Skip to main content
Glama

GitHub stars PyPI npm PyPI downloads PyPI monthly npm monthly MCP Registry Python CI Coverage License: MIT Glama Listed in Awesome MCP Servers


Why

Your agent edits an MCP tool, but the client still runs the old process. Someone has to restart it before the agent can test the fix.

With Kitsune, connect, call and reload are tools. The agent runs the whole loop itself:

connect("uvx --from . my-mcp-server", name="dev")  # start your server
shapeshift("dev")  # its tools appear in the client
call("summarize", arguments={"url": "https://example.com"})

# … the agent (or you) edits the tool …

reload("dev")  # restart on fresh code, remount
call("summarize", arguments={"url": "https://example.com"})  # new code, same session

No Docker needed: connect() runs your own server as a plain local process, so the loop stays fast.

It also mounts any of 130,000+ servers from 7 registries mid-session. If Docker is installed, community packages run caged.

Try it: hot-reload tutorial · examples/demo-hot-reload/

Related MCP server: mcphub

Install

Claude Code

claude mcp add -s user kitsune -- uvx kitsune-mcp

Any other client (Claude Desktop, Cursor, Windsurf, Cline, Zed, …):

{
  "mcpServers": {
    "kitsune": { "command": "uvx", "args": ["kitsune-mcp"] }
  }
}

Also on PyPI (pip install kitsune-mcp, then "command": "kitsune-mcp") and npm (npx kitsune-mcp, delegates to uvx).

Requirements: Python 3.12+ · uv · node/npx for npm-based servers · Docker optional: not used for hot-reload, only to cage community servers when installed.

Three things it does

Loop

What you get

MCP REPL

connect → shapeshift → edit → reload → call

Iterate on your own server without restarting the client

Long-tail reach

search → shapeshift → call → shapeshift()

Use a server once without adding it to your config forever

Try before you trust

confirm=True + Docker cage + version pins

Run community npm/PyPI code contained, not as your user

Borrow a server you never configured

search("web scraping")
shapeshift("firecrawl", tools=["scrape_url"])  # mount one tool, not the whole server
call("scrape_url", arguments={"url": "https://example.com"})
shapeshift()  # drop it, session stays up

Try a community package, caged

search("pdf", registry="glama")
shapeshift("mcp-pdf-tools", confirm=True)  # npm/PyPI run in hardened Docker when available
call("extract_text", arguments={"path": "report.pdf"})
shapeshift()

Add credentials mid-session

auth("BRAVE_API_KEY", "sk-...")  # saved to ~/.kitsune/.env, no restart
shapeshift("brave", tools=["brave_web_search"])

Full live walkthrough: docs/demo-realtime.md.

When to use it, when not to

Use Kitsune when…

Skip it when…

You're building an MCP server and want an edit/reload loop

You only use 1–3 trusted servers (configure them natively)

A task needs a server that isn't in your config

Every turn hits the same server (keep it always-on)

You want to evaluate community MCP code without installing it for good

You want lower token use: the base cost is ~1,774 tokens/turn, and modern clients already defer tool schemas

Your MCP config is crowded (GATEWAY)

You need a sub-second first call (cold mount takes ~1–15 s)

How it works

shapeshift(server_id) picks a transport (stdio, HTTP+SSE, WebSocket, Docker), connects, reads tools/list, and registers each tool as a native tool with the server's real schema. The client receives notifications/tools/list_changed and sees first-class tools, with no wrapper in between. shapeshift() with no argument removes them and closes the connection.

search() covers the official servers repo, the MCP Registry, Glama, npm, PyPI, GitHub (github:owner/repo) and Smithery (hosted servers, free API key).

Tools

Default profile: 9 tools, ~1,774 tokens/turn (measured with python examples/benchmark.py).

Tool

Role

connect(command, name)

Start a persistent local server, e.g. the one you're developing

reload(name)

Release, restart on fresh code, remount, in one call

release(name)

Stop a persistent server

search(query, registry?)

Search 7 registries

shapeshift(server_id?, tools=[…])

Mount a server's tools (all or a subset); no argument drops them

call(tool_name, arguments)

Call a tool; the server is inferred when mounted

auth(var_or_server, value?)

Set an env key or run an OAuth 2.1 browser flow

auto(task, server_hint=)

Search, mount and call in one step

status()

Current form, connection pool, session stats

KITSUNE_TOOLS=all (or the kitsune-forge command) adds developer tools: inspect (schemas, credential check, token cost), test (quality score 0–100), bench (p50/p95 latency), compare, prewarm, craft, setup, and more. See docs/tools.md. Companion skills for Claude Code: kitsune-dev, kitsune-improve.

Safety, in short

  • Community sources need consent. npm, PyPI and GitHub servers require confirm=True. The model can set that flag itself, so real approval belongs in your client's tool-approval UI.

  • connect() runs the command it is given, as your user, with no consent gate and no cage. It is meant for your own code. Approve connect calls in your client before the agent runs them.

  • Community packages run in a Docker cage by default when Docker is installed: no host filesystem, --cap-drop ALL, read-only root, memory and PID limits. Credentials are passed by name, never in argv.

  • Version pins (TOFU). A later malicious publish doesn't silently replace a version you already ran.

  • Opt-in action guard. A ~/.kitsune/policy.json checks every downstream call against allow/ask/deny rules, path roots and a host allowlist. ask goes to you through MCP elicitation.

  • Install commands are validated and launched without a shell. fetch() blocks private hosts and re-checks every redirect.

Don't run it unattended with production admin, billing or security credentials. The full model, including what it does not protect against: docs/safety.md.

More

Why "Kitsune"?

In Japanese folklore the kitsune (狐) is known for what it can become: it borrows a form, uses that power, casts it off and returns to itself. That is the product loop.

I am not Japanese, and I use this name with the highest respect for the mythology and culture it comes from. The parallel felt too precise to ignore.

Contributing

make dev     # install with dev dependencies
make test    # pytest
make lint    # ruff

Issues and PRs welcome: github.com/kaiser-data/kitsune-mcp · CHANGELOG.md


MIT License · Python 3.12+ · Built on FastMCP

Available Tools

9 tools
authA

Check or set credentials. ALL_CAPS = env var; server-id = creds check or OAuth.

auth('GITHUB_TOKEN', 'ghp_...') # save env var auth('GITHUB_TOKEN') # check if set auth('server-id') # show creds needed / run OAuth auth('server-id', 'logout') # revoke OAuth tokens

NameRequiredDescriptionDefault
valueNo
server_id_or_varYes

Output Schema

NameRequiredDescription
resultYes

TDQS

A4.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must disclose behavior fully. It covers multiple modes (set, check, OAuth, logout) but does not detail side effects such as persistent storage or network calls. The examples are helpful but the description could be more explicit about underlying actions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise, using code examples to convey behavior efficiently. Every line adds value, and the structure is front-loaded with the overall purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the presence of an output schema, the description covers key usage scenarios adequately. It could mention error handling or synchronization behavior, but for a credential management tool it's sufficiently complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, yet the description adds rich meaning to both parameters via examples. It clarifies that server_id_or_var can be an env var name or server ID, and value can be a token or 'logout', which is far beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly specifies the tool's purpose: checking or setting credentials. Examples differentiate between env var and OAuth operations, and sibling tools (auto, call, etc.) are unrelated, so it stands out.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit usage patterns via examples (e.g., auth('GITHUB_TOKEN', 'ghp_...') for saving, auth('server-id') for OAuth). It implies when to use, but lacks explicit alternatives or when-not-to-use guidance, which is acceptable for a dedicated auth tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

autoB

search → pick server → infer args → call. Use when you don't know which server to use.

auto('what time in Tokyo') auto('list issues on acme/api', server_hint='github')

NameRequiredDescriptionDefault
keysNo
taskYes
argumentsNo
tool_nameNo
server_hintNo

Output Schema

NameRequiredDescription
resultYes

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must disclose behavioral traits. It describes the workflow (search, pick server, infer args, call) but does not mention potential side effects, error behavior, or whether calls are read-only or destructive. The agent is left guessing about safety and outcomes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise: two sentences plus two examples. Every word adds value, no fluff. The examples are well-chosen and demonstrate usage patterns effectively.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (automatic server selection, argument inference, calling other tools), the description is too sparse. It lacks details on return values (though an output schema exists), error handling, and the inference mechanism. Sibling tools like 'search' and 'call' are not explained in context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema_description_coverage, the description should clarify parameter meanings. It only hints at 'task' and 'server_hint' via examples but does not explain 'tool_name', 'arguments', or 'keys'. The schema lists these but provides no descriptions, leaving the agent underinformed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: an auto-routing orchestrator that searches for a server, picks it, infers arguments, and calls. Examples clarify usage with natural language tasks. It distinguishes from sibling tools like 'search' and 'call' by automating server selection.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use: 'Use when you don't know which server to use.' It also provides illustrative examples. However, it does not specify when not to use or mention alternative tools like 'call' for direct invocation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

callA

Invoke a tool on an MCP server. Returns the tool's response as text.

Routes through the warm pooled transport when a server is shapeshifted; otherwise spins up a transient transport for the given server_id. Records the call in session stats. Long responses (HTML, large outputs) are truncated with a continuation note.

Use when: the tool name and target server are known. Avoid when: discovery is needed — auto() does search → pick → call in one step.

call('get_current_time', arguments={'timezone': 'UTC'}) # after shapeshift call('list_directory', '@mcp/server-fs', {'path': '/tmp'}) # ad-hoc one-shot

NameRequiredDescriptionDefault
configNo
argumentsNoTool arguments matching its inputSchema (default {})
server_idNoDefaults to the currently shapeshifted form when omitted
tool_nameYes

Output Schema

NameRequiredDescription
resultYes

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, but description fully discloses routing behavior (warm pooled vs transient transport), session stats recording, and truncation of long responses with continuation note. No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Concise at 5 sentences, front-loaded with core purpose and behavior, includes clear usage examples with no fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers key behaviors: invocation, routing, stats, truncation. Lacks error handling description, but given output schema exists and tool is straightforward, it is nearly complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 50%; description provides usage examples that illustrate tool_name, arguments, and server_id usage but does not explain config parameter. Examples add value but not full semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states 'Invoke a tool on an MCP server' with specific verb and resource. Provides examples and distinguishes from sibling 'auto' which does search->pick->call in one step.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says 'Use when: the tool name and target server are known. Avoid when: discovery is needed — auto() does search → pick → call in one step.' Names alternative tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

connectC

Start a persistent server. command: server_id or shell cmd (e.g. 'uvx voice-mode'). name: alias for release().

NameRequiredDescriptionDefault
nameNo
commandYes
timeoutNo
inherit_stderrNo

Output Schema

NameRequiredDescription
resultYes

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must disclose all behavioral traits. It mentions 'persistent server' but omits details on side effects, required permissions, or lifecycle, leaving significant gaps.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise with two sentences, but the second sentence is terse and slightly confusing ('alias for release()'). It is efficient but could be clearer.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 4 parameters, no annotations, and an output schema that is not described, the description lacks completeness. Key behavioral aspects (e.g., return values, error handling) are omitted.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It explains 'command' and 'name' but does not address 'timeout' or 'inherit_stderr', offering only partial help.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool starts a persistent server, which is a specific verb+resource. However, it does not effectively distinguish this tool from siblings like 'reload' or 'auto', leaving some ambiguity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives is provided. The description implies a range of commands but does not specify prerequisites or context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

releaseB

Kill a persistent connection by name.

NameRequiredDescriptionDefault
nameYes

Output Schema

NameRequiredDescription
resultYes

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden. It does disclose the core behavioral trait, that this terminates/kills a connection (a destructive, non-reversible action), which is the most important signal. However, it omits permissions required, behavior when the name does not exist, and whether the operation is idempotent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, front-loaded sentence with the action first and the identifier second. Every word earns its place and there is no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Because an output schema exists, return values need not be explained. For a one-parameter destructive operation, the description covers the essential action but leaves gaps around failure modes, permissions, and effects on the connection's state, which is thin for a no-annotation tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% for the single 'name' parameter, so the description must compensate. 'By name' clarifies that the parameter identifies the connection to kill, adding meaning beyond the bare schema, but it does not specify naming conventions or whether the name is case-sensitive or unique.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a clear verb (kill) and resource (persistent connection), with a scoping clause ('by name'). It is specific enough for an agent to distinguish it from siblings like connect and status, though it does not name any sibling explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this versus alternatives such as connect or reload, nor any prerequisite (e.g., that a connection must exist first). The only implied usage is inferring from 'persistent connection' that it targets an existing session.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

reloadA

Reload a persistent connection after editing its code — the MCP REPL in one call.

reload('dev') # release the stale process, start fresh code, remount live

Replaces the manual release() + connect() + shapeshift() cycle and removes the "connect() handed back the old process" footgun (it always releases first). name is the alias you gave connect().

NameRequiredDescriptionDefault
nameYes

Output Schema

NameRequiredDescription
resultYes

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description fully discloses the internal steps: release stale process, start fresh code, remount live, and always releases first. No annotations exist, so the description carries the full burden. It could add more on error handling or prerequisites.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences plus a concise example; every sentence adds value. The description is front-loaded with the core action.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers purpose, behavior, parameter meaning, and usage context. With an output schema present, return values are not needed. It could mention prerequisites like having an active connection, but overall it is near complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description compensates by explaining that 'name' is the alias from connect(). This adds clear meaning, though it could include format or validation constraints.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool reloads a persistent connection after editing its code, and distinguishes it from siblings by explaining it replaces the manual release+connect+shapeshift cycle, making the purpose and differentiation explicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly says to use after editing code and replaces the manual cycle, providing clear context. However, it does not explicitly state when not to use it versus other single tools like connect.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

shapeshiftA

Mount an MCP server's tools at runtime. Empty server_id unmounts.

shapeshift('mcp-server-time') # mount (community sources cage by default) shapeshift('id', tools=['only_this']) # lean — mount only listed tools shapeshift('id', sandbox=False) # opt out of the default Docker cage shapeshift('id', sandbox=True) # force the cage (hard-fail if no Docker) shapeshift() # unmount + kill process

sandbox: None (default) cages low-trust npm/PyPI/github sources in Docker when it's available (best-effort — runs uncaged with a nudge if not); True forces the cage; False opts out. source: auto|local|smithery|official. confirm=True for community sources.

NameRequiredDescriptionDefault
keepNo
toolsNo
sourceNoauto
confirmNo
sandboxNo
server_idNo
server_argsNo

Output Schema

NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It explains sandbox behavior in detail (best-effort, force, opt-out), the confirm parameter for community sources, and the unmounting process. It does not elaborate on potential side effects like process termination beyond unmounting, but coverage is solid.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with code-like examples and clear sections. It is somewhat lengthy but each line adds value. Could be slightly more concise without losing clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity (7 parameters, no required, 0% schema coverage), the description is highly complete. It covers main functionality, parameter behaviors, and example usages. An output schema exists, so return values are not required in the description.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description adds substantial meaning beyond the schema. It explains the key parameters: server_id (empty unmounts), sandbox (None default, True forces, False opts out), source (auto|local|smithery|official), confirm (for community sources), and tools (via examples). This is comprehensive.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Mount an MCP server's tools at runtime.' It provides specific verb+resource actions, including mounting, unmounting, and various configurations. The examples distinguish it from sibling tools like reload, search, etc.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit examples of when to use different options (e.g., mounting with specific tools, sandbox modes, unmounting). It does not explicitly state when not to use the tool, but the context is clear enough to infer appropriate use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

statusA

Show Kitsune runtime state: providers, current form, connections, token stats.

NameRequiredDescriptionDefault

No parameters

Output Schema

NameRequiredDescription
resultYes

TDQS

A4.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description indicates a read-only operation ('show') but with no annotations, it does not explicitly disclose behavioral traits like side effects, auth requirements, or rate limits. Adequate but lacks detail.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence that is informative and front-loaded with the purpose. No unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Low complexity with no parameters and existing output schema. The description covers the key details of what state is shown, making it complete for its purpose.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With zero parameters and 100% schema coverage, the description does not need to add parameter info. The baseline for 0 parameters is 4, and the description is sufficient.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool shows Kitsune runtime state, listing specific aspects: providers, current form, connections, token stats. This is a specific verb+resource and distinguishes from siblings like auth or call.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies use for checking runtime state but does not explicitly state when to use versus alternatives or provide exclusion criteria. No guidance on prerequisites or context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 1 tool updatev0.21.1
    • Addedrelease
  2. 3 tool updatesv0.21.0
    • Addedconnect
    • Addedreload
    • Changedshapeshift1 field changed
      • addedInput schema / properties / sandbox
        Added value: +{
        +  "anyOf": [
        +    {
        +      "type": "boolean"
        +    },
        +    {
        +      "type": "null"
        +    }
        +  ],
        +  "default": null,
        +  "title": "Sandbox"
        +}
  3. 2 tool updatesv0.20.5
    • Changedcall2 fields changed
      • addedInput schema / properties / arguments / description
        Added value: +"Tool arguments matching its inputSchema (default {})"
      • addedInput schema / properties / server_id / description
        Added value: +"Defaults to the currently shapeshifted form when omitted"
    • Changedsearch2 fields changed
      • addedInput schema / properties / compare / description
        Added value: +"Return a side-by-side token-cost comparison table"
      • addedInput schema / properties / query / description
        Added value: +"Keywords, capability description, or natural-language phrase"
  4. 5 tool updatesv0.20.3
    • Changedauth2 fields changed
      • removedInput schema / properties / server_id_or_var / description
        Removed value: -"Either an environment-variable name (ALL_CAPS, e.g. 'GITHUB_TOKEN') or a server identifier (e.g. 'mcp-server-time', '@octocat/repo-server'). The shape of this argument selects the operation."
      • removedInput schema / properties / value / description
        Removed value: -"Credential value to store (when first arg is an env var name), or the literal 'logout' to revoke OAuth tokens (when first arg is an OAuth server id). Leave empty to query state."
    • Changedauto5 fields changed
      • removedInput schema / properties / arguments / description
        Removed value: -"Optional arguments object. If omitted, auto() infers arguments from the task using category-specific adapters (timezone, owner/repo, search query, etc.)."
      • removedInput schema / properties / keys / description
        Removed value: -"Inline credentials to persist before calling — e.g. {'GITHUB_TOKEN': 'ghp_...'}. Stored to ~/.kitsune/.env (mode 0600)."
      • removedInput schema / properties / server_hint / description
        Removed value: -"Pin the server instead of searching. Accepts a server_id or package name. Use when you already know which provider to use."
      • removedInput schema / properties / task / description
        Removed value: -"Natural-language description of what you want done — e.g. 'what time is it in Tokyo', 'search the web for X', 'list issues on owner/repo'. Used to pick a server and infer args."
      • removedInput schema / properties / tool_name / description
        Removed value: -"Optional specific tool name to invoke. If omitted, auto() picks the best-matching tool from the chosen server's schema."
    • Changedcall4 fields changed
      • removedInput schema / properties / arguments / description
        Removed value: -"Arguments object for the tool, matching its inputSchema. Example: {'path': '/tmp'} for filesystem.list_directory. Defaults to an empty object."
      • removedInput schema / properties / config / description
        Removed value: -"Per-call credential overrides for servers that need them (rarely needed — prefer auth() to persist credentials to ~/.kitsune/.env). Keys are credential names declared by the server."
      • removedInput schema / properties / server_id / description
        Removed value: -"Target server identifier. Optional when a server is currently shapeshifted — defaults to the active form. Accepts package names, registry slugs, or full HTTP(S) URLs for ad-hoc servers."
      • removedInput schema / properties / tool_name / description
        Removed value: -"Name of the tool to invoke on the target server. Use the bare tool name (e.g. 'get_current_time') — Kitsune routes it to the currently shapeshifted server, or to server_id if provided."
    • Changedsearch7 fields changed
      • removedInput schema / properties / compare / description
        Removed value: -"If True, return a side-by-side token-cost comparison table instead of the default list — useful before committing to a shapeshift() target."
      • removedInput schema / properties / limit / description
        Removed value: -"Maximum number of results to return (typical range 1-20)."
      • removedInput schema / properties / limit / maximum
        Removed value: -50
      • removedInput schema / properties / limit / minimum
        Removed value: -1
      • removedInput schema / properties / query / description
        Removed value: -"Search phrase — keywords, capability description, or natural language. Examples: 'web search', 'github issues', 'postgres', 'fetch and summarize web pages'."
      • removedInput schema / properties / registry / description
        Removed value: -"Which registry/registries to search. 'all' (default) fans out across every configured source; pass a specific one to scope."
      • removedInput schema / properties / registry / examples
        Removed value: -[
        -  "all",
        -  "official",
        -  "mcpregistry",
        -  "glama",
        -  "npm",
        -  "smithery",
        -  "pypi"
        -]
    • Changedshapeshift7 fields changed
      • removedInput schema / properties / confirm / description
        Removed value: -"Bypass the community-trust gate after reviewing the server. Required for npm/github/glama-via-github sources unless KITSUNE_TRUST=community is set in the environment."
      • removedInput schema / properties / keep / description
        Removed value: -"On unmount (empty server_id), keep the subprocess in the pool for fast re-attach. Default False — fully cleans up on unmount."
      • removedInput schema / properties / server_args / description
        Removed value: -"Extra CLI arguments appended to the server's install command — e.g. ['/private/tmp'] to scope the filesystem server to a directory."
      • removedInput schema / properties / server_id / description
        Removed value: -"Server identifier to mount — npm package, PyPI package, registry slug, or full HTTP(S) URL. Leave empty to unmount the current form. Examples: 'mcp-server-time', '@modelcontextprotocol/server-filesystem', 'https://api.example.com/mcp'."
      • removedInput schema / properties / source / description
        Removed value: -"Registry/install source preference. 'auto' picks the best available; 'local' forces npx/uvx install (downloads + runs locally); 'smithery' requires SMITHERY_API_KEY; 'official' restricts to the verified MCP registry."
      • removedInput schema / properties / source / examples
        Removed value: -[
        -  "auto",
        -  "local",
        -  "smithery",
        -  "official"
        -]
      • removedInput schema / properties / tools / description
        Removed value: -"Optional allowlist of tool names to mount — load only these instead of the full toolset. Use to keep context lean when a server exposes many tools you don't need."
  5. 5 tool updatesv0.20.2
    • Changedauth2 fields changed
      • addedInput schema / properties / server_id_or_var / description
        Added value: +"Either an environment-variable name (ALL_CAPS, e.g. 'GITHUB_TOKEN') or a server identifier (e.g. 'mcp-server-time', '@octocat/repo-server'). The shape of this argument selects the operation."
      • addedInput schema / properties / value / description
        Added value: +"Credential value to store (when first arg is an env var name), or the literal 'logout' to revoke OAuth tokens (when first arg is an OAuth server id). Leave empty to query state."
    • Changedauto5 fields changed
      • addedInput schema / properties / arguments / description
        Added value: +"Optional arguments object. If omitted, auto() infers arguments from the task using category-specific adapters (timezone, owner/repo, search query, etc.)."
      • addedInput schema / properties / keys / description
        Added value: +"Inline credentials to persist before calling — e.g. {'GITHUB_TOKEN': 'ghp_...'}. Stored to ~/.kitsune/.env (mode 0600)."
      • addedInput schema / properties / server_hint / description
        Added value: +"Pin the server instead of searching. Accepts a server_id or package name. Use when you already know which provider to use."
      • addedInput schema / properties / task / description
        Added value: +"Natural-language description of what you want done — e.g. 'what time is it in Tokyo', 'search the web for X', 'list issues on owner/repo'. Used to pick a server and infer args."
      • addedInput schema / properties / tool_name / description
        Added value: +"Optional specific tool name to invoke. If omitted, auto() picks the best-matching tool from the chosen server's schema."
    • Changedcall4 fields changed
      • addedInput schema / properties / arguments / description
        Added value: +"Arguments object for the tool, matching its inputSchema. Example: {'path': '/tmp'} for filesystem.list_directory. Defaults to an empty object."
      • addedInput schema / properties / config / description
        Added value: +"Per-call credential overrides for servers that need them (rarely needed — prefer auth() to persist credentials to ~/.kitsune/.env). Keys are credential names declared by the server."
      • addedInput schema / properties / server_id / description
        Added value: +"Target server identifier. Optional when a server is currently shapeshifted — defaults to the active form. Accepts package names, registry slugs, or full HTTP(S) URLs for ad-hoc servers."
      • addedInput schema / properties / tool_name / description
        Added value: +"Name of the tool to invoke on the target server. Use the bare tool name (e.g. 'get_current_time') — Kitsune routes it to the currently shapeshifted server, or to server_id if provided."
    • Changedsearch7 fields changed
      • addedInput schema / properties / compare / description
        Added value: +"If True, return a side-by-side token-cost comparison table instead of the default list — useful before committing to a shapeshift() target."
      • addedInput schema / properties / limit / description
        Added value: +"Maximum number of results to return (typical range 1-20)."
      • addedInput schema / properties / limit / maximum
        Added value: +50
      • addedInput schema / properties / limit / minimum
        Added value: +1
      • addedInput schema / properties / query / description
        Added value: +"Search phrase — keywords, capability description, or natural language. Examples: 'web search', 'github issues', 'postgres', 'fetch and summarize web pages'."
      • addedInput schema / properties / registry / description
        Added value: +"Which registry/registries to search. 'all' (default) fans out across every configured source; pass a specific one to scope."
      • addedInput schema / properties / registry / examples
        Added value: +[
        +  "all",
        +  "official",
        +  "mcpregistry",
        +  "glama",
        +  "npm",
        +  "smithery",
        +  "pypi"
        +]
    • Changedshapeshift7 fields changed
      • addedInput schema / properties / confirm / description
        Added value: +"Bypass the community-trust gate after reviewing the server. Required for npm/github/glama-via-github sources unless KITSUNE_TRUST=community is set in the environment."
      • addedInput schema / properties / keep / description
        Added value: +"On unmount (empty server_id), keep the subprocess in the pool for fast re-attach. Default False — fully cleans up on unmount."
      • addedInput schema / properties / server_args / description
        Added value: +"Extra CLI arguments appended to the server's install command — e.g. ['/private/tmp'] to scope the filesystem server to a directory."
      • addedInput schema / properties / server_id / description
        Added value: +"Server identifier to mount — npm package, PyPI package, registry slug, or full HTTP(S) URL. Leave empty to unmount the current form. Examples: 'mcp-server-time', '@modelcontextprotocol/server-filesystem', 'https://api.example.com/mcp'."
      • addedInput schema / properties / source / description
        Added value: +"Registry/install source preference. 'auto' picks the best available; 'local' forces npx/uvx install (downloads + runs locally); 'smithery' requires SMITHERY_API_KEY; 'official' restricts to the verified MCP registry."
      • addedInput schema / properties / source / examples
        Added value: +[
        +  "auto",
        +  "local",
        +  "smithery",
        +  "official"
        +]
      • addedInput schema / properties / tools / description
        Added value: +"Optional allowlist of tool names to mount — load only these instead of the full toolset. Use to keep context lean when a server exposes many tools you don't need."
  6. 6 tool updatesv0.20.1
    • First observedauth
    • First observedauto
    • First observedcall
    • First observedsearch
    • First observedshapeshift
    • First observedstatus

TDQS

A3.8/5.0

Scored across 9 tools

Disambiguation4/5

Most tools have distinct roles: search discovers servers, auth handles credentials, call invokes a known tool, and auto combines discovery and invocation. However, connect/shapeshift/release/reload/status all concern server lifecycle and can overlap in when-to-use decisions, though descriptions help clarify.

Naming Consistency4/5

All names are lowercase single words with no mixed camelCase/snake_case inconsistencies. The convention is not verb_noun, and status is a noun while most others are action words, but the set is still readable and predictable enough.

Tool Count5/5

Nine tools is well-scoped for an MCP orchestration server covering discovery, auth, connection, mounting, calling, reloading, releasing, and status. Each tool appears to earn its place without excessive surface.

Completeness4/5

The core lifecycle is covered: search, auth, connect, shapeshift, call, auto, reload, release, and status. A minor gap is the referenced inspect() operation, which is mentioned in search's description but not exposed as a tool.

Maintenance

ActivityActive
ResponsivenessWithin a week

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    D
    maintenance
    A server that implements the Model Context Protocol for managing dynamic forms, allowing users to create, retrieve, and handle responses for web forms via the @dynamicfrm/js library.
    4
    ISC
  • A
    license
    Not graded
    quality
    A
    maintenance
    A unified hub for centrally managing and dynamically orchestrating multiple MCP servers/APIs into separate endpoints with flexible routing strategies.
    2,698 npm
    2,605
    Apache 2.0
  • A
    license
    C
    quality
    C
    maintenance
    Enables academic research through paper search across multiple databases (IACR, CryptoBib, Crossref, Google Scholar), PDF processing, and GitHub repository browsing. Features modular architecture with FastMCP-based proxy server routing to specialized academic tools.
    7
    24 PyPI
    2
    MIT