Skip to main content
Glama

macOS Agent Bridge

让 AI 通过 MCP 调用 Mac 的日历、提醒事项、文件和桌面能力,在 Tinycast / Raycast 扩展中统一管理能力开关、权限、待确认操作与审计记录。独立 MCP 客户端也能使用同一套工具。

63 个工具定义 · 5 个扩展命令 · 本地运行。工具数量不等于全部能力均已实机验收,逐项状态见能力覆盖矩阵。

下载 v0.2.0 · 快速开始 · 能力与边界 · 安全说明

从一次调用开始

完成安装与 MCP 连接后,在 Tinycast AI Chat 中试试:

@macos-bridge 仅查询系统时区和运行时间。

也可以让 Agent 列出可用日历、查询指定时间段的空闲,或搜索并读取公开网页。日历等资源需要对应的 macOS 权限;联网工具需要网络连接。

开发者可直接调用同名 MCP 工具:

{"name":"system_status","arguments":{}}

所有调用返回统一的 ok、error 或 confirmation_required 状态。待确认表示尚未执行;在扩展里审阅参数并批准后,Agent 可用原幂等键取得结果。

Related MCP server: osa-mcp

快速开始

v0.2.0 是初始公开开发版本。 预构建包面向 Apple Silicon,Helper 使用 ad-hoc 签名,尚未完成 Developer ID 公证或商店审核。macOS 可能阻止首次打开;参阅发行与安全说明,也可选择从源码构建。

1. 安装运行组件

从 Release 下载 macos-agent-bridge-macos-arm64.zip 和 SHA256SUMS,在下载目录校验后解压:

shasum -a 256 -c SHA256SUMS

运行解压目录中的 Install.command。安装包包含 Node 运行时、Swift Helper 和已构建扩展,无需另外安装 Node 或 Swift。

需要 macOS 14+、Node.js 22+、Xcode Command Line Tools / Swift;使用的启动器还需满足自身系统要求。

git clone https://github.com/juliusloon/macos-agent-bridge.git
cd macos-agent-bridge
npm ci
npm run install:local

安装器编译运行组件,并为当前用户生成扩展与 MCP 配置。重新安装前,先退出正在运行的 MacOS Agent Bridge Helper。

2. 导入管理扩展

  • Tinycast:Settings → Extensions → Add from folder,选择安装包内的 Extension/;源码安装选择 raycast-extension/dist/。

  • Raycast:Import Extension 选择 raycast-extension/ 源码目录。在扩展设置中将 Bridge launcher 指向已安装的 bridge 文件。

安装后的入口:

命令

用途

macOS Agent Bridge

管理能力、文件范围、自动批准与系统权限

Review Agent Actions

审阅具体参数,批准并执行或拒绝

Agent Bridge Activity

查看脱敏的操作状态记录

Bridge Calendar

预览未来七天日程

Connect Tinycast AI Chat

复制当前用户的 MCP 配置

3. 连接 MCP

在 Connect Tinycast AI Chat 中复制配置。Tinycast 的入口为 Settings → AI → MCP Servers:Connection 选 Command,填入安装器生成的启动路径,Arguments 填 --serve。测试连接应发现 63 个工具。

导入扩展与连接 MCP 是两个步骤。 服务启动后无需持续打开管理界面;Tinycast AI Chat 需使用支持 MCP 工具的模型连接。

其他 MCP 客户端使用相同的 stdio 配置:

{
  "mcpServers": {
    "macos-agent-bridge": {
      "command": "/Users/<用户名>/Library/Application Support/MacOSAgentBridge/bridge",
      "args": ["--serve"]
    }
  }
}

上方路径是占位示例,不能直接粘贴使用。优先复制扩展提供的真实配置;源码安装也会生成 docs/mcp-client.json。不要假设 MCP 客户端会自动展开 ~ 或环境变量。

能力与边界

能力组

接入内容与范围

日历与提醒事项

EventKit 列表、查询与写入接口;时间参数明确 UTC 偏移和时区

文件

仅用户授权根目录内的搜索、文本读写、复制与移动等操作

桌面与系统

应用、当前剪贴板、窗口、截图及固定只读系统命令

Apple 应用

Contacts;Notes、Mail、Safari、Music 的固定公开脚本接口

快捷指令

枚举和运行已安装的 Shortcuts;执行始终需要确认

公网工具

web_search、web_fetch、network_check

这些是接口范围;Contacts、Accessibility、截图及部分应用写入仍有权限或验收限制。完整支持状态与限制以覆盖矩阵为准。

不提供任意 shell、任意 AppleScript / JavaScript 执行,也不读取 Raycast 私有的 Clipboard History、Notes、Snippets 或 Quicklinks 数据库。

写入、权限与隐私

  • 默认逐次审批写入。 用户可开启普通写入自动批准或信任指定能力;删除、发送邮件、运行快捷指令等高风险操作仍需明确批准。

  • 重试沿用同一幂等键。 审批绑定具体工具、参数和来源;不确定的执行结果需先核实,避免重复写入。

  • 文件访问有范围。 默认工作目录为 ~/Documents/Agent Bridge Workspace,不会自动授权整个主目录。

  • 本地通信与状态。 MCP 使用 stdio;Swift Helper 使用当前用户的 Unix socket。审计日志记录状态,不记录正文或参数;待审批参数与短期执行结果会保存在本地状态中。

  • 联网有明确边界。 公网工具不读取浏览器 Cookie,不执行网页脚本;搜索词和请求 URL 会发送给相应服务。选定的 AI 客户端如何处理工具结果,由该客户端决定。

macOS 系统授权、启动器的 MCP 信任设置、Bridge 的动作审批分别生效。详细保存规则与威胁边界见安全说明。

开发与验证

npm run check
npm test
npm run build
npm run build:native
npm run build:extension

原生工具的实际行为取决于系统权限、应用账户与宿主支持。自动测试通过不代表全部原生读写已经实机验证;公开验证范围见验收说明。

文档

内容

架构

MCP、共享执行引擎与 Swift Helper

Tinycast 接入

导入、MCP 连接和审批流程

能力覆盖矩阵

逐工具状态、权限、限制

安全与数据保存

审批、文件边界、本地数据、发行签名

0.2.0 更新说明

自动批准、联网与操作状态查询

第三方组件

运行时与依赖许可证

贡献指南 · 安全报告 · 变更日志

参与开发、报告漏洞与版本记录

欢迎通过 Issues 反馈可复现的问题,或提交改进。报告中请使用占位数据,不上传日程、联系人、邮件正文或完整本地状态目录。

许可证

MIT © 2026 Cano and contributors。第三方组件保留各自许可证。

Available Tools

63 tools
bridge_diagnosticsA
Read-onlyIdempotent

Inspect helper, real macOS permission status, configuration, version and native availability. Does not request permissions. [v1.0.0; permissions: none]

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, non-destructive, and closed-world. The description adds genuinely useful context beyond them: it reports real permission status, includes version info, and explicitly states it does not request permissions, which matters for a diagnostics tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence covering the resources, followed by one behavioral caveat and a compact version/permission tag. No filler, though the bracketed metadata is slightly terse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, return values need not be explained, and there are no parameters to document. The description covers scope, permission behavior, and version, leaving nothing an agent needs missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so there is nothing for the description to clarify; baseline is 4. Schema coverage is 100% and the description correctly introduces no parameter discussion.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Inspect) with concrete resources: helper, macOS permission status, configuration, version, native availability. An agent can tell what it returns. However, it does not differentiate itself from sibling bridge tools like bridge_list_capabilities or bridge_get_operation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: an agent would infer this is the diagnostic entry point. There is no explicit when-to-use or when-not-to-use guidance relative to the sibling bridge tools, though 'Does not request permissions' hints at a boundary.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

bridge_get_operationA
Read-onlyIdempotent

Read the status and saved result of a write from this client without executing it again. Use the original tool name and idempotency key while waiting for approval or resolving an uncertain result. [v1.0.0; permissions: none]

ParametersJSON Schema
NameRequiredDescriptionDefault
toolYesOriginal write tool name
idempotencyKeyYesOriginal _idempotencyKey

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/non-destructive/non-open-world, so the bar is lower, yet the description still adds value: it clarifies the call performs no re-execution, is a readback of saved state, and notes 'permissions: none'. It does not mention rate limits or failure modes, keeping it at a solid 4.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences, front-loaded with the core action and followed by usage context; no filler. The trailing version/permissions tag is metadata rather than description, which slightly dilutes the prose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists and annotations cover the safety profile, so the description need not explain return values. It adequately covers what the tool does and when to call it, leaving only minor gaps such as behavior on a missing or expired idempotency key.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and both parameters already carry descriptions ('Original write tool name', 'Original _idempotencyKey'). The description only echoes the notion of using the original name and key, adding little syntax or format detail beyond the schema, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Read the status and saved result of a write') and clarifies it does so 'without executing it again', which conceptually separates it from re-running the sibling write tools. It stops short of naming any sibling, so it is clear but not fully differentiated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit conditions for use: 'while waiting for approval or resolving an uncertain result', and instructs the caller to reuse the original tool name and idempotency key. There are no explicit exclusions or named alternatives, but the triggering context is concrete.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

bridge_list_capabilitiesA
Read-onlyIdempotent

Discover compact tool metadata. Set includeSchemas to retrieve full input/output schemas, and adapter to filter one capability family. [v1.0.0; permissions: none]

ParametersJSON Schema
NameRequiredDescriptionDefault
adapterNo
includeSchemasNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare read-only, idempotent, non-destructive, and non-open-world behavior. The description adds meaningful context beyond that: by default it returns compact metadata, includeSchemas expands to full input/output schemas, adapter narrows to one family, and no permissions are required. It does not mention rate limits or pagination, but for this simple read-only tool that is a minor gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences plus a bracketed version/permission note. It is front-loaded with the core purpose, then moves to parameter guidance, and contains no filler content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only discovery tool, the description covers purpose, parameter behavior, output-format choices, and permission context. An output schema exists, so return values need no further explanation. It could go slightly further by stating when an agent should call this before invoking sibling tools, but nothing critical is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must carry the burden. It explains both parameters: includeSchemas retrieves full input/output schemas, and adapter filters to one capability family. The enum values themselves are self-explanatory, though the description does not state defaults or that adapter accepts exactly one family.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear verb and resource: 'Discover compact tool metadata.' The adapter enum families make the scope concrete (bridge, network, calendar, etc.), so an agent can distinguish this meta-tool from the specific action siblings. It falls short of a 5 because it doesn't explicitly contrast itself with those siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides parameter-level usage ('Set includeSchemas to retrieve full schemas', 'adapter to filter one capability family') but gives no explicit when-to-use guidance or conditions. The discovery purpose is implied by the name and description, but there is no stated alternative or trigger condition.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

calendar_create_eventA
Idempotent

Create a single, nonrecurring EventKit event and return persisted native ID. [v1.0.0; permissions: calendar]

ParametersJSON Schema
NameRequiredDescriptionDefault
endYesISO 8601 date-time with explicit Z or numeric UTC offset
notesNoNotes
startYesISO 8601 date-time with explicit Z or numeric UTC offset
titleYesTitle
locationNoLocation
timezoneYesIANA time zone, e.g. Asia/Shanghai
calendarIdNoWritable Calendar ID; omit for default calendar
_approvalIdNoID of the exact action approved by a human in the macOS Agent Bridge extension
_idempotencyKeyYesClient-generated unique key, required for writes; reuse only with identical arguments, including while waiting for approval

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

A3.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare the safety profile (readOnly=false, destructive=false, idempotent=true, openWorld=true), so the bar is lower. The description adds genuinely new context: the required 'calendar' permission and that it returns the persisted native ID. It stops short of explaining the approval/_idempotencyKey workflow, but the permission disclosure is real value beyond annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence plus a compact bracketed metadata tag. No wasted words, and the core purpose is stated first.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present and 100% schema coverage plus annotations covering safety, the description only needs purpose, scope, and permission context, all of which it supplies. The main gap is cross-tool routing guidance, which would round it out.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all 9 parameters, including timezone, calendarId, and _idempotencyKey semantics, are already documented in the schema. The description adds no parameter-level detail beyond the schema, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Create a single, nonrecurring EventKit event') and scopes it to nonrecurring events, which distinguishes it from a recurring-create or update path. It does not explicitly name siblings like calendar_update_event, but the verb+resource pair is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit when-to-use guidance and no named alternatives. The 'single, nonrecurring' scoping implies the tool cannot be used for recurring events, but the agent gets no routing help vs calendar_update_event, calendar_find_free_slots, or calendar_list_events.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

calendar_delete_eventA
DestructiveIdempotent

Delete one occurrence of an event. Requires human approval. [v1.0.0; permissions: calendar]

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesStable native object ID
_approvalIdNoID of the exact action approved by a human in the macOS Agent Bridge extension
_idempotencyKeyYesClient-generated unique key, required for writes; reuse only with identical arguments, including while waiting for approval

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint=true, idempotentHint=true and readOnlyHint=false, so the safety profile is known. The description adds genuine context beyond them: the human-approval requirement, which explains the _approvalId gate and signals a non-immediate, two-step workflow, plus the 'one occurrence' deletion scope.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences plus a version/permission tag; the destructive action, its scope and the approval precondition are all front-loaded with zero filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Output schema exists, so return values need not be explained, and the schema covers parameters. The description covers scope and the approval precondition, leaving only minor gaps such as whether deletion is reversible and how approval is obtained.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents id, _approvalId and _idempotencyKey fully. The description's 'one occurrence' phrasing hints that id targets an occurrence, but it adds no syntax or format detail beyond the schema. Baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (delete) and resource (event), and adds the important scope qualifier 'one occurrence', which tells the agent this removes a single instance rather than a recurring series. It does not explicitly contrast with other calendar tools, but the resource is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The 'Requires human approval' clause establishes a real precondition, but there is no explicit when-to-use guidance versus siblings such as calendar_update_event or any guidance on handling the approval/idempotency flow. Usage is implied rather than directed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

calendar_find_free_slotsA
Read-onlyIdempotent

Find free intervals in the requested range using non-free, non-cancelled calendar events. Bound to selected calendars; does not infer working hours. [v1.0.0; permissions: calendar]

ParametersJSON Schema
NameRequiredDescriptionDefault
endYesISO 8601 date-time with explicit Z or numeric UTC offset
startYesISO 8601 date-time with explicit Z or numeric UTC offset
timezoneYesIANA time zone, e.g. Asia/Shanghai
calendarIdsNo
durationMinutesYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint/idempotentHint/destructiveHint, so the safety profile is covered. The description adds real behavioral context beyond that: which events count as busy (non-free, non-cancelled), the selected-calendar scoping, the no-working-hours inference boundary, and the required 'calendar' permission.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tightly written clauses with the core action front-loaded and no filler; the version/permission suffix is the only low-value element.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists so return values need no explanation, and annotations carry the safety profile. The description covers boundaries and scope well; the only gap is the unaddressed durationMinutes/timezone semantics for a 5-param tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 60%. The description maps loosely to parameters ('requested range' → start/end, 'selected calendars' → calendarIds), but durationMinutes has an empty schema description and no compensating explanation, and timezone semantics are unaddressed. Baseline 3 for partial coverage that is only marginally compensated.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('Find free intervals') and clarifies the computation basis ('using non-free, non-cancelled calendar events'). This clearly distinguishes it from siblings like calendar_list_events, though it does not name an alternative explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The clause 'does not infer working hours' and 'Bound to selected calendars' give boundary conditions that imply the intended usage context, but there is no explicit when-to-use/when-not guidance or routing to sibling tools such as calendar_list_events.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

calendar_list_calendarsB
Read-onlyIdempotent

List EventKit calendars and write support. [v1.0.0; permissions: calendar]

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

B3.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false and openWorldHint=true, so the safety profile is covered. The description usefully adds the permission scope ('permissions: calendar') and version, but the ambiguous 'write support' phrase sits awkwardly against the readOnly annotation and could confuse the agent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Extremely short and front-loaded, with the action first and metadata bracketed at the end. The only wasted corpus is the ambiguous 'and write support', but overall it is tight.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no params, rich annotations, and an output schema, the description covers the essentials. What is missing is routing context relative to the other calendar tools and any clarification of what 'write support' means, which leaves a real gap for an agent choosing between siblings.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Zero parameters with 100% schema coverage, so there is nothing for the description to compensate for; baseline 4 applies. No parameter syntax or format detail is needed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a clear verb+resource ('List EventKit calendars'), which is enough to distinguish it from calendar_list_events. However, the trailing phrase 'and write support' is vague and muddies what the tool actually does, leaving the agent unsure whether it merely lists calendars or also performs/reports something write-related.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this versus calendar_list_events, calendar_find_free_slots, or any sibling. The 'permissions: calendar' tag hints at a prerequisite but doesn't tell the agent anything about selection context or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

calendar_list_eventsA
Read-onlyIdempotent

List events intersecting a bounded time range (at most 366 days). Explicit UTC offsets and IANA timezone required. [v1.0.0; permissions: calendar]

ParametersJSON Schema
NameRequiredDescriptionDefault
endYesISO 8601 date-time with explicit Z or numeric UTC offset
limitNo
startYesISO 8601 date-time with explicit Z or numeric UTC offset
timezoneYesIANA time zone, e.g. Asia/Shanghai
calendarIdsNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

A3.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, openWorld and non-destructive, so the safety profile is covered. The description still adds real value beyond them: the 366-day maximum span, the requirement for explicit UTC offsets and an IANA timezone, and the 'permissions: calendar' authorization requirement, none of which appear in the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three compact clauses with the range bound and timezone requirement front-loaded before the version/permission tag. The bracketed metadata is marginally useful but is the only element not directly helping an agent call the tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, return values need no explanation, and annotations cover the safety profile, so the description is nearly sufficient. The remaining gaps are the undocumented 'limit' cap/behavior and whether calendarIds defaults to all calendars, which an agent would need to guess.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

At 60% schema coverage, the description reinforces the start/end/timezone formats already documented in the schema but adds the non-obvious 366-day span limit that the schema does not express. It says nothing about 'limit' (empty schema description) or what calendarIds defaults to, leaving part of the coverage gap unfilled.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('List events') plus a scoping qualifier ('intersecting a bounded time range'), which cleanly separates it from calendar_find_free_slots and calendar_list_calendars. It does not name any sibling explicitly, so it stops short of full differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to choose this tool over calendar_find_free_slots or calendar_list_calendars, and no stated exclusions. Only hard constraints (366-day bound, timezone requirement) are given, which are validation rules rather than usage routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

calendar_update_eventA
Idempotent

Update one occurrence of an event by native ID. Recurring series are not bulk modified. [v1.0.0; permissions: calendar]

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesStable native object ID
endNoISO 8601 date-time with explicit Z or numeric UTC offset
notesNoNotes
startNoISO 8601 date-time with explicit Z or numeric UTC offset
titleNoTitle
locationNoLocation
timezoneNoIANA time zone, e.g. Asia/Shanghai
calendarIdNoWritable Calendar ID; omit for default calendar
_approvalIdNoID of the exact action approved by a human in the macOS Agent Bridge extension
_idempotencyKeyYesClient-generated unique key, required for writes; reuse only with identical arguments, including while waiting for approval

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare the full safety profile (non-readOnly, idempotent, non-destructive, openWorld). The description adds the recurring-series scoping behavior and the required 'calendar' permission, which are genuine additions not covered by annotations. It does not describe what happens to unspecified fields or any rate/permission failure behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences with the operation and scope front-loaded, plus a compact permission/version tag. No filler, though the bracketed tag is slightly meta rather than task-oriented.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists and annotations cover the safety profile, so the description needn't explain returns. With complete parameter documentation and an explicit permission requirement, an agent has enough to invoke it correctly; only sibling routing is left implicit.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so every one of the 10 parameters is documented in the schema itself (including _idempotencyKey reuse rules and calendarId defaulting). The description adds no parameter-level detail beyond the 'native ID' phrasing, so the baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('Update one occurrence of an event') and its scope ('by native ID'), which clearly separates it from calendar_create_event and calendar_delete_event. It does not explicitly name those siblings, but the operation is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The line 'Recurring series are not bulk modified' implies the tool operates on a single occurrence rather than a whole series, which is useful scoping. However, it never states when to choose this over calendar_create_event/calendar_delete_event, and gives no prerequisites or exclusions beyond that hint.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

clipboard_readA
Read-onlyIdempotent

Read current plain-text clipboard only. Does not import Raycast Clipboard History. [v1.0.0; permissions: none]

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, non-destructive and openWorld, so the safety profile is covered. The description still adds real value beyond them: plain-text-only format limitation, 'current' versus history scope, and 'permissions: none' as an auth requirement.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with the action and scope constraint. The bracketed '[v1.0.0; permissions: none]' tag is partly useful (permissions) but the version string is filler that slightly dilutes the signal.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, return values need no explanation, and annotations carry the safety profile. Scope, format limitation, and auth needs are all covered, leaving nothing an agent needs in order to call this correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so the baseline is 4 and there is no parameter semantics to document. The description correctly implies a no-argument call and adds no misleading parameter hints.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Read current plain-text clipboard') and narrows scope with 'only', which separates it from history-import behavior. It does not name the sibling clipboard_write, so the differentiation is scope-based rather than explicit routing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Does not import Raycast Clipboard History' is an effective when-not boundary that tells the agent this tool is not the path for history retrieval. There is no positive statement of when to prefer it over alternatives such as system_get_selected_text, so the guidance stops just short of full routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

clipboard_writeA
Idempotent

Replace system clipboard with explicit plain text. [v1.0.0; permissions: none]

ParametersJSON Schema
NameRequiredDescriptionDefault
textYesClipboard text
_approvalIdNoID of the exact action approved by a human in the macOS Agent Bridge extension
_idempotencyKeyYesClient-generated unique key, required for writes; reuse only with identical arguments, including while waiting for approval

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

A3.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare this as a write, idempotent, non-destructive, open-world operation. The description adds meaningful context beyond them: it only writes plain text, it replaces the existing clipboard contents, and it requires no permissions. It does not contradict any annotation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence states the action and scope with no wasted words. The bracketed version/permission note is compact and does not obscure the core instruction.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple write tool with an output schema, full parameter descriptions, and safety annotations, the description covers the essential purpose, text format, and permission level. It could more explicitly note the overwrite of prior clipboard contents or the optional human approval flow, but it is largely complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all three parameters, including the required idempotency key and optional approval ID. The description adds only the 'explicit plain text' qualifier for the text parameter, which is marginal; baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Replace') and resource ('system clipboard'), plus the text scope ('explicit plain text'). It does not explicitly distinguish the operation from the sibling clipboard_read, but the action itself is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no when-to-use guidance, no conditions selecting it over clipboard_read, and no exclusions. It only states what the tool does, leaving usage context entirely to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

contacts_createA
Idempotent

Create a contact in the default writable container. [v1.0.0; permissions: contacts]

ParametersJSON Schema
NameRequiredDescriptionDefault
emailNoEmail
phoneNoPhone
givenNameYesGiven name
familyNameNoFamily name
_approvalIdNoID of the exact action approved by a human in the macOS Agent Bridge extension
_idempotencyKeyYesClient-generated unique key, required for writes; reuse only with identical arguments, including while waiting for approval

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare write (readOnlyHint=false), idempotent (idempotentHint=true), non-destructive, and open-world behavior, so the safety profile is covered. The description adds useful context beyond that — the write lands in the 'default writable container' and requires the 'contacts' permission — but does not explain what an existing duplicate does or how the idempotency key behaves.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Extremely compact: a single front-loaded purpose clause plus a bracketed metadata tag. No filler, and the verb+resource leads. The bracket tag is slightly cryptic but does not bloat the text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple create tool, the description covers purpose, target container, and the governing permission, while annotations cover safety and an output schema covers return values. Little an agent needs is missing beyond optional usage routing toward contacts_update.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all six parameters (including givenName, _idempotencyKey, and _approvalId) are already documented in the schema. The description adds no field-level meaning beyond what the schema provides, so the baseline of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb (Create) and resource (a contact), and narrows the target with 'in the default writable container'. It distinguishes itself from the read-oriented siblings (contacts_get, contacts_search) and the mutating contacts_update by virtue of being the sole create operation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: 'Create a contact' tells the agent what to do but gives no explicit when-to-use condition, no prerequisites, and no reference to alternatives such as contacts_update. The 'permissions: contacts' tag hints at an auth requirement but does not spell out the trigger conditions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

contacts_getA
Read-onlyIdempotent

Read an accessible contact by identifier. [v1.0.0; permissions: contacts]

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesStable native object ID

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false, so the safety profile is covered. The description adds the permission scope ('permissions: contacts') and the 'accessible' gating notion, which is real added context, but it says nothing about behavior for missing or inaccessible contacts.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Very tight and front-loaded: the action and the identification method come first. The bracketed version/permission tag is slightly noise-like but carries permission information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists so return details needn't be described, annotations cover the safety profile, and the single parameter is fully documented. Purpose, identifier method, and permission scope are all present; only edge-case behavior is left unstated.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the id parameter is fully documented as 'Stable native object ID'. The description's 'by identifier' corroborates but adds no syntax or format detail beyond the schema, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Read) and resource (contact) plus the identifier method, which distinguishes it from contacts_search and the mutation siblings contacts_create/contacts_update. It doesn't name a sibling explicitly, so it falls short of 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'by identifier' implies the caller must already have an ID (as opposed to contacts_search which finds them), but there is no explicit when-to-use, when-not, or named alternative. Usage is only implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

contacts_updateA
DestructiveIdempotent

Update only specified contact name, email or phone fields. Email/phone replaces that collection. [v1.0.0; permissions: contacts]

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesStable native object ID
emailNoEmail
phoneNoPhone
givenNameNoGiven name
familyNameNoFamily name
_approvalIdNoID of the exact action approved by a human in the macOS Agent Bridge extension
_idempotencyKeyYesClient-generated unique key, required for writes; reuse only with identical arguments, including while waiting for approval

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

A3.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint=true, idempotentHint=true and openWorldHint=true, so the bar is lower, but the description adds non-trivial context: email/phone fully replaces that collection rather than appending, and the '[permissions: contacts]' tag discloses the authorization scope. It stops short of describing the human-approval gate implied by the _approvalId parameter and destructiveHint.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences plus a metadata tag, front-loaded with the update scope and then the field-replacement rule. No filler; the only marginal element is the version/permission tag, which still carries operational value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need no explanation, and the description covers the partial-update contract, replacement semantics and permission scope. The main omission is the approval/idempotency workflow, which is left entirely to the schema's parameter descriptions.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all seven parameters, making 3 the baseline. The description reinforces which fields are updatable (name, email, phone) and clarifies replacement semantics for two of them, but adds no syntax or validation detail beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (update) and resource (contact), and scopes it to 'only specified ... fields', which distinguishes a partial patch from a full replace. It never names a sibling such as contacts_create or contacts_search, so the differentiation comes from the name rather than the text.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit when-to-use, when-not-to-use, or alternative routing guidance. The phrase 'only specified' implies partial-update behavior, but an agent gets no signal about when this beats contacts_create or what prerequisites (existing contact id, approval) apply.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

finder_copy_fileB
Idempotent

copy file inside authorized roots, refuse overwrite. Rename accepts a destination absolute path. [v1.0.0; permissions: none]

ParametersJSON Schema
NameRequiredDescriptionDefault
sourceYesSource absolute path
_approvalIdNoID of the exact action approved by a human in the macOS Agent Bridge extension
destinationYesDestination absolute path
_idempotencyKeyYesClient-generated unique key, required for writes; reuse only with identical arguments, including while waiting for approval

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

B3.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnly=false, idempotent=true, and destructive=false, so the safety profile is partly covered. The description adds genuinely new context: the operation is confined to authorized roots, it refuses to overwrite, and it requires no permissions, which is useful beyond the structured hints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

It is short and front-loads the core action, but the second sentence about 'Rename' is out of place and misleading for a copy tool, so it does not fully earn its place. The version/permissions tag is compact metadata but adds little.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, and annotations cover the safety profile. The description supplies the scope constraint and overwrite behavior, making it largely complete, though the missing when-to-use guidance leaves a small gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents source, destination, _approvalId, and _idempotencyKey. The description only restates that destination is an absolute path, adding nothing beyond the schema, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('copy file') plus a scope constraint ('inside authorized roots') and a behavior ('refuse overwrite'), which distinguishes it from siblings like finder_move_file and finder_rename_file. The trailing sentence 'Rename accepts a destination absolute path' is confusing because it references a different operation name, slightly muddying the purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives constraints but no when-to-use guidance or routing against alternatives such as finder_move_file or finder_rename_file. An agent must infer from the name alone when a copy is preferred over a move or rename.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

finder_create_directoryA
Idempotent

Create a single directory within an authorized root. [v1.0.0; permissions: none]

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYesAbsolute path within user-authorized file roots
_approvalIdNoID of the exact action approved by a human in the macOS Agent Bridge extension
_idempotencyKeyYesClient-generated unique key, required for writes; reuse only with identical arguments, including while waiting for approval

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=false, idempotentHint=true and destructiveHint=false, so the safety profile is covered structurally. The description adds that only a 'single' directory is created (implying non-recursive behavior) and notes 'permissions: none', but omits approval triggers, overwrite behavior for existing paths, and error semantics that matter for a write tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The operative sentence is front-loaded and wastes no words. The bracketed version/permission tag '[v1.0.0; permissions: none]' is metadata clutter of limited value, but the description remains short and readable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists and annotations cover the safety profile, so return values need not be described. However, for a write operation whose schema exposes an _approvalId gate, the description leaves the approval path and failure modes unexplained, which is a meaningful gap for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all three parameters including _idempotencyKey and _approvalId are documented in the schema itself. With no params needing description compensation and the description aligning with the schema's 'authorized roots' wording, the baseline is met and slightly exceeded by reinforcing the root constraint.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Create a single directory') and constrains scope with 'within an authorized root'. This distinguishes it from the other finder mutation siblings like finder_write_file and finder_move_file, though no sibling is named explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'within an authorized root' implies a precondition, and the schema's _approvalId parameter hints at an approval workflow, but the description never states when to use this tool versus alternatives or when an approval ID is required. Usage is only inferable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

finder_list_filesB
Read-onlyIdempotent

List immediate directory entries within authorized roots without following directory symlinks. [v1.0.0; permissions: none]

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYesAbsolute path within user-authorized file roots
limitNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

B3.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already carry the safety profile (readOnly, idempotent, non-destructive), but the description adds genuine behavioral value: it will not follow directory symlinks and it requires no permissions ('[permissions: none]'). It omits pagination/ordering context tied to limit.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence carries the scope and symlink constraint, followed by compact version/permission metadata. No wasted prose, though the bracketed tag is tangential to tool selection.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, return values need not be explained, and the description covers scope, symlink behavior, and permissions. The undocumented limit parameter and lack of ordering/pagination context leave a gap for a 500-max listing tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is only 50% (path is documented, limit has an empty description), and the description adds no parameter meaning at all. It does not explain what limit controls or how it interacts with the non-recursive listing.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (list) and resource (immediate directory entries) with scope qualifiers ('within authorized roots', 'without following directory symlinks'). The 'immediate' (non-recursive) wording implicitly separates it from finder_search_files, but no sibling is named explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit when-to-use or when-not guidance, nor any reference to the obvious alternative finder_search_files. The agent must infer that this is for shallow listings and search is for recursive lookups.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

finder_move_fileB
Idempotent

move file inside authorized roots, refuse overwrite. Rename accepts a destination absolute path. [v1.0.0; permissions: none]

ParametersJSON Schema
NameRequiredDescriptionDefault
sourceYesSource absolute path
_approvalIdNoID of the exact action approved by a human in the macOS Agent Bridge extension
destinationYesDestination absolute path
_idempotencyKeyYesClient-generated unique key, required for writes; reuse only with identical arguments, including while waiting for approval

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

B3.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare idempotentHint=true, destructiveHint=false and readOnlyHint=false, so the safety profile is largely covered. The description does add genuine behavior beyond that: the operation is confined to 'authorized roots' and refuses to overwrite an existing destination. It omits the human-approval flow implied by the _approvalId parameter and the 'permissions: none' note, which is a meaningful gap for a mutation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Short and front-loaded with the core action, but the middle sentence about 'Rename' is confusing noise for a tool named move_file, and the trailing '[v1.0.0; permissions: none]' bracket is metadata that does not help an agent decide or invoke.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present and annotations covering safety/idempotency, the description need not explain return values. Still, it leaves the approval/idempotency-key workflow and the move-vs-rename-vs-copy choice unexplained, which an agent needs for correct invocation in a mutating filesystem toolset.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents source, destination, _idempotencyKey and _approvalId in detail; baseline is 3. The description adds little parameter-level meaning, and its 'destination absolute path' phrasing is already stated in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (move) and resource (file) plus two meaningful constraints: 'inside authorized roots' and 'refuse overwrite'. However, the second sentence ('Rename accepts a destination absolute path') references a different sibling tool (finder_rename_file), which muddies the identity rather than sharpening the distinction from finder_copy_file/finder_rename_file.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit when-to-use guidance and no routing to alternatives such as finder_copy_file (preserve original) or finder_rename_file. The only contextual cue is the misplaced 'Rename accepts...' sentence, which reads as belonging to another tool rather than as guidance for this one.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

finder_open_fileB
Idempotent

Open an authorized file with its default app. [v1.0.0; permissions: none]

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYesAbsolute path within user-authorized file roots
_approvalIdNoID of the exact action approved by a human in the macOS Agent Bridge extension
_idempotencyKeyYesClient-generated unique key, required for writes; reuse only with identical arguments, including while waiting for approval

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=false, destructiveHint=false and idempotentHint=true, so the safety profile is covered. The description adds the scoping constraint that only files under user-authorized roots can be opened and notes 'permissions: none', which is useful, but it omits the human-approval flow implied by the _approvalId parameter and any side effect of launching an external app.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no wasted prose. The bracketed '[v1.0.0; permissions: none]' tag is metadata noise that slightly dilutes an otherwise tight statement.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, return values need not be explained, and the annotations carry the safety profile. The remaining gap is that the description never surfaces the approval/idempotency mechanics of a side-effecting open action, but it is adequate for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so path, _approvalId and _idempotencyKey are fully documented in the schema. The description adds only the 'authorized file' notion, which overlaps the path description already in the schema; baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (open) and resource (authorized file) plus the mechanism (default app), which implicitly separates it from finder_read_file (reads contents) and system_open_app (launches an app). It does not explicitly name those siblings, so differentiation is inferable rather than stated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance, no exclusions, and no alternatives named. The word 'authorized' hints at a precondition but the description never says when to choose this over finder_read_file or system_open_app.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

finder_read_fileA
Read-onlyIdempotent

Read a UTF-8 text file within authorized roots, maximum 1 MiB. [v1.0.0; permissions: none]

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYesAbsolute path within user-authorized file roots

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

A3.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/non-destructive, so the safety profile is covered. The description adds genuinely useful behavioral facts beyond them: UTF-8 encoding only, a 1 MiB maximum, and the authorized-roots boundary with permissions: none. What it lacks is any note on error behavior for files outside roots or exceeding the size limit.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence carrying the resource, encoding, scope, and size limit, followed by compact bracketed metadata. No wasted words; the operative constraint appears first.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple, fully-annotated read tool with a 100%-covered single parameter and a declared output schema, the definition is nearly complete. Only the failure-mode behavior (missing file, out-of-root path, oversize file) is left unstated, which is a minor omission.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the single path parameter is already documented as an absolute path within authorized roots, so the schema carries the load. The description's 'within authorized roots' phrasing echoes the schema rather than adding format or edge-case detail, making the baseline 3 appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Read) and resource (UTF-8 text file) plus scope (within authorized roots) and a size bound, so the agent knows exactly what the tool does. It does not, however, distinguish itself from siblings like finder_open_file or finder_search_files, which is why it falls short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no when-to-use or when-not-to-use guidance and never names an alternative (e.g. finder_search_files for locating a file, finder_open_file for launching one). With over 60 sibling tools, the absence of routing guidance for a read operation is a real gap.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

finder_rename_fileA
Idempotent

rename file inside authorized roots, refuse overwrite. Rename accepts a destination absolute path. [v1.0.0; permissions: none]

ParametersJSON Schema
NameRequiredDescriptionDefault
sourceYesSource absolute path
_approvalIdNoID of the exact action approved by a human in the macOS Agent Bridge extension
destinationYesDestination absolute path
_idempotencyKeyYesClient-generated unique key, required for writes; reuse only with identical arguments, including while waiting for approval

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare non-read-only, idempotent, non-destructive behavior, so the bar is lower, yet the description still adds real value: it discloses the authorized-roots boundary and the refuse-on-overwrite rule, which explains a non-obvious failure the annotations do not cover. It omits cross-volume/atomicity behavior and the human-approval path implied by _approvalId.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences with the operational constraints front-loaded and no padding. The trailing '[v1.0.0; permissions: none]' metadata is low-value noise for selection purposes, keeping it out of the top score.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, return values need not be explained, and annotations plus 100% schema coverage carry most of the burden. The description adds the two things an agent most needs here, the authorized-roots boundary and the no-overwrite rule, so it is nearly complete for a simple rename operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and all four parameters are documented in the schema, including the required _idempotencyKey and optional _approvalId. The description only restates that destination is an absolute path, which the schema already says, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (rename) and resource (file) plus a scope constraint (inside authorized roots) and a behavioral guarantee (refuse overwrite). It does not explicitly differentiate itself from the sibling finder_move_file, which is the closest alternative an agent would consider, so it falls short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The 'inside authorized roots' clause implies a precondition and 'refuse overwrite' implies a failure mode, which gives some implicit guidance. However, it never states when to pick this over finder_move_file or finder_copy_file, nor what to do when the destination already exists, so usage must be inferred.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

finder_search_filesA
Read-onlyIdempotent

Search filenames recursively within authorized root, at most 10,000 visited entries. Does not access Raycast private search index. [v1.0.0; permissions: none]

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYesAbsolute path within user-authorized file roots
limitNo
queryYesCase-insensitive filename substring

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare read-only, idempotent, non-destructive, non-open-world behavior, so the safety profile is covered. The description adds genuinely new behavioral facts beyond them: a 10,000-visited-entry traversal cap, the fact it avoids the private search index, and an explicit 'permissions: none' claim.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three compact sentences with the core action front-loaded, followed by the scope exclusion and metadata tag. Little waste; the version/permissions tag is arguably extraneous but small.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need no explanation, and annotations carry the safety profile. The description covers scope, traversal bound, and a permission note; the only real gap is the unstated semantics of the limit parameter.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 67%: path and query are documented in-schema, while limit has an empty description. The description reinforces that the query matches filenames, but it does not clarify the limit parameter or its distinction from the 10,000-entry traversal cap. Baseline 3 fits a schema doing most of the work.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (search) and resource (filenames) with a scope qualifier ('recursively within authorized root'), which implicitly separates it from directory-listing siblings like finder_list_files. It does not explicitly name a sibling alternative, so it falls just short of full differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The recursion scope and 'does not access Raycast private search index' line imply when this tool applies versus other finders, but there is no explicit when-to-use/when-not guidance or named alternative (e.g. finder_list_files for non-recursive listing). Usage must be inferred.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

finder_trash_fileA
DestructiveIdempotent

Move a file to macOS Trash via public FileManager API; no permanent deletion. [v1.0.0; permissions: none]

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYesAbsolute path within user-authorized file roots
_approvalIdNoID of the exact action approved by a human in the macOS Agent Bridge extension
_idempotencyKeyYesClient-generated unique key, required for writes; reuse only with identical arguments, including while waiting for approval

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint/idempotentHint, but the description adds genuinely useful nuance: trashing is reversible (no permanent deletion) and requires no permissions. It does not explain the human-approval flow implied by the _approvalId parameter, which is the main remaining gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Effectively one front-loaded sentence plus a short metadata tag. The bracketed '[v1.0.0; permissions: none]' is terse and slightly ambiguous but doesn't bury the core action.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need no explanation, and annotations cover the safety profile. The reversible-deletion clarification is present; only the approval/idempotency operating context is left entirely to the schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema documents path, _approvalId, and _idempotencyKey fully. The description adds no parameter-level detail (path root constraints, idempotency reuse semantics), so baseline 3 is correct.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Move a file to macOS Trash') plus the mechanism used, which distinguishes it from siblings like finder_move_file or a hypothetical hard-delete. An agent can tell what it does without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: 'no permanent deletion' hints this is the safe/reversible alternative to a real delete, but no explicit when-to-use vs finder_move_file or any exclusion is given. Adequate but leaves routing to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

finder_write_fileA
Idempotent

Create UTF-8 text file; will not overwrite existing files. [v1.0.0; permissions: none]

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYesAbsolute path within user-authorized file roots
contentYesUTF-8 contents
_approvalIdNoID of the exact action approved by a human in the macOS Agent Bridge extension
_idempotencyKeyYesClient-generated unique key, required for writes; reuse only with identical arguments, including while waiting for approval

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

A3.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare the write/safe/idempotent profile (readOnlyHint=false, destructiveHint=false, idempotentHint=true), and the description adds real value beyond them: the no-overwrite guarantee and UTF-8 encoding are behavior an agent must know before invoking. It omits error semantics (what happens when the file exists) and approval-related behavior, keeping it from a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence carries the core semantics, with version and permission notes bracketed at the end. It is efficient, though the bracketed metadata is marginally useful to an agent selecting a tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given an output schema exists and 100% schema coverage, the description supplies the key non-schema facts (encoding, no-overwrite, permissions: none). The main gap is the failure mode when a file already exists and how the approval flow interacts with the call.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% – path, content, _approvalId, and _idempotencyKey are all documented in the schema, including the reuse rule for the idempotency key. The description adds no parameter-level detail, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

"Create UTF-8 text file" gives a specific verb plus the exact resource and encoding, which separates it from siblings like finder_create_directory or finder_copy_file. It stops short of naming an alternative sibling, so it is clear but not fully differentiated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The only usage signal is the implicit constraint that it will not overwrite existing files, which hints at a failure case but names no alternative tool for overwriting or for reading an existing file. No explicit when-to-use or when-not-to-use guidance is provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mail_create_draftA
Idempotent

Create an unsent outgoing message in Mail and return its scripting ID. Delivery is a separate high-risk action. [v1.0.0; permissions: automation:Mail]

ParametersJSON Schema
NameRequiredDescriptionDefault
toYesOne recipient email
bodyYesPlain text body
subjectYesSubject
_approvalIdNoID of the exact action approved by a human in the macOS Agent Bridge extension
_idempotencyKeyYesClient-generated unique key, required for writes; reuse only with identical arguments, including while waiting for approval

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (readOnly=false, destructive=false, idempotent=true, openWorld=true), so the bar is lower. The description adds meaningful context: the message is unsent, delivery is a separate high-risk action, and it discloses the automation:Mail permission requirement.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three compact sentences with zero waste; the core action and the delivery caveat are front-loaded, and the metadata tag is deferred to the end.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return-value documentation is unnecessary, and permissions plus idempotency behavior are noted. Complete for invocation, though it says nothing about approval flow (the _approvalId param implies human approval) which a draft write could surface.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all five parameters (including _idempotencyKey and _approvalId) are already documented in the schema. The description adds no parameter-level meaning, which is the correct baseline when the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Create an unsent outgoing message in Mail') plus the return value ('return its scripting ID'). The 'unsent' qualifier and 'Delivery is a separate high-risk action' cleanly separate it from the mail_send sibling.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly signals that this tool composes but does not deliver, routing the agent away from send semantics. It does not name the alternative (mail_send) directly or state exclusion conditions, so a small inference remains.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mail_readA
Read-onlyIdempotent

Read one inbox message by numeric Mail ID; limited to current inbox scope. [v1.0.0; permissions: automation:Mail]

ParametersJSON Schema
NameRequiredDescriptionDefault
idYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (readOnly, idempotent, non-destructive, openWorld), so the bar is lower. The description still adds two things those annotations do not: the required automation:Mail permission and the scope restriction to the current inbox. It does not describe failure behavior for out-of-scope IDs, which keeps it from a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One compact sentence carries the operation, key, and scope, with the permission metadata bracketed at the end. Front-loaded and waste-free, though the version/permission tag is boilerplate that could be trimmed if the runtime already surfaces it.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need no explanation, and this is a single-parameter read-only tool. Scope, key semantics, and auth requirement are all present; only the ID-provenance path (mail_search) and out-of-scope error handling are absent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% — the id parameter is a bare integer with an empty description. The phrase "numeric Mail ID" and "limited to current inbox scope" do clarify that the integer is a Mail ID scoped to the inbox, which is real added meaning, but the description doesn't explain how to source the ID or what happens if it isn't an inbox message.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ("Read one inbox message") and identifies the lookup key (numeric Mail ID), which clearly separates it from mail_search, mail_send, and mail_create_draft. It stops short of naming an alternative sibling explicitly, so it lands at 4 rather than 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

"limited to current inbox scope" implies when this tool is appropriate (inbox messages only) and implicitly excludes other mailboxes or search-driven retrieval. However, it never states how to obtain the ID or routes the agent to mail_search when the target isn't in the inbox, leaving usage to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mail_sendA
DestructiveIdempotent

Send exactly this recipient, subject and body using Mail. Requires separate human approval; never auto-sends a mutable draft. [v1.0.0; permissions: automation:Mail]

ParametersJSON Schema
NameRequiredDescriptionDefault
toYesOne recipient email
bodyYesPlain text body
subjectYesSubject
_approvalIdNoID of the exact action approved by a human in the macOS Agent Bridge extension
_idempotencyKeyYesClient-generated unique key, required for writes; reuse only with identical arguments, including while waiting for approval

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint=true, idempotentHint=true and openWorldHint=true, so the safety profile is covered. The description earns credit by adding the approval-workflow requirement and the permission scope ('automation:Mail'), which annotations do not convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three compact clauses, front-loaded with the core action before the approval caveat and metadata. The bracketed version/permission tag is slightly noisy but does not bury the essential information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need no explanation, and the schema fully documents parameters. The description supplies the approval precondition and permission scope, leaving little an agent needs missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so every parameter including _approvalId and _idempotencyKey is documented in the schema itself. The description names recipient, subject and body but adds no syntax, format or constraint detail beyond what the schema already provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource ('Send exactly this recipient, subject and body using Mail') and the word 'exactly' pins down scope. It implicitly distinguishes itself from the sibling mail_create_draft by noting it never auto-sends a draft.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states the key precondition ('Requires separate human approval; never auto-sends a mutable draft'), which tells the agent this is only invoked after a human gate. It stops short of naming mail_create_draft as the alternative path for staging a message, so routing is clear but not fully explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

music_controlB
Idempotent

Control Music playback with fixed action play, pause, next, previous. [v1.0.0; permissions: automation:Music]

ParametersJSON Schema
NameRequiredDescriptionDefault
actionYes
_approvalIdNoID of the exact action approved by a human in the macOS Agent Bridge extension
_idempotencyKeyYesClient-generated unique key, required for writes; reuse only with identical arguments, including while waiting for approval

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare it a non-destructive, idempotent, open-world write, so the safety profile is covered. The description adds useful context beyond annotations by disclosing the required permission (automation:Music) and version, but stays silent on the human-approval flow implied by _approvalId, which is meaningful for a write tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with the action set stated up front, plus a compact bracketed metadata tag. No wasted prose, though the action enumeration is redundant with the schema enum.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, and annotations cover the safety profile. However, for a write tool that requires an idempotency key and supports a human-approval ID, the description omits any mention of the approval/retry behavior an agent needs to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 67%, and the description's enumeration of the action values merely restates the enum already defined in the schema. It adds no syntax or meaning for _approvalId or _idempotencyKey, so it does not compensate for the uncovered portions of the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Control) and resource (Music playback), and enumerates the four transport actions, so an agent can tell this is playback transport control rather than library browsing. It does not, however, distinguish itself from the sibling music_play_track, leaving ambiguity about which to prefer.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description lists the fixed actions but gives no when-to-use guidance, no prerequisites, and no alternative tools. With music_status, music_search, and music_play_track as siblings, an agent must infer on its own when this tool is the right choice.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

music_play_trackB
Idempotent

Play a track in the local Music library by database ID. [v1.0.0; permissions: automation:Music]

ParametersJSON Schema
NameRequiredDescriptionDefault
idYes
_approvalIdNoID of the exact action approved by a human in the macOS Agent Bridge extension
_idempotencyKeyYesClient-generated unique key, required for writes; reuse only with identical arguments, including while waiting for approval

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=false, idempotentHint=true, destructiveHint=false, and openWorldHint=true. The description adds the automation:Music permission requirement and a version tag, which is genuine value beyond the annotations, but it says nothing about the approval flow implied by _approvalId or what playback state results.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One tight sentence with the action front-loaded, followed by a compact metadata bracket. Nothing is redundant, though the bracketed version tag is of limited use to an agent.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, and annotations cover the safety profile. The permission note closes the main auth gap; the only remaining omission is behavior when the ID does not resolve to a track.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 67%; the required 'id' parameter has an empty schema description, and the phrase 'by database ID' is the only thing giving it meaning. The other two parameters are documented in the schema itself, so the description neither compensates fully nor adds much beyond the baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Play') and resource ('a track in the local Music library') plus the lookup key ('by database ID'), which is enough to distinguish it from music_search and music_control. It does not explicitly name those siblings, so it falls short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no when-to-use guidance, no mention of when to prefer music_control or music_search, and no prerequisites or exclusions. An agent must infer the boundary from the name alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

music_statusA
Read-onlyIdempotent

Read Music playback state and current track, when present. [v1.0.0; permissions: automation:Music]

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly/idempotent/non-destructive and open-world. The description adds value beyond that by disclosing the required permission ('automation:Music') and the behavioral edge case that playback may not be present, so the agent knows a null/empty result is possible rather than an error.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two compact sentences with the core action front-loaded and the version/permission metadata bracketed at the end. No filler, every clause carries information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be documented, and there are no parameters to explain. The description covers purpose, the absence edge case, and the permission requirement, which is sufficient for a simple read tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so per the rubric the baseline is 4. There is nothing for the description to clarify beyond the fact that no arguments are needed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: 'Read Music playback state and current track'. An agent can distinguish this read-state tool from music_search, music_play_track, and music_control by their names, though the description never explicitly names a sibling or states the contrast.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'when present' implies this is the tool to poll for current playback status, which is contextually implied by the music_* sibling set. However, there is no explicit statement of when to use this versus music_control (which may also read/modify state) or any exclusion guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

network_checkA
Read-onlyIdempotent

Resolve a public HTTP(S) URL and optionally check its HTTP connectivity. Reports DNS addresses, timings and HTTP status; HTTP failures remain visible. Never probes private or loopback networks. [v1.0.0; permissions: none]

ParametersJSON Schema
NameRequiredDescriptionDefault
urlYesPublic HTTP(S) URL to diagnose
httpNoCheck HTTP connectivity after DNS; default true. Set false for DNS only.
timeoutMsNoTotal timeout in milliseconds, including DNS and redirects; default 15000.

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, non-destructive, open-world behavior, so the bar is lower. The description adds real context: partial-failure semantics ('HTTP failures remain visible'), a security boundary (no private/loopback probing), and a permissions note. Return contents ('DNS addresses, timings and HTTP status') partly duplicate the output schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences with the core capability front-loaded, followed by return content and then the safety constraint. The trailing '[v1.0.0; permissions: none]' tag is slightly noisy but compact and arguably useful metadata.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, return values needn't be explained, and rich annotations cover the safety profile. The description still conveys scope, failure behavior, and permissions, leaving little an agent needs that is missing. Only the lack of sibling routing keeps it from 5.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and each parameter is self-documented (url, http, timeoutMs including redirects and default). The description's 'optionally check its HTTP connectivity' loosely mirrors the http flag but adds no format or interaction detail beyond the schema, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: 'Resolve a public HTTP(S) URL and optionally check its HTTP connectivity.' An agent immediately knows this is a DNS/HTTP diagnostic. It does not differentiate itself from adjacent diagnostic siblings such as bridge_diagnostics, so it falls short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied (diagnostics) and no alternative tool is named for connectivity/HTTP work, e.g. web_fetch. It does provide a genuine 'when-not' in 'Never probes private or loopback networks,' which narrows the applicable input space, but there is no explicit routing to siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

notes_appendA
Idempotent

Append safely encoded plain text to an existing note. Locked notes may reject access. [v1.0.0; permissions: automation:Notes]

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesStable native object ID
textYesPlain text to append
_approvalIdNoID of the exact action approved by a human in the macOS Agent Bridge extension
_idempotencyKeyYesClient-generated unique key, required for writes; reuse only with identical arguments, including while waiting for approval

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

A3.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare the mutation/idempotency/scope profile, and the description adds real value beyond them: it discloses a concrete failure mode ("Locked notes may reject access"), notes that text is safely encoded, and surfaces the required permission scope (automation:Notes). It does not discuss what an append does to note structure or encoding edge cases, keeping it from a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences with the action front-loaded and the failure caveat second; the trailing version/permission bracket is standard metadata. "Safely encoded" is slightly opaque, which costs a point, but there is no padding or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, return values need no explanation, and annotations plus a 100%-covered schema carry the safety and parameter burden. The description closes the main remaining gap by flagging the locked-note failure mode; only explicit sibling routing is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3. The description adds only the "plain text" and "safely encoded" framing, which is consistent with but not richer than the schema's own "Plain text to append" description; nothing new about id, idempotency key, or approval id is contributed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

"Append safely encoded plain text to an existing note" gives a specific verb (append) and resource (note), and the phrase "existing note" implicitly separates it from notes_create. It stops short of naming its siblings explicitly, so the differentiation is inferred rather than stated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description offers no guidance on when to use this versus notes_create or notes_get, nor any prerequisites beyond a passing mention that locked notes reject access. The agent must infer the routing decision from the tool name alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

notes_createA
Idempotent

Create a note in the default Notes account; plain text is safely encoded as HTML. [v1.0.0; permissions: automation:Notes]

ParametersJSON Schema
NameRequiredDescriptionDefault
textYesPlain text body
titleYesTitle
_approvalIdNoID of the exact action approved by a human in the macOS Agent Bridge extension
_idempotencyKeyYesClient-generated unique key, required for writes; reuse only with identical arguments, including while waiting for approval

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

A3.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare the write/idempotent/open-world safety profile, and the description adds genuinely useful behavior: plain text is safely encoded as HTML, and the operation requires the automation:Notes permission. It omits any mention of the human-approval path that the _approvalId parameter implies, but it goes beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence plus a compact bracketed version/permission tag; nothing is wasted. Slightly terse given it is the only prose the agent gets.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists so return values need no explanation, and annotations cover the safety profile. The description covers scope, encoding and permissions; the only gap is that it never hints at the approval workflow that gates the write.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so title, text, _approvalId and _idempotencyKey are all documented in the schema. The description only echoes the plain-text encoding idea already present in the text field description, adding no new parameter semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource ("Create a note") and narrows the scope to "the default Notes account", which lets an agent distinguish it from notes_append or notes_get. It does not explicitly name sibling alternatives, so it falls short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit when-to-use or when-not-to-use guidance and no mention of the approval/idempotency prerequisites for this write. The agent must infer that creation (rather than notes_append) is the right call from the tool name alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

notes_getA
Read-onlyIdempotent

Read note body as HTML via native Notes scripting interface. [v1.0.0; permissions: automation:Notes]

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesStable native object ID

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

A3.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (readOnly, idempotent, openWorld, non-destructive), so the bar is lower. The description adds genuinely non-redundant context: the required Automation permission for Notes and the fact that the body is returned as HTML rather than plain text.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded core action in one sentence, with version and permission metadata tucked into a compact bracket. No wasted prose, though the bracketed metadata is slightly noisy relative to the semantic content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, the description needn't explain return values, and it helpfully signals the HTML format and required permission. An agent has enough to call it correctly, with only the sibling-routing guidance absent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is a single required 'id' parameter with 100% schema description coverage, so the schema already carries the semantics. The description adds nothing about the ID's format or origin, so this sits at the baseline 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Read note body as HTML', plus the mechanism (native Notes scripting interface). It's distinguishable from notes_create/notes_append by naming a read of the body, but it never explicitly contrasts with notes_search, so it stops short of full sibling differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance and no mention of when to prefer notes_get over notes_search or any other alternative. The agent must infer usage entirely from the name and the returned format.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

reminders_complete_taskB
Idempotent

Set a reminder completion state and return saved record. [v1.0.0; permissions: reminders]

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesStable native object ID
completedYes
_approvalIdNoID of the exact action approved by a human in the macOS Agent Bridge extension
_idempotencyKeyYesClient-generated unique key, required for writes; reuse only with identical arguments, including while waiting for approval

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare write, idempotent, and non-destructive behavior, so the description only needs to add context. It contributes the return contract ('return saved record') and the required permission scope, but says nothing about the human-approval path implied by the _approvalId parameter or how idempotency keys must be reused.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short clauses with the action front-loaded and no filler; the trailing version/permission tag is compact. It is appropriately sized, though the bracket tag is boilerplate rather than informative.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The output schema covers return values and the annotations cover the safety profile, so those gaps are excused. What remains missing is the toggle direction of `completed`, the relationship to reminders_update_task, and any note on the approval workflow for a write tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 75%, so the schema already documents id, _approvalId, and _idempotencyKey. The phrase 'completion state' loosely maps to the bare `completed` boolean (the one undocumented parameter), but it never clarifies that setting it false reverses completion, which is the key semantic ambiguity.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Set a reminder completion state') plus the return behavior ('return saved record'), so the agent knows exactly what operation runs. It does not, however, distinguish itself from the sibling reminders_update_task, which could plausibly also set a completion field.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance, no indication that completed=false is how you un-complete a task, and no mention of when to prefer this over reminders_update_task or reminders_delete_task. The agent must infer the routing decision entirely from the name.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

reminders_create_taskB
Idempotent

Create a reminder; due dates require timezone. [v1.0.0; permissions: reminders]

ParametersJSON Schema
NameRequiredDescriptionDefault
dueNoISO 8601 date-time with explicit Z or numeric UTC offset
notesNoNotes
titleYesTitle
listIdNoList identifier
priorityNo
timezoneNoIANA time zone, e.g. Asia/Shanghai
_approvalIdNoID of the exact action approved by a human in the macOS Agent Bridge extension
_idempotencyKeyYesClient-generated unique key, required for writes; reuse only with identical arguments, including while waiting for approval

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare this is a non-read-only, non-destructive, idempotent, open-world write. The description adds two things beyond that: the timezone dependency for due dates and the required 'reminders' permission scope. It does not mention the human-approval path implied by the _approvalId parameter, which is notable for a write tool, keeping this at a 3.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with zero filler; the constraint is stated immediately after the verb. The bracketed version/permission tag is somewhat metadata-like, but it carries scope information useful to the caller.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be described, and the idempotency/approval parameter semantics live in the schema. However, for a write tool that carries an _approvalId parameter, the description never tells the agent an approval may be required or how the approval flow interacts with the idempotency key, leaving a real gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 88%, so the schema already documents title, notes, listId, timezone, and idempotency semantics; baseline is 3. The description does add one genuinely cross-field constraint not encoded in the schema (a due date requires a timezone), but only for a single parameter family, so it does not rise above baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Create') and resource ('a reminder'), so an agent can distinguish it from reminders_list_tasks and reminders_update_task by intent. It stops short of explicitly naming the sibling it is not (e.g. use reminders_update_task to modify an existing reminder), so it earns a 4 rather than a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied by the verb 'Create' plus the prerequisite 'due dates require timezone', which tells the agent something must be supplied for dated reminders. There is no explicit when-to-use/when-not guidance against reminders_update_task or reminders_complete_task, so this is the minimum-viable tier.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

reminders_delete_taskA
DestructiveIdempotent

Permanently delete a reminder with human approval. [v1.0.0; permissions: reminders]

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesStable native object ID
_approvalIdNoID of the exact action approved by a human in the macOS Agent Bridge extension
_idempotencyKeyYesClient-generated unique key, required for writes; reuse only with identical arguments, including while waiting for approval

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint=true, idempotentHint=true and openWorldHint=true. The description adds meaningful context beyond them: the operation is irreversible ('permanently') and gated on a human approval workflow, which is behavioral context the annotations do not convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short clauses with the destructive verb and the approval requirement front-loaded, plus a compact version/permissions tag. No wasted prose, though it is terse to the point of omitting guidance.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, return values need not be described, and annotations plus the approval note cover the safety profile. For a destructive write gated on human approval, this is nearly complete, though it omits any reference to the idempotency/approval-key mechanics that the schema documents.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents id, _approvalId and _idempotencyKey thoroughly. The description adds no parameter-level detail, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ('Permanently delete a reminder'), and 'permanently' distinguishes it from softer alternatives like reminders_complete_task. It does not explicitly name a sibling, but the scope is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Mentions that deletion requires 'human approval', which implies a precondition for calling it. However, it gives no explicit when-not guidance (e.g., use reminders_complete_task to mark done rather than delete) and no alternatives, leaving usage largely implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

reminders_list_listsB
Read-onlyIdempotent

List EventKit reminder lists. [v1.0.0; permissions: reminders]

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, destructiveHint=false, and openWorldHint, so the safety profile is fully covered. The description adds a genuine behavioral detail beyond the schema – the required 'reminders' permission – which is useful for auth planning, but nothing about result shape or limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence plus a bracketed version/permission tag; nothing is wasted. It is terse rather than padded, though the metadata tag is convention-driven rather than descriptive.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, read-only listing tool with an output schema present, the description need not explain return values. Auth scope is noted; the only real gap is the absence of any routing hint toward reminders_list_tasks.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so there is nothing for the description to clarify beyond the schema. Baseline 4 applies for a no-argument tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('List EventKit reminder lists'), which is unambiguous on its own. It implicitly separates itself from reminders_list_tasks by naming 'lists' as the resource, but never explicitly distinguishes the two sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance, no prerequisites, and no mention of alternatives such as reminders_list_tasks. The agent must infer from the name alone that this is the tool to call before listing tasks.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

reminders_list_tasksA
Read-onlyIdempotent

Read reminders, optionally filtering list and completion; bounded result. [v1.0.0; permissions: reminders]

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
listIdNoList identifier
completedNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and destructiveHint=false, so the safety profile is covered structurally. The description adds two useful facts beyond that: results are bounded (limit-capped at 500 per schema) and the tool requires the 'reminders' permission, which helps the agent anticipate auth gating.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One front-loaded sentence covering action, filters, and result bound, plus a compact bracketed metadata tag. Nothing is padded, though the semicolon-joined metadata is slightly harder to parse than plain prose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return-shape explanation isn't required, and the annotations cover the read-only safety profile. The remaining gap is default behavior when filters and limit are omitted, but for a low-complexity 3-optional-param list tool the definition is largely sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is only 33% (limit and completed have empty descriptions), so the description must compensate. It partially does by naming 'list' and 'completion' filtering, but says nothing about the limit parameter's default, upper bound, or what 'bounded result' means in practice when no limit is supplied.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Read reminders') and names the available filters (list, completion). It is clear what the tool returns, but it doesn't explicitly separate itself from the adjacent reminders_list_lists sibling, leaving the agent to infer the task-vs-list distinction from the name alone.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'optionally filtering list and completion' implies the intended use case (browse reminders with optional filters), but there is no explicit when-to-use statement, no when-not, and no pointer to reminders_list_lists or the create/update/complete siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

reminders_update_taskA
Idempotent

Update reminder fields by native ID. [v1.0.0; permissions: reminders]

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesStable native object ID
dueNoISO 8601 date-time with explicit Z or numeric UTC offset
notesNoNotes
titleNoTitle
listIdNoList identifier
priorityNo
timezoneNoIANA time zone, e.g. Asia/Shanghai
_approvalIdNoID of the exact action approved by a human in the macOS Agent Bridge extension
_idempotencyKeyYesClient-generated unique key, required for writes; reuse only with identical arguments, including while waiting for approval

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=false, idempotentHint=true, destructiveHint=false, and openWorldHint=true, so the description carries a lower burden. It adds the permission scope ("permissions: reminders") and the native-ID targeting requirement, which is useful, but says nothing about whether omitted fields are preserved, whether an approval is required, or how _approvalId interacts with the write.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two compact fragments with the action front-loaded and the version/permission metadata clearly bracketed as secondary. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, and annotations plus the permission tag cover the safety and auth profile. For a reminder update tool the description supplies enough to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 89%, so the schema already documents nearly every field including id, due, listId, and _idempotencyKey. The description adds no field-level meaning beyond what the schema provides, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

"Update reminder fields by native ID" gives a specific verb (update), resource (reminder fields), and identifying key (native ID), which separates it from siblings like reminders_create_task, reminders_complete_task, and reminders_delete_task. It stops short of explicitly naming those alternatives, but the core action is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use, when-not-to-use, or alternative routing is provided. An agent must infer that this is for editing existing reminders rather than completing (reminders_complete_task) or recreating them, and there is no guidance on partial-update semantics versus full replacement.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

safari_close_tabA
DestructiveIdempotent

Close a tab identified by window ID and one-based tab index. Prompts for human approval. [v1.0.0; permissions: automation:Safari]

ParametersJSON Schema
NameRequiredDescriptionDefault
tabIndexYes
windowIdYes
_approvalIdNoID of the exact action approved by a human in the macOS Agent Bridge extension
_idempotencyKeyYesClient-generated unique key, required for writes; reuse only with identical arguments, including while waiting for approval

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint=true, readOnlyHint=false, and openWorldHint=true, so the safety profile is covered. The description adds a genuinely non-redundant behavioral fact — that a human approval prompt gates execution — plus the required automation:Safari permission scope. It stops short of describing failure behavior for an invalid tab or the idempotency semantics declared in annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences: the action and its identifiers come first, then the approval gate and the version/permission metadata. Every element is relevant, though the bracketed metadata block is slightly mechanical and could be trimmed without loss.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, return values need no explanation, and annotations carry the safety profile; the critical extra fact (human approval) is stated. The remaining gap is operational: how to discover valid window/tab identifiers and what happens on a stale or out-of-range index.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is only 50%: windowId and tabIndex have empty schema descriptions, while _approvalId and _idempotencyKey are documented in the schema. The description compensates for the gap by clarifying that tabIndex is one-based and that the pair (window ID, tab index) is the identifier, which adds real meaning beyond the bare integer minimums.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource (close a tab) plus the exact identification scheme (window ID + one-based tab index), which cleanly separates it from siblings like safari_open_tab and safari_list_tabs. An agent can decide to use this tool without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the purpose (this is the only close-tab tool among the siblings), and the approval requirement signals it is a deliberate, gated action. However, it never says how to obtain a valid windowId/tabIndex (e.g. via safari_list_tabs) or what to do when the tab does not exist, so no explicit when/when-not guidance is given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

safari_list_tabsA
Read-onlyIdempotent

Read open Safari windows and tabs, titles and URLs via Safari scripting. [v1.0.0; permissions: automation:Safari]

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, and non-destructive, so the safety profile is covered. The description adds genuine value beyond them by disclosing the mechanism ('via Safari scripting') and the required permission (automation:Safari), which is actionable auth context an agent needs before invoking.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence carries the full purpose, with the version/permission tag compactly bracketed at the end. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a parameterless read tool with an output schema (return values need not be explained) and annotations covering safety, the description is nearly sufficient. It states purpose, mechanism, and required permission. It could add a note on ordering/scope of the returned tabs, but nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so the baseline of 4 applies. There are no parameter semantics to clarify and nothing in the description misrepresents input needs.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Read) and resource (open Safari windows and tabs, titles and URLs), clearly distinguishing it from siblings safari_open_tab and safari_close_tab. An agent can identify the operation without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the name and description (list what's currently open), but there is no explicit when-to-use guidance or reference to alternatives like system_list_windows or system_get_active_window that also enumerate windows. Minimum viable, no routing help.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

safari_open_tabB
Idempotent

Open one HTTP(S) URL in Safari. [v1.0.0; permissions: automation:Safari]

ParametersJSON Schema
NameRequiredDescriptionDefault
urlYesHTTP(S) URL
_approvalIdNoID of the exact action approved by a human in the macOS Agent Bridge extension
_idempotencyKeyYesClient-generated unique key, required for writes; reuse only with identical arguments, including while waiting for approval

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=false, openWorldHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description adds the genuinely useful auth context 'permissions: automation:Safari,' but omits the human-approval flow implied by the required _approvalId parameter and says nothing about tab focus or existing-tab behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short clauses, front-loaded with the action and resource; nothing is wasted. The bracketed version/permission tag is mildly noisy but also carries the one substantive extra fact.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need no explanation, and all three parameters are fully documented in the schema. The description supplies the required-permission context; only the approval-gated write flow is left implicit.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents url, _approvalId, and _idempotencyKey in detail. The description adds nothing about parameter syntax, formats, or edge cases, which is the baseline 3 when the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: 'Open one HTTP(S) URL in Safari,' with the 'one' scope constraint making it clear this is a single-tab open. It does not, however, distinguish itself from the sibling system_open_url or safari_list_tabs, which an agent must infer from names alone.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance, no prerequisites, and no mention of when an alternative (e.g., system_open_url or web_fetch) would be preferable. Usage is only implied by the tool name.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

shortcuts_listA
Read-onlyIdempotent

Discover names of user-installed Apple Shortcuts using the public shortcuts CLI. [v1.0.0; permissions: none]

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare the read-only, idempotent, non-destructive profile. The description adds context annotations cannot supply: it goes through the public shortcuts CLI and requires no permissions ('permissions: none'), which tells the agent there is no auth gate or consent prompt. It does not mention scope limits such as built-in vs user shortcuts beyond the 'user-installed' qualifier.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One sentence carries the purpose, with version and permission metadata in a compact bracketed tag. Front-loaded, no filler, nothing repeated from structured fields.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, return values need not be explained, and the tool is parameterless and simple. Version and permission context are supplied; the only minor gap is the absence of any hint about ordering or how names relate to the sibling shortcuts_run.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Zero parameters, so the schema-based baseline of 4 applies. There is nothing for the description to disambiguate, and it correctly makes no parameter claims that would conflict with the empty schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource: 'Discover names of user-installed Apple Shortcuts'. It is clear what the tool returns (names, not execution), which implicitly separates it from shortcuts_run, though it never names that sibling.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: an agent can infer this is the discovery step before shortcuts_run, but the description gives no explicit when-to-use, prerequisites, or exclusions. No alternative is named.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

shortcuts_runA
DestructiveIdempotent

Execute an existing Shortcut by exact name after human approval. Its workflow can have arbitrary side effects; no dynamic code accepted. [v1.0.0; permissions: shortcuts]

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesExact Shortcut name
_approvalIdNoID of the exact action approved by a human in the macOS Agent Bridge extension
_idempotencyKeyYesClient-generated unique key, required for writes; reuse only with identical arguments, including while waiting for approval

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructive, openWorld, and idempotent behavior. The description adds important context beyond them: human approval is required, the shortcut workflow can have arbitrary side effects, and dynamic code is not accepted.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tightly written sentences front-load the action and its constraints, followed by a compact version/permissions bracket. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema and rich annotations already present, the description covers the key behavioral risks and approval requirement. A minor ambiguity remains because _approvalId is not required in the schema despite the description implying human approval is needed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents name, _approvalId, and _idempotencyKey. The description reinforces that name must be exact, but adds no semantic detail beyond what the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: 'Execute an existing Shortcut by exact name.' It distinguishes itself from shortcuts_list by requiring an existing shortcut name and specifying human approval.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context: run an existing shortcut by exact name, after human approval, with no dynamic code accepted. It does not explicitly name shortcuts_list as the alternative for discovering names, but the preconditions are clear enough to guide use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

system_activate_appB
Idempotent

Activate a running application by bundle ID. [v1.0.0; permissions: none]

ParametersJSON Schema
NameRequiredDescriptionDefault
bundleIdYesApp bundle identifier
_approvalIdNoID of the exact action approved by a human in the macOS Agent Bridge extension
_idempotencyKeyYesClient-generated unique key, required for writes; reuse only with identical arguments, including while waiting for approval

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint=false, idempotentHint=true, and openWorldHint=true, covering the safety profile. The description adds 'permissions: none' and the 'running' precondition, but does not disclose what happens if the app is not running (error vs. launch) or any side effects of bringing an app to the foreground.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short clauses, front-loaded with the action and resource. The bracketed metadata '[v1.0.0; permissions: none]' is slightly noisy but compact and does convey a permission fact.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need no explanation. Still, for an open-world mutation-ish tool with a required idempotency key and an approval mechanism, the description omits the failure mode when the app is not running and any mention of the approval flow required by _approvalId.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and all three parameters (bundleId, _idempotencyKey, _approvalId) are documented in the schema, so the baseline is 3. The description only echoes the bundleId concept and adds nothing about the required idempotency key or the approval ID.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Activate') and resource ('a running application') qualified by the identifier type ('by bundle ID'), so the action is unambiguous. It does not explicitly name or contrast with the closest sibling, system_open_app, leaving the activate-vs-launch distinction to inference from 'running'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Activate a running application' implies the precondition that the target is already running, which is useful context. However, it never states when to choose this over system_open_app (which presumably launches a non-running app) or what to do if the app is not running, so routing guidance is only implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

system_capture_screenA
Idempotent

Capture full display or one window to PNG inside an authorized file root. Screen Recording permission required. [v1.0.0; permissions: screenRecording]

ParametersJSON Schema
NameRequiredDescriptionDefault
windowIdNo
outputPathYesAbsolute .png path, will not overwrite
_approvalIdNoID of the exact action approved by a human in the macOS Agent Bridge extension
_idempotencyKeyYesClient-generated unique key, required for writes; reuse only with identical arguments, including while waiting for approval

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (idempotentHint true, destructiveHint false), so the bar is lower. The description adds genuinely useful context beyond them: the Screen Recording permission requirement and the authorized-file-root confinement for the output. It omits the human-approval requirement implied by _approvalId and the non-overwrite behavior, but the core behavioral traits are disclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with the action and scope, with the permission requirement immediately following. Nothing redundant; the version tag is compact metadata.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need no explanation, and the description carries the permission and file-root constraints. Approval workflow and overwrite behavior live in the schema, so the description is complete enough for correct invocation. Marginal room to note the approval gate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 75%, below the 80% baseline, and windowId ships with an empty description. The phrase "full display or one window" compensates for exactly that gap by explaining windowId's semantics (its presence selects single-window mode) and its optionality. The remaining three parameters are documented in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

"Capture full display or one window to PNG inside an authorized file root" gives a specific verb (capture), a clear resource (full display or one window), the output format (PNG), and a scope constraint (authorized file root). An agent can tell this apart from window-inspection siblings like system_get_active_window or system_list_windows. It stops short of the explicit 5 because it never names those siblings directly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states a prerequisite ("Screen Recording permission required") and implies the display-vs-window choice, but gives no when-to-use/when-not guidance relative to alternatives and no exclusions. Usage context is only implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

system_get_active_windowA
Read-onlyIdempotent

Read frontmost focused window title and geometry via Accessibility. [v1.0.0; permissions: accessibility]

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (readOnly, non-destructive, idempotent, openWorld). The description adds genuinely non-derivable context: the read happens via the Accessibility API and requires the accessibility permission, which tells the agent why calls may fail or prompt.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One dense sentence plus a compact metadata bracket, with the purpose front-loaded. Every clause earns its place: verb, resource, mechanism, and prerequisites.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema covering return values and annotations covering safety, the description only needs to name the resource and prerequisites, which it does. It stops short of noting behavior when no window is focused, but the essentials for calling correctly are present.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so the baseline of 4 applies and the schema has nothing to document. The description's mention of what is retrieved (title and geometry) is a scope note rather than parameter guidance.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource: reads the frontmost focused window's title and geometry. The word 'window' (vs 'app') gives an agent enough to distinguish it from system_get_frontmost_app, though it never explicitly names that sibling or system_list_windows as the non-focus-wide alternative.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use or when-not guidance is given. Although the purpose implies its use, there is nothing telling the agent to prefer this over system_get_frontmost_app or system_list_windows, and no failure conditions are mentioned beyond an implied permission prerequisite.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

system_get_frontmost_appB
Read-onlyIdempotent

Read frontmost application metadata using NSWorkspace. [v1.0.0; permissions: none]

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare the full safety profile (readOnly, idempotent, openWorld, non-destructive), so the description is not the burden-carrier here. It does add one piece of non-annotation context, '[permissions: none]', which usefully tells the agent no authorization is needed; the NSWorkspace mention is implementation detail rather than agent-relevant behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence plus a short bracketed metadata tag; nothing is buried and nothing is wasted. The version/permission tag is arguably clutter, but it carries real information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, the return contents need no prose, and with zero parameters there is no input surface to document. The description plus rich annotations and a defined output shape cover everything needed to invoke this tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so there is nothing for the description to disambiguate and the baseline is 4. The description correctly avoids inventing argument semantics that do not exist.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb ('Read') and a precisely scoped resource ('frontmost application metadata'), which separates it from system_list_apps (all apps) and system_get_active_window (windows). It stops short of naming those siblings explicitly, so it is clear but not self-differentiating.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no statement of when to use this tool versus system_list_apps, system_get_active_window, or system_activate_app. The agent must infer usage purely from the word 'frontmost' in the purpose line.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

system_get_selected_textA
Read-onlyIdempotent

Read focused Accessibility element selected text. Does not use clipboard keystroke fallback. [v1.0.0; permissions: accessibility]

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safe read-only profile, but the description adds valuable behavioral context: it avoids clipboard keystroke fallback and requires accessibility permissions. This helps an agent understand the method and auth needs beyond the structured annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is very short and front-loaded with the core purpose. Every fragment adds useful information: method constraint and permission requirement, with no wasted text.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simple zero-parameter read operation, existing output schema, and rich annotations, the description is largely complete. It could explicitly route between this tool and clipboard_read, but the method exclusion provides enough context for correct selection.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so there is no parameter semantics to document in the description. The baseline for a zero-parameter tool is 4, and nothing in the description contradicts or adds parameter details.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: reading selected text from the focused Accessibility element. It also distinguishes itself from a clipboard-based sibling by explicitly saying it does not use clipboard keystroke fallback.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage by contrasting the method with clipboard fallback, but it does not explicitly state when to choose this tool over clipboard_read or what conditions must be met. No clear when/when-not guidance is present.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

system_list_appsA
Read-onlyIdempotent

List running regular applications. [v1.0.0; permissions: none]

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, non-destructive, and openWorld, so the safety profile is fully covered. The description contributes 'permissions: none' (auth requirement) and a version tag, which is real added context, but it says nothing about ordering, result limits, or what 'regular' excludes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One short sentence with the scope stated first, followed by a bracketed metadata tag. Nothing is wasted and the key fact is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need no explanation, and with no parameters the description's burden is light. It is nearly complete for this tool, though the meaning of 'regular applications' and result ordering remain unstated.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Zero parameters, so there is no parameter semantics to explain; baseline is 4. The description correctly implies no arguments are needed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (List) and resource (running regular applications), which separates it from system_get_frontmost_app, system_activate_app, and system_open_app. The qualifier 'regular' is undefined, so an agent can't tell whether background/accessory apps are included, which keeps it short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use guidance, no exclusions, and no sibling alternatives named. The agent must infer that this is the tool to enumerate running apps versus system_status or system_list_windows.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

system_list_windowsA
Read-onlyIdempotent

List visible window metadata; titles require Screen Recording permission on some macOS versions. [v1.0.0; permissions: screenRecording]

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

A3.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish that this is a safe, idempotent, non-destructive read. The description adds genuinely useful behavioral context beyond them: a prerequisite permission (Screen Recording) that gates whether window titles are populated on some macOS versions. It does not describe scope limitations such as only visible/minimized windows or ordering.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two compact sentences with the core action front-loaded, followed by the permission caveat that directly affects output reliability. The bracketed version/permission tag is slightly noisy but carries real prerequisite information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return-shape details are not needed. For a zero-parameter read tool with rich annotations, the description covers purpose and the key permission prerequisite; only explicit routing to sibling tools is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so the baseline is 4. The description correctly implies a no-argument listing operation and adds the permission-dependent behavior of the title field, which is meaningful even without parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('List visible window metadata'), which is clearly distinct from the single-window sibling system_get_active_window and from system_list_apps. It does not explicitly name a sibling to differentiate scope, but the 'list all windows' intent is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use or when-not-to-use guidance, and no routing to alternatives such as system_get_active_window for a single window or system_list_apps for applications. The only conditional context is a permission caveat, not a selection rule.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

system_open_appA
Idempotent

Open an installed app by exact bundle ID; does not execute arbitrary binaries. [v1.0.0; permissions: none]

ParametersJSON Schema
NameRequiredDescriptionDefault
bundleIdYesApp bundle identifier
_approvalIdNoID of the exact action approved by a human in the macOS Agent Bridge extension
_idempotencyKeyYesClient-generated unique key, required for writes; reuse only with identical arguments, including while waiting for approval

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare the safety profile (readOnly=false, destructive=false, idempotent=true, openWorld=true). The description adds two traits not covered there: the permission requirement ("permissions: none") and the hard scope restriction against launching arbitrary binaries. It does not, however, mention the human-approval path implied by the _approvalId parameter.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence carrying the action, the scope limit, and the version/permission metadata in brackets. No filler, nothing that could be cut without losing information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need no explanation, and the parameters are fully documented in the schema. The remaining gap is the approval workflow (when _approvalId must be supplied) and routing among the open/activate/run siblings, which the description leaves implicit.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all three parameters, including the idempotency and approval keys. The description's "exact bundle ID" wording adds only a mild nuance about matching semantics, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb + resource ("Open an installed app by exact bundle ID") with an explicit scope boundary ("does not execute arbitrary binaries"). That boundary cleanly separates it from siblings like system_run_command, system_open_url, and system_activate_app without the agent needing to open any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The exclusion of arbitrary binary execution implies the right alternative (system_run_command), but no sibling is named and no when-to-use condition is stated for choosing between this, system_activate_app, and system_open_url. Usage is only implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

system_open_urlA
Idempotent

Open an http or https URL in the default browser. Other URL schemes are forbidden. [v1.0.0; permissions: none]

ParametersJSON Schema
NameRequiredDescriptionDefault
urlYesHTTP(S) URL
_approvalIdNoID of the exact action approved by a human in the macOS Agent Bridge extension
_idempotencyKeyYesClient-generated unique key, required for writes; reuse only with identical arguments, including while waiting for approval

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare the side-effect profile (readOnlyHint=false, openWorldHint=true, idempotentHint=true, destructiveHint=false). The description adds the useful constraint that only http/https schemes are accepted and that no permissions are required, but says nothing about the human-approval flow implied by the _approvalId parameter or about browser foregrounding/tab behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with the action and immediately followed by the scheme constraint. The bracketed '[v1.0.0; permissions: none]' metadata adds little operational value but is brief and does not obscure the core instruction.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With a full-coverage schema, an output schema, and annotations covering safety and open-world scope, the description supplies the one thing not fully carried elsewhere: the scheme restriction. It is nearly complete; only the approval/idempotency workflow for this write-like action is left implicit.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all three parameters (url, _approvalId, _idempotencyKey) are documented in the schema. The description only restates the accepted URL scheme, adding no format, length, or idempotency semantics beyond structured data; baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource (open a URL in the default browser) and constrains input scope to http/https, which is more precise than the bare name. It does not, however, distinguish itself from close siblings like safari_open_tab or system_open_app, leaving the agent to infer which opener applies.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied rather than stated: an agent can infer this is for handing an http(s) link to the OS default browser, and the scheme restriction excludes other cases. There is no explicit when-to-use guidance or named alternative for cases like 'open a file' (finder_open_file) or 'open a specific app' (system_open_app).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

system_run_commandA
Read-onlyIdempotent

Run one fixed read-only utility: disk_usage, battery, uptime. No command string or shell accepted. [v1.0.0; permissions: none]

ParametersJSON Schema
NameRequiredDescriptionDefault
commandYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false and openWorldHint=false, so the safety profile is covered structurally. The description adds value beyond that with 'permissions: none' (explicit auth requirement) and the explicit rejection of shell input, which materially shapes how an agent may call it.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, zero padding, and the functional core is front-loaded before the constraining clause. The bracketed metadata is terse and appended rather than buried mid-sentence.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With only one enum-constrained parameter, thorough annotations, and an output schema that handles return values, the description covers everything an agent needs to call this correctly. The input restriction and permission status are the only behaviors that mattered and both are stated.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must carry the param semantics — and it does, naming all three enum values (disk_usage, battery, uptime) inline. The enum in the schema is technically authoritative, so this repeats rather than extends, but it compensates fully for the missing schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb ('Run') plus the exact resource (one fixed read-only utility), with the three allowed values enumerated inline. The clause 'No command string or shell accepted' pre-empts the obvious misreading an agent would have from the name 'system_run_command', distinguishing it from any general shell-execution sibling.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description makes the usage constraints clear ('one fixed', 'no command string or shell accepted'), which tells the agent this is not a general-purpose executor. However, it never states when to prefer this over adjacent diagnostic siblings such as bridge_diagnostics or system_status, nor what conditions make each of the three utilities the right pick.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

system_set_window_frameB
Idempotent

Move/resize the frontmost focused window using Accessibility. Does not implement arbitrary UI clicking. [v1.0.0; permissions: accessibility]

ParametersJSON Schema
NameRequiredDescriptionDefault
xYes
yYes
widthYes
heightYes
_approvalIdNoID of the exact action approved by a human in the macOS Agent Bridge extension
_idempotencyKeyYesClient-generated unique key, required for writes; reuse only with identical arguments, including while waiting for approval

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

B3.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the write/idempotent/open-world profile, and the description adds context beyond them: the Accessibility API dependency, the required 'accessibility' permission, and the fact that only the frontmost focused window is affected. It still says nothing about failure behavior when no window is focused, multi-monitor coordinate handling, or the human-approval flow implied by _approvalId.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences with the action front-loaded, followed by a bracketed metadata tag. No filler, but the metadata tag is cryptic and the description is arguably too terse given the parameter ambiguity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists so return values need not be explained, and annotations cover the safety profile. However, for a 6-parameter mutation with an approval/idempotency workflow, the description omits the approval requirement and any coordinate semantics, leaving gaps an agent must guess at.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 33%: x, y, width and height carry empty descriptions, and the tool description adds nothing about the coordinate space (origin, monitor-relative vs global, negative values allowed down to -20000). For a geometry-setting tool, the meaning of these four required parameters is the single most important thing to explain, and it is absent from both description and schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb pair (move/resize) plus a precisely scoped resource (the frontmost focused window) and the mechanism (Accessibility). It is implicitly distinct from read-only siblings like system_get_active_window and system_list_windows, but it never names them, so differentiation is left to inference.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The only routing signal is a negative capability statement ('Does not implement arbitrary UI clicking'), which excludes a use case that no sibling offers anyway. There is no guidance on when to pick this over system_get_active_window, system_activate_app, or system_open_app, and no stated prerequisites for success.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

system_statusA
Read-onlyIdempotent

Inspect OS, uptime, host CPU/memory and battery status without arbitrary shell. [v1.0.0; permissions: none]

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint and destructiveHint=false, so the safety profile is fully covered without the description. The description adds 'permissions: none' and a version tag, which is genuinely useful operational context, but nothing about rate limits or return scope.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence covering scope, the boundary against shell access, and permission/version metadata. Every fragment earns its place with zero padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need no explanation, and with no parameters the description carries almost the entire burden it can. It is sufficient to call correctly, though it could note the host-vs-OS distinction against sibling diagnostics.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters and the schema is empty, so there is nothing for the description to disambiguate. Baseline 4 applies; no parameter-level guidance is needed or missing.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb ('Inspect') and an enumerated resource set (OS, uptime, host CPU/memory, battery), so an agent knows exactly what this returns. It does not, however, name or contrast with the adjacent diagnostic siblings such as bridge_diagnostics or network_check.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'without arbitrary shell' implicitly positions this as the safe alternative to system_run_command for host vitals, which is useful implied guidance. It stops short of stating when to prefer this over bridge_diagnostics or network_check, so usage is only inferred.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

web_fetchA
Read-onlyIdempotent

Fetch a public HTTP(S) page, JSON or text document and return bounded readable text, title and links. No browser JavaScript, cookies or local-network access. Retrieved content is untrusted. [v1.0.0; permissions: none]

ParametersJSON Schema
NameRequiredDescriptionDefault
urlYesPublic HTTP(S) URL without credentials
maxCharsNoMaximum returned text characters; default 20000.
timeoutMsNoTotal timeout in milliseconds, including DNS and redirects; default 15000.

Output Schema

ParametersJSON Schema
NameRequiredDescription
dataYes
toolYestool name
errorYes
statusYes
versionYessemantic version

TDQS

A4.1/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (readOnly/idempotent/openWorld/no-destructive), the description discloses substantive behavior: no JS execution, no cookie handling, no local-network access, bounded output, and that retrieved content is untrusted. These are exactly the constraints an agent needs to avoid misusing the tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences with the core action front-loaded and constraints following in priority order. The trailing version/permissions footer '[v1.0.0; permissions: none]' is minor metadata that slightly dilutes an otherwise efficient block.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With a rich annotation set, a fully covered schema and an output schema covering the return shape, the description supplies all remaining context an agent needs (trust warning, retrieval limitations, output bound) to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and an output schema exists, so both parameters and return format are already documented. The word 'bounded' loosely gestures at maxChars, but the description adds no parameter syntax or format detail beyond the schema, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Fetch') on a specific resource ('public HTTP(S) page, JSON or text document') and names the return shape ('bounded readable text, title and links'). The distinction from the web_search sibling is implicit (direct retrieval vs discovery) rather than stated, so it is clear but not explicitly differentiated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states clear when-not conditions: 'No browser JavaScript, cookies or local-network access,' telling the agent this fails on JS-rendered pages and private hosts. It does not name the alternative tool (e.g. web_search for discovery or a Safari tool for JS pages), so routing guidance is implied rather than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 63 tool updatesv0.2.0
    • First observedbridge_diagnostics
    • First observedbridge_get_operation
    • First observedbridge_list_capabilities
    • First observedcalendar_create_event
    • First observedcalendar_delete_event
    • First observedcalendar_find_free_slots
    • First observedcalendar_list_calendars
    • First observedcalendar_list_events
    • First observedcalendar_update_event
    • First observedclipboard_read
    • First observedclipboard_write
    • First observedcontacts_create
    • First observedcontacts_get
    • First observedcontacts_search
    • First observedcontacts_update
    • First observedfinder_copy_file
    • First observedfinder_create_directory
    • First observedfinder_list_files
    • First observedfinder_move_file
    • First observedfinder_open_file
    • First observedfinder_read_file
    • First observedfinder_rename_file
    • First observedfinder_search_files
    • First observedfinder_trash_file
    • First observedfinder_write_file
    • First observedmail_create_draft
    • First observedmail_read
    • First observedmail_search
    • First observedmail_send
    • First observedmusic_control
    • First observedmusic_play_track
    • First observedmusic_search
    • First observedmusic_status
    • First observednetwork_check
    • First observednotes_append
    • First observednotes_create
    • First observednotes_get
    • First observednotes_search
    • First observedreminders_complete_task
    • First observedreminders_create_task
    • First observedreminders_delete_task
    • First observedreminders_list_lists
    • First observedreminders_list_tasks
    • First observedreminders_update_task
    • First observedsafari_close_tab
    • First observedsafari_list_tabs
    • First observedsafari_open_tab
    • First observedshortcuts_list
    • First observedshortcuts_run
    • First observedsystem_activate_app
    • First observedsystem_capture_screen
    • First observedsystem_get_active_window
    • First observedsystem_get_frontmost_app
    • First observedsystem_get_selected_text
    • First observedsystem_list_apps
    • First observedsystem_list_windows
    • First observedsystem_open_app
    • First observedsystem_open_url
    • First observedsystem_run_command
    • First observedsystem_set_window_frame
    • First observedsystem_status
    • First observedweb_fetch
    • First observedweb_search

TDQS

A3.6/5.0

Scored across 63 tools

Disambiguation4/5

Most tools are clearly distinguished by family prefix and resource/action, but the Finder copy/move/rename trio share nearly identical descriptions ('Rename accepts a destination absolute path'), and system_run_command overlaps with system_status for battery/uptime. These few cases could cause occasional misselection.

Naming Consistency5/5

All tool names use consistent snake_case with predictable family prefixes (calendar_, contacts_, mail_, etc.) and clear action verbs. Minor noun-only names like bridge_diagnostics or system_status still follow the same family-prefix convention.

Tool Count2/5

With 63 tools, the server is far above the heavy threshold for a single MCP server, even given its broad macOS bridge scope. While each domain has some coverage, the volume risks overwhelming an agent and suggests consolidation opportunities.

Completeness4/5

Core workflows are covered across many domains, but several apps lack full lifecycle support: Contacts and Notes have no delete, Mail lacks management operations like delete/move/flag, and Music is limited. These are moderate gaps that agents can partially work around.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    D
    maintenance
    Provides native macOS computer control tools including mouse and keyboard simulation, screenshot capture, and application management for MCP-compatible agents. It enables AI assistants to directly interact with the macOS operating system and installed apps through standard tool calls.
    24
    22 npm
    8
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    Automatically discovers all scriptable macOS apps and generates MCP tools for them, giving AI access to apps like Mail, Calendar, and Finder without any configuration.
    4 npm
    3
    BSD 3-Clause