listing is recursive or how missing paths are handled.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 50%: sandboxId is documented in the schema, while path is not. The description compensates meaningfully for path by explaining that relative paths start at /workspace, though it does not mention the default or absolute-path handling.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: listing one directory inside a sandbox. It also names the fields returned (name, path, type, size), which distinguishes it from siblings like sandbox_read_file or sandbox_exec.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'List one directory' implies non-recursive directory listing, and the relative-path note gives useful context. However, it does not explicitly say when to use this instead of sandbox_read_file or sandbox_exec, nor does it state exclusions or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sandbox_pausePause sandboxADestructiveIdempotentInspect
Save a running sandbox's memory, processes and files, and stop it. A paused sandbox costs only its storage and does not count against the running-sandbox limit. Waits up to 2 minutes for it to finish pausing. Undo with sandbox_resume.
| Name | Required | Description | Default |
|---|---|---|---|
| sandboxId | Yes | Exact sandbox ID from sandbox_create or sandbox_list |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With destructiveHint=true and idempotentHint=true already declared, the description adds real substance: stored-state-only billing, exemption from the running-sandbox limit, a 2-minute wait ceiling, and the reversibility path via sandbox_resume. It does not say what happens if pausing exceeds the 2-minute window or how in-flight exec sessions are treated, which leaves the main operational edge case unresolved.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four short sentences, each carrying distinct information: what it does, cost implications, timing limit, and reversal. Front-loaded with the action and no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter mutating tool with annotations and no output schema, the description covers cost, limits, latency, and undo. The only meaningful gap is post-timeout behavior (error vs. eventual completion), which an agent would want before relying on the 2-minute guarantee.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is a single parameter with 100% schema coverage, including a pattern, length bounds, and a description pointing at sandbox_create/sandbox_list as sources. The prose adds nothing about sandboxId, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb chain ('save memory, processes and files, and stop it') against a specific resource (sandbox), which precisely separates it from sandbox_resume (the inverse) and sandbox_snapshot (which saves state but does not stop the sandbox). An agent can route correctly from the first sentence alone.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The closing sentence 'Undo with sandbox_resume' gives the explicit inverse operation, and the cost/limit sentence implies when pausing is preferable to deleting. It stops short of naming when to prefer sandbox_snapshot or sandbox_delete over pausing, so the alternative routing is only partial.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sandbox_read_fileRead sandbox text fileARead-onlyIdempotentInspect
Read up to 64 KiB of UTF-8 text from a sandbox. Relative paths start at /workspace. Paths refer to the remote sandbox, never the MCP server's files. Uses the Lizard API; docs: https://lizard.build/docs/.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| sandboxId | Yes | Exact sandbox ID from sandbox_create or sandbox_list |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint and destructiveHint=false, so the description correctly focuses on what annotations cannot express: the 64 KiB read cap, UTF-8-only constraint, and relative-path resolution against /workspace. It stops short of stating what happens on truncation or non-UTF-8 input (error vs partial content).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with the core action and cap, followed by path resolution and the remote/local distinction. The docs URL is the only debatable element and is cheap. Nothing is redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter read tool with a read-only annotation profile and no output schema, the description covers the key risks (remote vs local, size cap, encoding). The one gap is that it never describes the return payload shape or truncation signalling, which the absent output schema leaves unstated.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 50%: sandboxId is documented in the schema but path is not. The description compensates by defining path semantics (relative paths start at /workspace, remote resolution), which is exactly the gap the schema leaves. It adds no detail beyond the schema for sandboxId, but that field is already covered.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Read up to 64 KiB of UTF-8 text from a sandbox') with scope qualifiers (size cap, encoding). The sentence clarifying that paths refer to the remote sandbox, never the MCP server's files, separates it from repo_read_file and from any local-file interpretation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the remote-sandbox scoping, but there is no explicit routing guidance such as 'use sandbox_list_files to discover paths first' or 'use repo_read_file for repo contents'. The agent must infer when this beats sandbox_exec or sandbox_list_files.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sandbox_resumeResume sandboxADestructiveIdempotentInspect
Start a paused sandbox again, where it left off: same memory, processes and files. Waits up to 2 minutes for it to run. If resuming fails, the saved state is kept; try again.
| Name | Required | Description | Default |
|---|---|---|---|
| sandboxId | Yes | Exact sandbox ID from sandbox_create or sandbox_list |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations cover the safety profile (readOnly=false, idempotent=true, destructive=true), and the description adds genuinely non-obvious behavior: it blocks for up to 2 minutes, the sandbox resumes with preserved memory/processes/files, and a failed resume preserves state rather than destroying it. It does not reconcile the destructiveHint=true flag with that 'state is kept' reassurance, leaving mild ambiguity about what is actually at risk.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with the action and its state-preservation guarantee, followed by the blocking behavior and the failure/retry note. No filler and nothing buried.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-param tool with full schema coverage and annotations, this covers the operationally important facts: blocking duration, state preservation, and failure handling. It would be complete with a note on what a successful resume returns (status/connection info) since no output schema exists.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one parameter (sandboxId) and schema coverage is 100%, with the schema itself explaining it is the exact ID from sandbox_create or sandbox_list. The description adds nothing about the parameter, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (start/resume) and resource (paused sandbox), and adds the crucial scope detail that it resumes 'where it left off: same memory, processes and files.' That framing cleanly distinguishes it from sandbox_pause, sandbox_fork, and workspace_resume without needing their schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Start a paused sandbox again' implicitly scopes usage to paused sandboxes, and the closing 'If resuming fails, the saved state is kept; try again' gives explicit retry guidance. It stops short of naming an alternative (e.g., sandbox_create if the sandbox is gone) or stating what to do if the 2-minute wait times out.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sandbox_set_timeoutSet sandbox lifetimeADestructiveIdempotentInspect
Change how long a sandbox lives from now: it stops and loses its files (except an attached volume) when the time runs out. Use it to keep a sandbox the user still needs, or to end one sooner. 60,000 ms to 86,400,000 ms (a day).
| Name | Required | Description | Default |
|---|---|---|---|
| sandboxId | Yes | Exact sandbox ID from sandbox_create or sandbox_list | |
| lifetimeMs | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already flag destructiveHint=true and idempotentHint=true, so the description's real value is the consequence detail: the sandbox stops and loses its files, except for an attached volume. That is genuinely beyond the annotations. It doesn't address edge cases such as whether this works on an already-paused sandbox or how the server resolves competing timeout changes.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences: effect first, usage second, constraint last. Every clause carries information — consequence, intent, and range — with no padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter mutation with annotations covering idempotency and destructiveness and no output schema, the description supplies the missing pieces: relative timing, file-loss behavior, and units/range. Only minor operational context (permissions, behavior on paused sandboxes, error conditions) is absent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 50%: sandboxId is documented but lifetimeMs has only bare numeric bounds. The description compensates well by naming units (ms) and the range 60,000–86,400,000 with the '(a day)' anchor, though it doesn't explain what happens if the new lifetime is shorter than the elapsed time.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource (change sandbox lifetime) and clarifies the change is measured 'from now', which is a non-obvious semantic. It does not explicitly distinguish itself from siblings like sandbox_pause or sandbox_delete, which also terminate/limit a sandbox, so an agent must infer the boundary.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Use it to keep a sandbox the user still needs, or to end one sooner' gives clear positive usage contexts for both directions of adjustment. It stops short of naming the alternatives (pause vs. delete) an agent should consider when the intent is stopping rather than rescheduling.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sandbox_showShow sandboxARead-onlyIdempotentInspect
Read a sandbox's status (running, pausing, paused, resuming, ...), project, template, size and expiry. The platform checks the current user's access to this ID.
| Name | Required | Description | Default |
|---|---|---|---|
| sandboxId | Yes | Exact sandbox ID from sandbox_create or sandbox_list |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, non-destructive, and closed-world behavior, lowering the bar. The description adds meaningful behavioral context beyond them: it discloses that access to the ID is checked by the platform and enumerates the status fields returned. It does not describe behavior when the sandbox is missing or access is denied.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the read action and the fields returned, with no filler. The truncated status list ('running, pausing, paused, resuming, ...') is slightly imprecise but compact.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter read tool with full schema coverage and strong annotations, this is nearly complete: it conveys what is read and the authorization check. Missing only not-found/unauthorized behavior and any mention of output shape beyond the listed fields.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the sandboxId field already explains it must be an exact ID from sandbox_create or sandbox_list. The description adds only the access-check note on 'this ID' and does not add format or constraint detail beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Read) and resource (sandbox) and enumerates the fields returned (status, project, template, size, expiry). It implicitly distinguishes itself from sandbox_list by operating on one sandbox, but never names or contrasts with sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by 'Read a sandbox's status ...' and the schema note that sandboxId comes from sandbox_create or sandbox_list, but there is no explicit when-to-use or exclusion guidance versus siblings like sandbox_list.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sandbox_snapshotSnapshot sandboxADestructiveInspect
Save a running sandbox, memory and processes included, as a private snapshot to start new sandboxes from (sandbox_create with snapshotId). The sandbox keeps running. scope says where it may be restored: user (any of your projects), workspace, or project. Snapshots are billed for storage until deleted. Waits up to 2 minutes for the snapshot to be ready; a large one may still be processing, so check sandbox_snapshot_list.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | A name for the snapshot | |
| scope | No | ||
| sandboxId | Yes | Exact sandbox ID from sandbox_create or sandbox_list |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Adds substantial behavior beyond the annotations: the source sandbox keeps running, storage is billed until the snapshot is deleted, the call blocks up to 2 minutes, and a large snapshot may still be processing afterward. That last caveat is exactly the kind of async-completion detail an agent needs and that destructiveHint/idempotentHint cannot convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core action and result, then layered with scope, billing, and completion caveats in a logical order. Four dense sentences with no outright filler, though the scope clause is slightly compressed for the amount of meaning it carries.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers the mutation's side effects, lifetime, restore boundary, and the delayed-readiness problem, with a pointer to sandbox_snapshot_list since no output schema exists. Only minor gap is not saying what the call itself returns (e.g., a snapshot ID) versus what must be discovered via the list tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 67%: name and sandboxId are self-explanatory, but the scope enum is undocumented in the schema. The description fills that gap by defining user (any of your projects), workspace, and project as restore boundaries, which is real added meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource (save a running sandbox as a private snapshot) and the exact contents captured (memory and processes). It also names the downstream consumer (sandbox_create with snapshotId) and the follow-up check (sandbox_snapshot_list), so an agent can place it precisely among the sandbox_* siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explains the intended use (create a reusable image to start new sandboxes) and clarifies scope semantics and billing lifetime. It does not explicitly contrast with sandbox_fork or sandbox_pause/resume, which are the nearest alternatives, so the when-not guidance is incomplete.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sandbox_snapshot_deleteDelete sandbox snapshotADestructiveIdempotentInspect
Permanently delete a saved sandbox snapshot. Sandboxes already started from it keep running. Get the user's approval first.
| Name | Required | Description | Default |
|---|---|---|---|
| confirm | Yes | ||
| snapshotId | Yes | Snapshot ID from sandbox_snapshot or sandbox_snapshot_list |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and idempotentHint=true, so the bar is lower, yet the description still adds real value: the deletion is permanent/irreversible, and derived running sandboxes are not affected. The one remaining gap is failure behavior for an unknown snapshotId, which is not addressed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with the action and its permanence, then the blast radius, then the prerequisite. Zero filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 2-parameter destructive tool with no output schema, the description covers permanence, side effects, and the approval gate, which is most of what an agent needs. It could add what happens on a nonexistent or already-deleted ID, but that is a minor omission.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 50%; the snapshotId description in the schema is already strong, but the 'confirm' parameter has no schema description at all, and the description implicitly gives it meaning by demanding user approval first — the agent can connect confirm=true to that requirement. It stops short of explicitly naming confirm, so not a 5.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Permanently delete') and a precisely scoped resource ('a saved sandbox snapshot'), and immediately clarifies that sandboxes already started from it are unaffected — which is exactly what separates this from sandbox_delete. An agent can distinguish it from sandbox_snapshot, sandbox_snapshot_list, and sandbox_delete without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides one concrete gating instruction ('Get the user's approval first') and one scoping note (running sandboxes survive), which implies it is safe to use only for cleanup of unused snapshots. However, it never routes the agent explicitly — no 'use sandbox_snapshot_list to find the ID' or 'use sandbox_delete to remove the running sandbox instead'. Usage is inferred rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sandbox_snapshot_listList sandbox snapshotsBRead-onlyIdempotentInspect
List the saved sandbox snapshots of a project: ID, name, template, region, size, scope and status.
| Name | Required | Description | Default |
|---|---|---|---|
| project | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true and destructiveHint=false, so safety is covered. The description adds the return field set, which is useful, but says nothing about pagination, ordering, or volume of results.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with the verb first and the return fields enumerated; no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, listing the returned fields is genuinely helpful. However, for a list tool the description omits result volume/ordering and any hint that the project identifier format matters, leaving gaps an agent must guess at.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has one required parameter with 0% description coverage. The description's phrase 'of a project' loosely maps to it but does not say whether it accepts a project name, slug, or ID, nor any format constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (List) and resource (saved sandbox snapshots of a project), plus the fields returned. It implicitly separates itself from sandbox_list (running sandboxes) and sandbox_snapshot (creation) but never names those siblings explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to call this versus sandbox_list, sandbox_show, or sandbox_snapshot, and no prerequisites or exclusions. The agent must infer the distinction from the word 'snapshots' alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sandbox_unexpose_portRemove sandbox port URLADestructiveIdempotentInspect
Remove the HTTPS URL of a sandbox port; its access token stops working. The process inside keeps running.
| Name | Required | Description | Default |
|---|---|---|---|
| port | Yes | ||
| sandboxId | Yes | Exact sandbox ID from sandbox_create or sandbox_list |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and idempotentHint=true, so the bar is lower, yet the description adds genuinely new behavioral facts: the access token is invalidated and the underlying process survives. It stops short of saying whether re-exposing issues a fresh token or whether calling on a non-exposed port errors.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tightly packed clauses separated by a semicolon, with the primary effect front-loaded and the non-obvious side effect second. Every phrase carries information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 2-parameter destructive tool with full annotation coverage and no output schema, the description supplies the essential effects (URL gone, token dead, process alive). Only edge-case behavior — idempotent re-calls on an unexposed port, and whether the port param must match an existing exposure — is left unstated.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is only 50%: sandboxId is documented in-schema while 'port' has no description beyond numeric bounds. The description says 'a sandbox port' but adds no format, range, or lookup guidance (e.g. from sandbox_show) to compensate for the undocumented parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Remove) and resource (the HTTPS URL of a sandbox port), which unambiguously makes it the inverse of the sibling sandbox_expose_port. It stops short of naming the sibling pair explicitly, but the operation is still instantly identifiable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The clarifier 'the process inside keeps running' implicitly steers an agent away from this tool when the goal is to terminate the sandbox (use sandbox_delete instead), but no alternative is named and no explicit when/when-not condition is given. Usage must be inferred from the effect description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sandbox_write_fileWrite sandbox text fileADestructiveIdempotentInspect
Write up to 64 KiB of UTF-8 text to a sandbox, replacing an existing file. Requires the user's approval. Relative paths start at /workspace. Does not write to the MCP server's filesystem. Uses the Lizard API; docs: https://lizard.build/docs/.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| confirm | Yes | ||
| content | Yes | ||
| sandboxId | Yes | Exact sandbox ID from sandbox_create or sandbox_list |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true, idempotentHint=true, and readOnlyHint=false, so the safety profile is covered. The description adds genuinely new context: the 64 KiB ceiling, UTF-8 encoding, mandatory user approval, and the explicit assurance that it does not touch the MCP server's filesystem. The unexplained overwrite-vs-create semantics is the only real gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Five short sentences, front-loaded with the action and the size limit, followed by preconditions and a scope disclaimer. The Lizard API/docs pointer is marginal but brief; every other sentence carries operative information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive four-parameter write with no output schema, the description covers size limits, encoding, approval, path resolution, and filesystem isolation, which is most of what an agent needs. It stops short of describing error behavior on missing files or whether directories are created.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is only 25% (only sandboxId is documented), so the description must compensate. It adds meaning for content (UTF-8, 64 KiB cap) and path (relative paths resolve at /workspace), but says nothing about the required `confirm` flag, leaving one of four parameters explained only by its const:true schema constraint.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource (write UTF-8 text to a sandbox) plus the scope constraint of 64 KiB, which clearly separates it from sandbox_read_file and sandbox_list_files. The phrase 'replacing an existing file' is ambiguous about whether it can create new files, which keeps it just short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives useful preconditions (user approval required, relative paths rooted at /workspace), so an agent knows how to call it. But it never says when to prefer this over sandbox_exec or repo_commit for putting content somewhere, and it does not state what happens if the target file does not exist.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
secrets_deleteDelete secretsADestructiveInspect
Use this when the user wants to remove one or more environment variables/secrets from a Lizard service or project. This is destructive and cannot be undone — requires explicit confirmation.
| Name | Required | Description | Default |
|---|---|---|---|
| keys | Yes | ||
| confirm | Yes | Must be true to proceed; there is no interactive confirmation in MCP | |
| project | Yes | ||
| service | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already declare destructiveHint=true and readOnlyHint=false, so the description's 'this is destructive and cannot be undone' largely restates that signal. It does add the useful operational fact that explicit confirmation is required and there is no interactive prompt path. It says nothing about partial-failure behavior when deleting multiple keys or what the response contains.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, front-loaded with the trigger condition, followed by the risk statement. No filler or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive four-parameter tool with no output schema and a 25% parameter coverage gap, the description covers the trigger and the danger but leaves the project/service/keys relationship unexplained. An agent can call it, but must infer which scoping parameter is required in which context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 25%: only `confirm` is documented in the schema. The description never explains that `keys` is an array of secret names, whether `service` is optional versus `project`, or how the two scoping params interact. With low coverage, the description was expected to compensate and largely does not.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb (remove) and a specific resource (environment variables/secrets) scoped to a service or project, which distinguishes it from secrets_list and secrets_set without needing to read the schema. It does not explicitly name sibling alternatives, but the action is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It states a clear trigger: 'when the user wants to remove one or more environment variables/secrets' from a service or project. It also flags that explicit confirmation is required. It stops short of naming adjacent tools (secrets_set, secrets_refs) as alternatives, so it falls below the top band.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
secrets_listList secretsARead-onlyIdempotentInspect
Use this when the user wants to see environment variables/secrets configured for a Lizard service or project. Values are masked by default; pass reveal:true to see actual values.
| Name | Required | Description | Default |
|---|---|---|---|
| reveal | No | ||
| project | Yes | ||
| service | No | Omit for project-wide (global) secrets |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly/idempotent/non-destructive, so the bar is lower, and the description still adds meaningful behavior: values are masked by default and reveal:true unmaskes them. It does not say whether revealing requires elevated permissions, whether the reveal is audited, or what the masked value looks like, so it stops short of 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, zero filler, with the usage trigger front-loaded and the security-relevant masking default second. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 3-parameter read tool with full annotation coverage and no output schema, the description covers the two things an agent could get wrong: the reveal/masking behavior and the service-omitted-means-global scoping. Nothing essential to correct invocation appears missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is only 33% (only `service` is documented), but the description compensates by explaining `reveal` semantics (masked by default, reveal:true for actual values) and, together with the schema note, the project-wide vs service-level scoping. It leaves `project` unexplained (required param, no format hint such as slug vs name).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a concrete verb+resource (view environment variables/secrets) scoped to a Lizard service or project, which cleanly separates it from secrets_set, secrets_delete and secrets_refs in the sibling list. It stops short of naming an alternative when the user wants references rather than values, so it is clear but not fully differentiated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
"Use this when the user wants to see environment variables/secrets configured for a Lizard service or project" gives an explicit trigger condition tied to user intent. There are no when-not conditions or pointers to sibling tools for related intents, keeping it below a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
secrets_refsList variable referencesBRead-onlyIdempotentInspect
Use this when the user wants to see the available reference-variable templates (like postgres connection strings) they can inject into another service's secrets.
| Name | Required | Description | Default |
|---|---|---|---|
| project | Yes | ||
| service | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false, so the safety profile is settled. The description adds useful framing that these are templates meant to be injected into another service's secrets. It does not say whether results are scoped or filtered by the project/service parameters, which matters behaviorally.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with the usage cue first and zero filler. Nothing redundant, nothing padded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema and no parameter documentation, so the description is the only place to explain what the returned templates look like and how project/service scope the list. It explains none of that, leaving an agent unable to predict the result set of a 2-param, low-coverage tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must carry the parameter burden and it does not: neither 'project' nor the optional 'service' is mentioned. The phrase 'inject into another service's secrets' only faintly hints at the service parameter's role and never explains whether omitting it lists across all services.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific resource (reference-variable templates such as postgres connection strings) and distinguishes it implicitly from raw secret listing by framing these as injectable templates. It stops short of naming sibling secrets_list to make the boundary explicit, but an agent can tell what is returned.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The 'Use this when the user wants to see...' clause gives a clear trigger condition, which is better than nothing. However, it offers no exclusions or alternatives — nothing says whether this replaces or complements secrets_list, or when to prefer secrets_list for actual secret values.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
secrets_setSet secretsADestructiveIdempotentInspect
Use this when the user wants to set one or more environment variables/secrets on a Lizard service or project. Overwrites existing values with the same key.
| Name | Required | Description | Default |
|---|---|---|---|
| values | Yes | Key-value pairs to set | |
| project | Yes | ||
| service | No | Omit to set project-wide (global) secrets |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true, idempotentHint=true, and readOnlyHint=false. The description adds concrete value by specifying what is destroyed: existing values with the same key are overwritten. It stops short of saying whether keys not listed are preserved or purged, and says nothing about auth requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, with the usage trigger front-loaded and the overwrite caveat second. Minor filler in 'Use this when the user wants to', but no redundancy overall.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with a nested key-value object and no output schema, the description is adequate but leaves a material question open: whether the call merges with or replaces the full secret set. Project identifier format and return behavior are also unaddressed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 67%; 'values' and 'service' are documented ('Omit to set project-wide (global) secrets'), while 'project' has no schema description at all. The description corroborates the service/global distinction but adds no format guidance for 'project' (ID vs. name) and does not say what happens with empty-string values. Baseline 3 for partial coverage is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('set') and resource ('environment variables/secrets') and scopes it to a Lizard service or project. It does not explicitly contrast with siblings like secrets_list, secrets_delete, or secrets_refs, but the verb itself is distinctive enough for an agent to route correctly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Use this when the user wants to set one or more environment variables/secrets' gives a clear trigger condition. It does not state exclusions (e.g. use secrets_refs to read, secrets_delete to remove) or prerequisites such as required permissions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
service_createCreate serviceADestructiveInspect
Use this when the user wants to create a new empty Lizard service, or deploy a repository as a new service: GitHub, or Lizard Git (lizard:owner/name, from repo_list). Omit repoUrl for an empty service you configure later; provide repoUrl to deploy that repo immediately; later pushes or commits to its branch deploy again. Calling this again creates another service, even with the same name — it does not update an existing one. A *.onlizard.com domain is assigned automatically, but not until the build finishes and the service boots — this response's domain field will be null right after creation, that is expected, not an error. Do not invent, guess, or predict a hostname to fill that gap. Tell the user the deploy is in progress and the domain isn't assigned yet; poll service_show or deploy_events and report the real domain value once it's non-null.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Service name | |
| region | Yes | Deployment region code — call region_list first if unsure of valid values, do not guess | |
| envVars | No | ||
| project | Yes | ||
| repoUrl | No | https URL, owner/name (GitHub) or lizard:owner/name (Lizard Git) — when provided, this becomes a deploy of that repo | |
| containerPort | No | ||
| skipInitialDeploy | No | With repoUrl: attach the repo but skip the initial build |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well past the annotations by disclosing non-idempotency in concrete terms ('calling this again creates another service, even with the same name'), the deferred-domain behavior, and an explicit anti-hallucination instruction about the null `domain` field. The 'later pushes or commits deploy again' note explains ongoing side effects that readOnlyHint/destructiveHint cannot convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the selection condition and every sentence carries operational weight, but the domain-null guidance is spread across three sentences ('that is expected', 'do not invent', 'tell the user...poll...') that restate the same instruction with some redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description takes on the return-value burden and does it: it explains the `domain` field's null-on-creation state, why it is null, and how to obtain the real value. For a mutation tool with nested envVars and a deferred build, nothing essential is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
At 57% schema coverage the description should compensate, and it does for repoUrl (the omit/provide fork and the deploy-on-push behavior are genuinely beyond the schema). But name, region, envVars, and containerPort get no treatment in the description, leaving a meaningful share of parameters carried by the schema alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource and immediately splits the two operating modes (empty service vs. repo deploy) with concrete repo formats. It also explicitly carves out the boundary against the update path by saying a repeat call creates another service, so an agent can distinguish this from service_set or service_rename without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit trigger ('use this when the user wants to create'), an explicit branch condition (omit repoUrl vs. provide repoUrl, with the consequence of each), and names the follow-up tools to use instead of guessing (service_show, deploy_events). The 'does not update an existing one' clause routes the update case away from this tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
service_deleteDelete serviceADestructiveInspect
Use this when the user wants to permanently delete a Lizard service (app or addon). This is destructive and cannot be undone — requires explicit confirmation.
| Name | Required | Description | Default |
|---|---|---|---|
| confirm | Yes | Must be true to proceed; there is no interactive confirmation in MCP | |
| project | Yes | ||
| service | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already declare destructiveHint=true and readOnlyHint=false, so the safety profile is structured. The description still adds real value by spelling out irreversibility ('cannot be undone') and that explicit confirmation is required, which tells the agent a precondition beyond the hint flags. It stops short of saying what is destroyed (volumes, domains, deploys) or whether the delete is immediate vs queued.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence with the use condition first and the danger warning second; no filler and nothing redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 3-parameter destructive tool with no output schema, the description covers the essential preconditions (permanence, confirmation). Minor gaps remain around identifier format for project/service and what collateral resources disappear, but nothing that would cause a wrong invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 33%: only 'confirm' is documented in the schema, while 'project' and 'service' are bare minLength-1 strings. The description hints at the confirmation requirement but never clarifies that 'project' and 'service' are identifiers/names or how to obtain them (e.g. from service_list or service_show). Partial compensation, not full.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: 'permanently delete a Lizard service (app or addon)'. The word 'permanently' and the explicit '(app or addon)' scope distinguish it from the many soft-state siblings like service_pause, service_resume, service_sleep_set, and service_scale.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives a clear triggering condition ('Use this when the user wants to permanently delete...'), which is a strong positive-selection cue. It does not explicitly name the non-destructive alternatives (service_pause / service_sleep_set), so an agent must infer that those are the right tools when the user only wants to stop a service.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
service_get_portGet container portBRead-onlyIdempotentInspect
Use this when the user wants to know which container port a Lizard app is listening on.
| Name | Required | Description | Default |
|---|---|---|---|
| project | Yes | ||
| service | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, destructiveHint=false and openWorldHint=false, so the safety profile is fully covered. The description adds no behavioral context of its own: nothing about what is returned, what happens if no port is configured, or any permission scoping.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with the trigger condition first and no filler. It is appropriately sized, though that economy comes at the cost of the missing parameter and return information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With two undocumented required parameters, no output schema, and no detail on what the tool returns (a port number? a mapping?), the description leaves an agent guessing on inputs and outputs. It is not adequate for a two-parameter lookup tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% for two required parameters, so the schema gives no meaning for 'project' or 'service'. The description never mentions either; the phrase 'a Lizard app' only loosely gestures at the service parameter and says nothing about how project and service combine to identify the target.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific read action ('know which container port ... is listening on') on a specific resource, which distinguishes it from the sibling mutation service_set_port. It is slightly informal in identifying the resource as a 'Lizard app' rather than naming the service/project parameters.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The opening clause 'Use this when the user wants to ...' gives an explicit trigger condition, which is more than most siblings offer. It does not state an exclusion or point to service_set_port as the write counterpart, so the when-not side is missing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
service_listList servicesARead-onlyIdempotentInspect
Use this when the user wants to see all apps and addons in a Lizard project.
| Name | Required | Description | Default |
|---|---|---|---|
| project | Yes | Project name, slug, or ID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already declare this as read-only, idempotent, non-destructive, and closed-world. The description adds only the listing scope, without covering pagination, authentication requirements, or whether stopped services are included, so it adds limited behavioral context beyond the structured metadata.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The definition is a single front-loaded sentence with no wasted text. It states the use case immediately and remains appropriately concise for a simple list operation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter read-only list tool with rich annotations and full schema coverage, the description is largely sufficient. It could be stronger by clarifying sibling boundaries or return scope, but nothing essential for invocation is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the single project parameter is already documented as accepting a name, slug, or ID. The description reinforces that the listing is scoped to a project but adds no syntax or format detail beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action and scope: seeing all apps and addons within a Lizard project. It is clearer than a bare name, but it does not explicitly distinguish the tool from nearby siblings such as service_show or project_list.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives a clear trigger: use this when the user wants to see all apps and addons in a project. It does not state exclusions or name alternatives like service_show for a single service, so it stops short of full routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
service_pausePause serviceADestructiveIdempotentInspect
Use this when the user wants to stop a Lizard service (app or database) without deleting it: it scales to 0, its URL answers 503 and a database refuses connections. Its URL, database host, port, password, settings and volumes are all kept, and nothing is billed for compute while paused. Undo with service_resume.
| Name | Required | Description | Default |
|---|---|---|---|
| project | Yes | Project name, slug, or ID | |
| service | Yes | App or database name or ID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Excellent disclosure of observable consequences the annotations cannot convey: scale-to-0, URL returns 503, database refuses connections, and URL/host/port/password/settings/volumes are preserved with no compute billing. One gap: annotations set destructiveHint=true while the description emphasizes nothing is lost and the action is fully reversible; the description never reconciles why this is flagged destructive, which could leave an agent unsure how much caution to apply.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences, front-loaded with the triggering condition, then the behavioral effects and the undo path. No filler and no repetition of the title.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter, no-output-schema state-change tool, the description covers trigger, effects, resource retention, billing, and reversal. Nothing an agent needs in order to call it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% with only two required params (project, service), each already documented in the schema as accepting name/slug/ID. The description adds no parameter guidance beyond what the schema provides, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (pause/stop) and resource (Lizard service, app or database), and explicitly separates itself from deletion ('without deleting it'), which is the key confusion against service_delete. It also names service_resume as the inverse, so an agent can distinguish it from every nearby sibling.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit trigger ('when the user wants to stop a Lizard service... without deleting it') and an explicit undo path ('Undo with service_resume'), plus the implications of pausing in concrete terms. The alternative (delete) and the reversal are both spelled out, leaving nothing to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
service_renameRename serviceBDestructiveIdempotentInspect
Use this when the user wants to rename an existing Lizard service.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | New name | |
| project | Yes | ||
| service | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and idempotentHint=true, but the description adds no behavioral context beyond the usage trigger. It does not warn about the consequences of renaming (e.g., dependent domains or DNS), nor mention permissions or reversibility. With annotations covering the safety profile, the description still leaves the destructive consequence unexplained.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no wasted words. It is appropriately concise, though its brevity contributes to the missing behavioral and parameter detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive mutation with three required parameters and no output schema, the description is too thin. It does not cover identifier expectations, rename consequences, or how the tool relates to service_set. An agent could invoke it but would be missing important context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 33%: only 'name' is described, as 'New name'. The description does not explain whether project and service are identifiers, slugs, or names, nor how the new name interacts with them. It fails to compensate for the low schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('rename an existing Lizard service'), so an agent can tell what it does without opening the schema. It does not differentiate from adjacent siblings like service_set, which also modifies a service, so it stops short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives an explicit trigger ('Use this when the user wants to rename...'), which is clear usage context. It offers no exclusions or alternatives, such as using service_set for unrelated configuration changes, so it is not fully routing-aware.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
service_resumeResume serviceADestructiveIdempotentInspect
Use this when the user wants to start a paused Lizard service (app or database) again. It comes back from the same image with the same URL, host, port, password, settings and data. Pausing or resuming one that already is does nothing.
| Name | Required | Description | Default |
|---|---|---|---|
| project | Yes | Project name, slug, or ID | |
| service | Yes | App or database name or ID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false, idempotentHint=true and destructiveHint=true, so the description doesn't need to restate safety. It does add real context beyond them: the service returns with the same image, URL, host, port, password, settings and data, and the no-op behavior reinforces the idempotency hint. It doesn't cover permissions or side effects like billing changes.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with the usage trigger, then what the agent gets back, then an edge case. Every sentence earns its place, though the final clause is slightly awkwardly worded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter tool with full schema coverage and annotations covering safety, the description supplies the missing behavioral picture: state preservation and idempotency. No output schema exists, but the 'it comes back with the same ...' sentence effectively communicates what to expect, so only minor gaps remain.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and both parameters are documented, so baseline is 3. The description's mention of 'app or database' restates what the service schema already says and adds no new syntax or format guidance for project or service.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('start a paused Lizard service (app or database) again'), which is clearly distinct from service_pause and from workspace_resume. An agent can identify the operation without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The opening sentence gives a clear trigger condition: the user wants to start a paused service again. The closing sentence adds that pausing/resuming an already-satisfied target is a no-op, which further pins down when calling is meaningful. It stops short of naming sibling alternatives explicitly (e.g., service_pause, project_resume).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
service_scaleScale serviceBDestructiveIdempotentInspect
Use this when the user wants to change replica count, CPU, memory, or storage limits for a Lizard service.
| Name | Required | Description | Default |
|---|---|---|---|
| cpu | No | CPU cores, apps only | |
| memory | No | Memory in MB, apps only | |
| project | Yes | ||
| service | Yes | ||
| storage | No | Storage in MB, addons only, grow-only | |
| replicas | No | Apps only |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true, idempotentHint=true, and readOnlyHint=false, so safety is covered. The description adds no behavior of its own: it does not explain that scaling is destructive/restarting, that storage is grow-only (only the schema says this), or what happens on invalid app-vs-addon combinations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no hedging or redundant restatement of the title. It is efficient, though arguably too terse for a multi-parameter destructive mutation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive, 6-parameter mutation with no output schema, the description leaves out app-vs-addon applicability rules, whether scale-down is permitted for storage, and any indication of the response. An agent must open the schema to call this safely, and even then storage's grow-only constraint is the only warning present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 67% and per-field descriptions already note 'apps only', 'addons only, grow-only', and ranges. The description only echoes the four scaling dimensions and adds no syntax, constraints, or examples beyond what the schema provides, so this sits at the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a concrete verb-and-resource combination (change replica count, CPU, memory, or storage limits) for a named entity (a Lizard service), so an agent knows exactly what the tool mutates. It stops short of distinguishing itself from similar siblings such as service_set or volume_resize, which an agent could easily confuse with this.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Use this when the user wants to change replica count, CPU, memory, or storage limits' gives a positive-use condition, but it never says when to prefer service_set, workspace_limits_set, or volume_resize instead, nor does it state prerequisites like the service needing to be an app vs an addon.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
service_setSet service build/deploy configBDestructiveIdempotentInspect
Use this when the user wants to change a Lizard service's build/deploy configuration — source repo, branch, build command, start command, etc.
| Name | Required | Description | Default |
|---|---|---|---|
| force | No | Skip the optimistic-concurrency revision check | |
| branch | No | ||
| project | Yes | ||
| repoUrl | No | ||
| service | Yes | ||
| sourceType | No | ||
| buildCommand | No | ||
| startCommand | No | ||
| containerPort | No | ||
| rootDirectory | No | ||
| watchPatterns | No | ||
| dockerfilePath | No | ||
| preDeployCommand | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false, destructiveHint=true, and idempotentHint=true, so the safety profile is covered by structured data. The description adds the scope of mutation (build/deploy config fields), but omits critical behavioral facts: whether unspecified fields are replaced or preserved, what happens on a revision conflict, and when 'force' should be used.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence that opens with the usage trigger and leads with the resource. Zero padding, though the brevity is partly the source of the missing detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
A 13-parameter destructive mutation with 8% schema coverage and no output schema needs substantially more description than one sentence. An agent cannot know merge-vs-replace semantics, conflict handling, or value formats for most parameters.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 8% (just the 'force' flag), so the description carries the burden for 13 parameters. It names roughly four field families (repo, branch, build command, start command) with no format, allowed values for sourceType, or glob syntax for watchPatterns, leaving most parameters undocumented in both places.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('change') and resource ('a Lizard service's build/deploy configuration') and enumerates representative fields, so an agent can tell it apart from service_create, service_rename, or service_scale. It stops short of naming a sibling explicitly, but the resource is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The 'Use this when the user wants to change...' framing gives an implied trigger condition, but there are no exclusions and no guidance on related tools that an agent would plausibly reach for instead (config_apply, service_create, service_show to inspect the current config first).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
service_set_portSet container portCDestructiveIdempotentInspect
Use this when the user wants to change the container port a Lizard app listens on.
| Name | Required | Description | Default |
|---|---|---|---|
| project | Yes | ||
| service | Yes | ||
| containerPort | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and idempotentHint=true, so the safety profile is covered. However, the description adds nothing about the consequences of a port change (traffic/routing breakage, need for redeploy, restart requirements), which is exactly the context a destructive mutation should surface.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no wasted words. It is efficient, though its brevity comes at the cost of the behavioral detail noted above.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, no annotation explanation needed, but 0% parameter documentation and an unconstrained integer port leave an agent guessing about valid inputs and post-call effects. Insufficient for a destructive, three-required-parameter mutation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for three required parameters and does not. Critically, the schema constrains containerPort only as any integer (negatives allowed) with no valid port range, and the description does not clarify valid values or what project/service identifiers look like.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb+resource: change the container port a Lizard app listens on. It is clearly distinguishable from read-only siblings like service_get_port, though it never mentions that a project and service must be identified to target the app.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
"Use this when the user wants to change the container port" gives a usage trigger, but there are no exclusions or alternatives — nothing distinguishes it from service_set, service_get_port, or sandbox_expose_port, which all touch port configuration.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
service_showShow service detailsBRead-onlyIdempotentInspect
Use this when the user wants details about a single Lizard service (app or addon) — status, config, resource limits.
| Name | Required | Description | Default |
|---|---|---|---|
| project | Yes | ||
| service | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, non-destructive, closed-world. The description adds useful context about what information is returned (status, config, resource limits), which annotations don't cover. It does not mention auth requirements, error behavior, or whether fields are truncated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One compact sentence, front-loaded with the usage trigger and ending with the returned content. No wasted words, though the em-dash clause could be split for scannability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter read tool with full annotation coverage, the description covers purpose and return content adequately. However, it leaves both required parameters undocumented and says nothing about identifier formats, which matters at 0% schema coverage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% for both required parameters (project, service), so the description must compensate – but it never explains what 'project' or 'service' identifiers are or their formats. 'Single Lizard service' hints at the service param only.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a clear verb ('wants details about') and resource ('a single Lizard service (app or addon)'), and lists the concrete data surfaced (status, config, resource limits). The word 'single' implicitly distinguishes it from service_list, but no sibling is named explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives a when-to-use trigger ('when the user wants details about a single service') and implicitly contrasts with list operations, but names no alternative tool and gives no exclusions or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
service_sleep_setTurn serverless on or offADestructiveIdempotentInspect
Use this when the user wants a Lizard service to be serverless (sleep when idle) or always on. On: with no traffic for idleMinutes (5-1440, default 15) it sleeps with its memory saved, costs almost nothing, and the next request or connection wakes it in about a second. Turning it on restarts the service once. Works for apps with one replica and a port, and for Postgres/Redis databases; the error says why otherwise.
| Name | Required | Description | Default |
|---|---|---|---|
| enabled | Yes | true: sleep when idle; false: always on | |
| project | Yes | Project name, slug, or ID | |
| service | Yes | App or database name or ID | |
| idleMinutes | No | Minutes without traffic before it sleeps |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the annotations by disclosing the concrete side effect that makes this destructive — 'turning it on restarts the service once' — plus idle cost, memory preservation, ~1 second wake latency, and that unsupported services return an explanatory error. That is exactly the context an agent needs before committing a destructiveHint mutation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the trigger condition, then modal behavior, then side effects and eligibility. Four dense sentences with no filler, though the final eligibility sentence is slightly compressed into a run-on.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema and no nested objects, so the description carries the full burden and does: trigger, both modes, idle default and range, restart side effect, cost/latency behavior, eligibility limits, and error reporting are all covered.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds information the schema lacks: the default of 15 for idleMinutes (the schema declares only min/max, no default) and the semantic contrast between enabled=true (sleep) and false (always on).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Names a specific verb (turn on/off serverless sleep) and resource (a Lizard service), and states both modes explicitly, so an agent can distinguish it from service_pause, service_resume and service_sleep_status without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Opens with a clear triggering condition ('when the user wants a service to be serverless or always on') and lists eligibility (one replica and a port, or Postgres/Redis), which implicitly tells the agent when not to use it. It stops short of naming the nearest alternative tools (service_pause vs. sleeping) explicitly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
service_sleep_statusServerless statusARead-onlyIdempotentInspect
Use this when the user asks whether a Lizard service (app or Postgres/Redis database) is serverless, i.e. sleeps when idle: returns enabled, idleMinutes, how many times it slept and woke, and the last error if it could not sleep.
| Name | Required | Description | Default |
|---|---|---|---|
| project | Yes | Project name, slug, or ID | |
| service | Yes | App or database name or ID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint and non-destructive, so the safety profile is covered; the description adds genuine value by listing exactly what the response contains, including the last error if the service could not sleep. It does not discuss permissions or behavior when the service is not serverless-enabled, which keeps it below a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One sentence, front-loaded with the usage trigger, and the return payload is spelled out without filler. It is dense but every clause carries information; slight density is the only knock.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With full schema coverage and rich annotations but no output schema, the description does exactly the remaining work: it tells the agent what the call returns. Nothing needed to select or invoke it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so both parameters are already documented, and the description's parenthetical about app-vs-database services largely restates the schema's 'App or database name or ID'. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action and resource: it reports whether a Lizard service (app or Postgres/Redis database) is serverless/sleeps when idle, and enumerates the returned fields (enabled, idleMinutes, sleep/wake counts, last error). That field list clearly separates it from service_show and service_sleep_set.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives an explicit trigger: 'Use this when the user asks whether a Lizard service ... is serverless, i.e. sleeps when idle.' There is no explicit exclusion naming the sibling to use for changing the setting (service_sleep_set), but the read-only framing makes the boundary reasonably clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
template_deployDeploy templateADestructiveInspect
Deploy a template as a new project in the chosen workspace. Read template_show first and supply required placeholderValues. Each call creates another project and may incur charges. Do not retry a partial failure blindly: inspect the returned project first.
| Name | Required | Description | Default |
|---|---|---|---|
| template | Yes | Template ID or slug | |
| projectName | Yes | ||
| workspaceId | Yes | ||
| placeholderValues | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and idempotentHint=false, but the description adds cost/charge consequences, the non-idempotent 'each call creates another project' framing, and recovery advice for partial failures. That is substantive context beyond the structured fields.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four short sentences, front-loaded with the action and prerequisite, then the risk note, then the failure-handling caveat. Every sentence earns its place, though the phrasing is slightly terse in the retry clause.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive, non-idempotent create with no output schema, the description covers the main risks and the pre-read step; the returned project is referenced for inspection. Remaining gap is naming/workspace parameter semantics rather than behavioral risk.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 25%, so the description carries extra burden. It usefully notes that placeholderValues must be sourced from template_show and are required in practice, but projectName (100-char limit, naming rules) and workspaceId are left unexplained, so the gap is only partially closed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Deploy a template as a new project') plus the scope ('in the chosen workspace'), which distinguishes it from siblings like project_create and template_show. An agent can tell immediately what this produces and where.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit prerequisite routing: 'Read template_show first and supply required placeholderValues', plus a warning that each call creates another project and may incur charges. It also tells the agent not to retry blindly on partial failure, which is exactly the when-not guidance an agent needs on a repeat-charge mutation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
template_listList templatesARead-onlyIdempotentInspect
Find published app templates to deploy. Set mine to list your own templates, including private ones. Use template_show to inspect required variables before deploying.
| Name | Required | Description | Default |
|---|---|---|---|
| mine | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, non-destructive, and closed-world, so the safety profile is covered. The description adds meaningful context the annotations don't: the default visibility filter (published only) versus the private-inclusive scope when mine is set. It doesn't describe pagination or return shape, but for a simple list tool that's a minor gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with the primary purpose, then the parameter behavior, then the follow-up tool. Zero filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter read-only list tool with rich annotations and no output schema, the description covers purpose, filtering behavior, and the natural next step. Return value details are not needed absent an output schema, though a hint that results are what you feed into template_deploy would tighten it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description carries the burden for the single `mine` parameter, and it does explain what setting it does ('list your own templates, including private ones'). That is genuine semantic value beyond the bare boolean schema; only the exact default value (false) is left implicit.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Find published app templates') and clarifies the scope is deployable published templates, which distinguishes it from template_show and template_deploy in the sibling list. An agent can immediately tell this is the discovery step of the template workflow.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states the default behavior (published templates), the condition for the alternative ('Set mine to list your own templates, including private ones'), and routes to template_show before deploying. Both when-to-use and a named next-step alternative are present.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
template_showShow templateARead-onlyIdempotentInspect
Read a template's services, addons and required variables before deployment. Pass the ID or slug returned by template_list.
| Name | Required | Description | Default |
|---|---|---|---|
| template | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false, so safety is covered; the description adds the return payload (services, addons, required variables), which matters because there is no output schema. It does not cover what happens on an unknown ID or whether the read is scoped to a workspace, but that is a minor residual gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, zero filler, with the purpose and the parameter-sourcing instruction both front-loaded. Nothing is repeated from the title or annotations.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter read tool with no output schema, the description supplies both the input source convention and the shape of the returned data. Missing only error/not-found behavior and whether output is workspace-scoped, which are minor for this tool class.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the single parameter is completely undocumented structurally. The description compensates by stating the accepted value types (ID or slug) and where to obtain them (template_list), which is exactly the missing information an agent needs to fill the field.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Read) and resource (template) and enumerates what is returned: services, addons, required variables. The phrase 'before deployment' distinguishes it from template_deploy, and naming template_list as the source of IDs separates it from the list tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Read ... before deployment' gives a clear usage context, and the instruction to pass an ID or slug from template_list establishes the prerequisite chain. It stops short of explicit exclusions or a direct 'use template_deploy to actually deploy' contrast, but the implied workflow is easy to infer.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
volume_createCreate volumeADestructiveInspect
Create a persistent volume. Without service: a sandbox volume in the project, to attach with sandbox_create's volume (it must be in the sandbox's region); the size defaults to the project's default and must be within its limits. With service: a volume attached to that app at mountPath (default /data), one per app; the app restarts with it mounted and files there survive restarts and redeploys. Volumes are billed for their size until deleted.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Lowercase letters, digits and dashes, up to 64 | |
| region | No | Sandbox volumes: region code (region_list) | |
| sizeGb | No | Size in GB | |
| project | Yes | Project name, slug, or ID | |
| service | No | App name or ID to attach the volume to | |
| mountPath | No | With service: absolute path, default /data |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Adds substantial behavior the annotations cannot convey: attaching to an app restarts it with the volume mounted, files survive restarts and redeploys, only one volume per app, and volumes are billed for their size until deleted. This surfaces both the cost consequence and the restart side effect of an otherwise ordinary-looking create call, which is exactly what an agent needs before invoking it.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Tightly front-loaded with the core action first, then the two modes, then billing. The nested parentheticals make the mode sentences dense, but essentially every clause carries a constraint an agent would otherwise get wrong.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a six-parameter creation tool with full schema coverage, annotations covering mutability/safety, and no output schema, the description covers the remaining gaps: mode selection, placement constraint, defaults, the app restart side effect, and ongoing billing. Nothing material for calling it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is already 100%, so the baseline is 3, but the description adds meaning beyond the field blurbs: region must match the target sandbox's region, sizeGb defaults to the project default and is bounded by project limits, and mountPath defaults to /data and only applies with service. Uniqueness of name within a project is never clarified, which keeps it off a 5.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Create a persistent volume') and then splits the outcome into two concrete modes: a sandbox volume when 'service' is omitted, an app-attached volume when 'service' is given. An agent can tell immediately which shape of resource it gets, and the cross-reference to sandbox_create's volume parameter further disambiguates it from unrelated create tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit conditions for each mode (omit service for sandbox use; provide service for app attachment, one per app) plus constraints: the sandbox volume 'must be in the sandbox's region' and the size 'must be within its limits'. It does not name adjacent tools such as volume_resize or volume_list as alternatives, so routing versus siblings is left partly implicit, but the within-tool decision guidance is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
volume_deleteDelete volumeADestructiveInspect
Permanently delete a volume and every file on it. Without service: a sandbox volume; one attached to a sandbox can't be deleted, so delete the sandbox first. With service: that app's volume; it is detached first and the app restarts without it. Delete an app's volume before deleting its project: a project in trash keeps it for 3 days. Get the user's approval before calling; this cannot be undone.
| Name | Required | Description | Default |
|---|---|---|---|
| volume | Yes | Volume name or ID (from volume_list) | |
| confirm | Yes | Set only after the user approves deleting this volume and its files | |
| project | Yes | Project name, slug, or ID | |
| service | No | The app the volume is attached to, to delete an app's volume |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and idempotentHint=false, and the description goes further: it discloses the detach-then-restart side effect on the app, the 3-day project-trash retention, the irreversibility, and the approval requirement. This is exactly the extra context annotations can't convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the destructive outcome, then packed with conditional clauses that each carry information. The telegraphic fragments ('Without service: a sandbox volume') are dense but readable; no sentence is filler, though the density borders on cramped.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, yet the description covers side effects, ordering constraints, blockers, and the approval gate for a 4-parameter destructive tool. Nothing an agent needs in order to call this safely is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds meaning the schema can't: the presence or absence of `service` selects between two different deletion behaviors, including an app restart. It also reinforces that `confirm` gates on explicit user approval of file loss.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Permanently delete a volume and every file on it') and immediately disambiguates two operating modes (sandbox volume vs. app volume) that distinguish it from siblings like volume_resize or sandbox_delete. An agent knows exactly what gets destroyed.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit branching guidance: omit service for a sandbox volume, supply it for an app volume, and the two mutual-exclusion rules ('a volume attached to a sandbox can't be deleted, so delete the sandbox first'). It also gives ordering advice (delete the app's volume before the project) and a hard prerequisite (get user approval first).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
volume_listList volumesARead-onlyIdempotentInspect
Use this when the user wants to see persistent volumes. Without service: the project's sandbox volumes — name, id, size (sizeGb), status, region, how much is used (lastUsedBytes), and the sandbox it is attached to, if any. With service: the volume attached to that app and where it is mounted.
| Name | Required | Description | Default |
|---|---|---|---|
| project | Yes | Project name, slug, or ID | |
| service | No | An app name or ID: list its volume instead |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish that this is a safe, idempotent read operation. The description adds useful behavioral detail beyond annotations: it lists the returned fields and explains that supplying 'service' changes the query from all sandbox volumes to a specific app volume and mount location.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short, front-loaded with the usage trigger, and then immediately explains the two operational modes and the returned data. Every sentence carries information needed to invoke or interpret the tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description appropriately names the important return fields (name, id, sizeGb, status, region, lastUsedBytes, attached sandbox). It is nearly complete for a simple read-only list tool, though it does not discuss pagination, empty results, or error cases.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so both parameters are already documented. The description still adds semantic value by clarifying the meaning of the optional 'service' parameter: without it, the tool lists project sandbox volumes; with it, the tool returns the volume attached to that app and where it is mounted.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('see persistent volumes') and explains the two scopes: project sandbox volumes by default, or the volume attached to a given app when 'service' is supplied. This is specific enough to distinguish it from volume_create, volume_resize, and volume_delete.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives a clear trigger ('Use this when the user wants to see persistent volumes') and explains the branch between omitting and supplying 'service'. It does not name alternatives or exclusions, but the usage context is explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
volume_resizeResize volumeADestructiveIdempotentInspect
Use this when the user wants a bigger persistent sandbox volume. It grows in place and online: no data is copied and an attached sandbox keeps running. A volume cannot shrink (volume_shrink_unsupported), except an older one, which can if at least 10% of the new size stays free (volume_too_full_to_shrink otherwise). Calling again with the current size is a no-op. Allowed sizes are per project (minSizeGb/maxSizeGb); the server rejects anything outside that range with invalid_volume_size, so do not assume a maximum. Returns the updated volume. grownInSandbox false means the attached sandbox still sees the old size until a sandbox next mounts the volume; sizeEnforced false means the region does not enforce the size as a hard limit. Other error codes: volume_not_resizable, volume_resize_in_progress (retry shortly), volume_not_provisioned, volume_capacity_unavailable (no room on the machine to grow), volume_resize_timeout (size left unchanged; safe to retry).
| Name | Required | Description | Default |
|---|---|---|---|
| sizeGb | Yes | New size in GB (whole number, at least 1) | |
| volume | Yes | Volume name or ID (from volume_list) | |
| project | Yes | Project name, slug, or ID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already flag mutation (readOnlyHint=false) and idempotency, but the description adds substantial context beyond them: online in-place growth, no data copying, the attached sandbox keeps running, irreversibility of shrink, and a detailed error taxonomy with retry safety. It does not contradict the destructiveHint; it clarifies exactly what changes and what cannot be undone.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the usage condition and the core behavior before the error details. It is dense and somewhat long, but every clause carries operational information (shrink rules, no-op, project limits, return flags, error codes), so little is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, yet the description explains the returned fields (grownInSandbox, sizeEnforced) and their meaning, plus the major error outcomes including whether retries are safe. That is sufficient for an agent to call the tool and interpret the result correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already defines the three parameters. The description adds meaningful server-side semantics: allowed sizes are per project (minSizeGb/maxSizeGb), the server rejects out-of-range values with invalid_volume_size, and the agent should not assume a fixed maximum. That is more than the schema's generic minimum of 1.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('resize ... persistent sandbox volume') and immediately scopes it to growth only, distinguishing it from create/delete siblings. The first sentence tells an agent exactly what the tool does and for what object.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says when to use it ('when the user wants a bigger persistent sandbox volume') and covers the negative case ('A volume cannot shrink') along with the edge-case exception. It also tells the agent that same-size calls are no-ops, so retry/repeat behavior is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
whoamiWho am IARead-onlyIdempotentInspect
Use this when you need to identify the currently authenticated Lizard user, e.g. before asking which workspace or project to act on.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare this as a safe, read-only, idempotent, non-destructive, closed-world operation. The description reinforces that it is an identity lookup but adds no further behavioral detail such as what identity fields are returned or any authentication/prerequisite behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no wasted text. It leads directly with the usage condition and purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter read-only identity tool with annotations covering safety, the description is nearly complete. It could say more about the returned identity fields, but the core need is sufficiently addressed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the schema imposes no semantic burden and the baseline is 4. The description correctly frames the call as requiring no input.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: identify the currently authenticated Lizard user. It is clearly distinct from all sibling tools, which manage workspaces, projects, services, and resources rather than authentication identity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives a clear usage context: call it before asking which workspace or project to act on. It does not name exclusions or alternatives, but this is a simple identity lookup where no close sibling alternative exists.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
workspace_createCreate workspaceADestructiveInspect
Create a new workspace when the user asks for one. Check workspace_list first. Each call creates another workspace; retries do not reuse the first one.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false, idempotentHint=false, and destructiveHint=true, so the safety profile is covered structurally. The description adds genuine, non-redundant context by spelling out the practical consequence of non-idempotency: each call creates another workspace and retries do not reuse the first one. It does not mention the destructiveHint=true warning (that these operations can have broad effects) or any auth or rate-limit constraints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, each one carrying a distinct payload: the action, the pre-check, and the retry hazard. The most important operational warning (retries create duplicates) is placed last as a deliberate caution.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description should tell the agent what it gets back — e.g. a workspace identifier that later tools like workspace_pause or workspace_delete require. That is missing, as is any explanation of the 'name' parameter, leaving an agent unable to reason about the result of the call.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the description never mentions the single parameter 'name' at all — no constraints (1-80 chars), no uniqueness expectation, no format guidance. For a tool whose only input is the workspace name, leaving it entirely unaddressed is a clear gap the schema cannot fill on its own.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource ('Create a new workspace') and names the sibling it should be paired with (workspace_list). It's clear enough that an agent can distinguish it from the ~80 sibling tools, though it adds nothing about what a workspace actually is in this system.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives an explicit trigger ('when the user asks for one') and an explicit prerequisite ('Check workspace_list first'), which is real routing guidance. It stops short of covering alternatives such as whether to reuse, rename, or resume an existing workspace instead of creating one.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
workspace_deleteDelete workspaceADestructiveInspect
Delete an empty workspace (owner only; not the personal one). The platform refuses while it still has live projects, sandboxes or volumes and says what is left. Requires the user's confirmation.
| Name | Required | Description | Default |
|---|---|---|---|
| confirm | Yes | Set only after the user approves deleting this workspace | |
| workspaceId | Yes | Workspace ID (see workspace_list) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With destructiveHint=true already declared, the description adds real value beyond annotations: the ownership requirement, the personal-workspace exclusion, and the specific failure mode (platform refuses and reports what is left behind). The confirmation requirement is also surfaced.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, each carrying a distinct constraint: eligibility, refusal behavior, and confirmation. The key restriction is front-loaded and nothing is redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter destructive tool with no output schema, the description covers eligibility, authorization, failure behavior, and the confirmation protocol. An agent has everything needed to decide whether to call it and what to expect on refusal.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so both parameters are already documented, including the const:true constraint on confirm and the workspace_list pointer for workspaceId. The description reinforces the confirmation gate but adds no syntax or format detail beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (delete) and resource (workspace) plus scoping constraints: must be empty, owner-only, and not the personal workspace. This separates it from project_delete and workspace_pause well enough, though it does not explicitly name those siblings as alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear preconditions for use (empty workspace, owner role, non-personal) and explains that the platform refuses while live projects, sandboxes or volumes remain. It stops short of naming which alternative to reach for when the workspace is non-empty (e.g. project_delete or volume_delete).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
workspace_limits_getRead workspace limitsARead-onlyIdempotentInspect
Use this when the user asks what a workspace may run at once, or a call failed with WORKSPACE_SANDBOX_LIMIT or WORKSPACE_USAGE_LIMIT. Returns limits (maxRunningSandboxes, maxCpuVcpus, maxMemoryMb, maxDiskGb; null = no limit) and usage now (runningSandboxes, cpuVcpus, memoryMb, diskGb). CPU and memory are what the workspace's apps and databases use, measured every ~10 s; disk is what its databases and volumes hold.
| Name | Required | Description | Default |
|---|---|---|---|
| workspaceId | Yes | Workspace ID (see workspace_list) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish the safe read-only/idempotent profile, and the description adds genuinely non-obvious behavior: null means no limit, CPU/memory usage reflects apps and databases sampled roughly every 10 seconds, and disk reflects database and volume storage. Those semantics materially change how an agent interprets the numbers and are unavailable anywhere else.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no waste: the first covers when to call, the second covers the return shape and measurement semantics. Front-loaded and tightly scoped to what an agent needs before invoking.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description carries the burden of explaining return values and does so completely — every returned field is named and interpreted, including the null-means-unlimited convention and the freshness of usage data. Nothing needed for a correct call is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one parameter, workspaceId, and the schema already documents it at 100% coverage with a pointer to workspace_list. The description adds no further parameter detail, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource — reads a workspace's limits and current usage — and enumerates the exact fields returned. It is unmistakably distinct from the sibling workspace_limits_set (which writes) and from metrics_get (which returns runtime metrics).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives two concrete invocation triggers: the user asking what a workspace may run at once, and a prior call failing with WORKSPACE_SANDBOX_LIMIT or WORKSPACE_USAGE_LIMIT. It stops short of explicit when-not guidance or naming workspace_limits_set as the alternative for changing limits, so it is clear context rather than full routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
workspace_limits_setSet workspace limitsADestructiveIdempotentInspect
Cap what a workspace may run at once (owner only, with a key that has no scopes). A field left out stays as it is; null removes that limit. Past maxRunningSandboxes a sandbox create, fork or resume fails with WORKSPACE_SANDBOX_LIMIT. While CPU, memory or disk use is at a cap, deploys, restarts, scale-ups, new databases and volume growth fail with WORKSPACE_USAGE_LIMIT; running services keep running and data stays.
| Name | Required | Description | Default |
|---|---|---|---|
| maxDiskGb | No | GB its databases and volumes may hold | |
| maxCpuVcpus | No | vCPU its apps and databases may be using | |
| maxMemoryMb | No | MB its apps and databases may be using | |
| workspaceId | Yes | Workspace ID (see workspace_list) | |
| maxRunningSandboxes | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare destructiveHint=true and idempotentHint=true, and the description goes well beyond that: it discloses owner-only auth and scope requirements, patch semantics (omitted field is preserved, null removes), and the exact downstream failure modes (WORKSPACE_SANDBOX_LIMIT on create/fork/resume, WORKSPACE_USAGE_LIMIT on deploys/restarts/scale-ups/volume growth) plus the reassurance that running services and data survive. This is exactly the behavioral context annotations cannot carry.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core action and the auth precondition, then the update semantics, then consequences. Dense with no filler, though the third sentence packs several consequence clauses together and could be split for scanability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive, no-output-schema mutation with 5 params, the description supplies auth requirements, patch semantics, and full downstream impact. Remaining gaps are minor: it does not say what the call returns or what error a non-owner receives.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 80% schema coverage the schema already documents four of five params, but the description adds the crucial semantics the schema lacks: omitted means unchanged and null means clear the limit. It also explains maxRunningSandboxes, the one param with no schema description, through the sandbox-limit failure narrative. It does not state units or accepted ranges, hence not a 5.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
"Cap what a workspace may run at once" names a specific verb (cap/set) and resource (workspace resource limits), and the enumeration of affected dimensions (sandboxes, CPU, memory, disk) makes it unmistakably the write counterpart to workspace_limits_get. An agent can tell what this does without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states the caller precondition (owner only, key with no scopes), which is the main gate on invoking it. It also describes what happens when limits are hit, giving the agent context for when setting limits matters. It does not name workspace_limits_get as the read alternative, so it falls short of a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
workspace_listList workspacesARead-onlyIdempotentInspect
Use this when the user wants to see which Lizard workspaces they belong to, or needs a workspace ID to scope a project lookup.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false, and openWorldHint=false, so the safety profile is fully covered. The description adds that results are membership-scoped and that IDs can be reused for scoping, but says nothing about ordering, pagination, or empty-result behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence beginning with 'Use this when' that carries both the trigger and the follow-on use of the returned IDs. Nothing superfluous.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, read-only list tool whose safety profile is fully covered by annotations, the description supplies the essential trigger and the downstream purpose of the returned IDs. Only the shape of the returned workspace records is left implicit, which is a minor gap given there is no output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so the baseline is 4; there are no argument semantics for the description to explain. The description correctly implies a no-input call.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: listing the Lizard workspaces the user belongs to, including the membership scope ('they belong to'). It is clearly distinct from mutating siblings like workspace_create or workspace_delete, though it doesn't explicitly contrast with whoami or domain_owned_list.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives concrete triggering conditions: the user wants to see their workspaces, or needs a workspace ID to scope a project lookup. No explicit when-not or named alternative, but the intended context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
workspace_pausePause workspaceADestructiveIdempotentInspect
Use this when the workspace owner wants to stop every service in every project of a workspace without deleting anything (same as project_pause for each project). Owner only. Undo with workspace_resume.
| Name | Required | Description | Default |
|---|---|---|---|
| workspaceId | Yes | Workspace ID (see workspace_list) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true, idempotentHint=true and readOnlyHint=false, so safety profile is largely covered. The description adds what annotations cannot: the owner-only permission requirement, the blast radius (all services in all projects), and the reversibility path via workspace_resume. It does not mention effects on in-flight traffic or whether individual services need re-resume.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Effectively two short sentences: the trigger and scope first, then auth and undo. The parenthetical equating it to project_pause is the most information-dense clause and nothing is redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter mutation with no output schema and full annotation coverage, the description supplies scope, permissions, and the undo tool. Only the post-call state of paused services (do they remain paused indefinitely, are they resumable individually) is left implicit.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one parameter and the schema already documents workspaceId at 100% coverage, including the workspace_list pointer. The description adds no format or sourcing detail beyond the schema, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (stop) and resource (every service in every project of a workspace), and explicitly equates it to project_pause applied per project. This clearly separates it from project_pause, service_pause, and workspace_delete in the sibling list.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit trigger (owner wants to stop all services across the workspace), an explicit exclusion versus the delete siblings ("without deleting anything"), and names the inverse tool (workspace_resume). An agent can route between pause/resume/delete without opening any schema.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
workspace_resale_pricing_getRead resale pricesARead-onlyIdempotentInspect
Read the prices a workspace's scoped API keys are shown, as multiples of Lizard's (owner only, with a key that has no scopes). Returns enabled and multipliers per resource: cpu, memory, storage (volumes), egress, objectStorage, sandbox.
| Name | Required | Description | Default |
|---|---|---|---|
| workspaceId | Yes | Workspace ID (see workspace_list) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly/idempotent/non-destructive, so the safety profile is covered. The description earns credit by adding the authorization model (owner-only, unscoped key) and the shape of the payload ('enabled and multipliers per resource: cpu, memory, storage (volumes), egress, objectStorage, sandbox'), which is valuable given no output schema. It stops short of saying what an unauthorized call returns.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One dense sentence with the action and the access constraint front-loaded, followed by the field enumeration. Efficient, though the parentheticals ('as multiples of Lizard's', '(volumes)') make it slightly packed.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter read tool with no output schema, the description covers what is returned and who may call it. The only gap is failure behavior for non-owner or scoped keys, which a caller would want before invoking.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the single workspaceId param is already documented in-schema with a pointer to workspace_list. The description adds nothing about parameters, which is acceptable at this coverage level but no better than baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Read') plus the exact resource ('the prices a workspace's scoped API keys are shown, as multiples of Lizard's') and enumerates the returned fields. This is unambiguously distinct from the sibling workspace_resale_pricing_set and from workspace_limits_get.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives a clear precondition for use: 'owner only, with a key that has no scopes'. It does not explicitly name the write counterpart or state what to do when the caller lacks owner rights, so the routing guidance is strong but not complete.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
workspace_resale_pricing_setSet resale pricesADestructiveIdempotentInspect
For a reseller: set the prices that keys scoped to this workspace (or its projects) see, as multiples from 1 to 100 of Lizard's, per resource. Resources not passed keep their current multiplier; off: true turns resale prices off. Only what scoped keys are shown changes: the owner's dashboard, unscoped keys and the owner's bill keep Lizard's prices. Owner only, with a key that has no scopes.
| Name | Required | Description | Default |
|---|---|---|---|
| cpu | No | ||
| off | No | Turn resale prices off | |
| egress | No | ||
| memory | No | ||
| sandbox | No | ||
| storage | No | Volumes | |
| workspaceId | Yes | Workspace ID (see workspace_list) | |
| objectStorage | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations (readOnlyHint=false, idempotentHint=true, destructiveHint=true), the description discloses partial-update semantics ('resources not passed keep their current multiplier'), the off switch, and, crucially, the blast radius: the owner's dashboard, unscoped keys and the owner's bill keep Lizard's prices. That impact scoping is exactly the context an agent needs before invoking a mutation with destructiveHint=true.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose comes first, then partial-update semantics, then the scope of effect, then the authorization requirement. No sentence is filler, and the parenthetical about projects is the only mild redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an 8-parameter mutation with no output schema, the definition covers who may call it, what it changes, what it leaves alone, and how omitted fields behave. It does not say whether off can be combined with multipliers or what the response looks like, but the essentials for correct invocation are present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With only 38% schema description coverage, the description compensates well: it explains that the numeric parameters are multipliers in the 1–100 range of Lizard's prices per resource, that omitted resources are untouched, and what off:true does. The one residual gap is that the storage (volumes) vs. objectStorage distinction is left entirely to the field names and the lone schema note.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb and resource ('set the prices that keys scoped to this workspace (or its projects) see'), including the pricing model (multiples of Lizard's, per resource, 1–100). It clearly separates this write operation from its read sibling workspace_resale_pricing_get by describing the act of setting rather than fetching.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It states a hard precondition — 'Owner only, with a key that has no scopes' — and clarifies the use context (reseller-facing pricing for scoped keys). It does not explicitly point at workspace_resale_pricing_get for inspecting current multipliers, so the alternative-routing guidance is implicit rather than spelled out.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
workspace_resumeResume workspaceADestructiveIdempotentInspect
Use this when the workspace owner wants to start again everything they paused in a workspace. Owner only. Returns what was resumed and what was skipped, with why.
| Name | Required | Description | Default |
|---|---|---|---|
| workspaceId | Yes | Workspace ID (see workspace_list) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already disclose that this is a non-read-only, idempotent, destructive operation. The description adds useful context beyond that: owner-only authorization and partial success behavior via returned resumed/skipped items with reasons. It does not explain why the operation is flagged destructive or what side effects/costs resumption may cause.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short, front-loaded sentences: usage condition, authorization constraint, and return behavior. Every sentence adds useful information with no repetition or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter mutation, the description covers the key missing pieces: owner-only access and partial-result reporting. Annotations cover safety traits, so the main remaining gap is the absence of explicit dependency or side-effect detail for workspace-wide resume behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is only one parameter and schema description coverage is 100%, with the schema already explaining that workspaceId comes from workspace_list. The description adds no parameter-level detail beyond what the schema provides, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: resuming everything paused in a workspace. It is clear enough to distinguish from workspace_pause, but it does not explicitly contrast with project_resume or service_resume, which are sibling tools with overlapping resume semantics.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives a clear usage condition: when the workspace owner wants to restart everything paused in a workspace, and adds an owner-only restriction. It lacks explicit when-not guidance or named alternatives such as project_resume for narrower scope.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
1 tool update
v0.1.4- Removed
ssh_exec
39 tool updates
v0.1.3- Added
ci_run_list - Added
ci_run_show - Changed
domain_attach1 field changed- changed
Input schema / properties / force / descriptionPrevious value: -"Move the domain here if it's attached to another of your services"New value: +"Move the domain here if it's attached to another of your services; on a bought domain, also replace records that point elsewhere"
- Added
domain_dns_list - Added
domain_dns_update - Added
domain_owned_list - Added
pr_create - Added
pr_list - Added
pr_merge - Added
pr_show - Added
repo_commit - Added
repo_commits - Added
repo_create - Added
repo_delete - Added
repo_files - Added
repo_list - Added
repo_read_file - Added
repo_show - Changed
sandbox_create7 fields changed- added
Input schema / properties / lifetimeMs / descriptionAdded value: +"Lifetime in ms, 60,000 to 86,400,000 (a day); extend later with sandbox_set_timeout" - changed
Input schema / properties / lifetimeMs / maximumPrevious value: -3600000New value: +86400000 - added
Input schema / properties / regionAdded value: +{ + "description": "Region code (region_list); default us-east-1, or the volume's or snapshot's region", + "minLength": 1, + "type": "string" +} - added
Input schema / properties / sizeAdded value: +{ + "description": "Default small; not with snapshotId", + "enum": [ + "small", + "medium", + "large" + ], + "type": "string" +} - added
Input schema / properties / snapshotIdAdded value: +{ + "description": "Snapshot ID from sandbox_snapshot or sandbox_snapshot_list", + "maxLength": 128, + "minLength": 1, + "pattern": "^[a-zA-Z0-9_-]+$", + "type": "string" +} - added
Input schema / properties / templateAdded value: +{ + "description": "Template name; default interpreter", + "pattern": "^[a-z0-9][a-z0-9-]{0,62}$", + "type": "string" +} - added
Input schema / properties / volumeAdded value: +{ + "description": "Persistent volume name or ID in the same project (volume_list)", + "minLength": 1, + "type": "string" +}
- Changed
sandbox_exec1 field changed- added
Input schema / properties / envsAdded value: +{ + "additionalProperties": { + "type": "string" + }, + "description": "Environment variables for this command only", + "propertyNames": { + "pattern": "^[A-Za-z_][A-Za-z0-9_]*$", + "type": "string" + }, + "type": "object" +}
- Added
sandbox_expose_port - Added
sandbox_fork - Added
sandbox_list_files - Added
sandbox_pause - Added
sandbox_resume - Added
sandbox_set_timeout - Added
sandbox_snapshot - Added
sandbox_snapshot_delete - Added
sandbox_snapshot_list - Added
sandbox_unexpose_port - Changed
service_create1 field changed- changed
Input schema / properties / repoUrl / descriptionPrevious value: -"GitHub repo URL — when provided, this becomes a deploy of that repo"New value: +"https URL, owner/name (GitHub) or lizard:owner/name (Lizard Git) — when provided, this becomes a deploy of that repo"
- Added
volume_create - Added
volume_delete - Changed
volume_list1 field changed- added
Input schema / properties / serviceAdded value: +{ + "description": "An app name or ID: list its volume instead", + "minLength": 1, + "type": "string" +}
- Added
workspace_delete - Added
workspace_limits_get - Added
workspace_limits_set - Added
workspace_resale_pricing_get - Added
workspace_resale_pricing_set
23 tool updates
v0.1.2- Added
billing_status - Added
project_delete - Added
project_pause - Added
project_resume - Added
sandbox_create - Added
sandbox_delete - Added
sandbox_exec - Added
sandbox_list - Added
sandbox_read_file - Added
sandbox_show - Added
sandbox_write_file - Added
service_pause - Added
service_resume - Added
service_sleep_set - Added
service_sleep_status - Added
template_deploy - Added
template_list - Added
template_show - Added
volume_list - Added
volume_resize - Added
workspace_create - Added
workspace_pause - Added
workspace_resume
33 tool updates
v0.1.0- First observed
addon_create - First observed
billing_summary - First observed
config_apply - First observed
deploy_events - First observed
deploy_redeploy - First observed
deploy_restart - First observed
domain_attach - First observed
domain_delete - First observed
domain_verify - First observed
git_checkout - First observed
git_connect - First observed
git_status - First observed
logs_tail - First observed
metrics_get - First observed
project_create - First observed
project_list - First observed
region_list - First observed
secrets_delete - First observed
secrets_list - First observed
secrets_refs - First observed
secrets_set - First observed
service_create - First observed
service_delete - First observed
service_get_port - First observed
service_list - First observed
service_rename - First observed
service_scale - First observed
service_set - First observed
service_set_port - First observed
service_show - First observed
ssh_exec - First observed
whoami - First observed
workspace_list
TDQS
Scored across 89 tools
The tools are mostly clearly separated by resource and action, with descriptions that explain scope differences such as service vs project vs workspace pause/resume/delete. A few areas still invite confusion, especially deploy_redeploy vs deploy_restart vs git_checkout, service_pause vs service_sleep_set, and config_apply vs narrower service/secrets tools, but the descriptions generally resolve the choice.
Names overwhelmingly follow a snake_case resource_action convention, e.g. service_list, project_create, sandbox_resume, pr_merge. There are minor deviations and uneven verb choices such as show vs get, plus outlier names like whoami, but the overall pattern is predictable.
89 tools is far beyond an appropriate surface for an agent-facing server, even for a broad cloud platform. The sheer number creates high selection and context burden, and many capabilities could be grouped into fewer higher-level tools or resource-oriented operations.
The surface covers a very wide platform lifecycle: workspaces, projects, services, addons, deploys, logs, metrics, secrets, domains/DNS, volumes, billing, templates, sandboxes, Git, pull requests and CI. There are still minor lifecycle gaps such as explicit project/workspace get or update operations, PR comments/reviews, and some billing/domain purchase actions, but core workflows are well covered.
Maintenance
Related MCP Connectors
Deploy apps from GitHub, read build/runtime logs, and manage your app's users from your AI agent.
Put AI-built apps online from GitHub: deploy, check status, read logs and set env vars.
Deploy and manage your apps, databases, storage, and scheduled jobs from your AI agent
Deploy your project to a live HTTPS URL from your AI tool; read logs, set variables, resize apps.
Related MCP Servers
- AlicenseAqualityCmaintenanceLet Claude and Cursor manage your Railway infrastructure through natural language. Deploy, configure, and monitor - autonomously and safely.38256 npm72MIT

PlugLayer MCP Serverofficial
AlicenseCqualityBmaintenanceEnables deploying and managing infrastructure via natural language, including project/domain management, compute nodes, image deployment, and CI/CD integration.70MIT- AlicenseBqualityDmaintenanceEnables management of Komodo infrastructure including servers, stacks, deployments, builds, repositories, procedures, and system settings through natural language.54383 npm10GPL 3.0

hostman-mcp-serverofficial
AlicenseAqualityDmaintenanceEnables deploying applications to Hostman, creating VPCs, databases, and floating IPs, and managing VCS providers through natural language prompts.127 npmMIT