agent-tool
agent-tool
AIコーディングエージェント向けのMCP(Model Context Protocol)ツールサーバー。
なぜ?
AIコーディングエージェント(Claude Code、Cursor、Codexなど)の組み込みツールには既知の制限があります:
タブインデントの破壊:LLMはスペースを出力しますが、プロジェクトはタブを使用しています。組み込みのEditツールはスペースをそのまま書き込むため、インデントスタイルが壊れます。
エンコーディングの破損:EUC-KR、Shift-JIS、GB18030ファイルを編集すると、黙ってUTF-8に変換され、レガシープロジェクトが壊れます。
ツールが多すぎる:エージェントにRedis CLI、MySQLクライアント、SSHクライアントなどを探してインストール・設定させるのは面倒でエラーが発生しやすいです。agent-toolは54のツールを1つのバイナリにバンドルし、コンパクトなプロファイルを通じてオンデマンドで公開します。
リバースエンジニアリング非対応:組み込みツールはバイナリの逆アセンブル、PE/ELFヘッダーの検査、関数境界の特定、クロスリファレンスの検索ができません。agent-toolには静的バイナリ解析(逆アセンブル、xref、関数検出)、DAPデバッガー、CheatEngineスタイルのメモリツールが含まれており、エージェントに完全なリバースエンジニアリング機能を提供します。
ネットワーク検閲:一部の国では、政府レベルのWebフィルタリングにより、素の
curl/wgetリクエストが機能しません。agent-toolはデフォルトでECH(Encrypted Client Hello)とDoH(DNS over HTTPS)を使用して、これらの制限を回避します。
agent-toolは、プロジェクトの規約を維持しながらモデルコンテキストを制限内に保つ、エージェント指向のツールでこれらの問題を解決します。
Related MCP server: DevToolkit MCP Server
対応エージェント
Claude Code、Codex CLI、Cursor、Windsurf、Cline、Gemini CLI、およびMCP互換の任意のエージェント。
デフォルトでLLM効率的
デフォルトのcoreプロファイルは、全54個ではなく11個のスキーマ(toolboxを含む)のみを公開します。プロトコルレベルの測定では、シリアライズされたツールリストが約84KB(full)から18KBに削減されました。toolbox(operation="describe", tool="ssh", compact=true, tool_operation="execute")を使用して1つのオペレーションのフィールドと必須リストのみを読み込み、その後toolbox(operation="call", tool="ssh", arguments={...})を通じて呼び出します。ゲートウェイは動的なツールリストの更新に依存しないため、Codexなどの固定バインディングのクライアントでも動作します。describeはツール/バージョンに紐づくschema_handleを返します。後続のdescribeでそれを送信すると、スキーマがまだ最新である場合、短い変更なしの確認応答が返ります。--profile coding|remote|analysis|fullで起動することもできます。
大きくなる可能性のあるテキスト応答は、デフォルトで32K文字、ハード上限128Kです。切り詰めは常に可視化され、ページング可能なツールはnext_offsetまたはnext_cursorを返します。ローカルの相対パスは、明示的なワークスペース、次にMCPクライアントのルートに対して解決されます。
機能
Tool | Description | Status |
Edit | スマートなインデントとエンコーディング保持を備えた文字列置換(dry_run対応) | ✅ |
Read | エンコーディング対応の行番号付き読み取り。デフォルトは400行/32K文字、切り詰めと正確な | ✅ |
Write | エンコーディング対応のファイル作成/上書き | ✅ |
Grep | エンコーディング対応の正規表現検索。32K出力予算、ファイル別にグループ化されたコンパクトな出力、相対パス、 | ✅ |
Glob |
| ✅ |
ListDir | 上限付き/ページング可能なディレクトリ一覧。max_entries + 継続カーソル、ディレクトリ/ファイルフィルター、エントリ名のglobフィルター、件数のみモード、フラット/ツリー出力 | ✅ |
Diff | 2つのファイルをユニファイドdiff出力で比較(エンコーディング対応)。行末または末尾の改行のみが異なるファイルは、空のdiffを返す代わりにその旨を報告 | ✅ |
Patch | ファイルにユニファイドdiffパッチを適用(dry_run対応)。各行は独自の行末を保持するため、CRLF/LF混在ファイルは書き換えられない | ✅ |
Checksum | ファイルハッシュの計算(md5、sha1、sha256) | ✅ |
FileInfo | ファイルメタデータ(サイズ、エンコーディング、混在行末の数、インデント、行数) | ✅ |
Compress | zip / tar.gz アーカイブの作成 | ✅ |
Decompress | zip / tar.gz アーカイブの展開(Zip Slip/Bomb保護) | ✅ |
Backup | 除外パターン付きのタイムスタンプ付きzipバックアップ。ディレクトリ統計、パターンマッチ数、最大ファイルを含むdry_runプレビュー | ✅ |
ConvertEncoding | ファイルエンコーディングの変換(EUC-KR ↔ UTF-8、BOMの追加/削除など) | ✅ |
Delete | 安全な単一ファイル削除(ディレクトリ不可、シンボリックリンク不可、システムパス保護、dry_run対応) | ✅ |
Rename | ファイル/ディレクトリのアトミックな名前変更または移動(dry_run対応) | ✅ |
SysInfo | システム情報 — OS、CPU、RAM、ディスク、稼働時間、CPU使用率の測定 | ✅ |
FindTools | インストール済み開発ツールの検出 — コンパイラ、ランタイム、ビルドシステム(Go、.NET、Node、Python、Java、Rust、C/C++など)。PATH、環境変数、既知の場所(~/bin、snap、scoop、Homebrew、SDKMAN、nvm、fnm、pyenv)を検索 | ✅ |
ProcList | 実行中プロセスの一覧 — PID、名前、コマンドライン、メモリ。機密引数は自動マスク。名前またはポートでフィルタリング | ✅ |
ProcKill | PIDまたはポートでプロセスを強制終了、一時停止、再開。ツリーキル、シグナル選択(kill/term/hup/int/stop/cont)、ゾンビ処理(Linux)、dry_run対応 | ✅ |
ProcExec | コマンドを新しいプロセスとして実行。フォアグラウンド/バックグラウンド/一時停止での起動、タイムアウト/環境変数、期限付き生出力取得による安全な繰り返し診断の圧縮 | ✅ |
EnvVar | 環境変数の読み取り。機密値(パスワード、トークン)は自動マスク | ✅ |
Firewall | ファイアウォールルールの読み取り — iptables/nftables/firewalld(Linux)、netsh(Windows)。読み取り専用 | ✅ |
SSH | 32Kの先頭+末尾キャプチャ、元のバイト数、適切な非ゼロ終了エラー、バックグラウンドジョブ( | ✅ |
SFTP | SSH経由でファイルを転送し、リモートファイルシステムを管理。アップロード、ダウンロード、ls、stat、mkdir、rm、chmod、rename。SSHセッションプールを再利用。転送あたり最大2 GB | ✅ |
Bash | 作業ディレクトリ/環境を保持する永続シェルセッション、安全な繰り返し診断の圧縮、期限付き生出力取得。セッションプーリング(最大5、アイドルタイムアウト30分)。Unix: bash/sh、Windows: PowerShell/git-bash/cmd | ✅ |
WebFetch | テキスト/MarkdownとしてWebコンテンツを取得(デフォルト32K/最大128K)。ECH + DoH、HTML→Markdown変換、SSRF保護、プロキシ対応、Chrome User-Agent | ✅ |
WebSearch | Brave SearchまたはNaver APIによるWeb検索。APIキー環境変数( | ✅ |
Download | URLからファイルをディスクにダウンロード。デフォルトでECH + DoH。SSRF保護。HTTP/SOCKS5プロキシ。アトミック書き込み。最大2 GB | ✅ |
HTTPReq | 任意のメソッド(GET/POST/PUT/PATCH/DELETE/HEAD/OPTIONS)でHTTPリクエストを実行。カスタムヘッダー、ボディ、プロキシによるAPIテスト。SSRF保護 | ✅ |
JSONQuery | ドット記法パス(例: | ✅ |
YAMLQuery | ドット記法パスでYAMLファイルをクエリ(JSONQueryと同じ構文) | ✅ |
TOMLQuery | ドット記法パスでTOMLファイルをクエリ(JSONQueryと同じ構文)。TOML固有の型(datetime、int64)に対応 | ✅ |
Copy | アトミック書き込みと権限保持でファイル/ディレクトリをコピー。再帰的ディレクトリコピー。Windowsのロックされたファイルのフォールバック(実行中のexe/DLLを退避して名前変更)。dry_runプレビュー | ✅ |
Mkdir | オプションの権限モード(8進数、例: 0755)でディレクトリを作成。デフォルトで再帰的(mkdir -p)。dry_runプレビュー | ✅ |
MultiRead | 呼び出し全体で32K予算、ファイルあたりデフォルト200行、長い行の安全性、ファイルごと/全体の継続メタデータで最大50ファイルを読み取り。ハッシュはオプトイン | ✅ |
RegexReplace | ファイル/ディレクトリ全体での正規表現の検索と置換。エンコーディングと行末を保持、キャプチャグループ($1、$2)。バイナリファイルはスキップ。dry_runプレビュー | ✅ |
TLSCheck | TLS証明書の詳細を確認 — サブジェクト、発行者、有効期限、SAN、TLSバージョン、暗号スイート | ✅ |
DNSLookup | DNSレコードの参照(A/AAAA/MX/CNAME/TXT/NS/SOA)。プライバシー保護のためデフォルトでDNS over HTTPS(DoH) | ✅ |
MySQL | MySQL/MariaDBでSQLクエリを実行。行/列/セル/合計出力の制限を設定可能なテーブル形式のSELECT結果、DMLの影響行数。ページングにはSQLのLIMIT/OFFSETを使用 | ✅ |
Redis | 型ごとにフォーマットされた出力でRedisコマンドを実行。TLS対応。危険なコマンド(FLUSHALL、SHUTDOWNなど)はブロック | ✅ |
PortCheck | ホスト上のTCPポートが開いているか確認。応答時間とともにOPEN/CLOSEDを返す。ホスト名、IPv4、IPv6に対応 | ✅ |
ExternalIP | 外部(パブリック)IPアドレスを取得。自動フォールバック付きの複数プロバイダー(ipify、ifconfig.me、icanhazip) | ✅ |
SLOC | 言語ごとのソースコード行数をカウント。70以上の言語検出、ファイル/言語別の内訳、空白行の統計、max_depth制御 | ✅ |
Debug | DAP(Debug Adapter Protocol)による対話型デバッガ。変数、補完、モジュール、読み込み済みソースの上限付き値/出力とページングを備えた完全なDAP対応。dlv(Go)、debugpy(Python)、codelldb(C/C++/Rust)でテスト済み。DAP互換の任意のアダプターで動作。StdioおよびTCPモード。注: vsdbg(Microsoft)はVS Codeのライセンスが必要で単体では使用不可 — オープンソースの代替としてcodelldbまたはnetcoredbgを使用 | ✅ |
Analyze | 静的バイナリ解析とリバースエンジニアリング。x86/x64/ARM/ARM64逆アセンブル、PE/ELF/Mach-O解析(上限付き・ページング可能なPEインポート出力付き)、xref、関数検出/コールグラフ、ポインタ/RTTI/vtable/構造体解析、imphash、Richヘッダー、DWARF、文字列、hexdump、パターン検索、エントロピー、オーバーレイ検出、バイナリ差分。ファイルサイズのグローバル制限なし | ✅ |
Memtool | CheatEngineスタイルのプロセスメモリツール — メモリ値の検索/フィルタリング/読み取り/書き込み、read_chain(ベース+オフセットのポインタチェーンを1回の呼び出しで一括解決)、ライブ逆アセンブル(x86/x64/ARM/ARM64)、アンドゥ、構造体パターン検索、ポインタスキャン、メモリ差分。大規模スキャン用のディスクバックアップスナップショット。アイドルタイムアウト付きのセッション管理。Windows(ReadProcessMemory)とLinux(/proc/pid/mem)。Windowsでは昇格時にSeDebugPrivilegeを自動有効化。オプトインの | ✅ |
IPC | TCP経由のAIエージェントセッション間のプロセス間通信。ブロッキング受信による1:1メッセージ受け渡し。プロトコル: [2バイト型][4バイト長][ペイロード]。操作: send、receive(タイムアウト付きブロッキング)、ping。マシン間で動作。最大1MBメッセージ、300秒タイムアウト | ✅ |
Wintool | Windows GUI自動化 — ウィンドウと子コントロールの検索/列挙、スクリーンショットのキャプチャ(PrintWindow経由のImageContent PNG)、クリップボード画像の読み取り、テキストの読み取り/設定、クリック、タイピング、生メッセージの送信、表示/非表示/最小化/最大化、移動/リサイズ、閉じる、フォーカス。screenshot/clipboardはデフォルトでImageContentを返す(ファイル出力用のsave_pathオプションあり)。AIエージェントがGUIアプリケーションを「見て」操作できるようにする。Windowsのみ | ✅ |
CodeGraph | 完全組み込みのセマンティックコードグラフ: Go標準ライブラリのASTに加え、C/C++、Python、C#、Rust、Java用の遅延圧縮tree-sitter WASM。宣言/定義の同一性、リターンチェーンとジェネリック/エイリアスの伝播、推移的インクルード、調整済みオーバーロード証拠、仮想/インターフェースディスパッチ、マクロ/コールバックエッジ、ビルド条件の来歴、マルチルートワークスペースを追加。コンパイラ、言語サーバー、外部バイナリ、LLM呼び出し、トークンコストは不要 | ✅ |
SetConfig | ランタイム設定の変更(エンコーディング、ファイルサイズ制限、シンボリックリンク、ワークスペースなど) | ✅ |
Help | エージェント向けの組み込み使用ガイド(エンコーディング、インデント、トラブルシューティング) | ✅ |
主な改善点
スマートなインデント
LLMは通常スペースを出力しますが、多くのプロジェクトではタブを使用します。AgentToolはファイルの既存のスタイルに合わせてインデントを自動変換します。
.editorconfigからindent_styleとindent_sizeを読み取りますコンテンツベースの検出(最初の100行)にフォールバックします
レガシーファイルを保護します: 実際のコンテンツが
.editorconfigと矛盾する場合は変換しません
エンコーディングの保持
編集はUTF-8を強制するのではなく、元のファイルエンコーディングを保持します。
検出優先順位: BOM →
.editorconfigの charset → BOMなしUTF-16 → 有効なUTF-8 → chardet自動検出 → フォールバックエンコーディング対応: UTF-8、UTF-8 BOM、EUC-KR、Shift-JIS、ISO-8859-1、UTF-16(LE/BE、BOMあり/なし)、その他
ASCIIでの誤警告なし: 有効なUTF-8は直接検証されるため、プレーンなASCIIファイルが低信頼度の警告を出すことはありません
改行コード: LF、CRLF、CR、および混在ファイルを検出します。
editは、ファイルがCRLFまたはLFを使用している場合(両方が混在するファイルを含む)に複数行のold_stringに一致し、edit/regexreplaceによって挿入されたテキストは、それが配置される領域の改行スタイルに従うため、ファイルの残りの部分はバイト単位で同一のままになります
トークンセーフなディレクトリ一覧
listdir はデフォルトで1ページあたり500エントリで、さらにエントリがある場合は next_cursor を返します。directories_only、files_only、name_pattern(例: A*)、または include 内の複数のORパターンで結果を絞り込みます。一致するファイル/ディレクトリの数のみが必要な場合は counts_only=true を使用します。
アイドル時のメモリ解放
ツール呼び出しが30分ないと、サーバーはヒープをOSに返します。stdio MCPサーバーは、放棄されたクライアントと静かなクライアントを区別できません。サーバーを生成したプロセスは、生存しているか、処理を終了しているか、パイプを開いたまま保持している可能性があり、EOFが届くことはありません。その推測で終了すると、単に一時停止したセッションが壊れてしまいます。メモリを解放することは、そのトレードオフの安全な半分です。かつて50MBのファイルを読み取ったインスタンスは、マシンの稼働時間の残りずっと200MBを保持する代わりに、約20MBのベースラインに戻ります。開いているシェルとsshセッションは存続し、クライアントが観察できるものは何も変わりません。
クイックスタート
お使いのOS用のバイナリを Releases からダウンロードします
agent-tool installを実行します(特定のエージェントの場合はagent-tool install claude)IDE / エージェントを再起動します
完了 — コンパクトなコアツールがすぐに利用可能になります。
toolboxは他のすべてのツールをオンデマンドで説明し呼び出します
または、AIエージェントに任せるだけです:
"https://github.com/knewstimek/agent-tool/releases/latest から agent-tool をダウンロードして
agent-tool installを実行してください"
有能なAIコーディングエージェント(Claude Code、Codexなど)は、ダウンロード → インストール → 再起動の一連の流れを自動的に処理できます。
推奨: エージェントに agent-tool を優先するよう指示する
インストール後、エージェントは agent-tool にアクセスできますが、組み込みツール(Read、Editなど)をデフォルトで使用する場合があります。エージェントが agent-tool のエンコーディング対応、インデントスマートなツールを優先するようにするには、以下のいずれかの指示を追加してください。
コードナビゲーションのヒント: 大規模プロジェクトでは、ASTベースのコードナビゲーションを有効にするために、これを CLAUDE.md / AGENTS.md に追加してください:
At the start of a session, run codegraph(op="index", path="<project_root>") to build a code index.
For several repositories sharing one graph, use codegraph(op="index", path="<db_root>", roots=["<source_root_1>", "<source_root_2>"]). Source-root provenance prevents unrelated projects with the same symbol names from contaminating candidates while explicit/transitive includes can still cross roots.
Then use codegraph for structural queries (find, callers, callees, methods, inherits) instead of grep.Strict または Soft を選択:
モード | 使用するタイミング | 指示 |
Strict | 非UTF-8ファイルまたは混在インデントのプロジェクト |
|
Soft | 一般的なプロジェクト |
|
配置場所:
プロジェクトごと — プロジェクトの CLAUDE.md に追加:
ALWAYS use agent-tool MCP tools (mcp__agent-tool__*) instead of built-in file tools.グローバル(全プロジェクト)— ~/.claude/CLAUDE.md に追加:
ALWAYS use agent-tool MCP tools (mcp__agent-tool__*) instead of built-in file tools.ハードな強制 — ~/.claude/settings.json で権限レベルで組み込みファイルツールを拒否:
{
"permissions": {
"deny": ["Read", "Edit", "MultiEdit", "Write", "Glob", "Grep"]
}
}これにより、Claude Codeの組み込みファイルツールが使用できなくなり、エージェントは agent-tool を使用せざるを得なくなります。プロンプトの指示に頼らずに厳格な強制を行いたい場合に推奨されます。
~/.codex/config.tomlに追加(トップレベル、[mcp_servers.*]内ではない):
model_instructions_file = "~/.codex/model_instructions.md"~/.codex/model_instructions.mdを作成:
ALWAYS use agent-tool MCP tools (mcp__agent-tool__*) instead of built-in file tools.Codex を再起動します。
プロジェクトごと — 代わりにプロジェクトの AGENTS.md に追加します。
プロジェクトの .cursorrules、.windsurfrules、または AGENTS.md に追加:
ALWAYS use agent-tool MCP tools (mcp__agent-tool__*) instead of built-in file tools.インストール
自動インストール(推奨)
# Register with all detected agents (full auto-approve — all tools)
agent-tool install
# Safe mode — only auto-approve local file tools (no SSH, HTTP, DB, shell)
agent-tool install --safe-approve
# No auto-approve — manual approval required for every tool call
agent-tool install --no-auto-approve
# Register with a specific agent
agent-tool install claude
agent-tool install claude --safe-approve
# Uninstall (removes agent-tool entry only, preserves other settings)
agent-tool uninstall # from all agents
agent-tool uninstall claude # from specific agentインストール権限レベル:
レベル | フラグ | 自動承認されるツール |
フル(デフォルト) | (なし) | すべてのツール( |
セーフ |
| 29のローカルのみのツール(read、edit、write、grep、globなど)— SSH、HTTP、DB、bash、プロセス制御はなし |
なし |
| ツールなし — すべての呼び出しに手動承認が必要 |
承認レベルはスキーマプロファイルとは独立しています。インストールはフルネームスペースを承認できますが、サーバーは依然としてトークン効率の良い core プロファイルで起動します。toolbox は、その operation=call ゲートウェイがネットワーク、シェル、データベース、プロセス制御ツールを呼び出すことができるため、--safe-approve によって自動承認されないよう意図的に設計されています。セーフモードのユーザーは、各 toolbox の承認を確認し、AgentTool のフルネームスペースを信頼するつもりがない限り、永続的な許可ルールを付与しないようにしてください。
手動セットアップ
Claude Code / Cursor / Cline(settings.json または mcp.json):
{
"mcpServers": {
"agent-tool": {
"command": "/path/to/agent-tool"
}
}
}Codex CLI(~/.codex/config.toml):
[mcp_servers.agent-tool]
command = "/path/to/agent-tool"オプション
# Select the initial schema profile (default: core)
agent-tool --profile coding
# Set fallback encoding for projects with non-UTF-8 files
agent-tool --fallback-encoding EUC-KRプロファイルは加算的なプリセットです: core(11スキーマ)、coding(coreに加えてより広範なファイル/ビルド/シェルツール)、remote、analysis、full。実行時には、クライアントに依存しない toolbox ゲートウェイを優先してください: operation=describe は1つのツールのスキーマを返し(compact=true と tool_operation を組み合わせると1つの操作に制限されます)、operation=call は安定した toolbox バインディングを通じてそれを呼び出します。返された schema_handle を再送信すると、変更されていないスキーマを再度受け取ることを回避できます。コマンド診断がコンパクト化された場合、operation=output は報告されたIDによって制限付きの生出力を30分間取得し、ページングが必要な場合は next_offset を報告します。enable、disable、profile は、tools/list_changed を尊重するクライアントのために引き続き利用可能です。固定バインディングのクライアントは常にゲートウェイを使用し続けることができます。
環境変数
CLIフラグを繰り返さないように、AGENT_TOOL_FALLBACK_ENCODING および/または AGENT_TOOL_PROFILE を設定します:
# Windows (no admin required)
setx AGENT_TOOL_FALLBACK_ENCODING EUC-KR
setx AGENT_TOOL_PROFILE coding
# Linux / macOS (add to ~/.bashrc or ~/.zshrc)
export AGENT_TOOL_FALLBACK_ENCODING=EUC-KR
export AGENT_TOOL_PROFILE=coding優先順位: CLIフラグ > 環境変数 > デフォルト(UTF-8)。
ローカルSSH/SFTP接続プロファイル
SSHとSFTPは、connection_profile またはセッションローカルの connection_id のいずれかを受け入れるため、ホスト、ユーザー、キー、ジャンプホストのフィールドを繰り返す必要はありません。プロファイルはOSのユーザー設定ディレクトリの agent-tool/connections.json から読み取られます。場所は AGENT_TOOL_CONNECTION_PROFILE_FILE で上書きできます。このファイルはローカルに保ち、ワークスペース内に配置する場合は明示的に無視してください。
{
"connections": {
"dev": {
"host": "192.0.2.10",
"user": "builder",
"key_file": "/local/path/to/id_ed25519",
"host_key_check": "strict",
"trusted": true
}
}
}最初の呼び出しは、両方のツールで30分間再利用可能な不透明な connection_id を返します。trusted:true は表示のみに影響します: 許可されたプライベートアドレスの警告は、呼び出しごとではなく、プールされた接続ごとに1回表示されます。SSRFブロッキングとクラウドメタデータ保護は変更されません。SSHは quiet、echo_command、result_only もサポートしています。最後のものは、stdout、stderr、exit_code を中心としたコンパクトなJSONを返します。SFTPは quiet、result_only、upload_many(最大100ファイル)をサポートしています。
ランタイム設定
エージェントは再起動せずに set_config を介して実行時に設定を変更できます:
パラメータ | 説明 | デフォルト |
| 自動検出が失敗した場合のフォールバックエンコーディング |
|
| エンコーディング検出の警告を表示 |
|
| read/edit/grep の最大ファイルサイズ(MB) |
|
| tarアーカイブからのシンボリックリンク抽出を許可 |
|
| 明示的なローカルワークスペースルート。それ以外の場合は、最初のMCPクライアントルートが使用され、次にcwdが使用されます | (MCP root/cwd) |
| webfetch/download/httpreq がプライベートIPにアクセスすることを許可 |
|
| mysqlツールがプライベートIPにアクセスすることを許可 |
|
| redisツールがプライベートIPにアクセスすることを許可 |
|
| ssh/sftpツールがプライベートIPにアクセスすることを許可 |
|
| DNS over HTTPS をグローバルに有効にする(webfetch/download/httpreq/dnslookup) |
|
| Encrypted Client Hello をグローバルに有効にする(webfetch/download/httpreq) |
|
ビルド
go build -trimpath -ldflags="-s -w" -o agent-tool .クロスコンパイル:
GOOS=linux GOARCH=amd64 go build -trimpath -ldflags="-s -w" -o agent-tool .
GOOS=darwin GOARCH=arm64 go build -trimpath -ldflags="-s -w" -o agent-tool .
GOOS=windows GOARCH=amd64 go build -trimpath -ldflags="-s -w" -o agent-tool.exe .トラブルシューティング
文字化け(エンコーディングの問題)
韓国語、日本語、その他の非ASCIIテキストが文字化けとして表示される場合:
オプション1: .editorconfig に charset を追加:
[*]
charset = euc-krオプション2: 環境変数を設定(永続的):
setx AGENT_TOOL_FALLBACK_ENCODING EUC-KR # Windows
export AGENT_TOOL_FALLBACK_ENCODING=EUC-KR # Linuxオプション3: CLIフラグ(セッションごと):
agent-tool --fallback-encoding EUC-KRエージェント向け組み込みヘルプ
agent-tool には、エージェントが使用ガイダンスのために呼び出せる agent_tool_help ツールが含まれています。エージェントがエンコーディング警告や文字化けに遭遇した場合、次のように呼び出すことができます:
{ "tool": "agent_tool_help", "arguments": { "topic": "encoding" } }利用可能なトピック: overview、encoding、indentation、tools、troubleshooting
セキュリティ
agent-tool は強力なシステムアクセス(SSH、MySQL、Redis、ファイル操作、HTTPリクエスト)を提供します。AIコーディングエージェントと一緒に使用する場合、プロンプトインジェクションのリスクに注意してください:
SSRF 保護: クラウドメタデータIP(169.254.x.x、fe80::/10)は設定に関係なく常にブロックされます。プライベートIPへのアクセスは、プロトコルごとに
set_config(allow_http_private、allow_mysql_private、allow_redis_private、allow_ssh_private)で設定できます。DLP(データ損失防止): すべての送信HTTPリクエストボディは、機密データパターン(PEM秘密鍵、AWSアクセスキー、GitHub/GitLabトークン、Slackトークン、.envファイルダンプ)がスキャンされ、送信前にブロックされます。
プロンプトインジェクション警告: プライベートIP接続のたびに、ユーザーとAIエージェントの両方にセキュリティ警告が表示され、取得したWebコンテンツからのプロンプトインジェクション攻撃の検出に役立ちます。
Zip Slip保護:
../パストラバーサルを含むアーカイブエントリはブロックされます(zipとtarの両方)。Zip Bomb保護: 単一ファイルの上限(1GB)、合計展開上限(5GB)。
シンボリックリンク: デフォルトではスキップされます。
set_config allow_symlinks=trueで有効化できます(tarのみ。zipのシンボリックリンクは常にスキップされます)。有効にしても、出力ディレクトリの外部を指すシンボリックリンクはブロックされます。ファイルサイズ制限: 設定可能な最大ファイルサイズ(デフォルト100MB)が大きなファイルでのOOMを防ぎます。
set_config max_file_size_mb=Nで調整できます。エンコーディングの安全性: chardetはメモリ効率のため、ファイル全体ではなく64KBのサンプルを使用します。
最大限のセキュリティを確保するには、承認前にAIエージェントのツール呼び出しを確認してください。特に、SSHコマンド、外部URLへのHTTPリクエスト、データベースクエリについて確認してください。
技術スタック
言語: Go
エンコーディング: saintfish/chardet + golang.org/x/text
配布: シングルバイナリ(クロスコンパイル)
ライセンス
Available Tools
11 toolsagent_tool_help
Returns usage guide for agent-tool. Call this when you encounter encoding warnings, garbled text, or need to understand agent-tool features. Topics: overview, encoding, indentation, tools, debug, analyze, troubleshooting.
| Name | Required | Description | Default |
|---|---|---|---|
| topic | No | Help topic. Available: overview, encoding, indentation, tools, debug, analyze, memtool, wintool, codegraph, troubleshooting. Empty = overview |
editA
Replace exact text in a file. Preserves encoding and local line endings, adapts indentation using the file and .editorconfig, and supports dry-run plus hash-guarded edits.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Alias for file_path | |
| dry_run | No | Preview only; default false | |
| file_path | No | File path; relative to workspace/MCP root | |
| new_string | No | Replacement text; must differ from old_string | |
| old_string | No | Exact text to find in the file | |
| new_content | No | Alias for new_string | |
| old_content | No | Alias for old_string | |
| replace_all | No | Replace every match; default false | |
| indent_style | No | tabs or spaces-N; default auto-detect | |
| expected_hash | No | Expected SHA-256; mismatch rejects edit |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full behavioral burden. It discloses several non-obvious traits: preserves encoding and local line endings, adapts indentation via .editorconfig, and supports dry-run and hash-guarded edits. It does not detail failure modes or response format, but for a mutation tool it offers respectable transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, tight sentence that front-loads the core action ('Replace exact text in a file') and packs three behavioral notes into a compact clause. Every phrase earns its place with zero fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is moderately complex with 10 parameters, but all are fully documented in the schema. The description covers key behavioral aspects (encoding, line endings, indentation, dry-run, hash). However, it lacks guidance on when to use this tool versus the closely related siblings (write, patch, multiedit), which is a meaningful completeness gap for correct selection.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description reiterates the purpose of dry_run and expected_hash and adds context about indentation adaptation, but does not add meaning beyond what the schema already documents for the parameters. It neither compensates for gaps nor contradicts the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Replace'), a resource ('a file'), and a distinctive qualifier ('exact text'), clearly separating it from write (new content) and patch (diff-based). It does not name sibling tools, but the exact-text aspect is sufficiently differentiating against the sibling set.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for exact text replacement and mentions advanced features (dry-run, hash-guard) that suggest safe editing contexts. However, it provides no explicit guidance on when to use this tool versus write, patch, or multiedit, and offers no exclusion criteria or alternative routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
globA
Finds files matching a glob pattern. Supports ** recursive matching and sorts results by modification time (newest first). Defaults to 200 workspace-relative paths and 32768 characters per page. Skips hidden paths and paths excluded by root .gitignore/.ignore or the common generated/vendor policy unless explicitly included. Returns total/has_more/truncated metadata and an opaque next_cursor.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Directory to search. Defaults to configured workspace, MCP client root, or current directory | |
| limit | No | Maximum paths returned per page. Default: 200, Max: 5000 | |
| cursor | No | Opaque continuation cursor returned by a previous glob call | |
| pattern | Yes | Glob pattern to match files (e.g. **/*.go or src/**/*.ts) | |
| include_hidden | No | Traverse hidden directories. Explicit hidden roots are always searched. Default: false | |
| relative_paths | No | Return paths relative to the search directory. Default: true | |
| include_ignored | No | Include paths excluded by .gitignore/.ignore or the common generated/vendor policy. Default: false | |
| max_output_chars | No | Maximum returned text characters. Default: 32768, Max: 131072 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full behavioral burden, and it excels: it discloses sorting by modification time, default limits (200 paths, 32768 chars), skip rules for hidden and ignored paths, and pagination via next_cursor and metadata (total/has_more/truncated). This is thorough and actionable, covering the major behavioral traits an agent needs to anticipate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact and front-loaded with the core purpose, followed by key behaviors and return metadata. Every sentence adds distinct information (recursion, sorting, defaults, exclusions, pagination) with no filler. It is well-structured and easy to scan.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 8 parameters, no annotations, and no output schema, the description covers the essential usage context: purpose, defaults, skip rules, sorting, and pagination metadata. It clearly states the return includes metadata and a cursor, which is sufficient for an agent to invoke and handle results. Minor gaps exist (e.g., exact shape of the path list) but these are not critical for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. The description adds value beyond the schema by explaining how parameters interact: e.g., include_hidden affects traversal, include_ignored overrides skip rules, and limit/cursor govern pagination. It also clarifies default behavior (workspace-relative, 200 limit). This enriches parameter understanding without contradicting the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a clear verb and resource: 'Finds files matching a glob pattern.' It immediately distinguishes from siblings like listdir (directory listing) and grep (content search) by specifying pattern matching and recursive support. This is a specific, unambiguous purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when pattern-based file discovery is needed but does not explicitly state when to prefer this over listdir or grep, nor does it list exclusions (e.g., 'for directory contents, use listdir'). Context is provided via behavior (e.g., default limits, skip rules) but not as routing guidance. It is adequate but not explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
grepA
Regex-search encoding-aware files or directories. Supports context, glob filters, content/file/count modes, ignored-path controls, and bounded pageable output. Directory searches skip detected binaries; explicit files are searched.
| Name | Required | Description | Default |
|---|---|---|---|
| glob | No | Directory file filter, e.g. *.go | |
| path | No | File or directory; defaults to workspace/MCP root/CWD | |
| after | No | Lines after; overrides context | |
| before | No | Lines before; overrides context | |
| cursor | No | Continuation cursor; incompatible with context lines | |
| context | No | Lines before/after; max 1000 | |
| pattern | Yes | Regular expression | |
| file_path | No | Alias for path | |
| recursive | No | Recurse; default true | |
| ignore_case | No | Ignore case | |
| max_results | No | Matches per page; default 100, max 100000 | |
| output_mode | No | content (default), files_with_matches, or count | |
| output_format | No | compact (default) or classic path:line:text | |
| include_hidden | No | Include hidden directories | |
| max_line_chars | No | Per-line cap; default 4000, max 32768 | |
| relative_paths | No | Paths relative to root; directory default true | |
| include_ignored | No | Include ignored/generated/vendor paths | |
| max_output_chars | No | Output cap; default 32768, max 131072 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does a strong job: it discloses encoding-awareness, binary skipping in directories, bounded pagination, ignored-path controls, and output modes. It does not mention rate limits or auth, but for a read-only search tool, this is comprehensive. No contradiction with annotations since none exist.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the core purpose, and every clause adds value (modes, filters, output behavior, binary handling). No fluff, well-structured for quick parsing.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite 18 parameters and no output schema, the description covers the major behavioral areas (search scope, filters, pagination, binary handling). It does not explicitly mention incompatibilities like cursor vs. context, but those are captured in the schema. The description is sufficient for an agent to understand the tool's role and invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents every parameter. The description adds high-level context (e.g., 'context, glob filters, content/file/count modes') that maps to parameters but does not explain each individually. It does not go beyond the schema, so a baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific verb ('Regex-search') and resource ('encoding-aware files or directories'), and enumerates key features that distinguish it from siblings like glob (which finds filenames) and read (which reads content). It leaves no ambiguity about what the tool does.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage via feature list but does not explicitly state when to use grep versus alternatives (e.g., 'use for content search, not filename matching'). It does clarify directory vs. explicit file behavior, but lacks direct routing guidance or exclusions, so the agent must infer from sibling names.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
listdirA
Lists directory contents with bounded, pageable output. Default: flat listing, max_depth=3, max_entries=500. When has_more=true, pass next_cursor as cursor to fetch the next page. Filter by type with directories_only or files_only, and by entry-name glob with name_pattern (single) or include (multiple OR patterns, e.g. ["A*", "*.go"]). Use counts_only=true for counts without names, flat=false for a visual tree, and relative_paths=true to save tokens. Skips hidden entries and common build/vendor directories during recursion.
| Name | Required | Description | Default |
|---|---|---|---|
| flat | No | Flat listing without tree connectors (one path per line). Default: true | |
| path | No | Directory to list. Relative paths use the configured workspace or MCP client root | |
| cursor | No | Opaque continuation cursor returned by a previous listdir call | |
| include | No | Additional entry-name glob patterns. An entry is included when any pattern matches | |
| file_path | No | Alias for path | |
| max_depth | No | Maximum depth for traversal. Default: 3 | |
| files_only | No | Return files only: true or false. Default: false | |
| counts_only | No | Return matching directory/file counts without listing names: true or false. Default: false | |
| max_entries | No | Maximum entries to return per page. Default: 500, maximum: 10000 | |
| name_pattern | No | Glob matched against each entry name, for example A* or *.go | |
| relative_paths | No | Show paths relative to the root. Saves tokens: true or false. Default: false | |
| directories_only | No | Return directories only while still traversing them: true or false. Default: false |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does a good job: it discloses pagination mechanics, skip behavior for hidden/build/vendor entries, the flat/tree distinction, counting mode, and token-saving relative paths. It does not describe the exact response fields, but it mentions has_more and next_cursor sufficient to drive pagination.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Each sentence carries a distinct responsibility: definition, defaults, pagination, filtering, output modes, skipped entries. There is no filler or repetition, and key information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers defaults, pagination, filtering, output modes, and behavioral exclusions, which is a solid level of context. Since there is no output schema, the only minor gap is omitted return record shape, but the provided behavior is enough for a capable agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds relationship semantics beyond the schema: pagination binds has_ more to the cursor parameter, name_pattern versus include as single/multi OR patterns, and counts_only relative_paths as output modifiers. These are not obvious from names alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool 'lists directory contents' and immediately adds the defining scope: bounded, pageable output. This is a specific verb plus resource and distinguishes the tool from siblings like read, write, and grep, even before opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives practical usage guidance: paginate with cursor when has_more=true, filter with directories_only/files_only, and use counts_only or relative_paths for optimization. It does not explicitly tell an agent when to prefer listdir over sibling tools like glob, but the tool's 'list directory contents' purpose implies the context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
multieditA
Applies multiple old_string -> new_string replacements to a single file in one call. Edits are applied sequentially in order; each edit sees the result of the previous one. Atomic: if any edit fails, the file is not modified at all. Encoding-aware: preserves original file encoding (UTF-8, EUC-KR, Shift-JIS, etc.). Line-ending aware: old_string matches whether the file uses CRLF or LF, and inserted newlines follow the region being edited (mixed-newline files stay intact). Accepts "path" as alias for "file_path". Use dry_run=true to preview all changes without modifying the file.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Alias for file_path | |
| edits | Yes | Ordered list of replacements to apply sequentially | |
| dry_run | No | Preview changes without modifying the file: true or false. Default: false | |
| file_path | No | File to edit. Relative paths use the configured workspace or MCP client root |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden, and it does this well. It discloses sequential application, atomic rollback on any failure, encoding preservation, CRLF/LF line-ending awareness, and alias support. These are meaningful behavioral characteristics beyond what the schema shows and are critical for correct agent use.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Each sentence earns its place: core function first, then ordering, atomicity, encoding, line endings, alias, and dry-run. It is detailed but compact, and the most important operational facts are front-loaded before the alias and dry-run notes.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a multi-edit file mutation tool with no annotations and no output schema, this description is unusually complete: it tells the agent what action, in what order, with what safety guarantees, and how to preview. Return format is not described, but the invocation-relevant behavior is covered thoroughly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds value by clarifying that old_string matching is encoding- and line-ending-aware, that newlines in inserted text follow the edited region, that path is an alias for file_path, and that dry_run preveview changes. This supplements the schema rather than restating it.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('Applies multiple old_string -> new_string replacements to a single file'), includes the precise edit primitive, and differentiates itself from siblings like edit by emphasizing multiple replacements, sequential application, and atomicity. An agent can clearly understand what the tool does and roughly how it differs from single-edit or patch alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides clear use-context: a single file with many ordered replacements, plus a dry_run option for previewing. It does not explicitly name sibling alternatives or state when not to use it, but the description makes the intended scenario obvious and includes an actionable preview-first workflow.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
multireadA
Reads multiple files in a single call to reduce API round-trips. Encoding-aware: auto-detects file encoding for each file. Supports offset/limit for reading specific line ranges. Defaults to 200 lines per file and 32768 characters total across the call. Returns visible per-file and overall truncation metadata with continuation positions. Use file_paths or paths (string array) with global offset/limit, or files (object array) for per-file offset/limit. If a file fails, the error is included in output and remaining files continue. Maximum 50 files per request.
| Name | Required | Description | Default |
|---|---|---|---|
| all | No | Remove the default per-file line limit. The total character budget still applies. Default: false | |
| files | No | Per-file read ranges. Each entry has path, offset, limit. Takes priority over file_paths | |
| limit | No | Maximum lines per file. Default: 200. Set 0 or all=true to remove the line limit | |
| paths | No | Compatibility alias for file_paths; prefer file_paths | |
| offset | No | Line number to start from (1-based, negative = from end). Default: 1 | |
| file_paths | No | File paths to read. All files use the global offset/limit. Use files for per-file ranges | |
| include_hash | No | Include per-file SHA-256 hashes. Default: false | |
| max_line_chars | No | Maximum characters returned from one line. Default: 4000, Max: 32768 | |
| max_output_chars | No | Maximum total returned text characters across all files. Default: 32768, Max: 131072 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries the full behavioral burden. It discloses encoding auto-detection, default line and character budgets, truncation metadata with continuation positions, per-file error isolation, and the 50-file cap. This is unusually transparent for a tool with no annotation support.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Every sentence contributes a distinct behavior or usage constraint: purpose, encoding, line/character limits, per-file modes, failure handling, and max file count. It is dense but not bloated, and the most important fact is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 9 parameters, no annotations, and no output schema, the description is remarkably complete. It covers defaults, limits, semantics, file failure handling, encoding behavior, and truncation continuation positions, leaving an agent with the practical knowledge needed to invoke it and interpret its results.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already covers 100% of parameters, so the baseline is 3. The description adds value by tying parameters to usage modes: global offset/limit vs per-file files entries, the interaction of all=true with the total character budget, and the 50-file request cap not visible in the schema. These aggregates help an agent pick the right parameter shape.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Reads multiple files in a single call to reduce API round-trips.' This immediately distinguishes it from the single-file 'read' sibling and clearly states the batching purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides strong contextual guidance: use the tool for reading multiple files efficiently, choose global file_paths/paths vs per-file files objects depending on offset/limit needs, and understand failure/encoding/limit behavior. It does not explicitly name the single-file 'read' tool as the alternative, but the multiple-vs-single distinction is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
patchA
Applies a unified diff patch to a file. Parses @@ hunk headers, verifies context lines, and applies changes. Encoding-aware: preserves original file encoding. Line-ending aware: each line keeps its own ending (a mixed CRLF/LF file is not rewritten) and a file without a trailing newline does not gain one. Use dry_run=true to preview without modifying the file.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Alias for file_path | |
| patch | Yes | Unified diff text (output of the diff tool) | |
| dry_run | No | Preview patch result without modifying the file: true or false. Default: false | |
| file_path | No | File to patch. Relative paths use the configured workspace or MCP client root |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description directly contradicts the provided annotations: it says the tool 'applies changes' and can modify a file, while annotations mark readOnlyHint=true and destructiveHint=false. This is an annotation contradiction, which forces the lowest score regardless of the strong encoding and line-ending details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and well-structured: it front-loads the primary action, then adds useful encoding/line-ending behavior, and ends with an actionable dry-run usage. Every sentence contributes unique information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool description covers the behavioral full picture: diff format, context verification, encoding preservation, line-ending behavior, and dry-run safety. The confusing annotation contradiction prevents a 5, but as a standalone spec it is nearly complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already describes all four parameters clearly, including patch, dry_run, and the path aliases. The description adds little beyond restating that dry_run previews without modifying, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description starts with a precise verb-resource pair: 'Applies a unified diff patch to a file.' It further clarifies behavior with hunk parsing and context verification, making it clearly distinct from nearby siblings like edit, write, or multiedit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description conveys a clear use-case: applying unified diff output to a file, with dry_run for preview. It does not explicitly contrast with edit or write, but the diff-specific framing makes the correct context fairly obvious.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
readA
Read text with line numbers or return raster images as ImageContent. Detects common encodings; SVG stays text. Text is bounded and reports truncation/next_offset. Use offset/limit to page; relative paths use the workspace or MCP root.
| Name | Required | Description | Default |
|---|---|---|---|
| all | No | Disable line cap; character cap remains | |
| path | No | Alias for file_path | |
| limit | No | Line limit; default 400. Use 0 or all=true for no line cap | |
| offset | No | Start line: 1-based integer, negative from end, 'start-end', or [start,end]; default 1 | |
| end_line | No | Inclusive end with start_line | |
| file_path | No | Absolute or workspace/MCP-root-relative file path | |
| start_line | No | Alias for offset | |
| include_hash | No | Include SHA-256; default true | |
| max_line_chars | No | Per-line character cap; default 4000, max 32768 | |
| max_output_chars | No | Output character cap; default 32768, max 131072 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations at all, the description carries the full burden and addresses key behaviors: encoding detection, SVG staying text, bounded output with truncation/next_offset reporting, and image results as ImageContent. It does not discuss permissions or failure modes, but for a read operation it discloses the traits most likely to surprise an agent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four short sentences front-load the core behavior and pack each line with non-redundant detail (images, encoding, truncation, paging, paths). No sentence is wasted and the structure lets an agent scan quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 10-parameter, 0-required, no-output-schema tool, the description covers the most important invocation concerns: return type, encoding edge case, truncation reporting, paging, and path base. It does not spell out all optional parameters, but those are fully documented in the schema, so an agent can call the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description adds value beyond the schema by explaining paging semantics ('Use offset/limit to page') and relative path resolution ('workspace or MCP root'). This helps disambiguate offset/limit and file_path without repeating every schema field.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific action ('Read text') and a clear resource, and covers the image-return case ('raster images as ImageContent'), going beyond a bare tautology. It does not explicitly name a sibling such as multiread to differentiate, but the core behavior is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives actionable context for paging ('Use offset/limit to page') and path interpretation ('relative paths use the workspace or MCP root'), which helps an agent decide how to call it. However, it provides no explicit guidance on when to prefer a sibling like multiread or grep, so the when-vs-alternatives guidance is implied rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
toolboxC
Discover and call tools without loading every schema. Use describe, preferably compact with tool_operation, then call with arguments. Reuse schema_handle. output retrieves preserved paged command output. list shows tools; enable/disable/profile manage direct bindings. Profiles: core-lite, core, coding, remote, analysis, full.
| Name | Required | Description | Default |
|---|---|---|---|
| tool | No | Target tool for describe/call | |
| tools | No | Tool names for enable/disable | |
| groups | No | Groups for enable/disable: core, file, coding, system, remote, data, analysis, windows | |
| compact | No | Return a reduced describe schema | |
| profile | No | Profile to add; core-lite, core, coding, remote, analysis, or full. core-lite is smallest at startup | |
| arguments | No | Target arguments for call; describe first if unknown | |
| operation | No | list (default), describe, call, output, enable, disable, or profile | |
| output_id | No | Raw output ID for output | |
| output_offset | No | Output character offset; default 0 | |
| schema_handle | No | Prior handle; short acknowledgement if unchanged | |
| tool_operation | No | Operation-specific compact schema, e.g. execute | |
| output_max_chars | No | Output character limit; default 32768, max 130048 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses that output is paged and preserved, that describe can be compact, and that profile management exists. However, it does not reveal side effects of enable/disable/profile operations (like whether they alter persistent state), auth requirements, or any output format details. For a tool that can modify bindings and profiles, more transparency is needed, but the basic behavioral facts are present.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense but poorly structured: it front-loads operational guidance but then lists operations and profiles in an unorganized way. Each sentence adds info, but the flow is jumbled, mixing instructions, operation list, and profile list without clear separation. It's not concise enough for the complexity; ideally it would use a structured list for operations and profiles.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (12 parameters, multiple operations, nested objects), the description covers the high-level workflow and mentions key parameters and profiles. However, it lacks details on return values (no output schema), side effects of enable/disable/profile, and edge cases like how output_id relates to output operation. It is minimally adequate but leaves gaps that an agent might need to infer or test.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so each parameter already has a description in the schema. The description adds some usage context around certain parameters (e.g., 'compact' and 'tool_operation' relationship, 'profile' list), but it doesn't add meaning beyond the schema for most parameters. It does clarify the default operation is 'list' and that 'schema_handle' might return a short acknowledgement, but that's marginal. With full coverage, baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description lists multiple operations ('list', 'describe', 'call', etc.) and the tool name 'toolbox' hints at a dispatch tool, but the core purpose is not stated as a single verb+resource. It bundles several operations, making the primary purpose ambiguous. The list of sibling tools (read, write, edit) are specific file operations, while this one is a general dispatcher, but that distinction is implied rather than explicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives some guidance on when to use certain operations: 'Use describe, preferably compact with tool_operation, then call with arguments' and 'output retrieves preserved paged command output'. However, it does not explicitly contrast with alternatives or state exclusions. It implies that for performance, compact describe is preferred, but it doesn't say when NOT to use this tool vs. siblings; it assumes the agent knows this is a dispatch tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
writeA
Create or overwrite a file. Preserves existing encoding, uses .editorconfig for new files, and creates parent directories.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Alias for file_path | |
| content | Yes | Content to write to the file | |
| file_path | No | File path; relative to workspace/MCP root |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It does well by revealing important side effects: overwriting, preserving existing encoding, applying .editorconfig for new files, and creating parent directories. It stops short of mentioning irreversibility risks, permissions, or failure behavior, but the core destructive nature is communicated through 'overwrite.'
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single focused sentence that front-loads the primary action ('Create or overwrite a file') and then adds three compact behavioral details. Every clause earns its place, with no filler or repetition of schema information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple write tool, the description covers the essential contextual details: overwrite semantics, encoding handling, editorconfig behavior, and directory creation. It lacks an explicit note about destructive impact or comparison to edit/patch, but the schema covers parameter requirements and the description provides enough behavioral context for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the structured fields already document content, file_path, and path as an alias. The description adds no parameter-specific detail beyond the schema, which matches the baseline of 3; no compensation is needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb and resource ('Create or overwrite a file') and further specifies exact behavior: preserving encoding, applying .editorconfig for new files, and creating parent directories. This clearly identifies it as a whole-file write operation and differentiates it from siblings like edit, patch, and multiedit, which imply targeted changes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool—creating new files or fully overwriting existing ones—but does not explicitly say when not to use it or mention alternatives such as edit/patch for partial modifications. An agent can infer the use case from 'Create or overwrite a file,' but there is no direct routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
1 tool update
v1.0.2- Changed
agent_tool_help1 field changed- changed
Input schema / properties / topic / descriptionPrevious value: -"Help topic. Available: overview, encoding, indentation, tools, debug, analyze, memtool, wintool, codegraph, ipc, troubleshooting. Empty = overview"New value: +"Help topic. Available: overview, encoding, indentation, tools, debug, analyze, memtool, wintool, codegraph, troubleshooting. Empty = overview"
6 tool updates
v0.9.7- Changed
edit6 fields changed- changed
Input schema / properties / dry_run / descriptionPrevious value: -"Preview changes without modifying the file: true or false. Default: false"New value: +"Preview only; default false" - changed
Input schema / properties / expected_hash / descriptionPrevious value: -"Optional SHA-256 hash of the file. If provided and mismatched, edit is rejected (optimistic concurrency)."New value: +"Expected SHA-256; mismatch rejects edit" - changed
Input schema / properties / file_path / descriptionPrevious value: -"File to edit. Relative paths use the configured workspace or MCP client root"New value: +"File path; relative to workspace/MCP root" - changed
Input schema / properties / indent_style / descriptionPrevious value: -"Override indentation style. Values: tabs or spaces-N (e.g. spaces-4). Empty = auto-detect (default)"New value: +"tabs or spaces-N; default auto-detect" - changed
Input schema / properties / new_string / descriptionPrevious value: -"Replacement text (must differ from old_string)"New value: +"Replacement text; must differ from old_string" - changed
Input schema / properties / replace_all / descriptionPrevious value: -"Replace all occurrences instead of just the first: true or false. Default: false"New value: +"Replace every match; default false"
- Changed
glob1 field changed- changed
Input schema / properties / include_ignored / descriptionPrevious value: -"Traverse generated/vendor directories such as node_modules, vendor, target, build, and dist. Default: false"New value: +"Include paths excluded by .gitignore/.ignore or the common generated/vendor policy. Default: false"
- Changed
grep17 fields changed- changed
Input schema / properties / after / descriptionPrevious value: -"Lines after each match. Overrides context. Default: 0, Max: 1000"New value: +"Lines after; overrides context" - changed
Input schema / properties / before / descriptionPrevious value: -"Lines before each match. Overrides context. Default: 0, Max: 1000"New value: +"Lines before; overrides context" - changed
Input schema / properties / context / descriptionPrevious value: -"Lines before and after each match (like grep -C). Default: 0, Max: 1000"New value: +"Lines before/after; max 1000" - changed
Input schema / properties / cursor / descriptionPrevious value: -"Opaque continuation cursor returned by a previous grep call. Not supported with context lines"New value: +"Continuation cursor; incompatible with context lines" - changed
Input schema / properties / glob / descriptionPrevious value: -"Glob pattern to filter files (e.g. *.go). Only used when path is a directory"New value: +"Directory file filter, e.g. *.go" - changed
Input schema / properties / ignore_case / descriptionPrevious value: -"Case-insensitive search. Default: false"New value: +"Ignore case" - changed
Input schema / properties / include_hidden / descriptionPrevious value: -"Search hidden directories. Explicitly provided hidden roots are always searched. Default: false"New value: +"Include hidden directories" - changed
Input schema / properties / include_ignored / descriptionPrevious value: -"Search common generated/vendor directories instead of skipping them. Default: false"New value: +"Include ignored/generated/vendor paths" - changed
Input schema / properties / max_line_chars / descriptionPrevious value: -"Maximum characters per matching/context line. Default: 4000, Max: 32768"New value: +"Per-line cap; default 4000, max 32768" - changed
Input schema / properties / max_output_chars / descriptionPrevious value: -"Maximum total result characters. Default: 32768, Max: 131072"New value: +"Output cap; default 32768, max 131072" - changed
Input schema / properties / max_results / descriptionPrevious value: -"Maximum matching lines/files per page. Default: 100, Max: 100000"New value: +"Matches per page; default 100, max 100000" - changed
Input schema / properties / output_format / descriptionPrevious value: -"Content layout: compact (group matches by file, default) or classic (path:line:text on every line)"New value: +"compact (default) or classic path:line:text" - changed
Input schema / properties / output_mode / descriptionPrevious value: -"Output mode: content (default), files_with_matches, or count"New value: +"content (default), files_with_matches, or count" - changed
Input schema / properties / path / descriptionPrevious value: -"File or directory to search. Defaults to configured workspace, MCP client root, or current directory"New value: +"File or directory; defaults to workspace/MCP root/CWD" - changed
Input schema / properties / pattern / descriptionPrevious value: -"Regular expression pattern to search for"New value: +"Regular expression" - changed
Input schema / properties / recursive / descriptionPrevious value: -"Recurse into subdirectories. Default: true"New value: +"Recurse; default true" - changed
Input schema / properties / relative_paths / descriptionPrevious value: -"Return paths relative to the search root. Default: true for directory searches"New value: +"Paths relative to root; directory default true"
- Changed
read11 fields changed- changed
Input schema / properties / all / descriptionPrevious value: -"Remove the default line limit. The max_output_chars safety budget still applies. Default: false"New value: +"Disable line cap; character cap remains" - changed
Input schema / properties / end_line / descriptionPrevious value: -"Inclusive end line used with start_line"New value: +"Inclusive end with start_line" - changed
Input schema / properties / file_path / descriptionPrevious value: -"Absolute or workspace-relative path to the file to read"New value: +"Absolute or workspace/MCP-root-relative file path" - changed
Input schema / properties / include_hash / descriptionPrevious value: -"Include SHA-256 for optimistic edit concurrency. Default: true"New value: +"Include SHA-256; default true" - changed
Input schema / properties / limit / descriptionPrevious value: -"Maximum lines to return. Default: 400. Set 0 or all=true to remove the line limit; the character budget still applies"New value: +"Line limit; default 400. Use 0 or all=true for no line cap" - changed
Input schema / properties / max_line_chars / descriptionPrevious value: -"Maximum characters returned from one line. Default: 4000, Max: 32768"New value: +"Per-line character cap; default 4000, max 32768" - changed
Input schema / properties / max_output_chars / descriptionPrevious value: -"Maximum returned text characters. Default: 32768, Max: 131072"New value: +"Output character cap; default 32768, max 131072" - changed
Input schema / properties / offset / descriptionPrevious value: -"Line offset. Integer (1-based, negative=from end), string range 'start-end', or [start,end] array. Default: 1"New value: +"Start line: 1-based integer, negative from end, 'start-end', or [start,end]; default 1" - added
Input schema / properties / offset / typeAdded value: +"integer" - changed
Input schema / properties / path / descriptionPrevious value: -"Compatibility alias for file_path; prefer file_path"New value: +"Alias for file_path" - changed
Input schema / properties / start_line / descriptionPrevious value: -"Compatibility alias for offset; prefer offset"New value: +"Alias for offset"
- Changed
toolbox12 fields changed- changed
Input schema / properties / arguments / descriptionPrevious value: -"Target tool arguments for operation=call. Use operation=describe first when the schema is unknown"New value: +"Target arguments for call; describe first if unknown" - changed
Input schema / properties / compact / descriptionPrevious value: -"Return a reduced input schema: true or false. Pair with tool_operation for operation-specific fields"New value: +"Return a reduced describe schema" - changed
Input schema / properties / groups / descriptionPrevious value: -"Tool groups to enable or disable: core, file, coding, system, remote, data, analysis, windows"New value: +"Groups for enable/disable: core, file, coding, system, remote, data, analysis, windows" - changed
Input schema / properties / operation / descriptionPrevious value: -"Operation: list (default), describe, call, output, enable, disable, profile. Prefer describe/call because they work even when the MCP client ignores dynamic tool-list changes"New value: +"list (default), describe, call, output, enable, disable, or profile" - changed
Input schema / properties / output_id / descriptionPrevious value: -"Preserved raw command output ID for operation=output"New value: +"Raw output ID for output" - changed
Input schema / properties / output_max_chars / descriptionPrevious value: -"Maximum raw-output characters returned by operation=output. Default: 32768, Max: 130048"New value: +"Output character limit; default 32768, max 130048" - changed
Input schema / properties / output_offset / descriptionPrevious value: -"Character offset for operation=output paging. Default: 0"New value: +"Output character offset; default 0" - changed
Input schema / properties / profile / descriptionPrevious value: -"Profile for operation=profile: core, coding, remote, analysis, full"New value: +"Profile to add; core-lite, core, coding, remote, analysis, or full. core-lite is smallest at startup" - changed
Input schema / properties / schema_handle / descriptionPrevious value: -"Handle returned by an earlier describe; matching handles return only an unchanged acknowledgement"New value: +"Prior handle; short acknowledgement if unchanged" - changed
Input schema / properties / tool / descriptionPrevious value: -"Single tool name for operation=describe or call"New value: +"Target tool for describe/call" - changed
Input schema / properties / tool_operation / descriptionPrevious value: -"Target tool operation for compact describe, for example execute or upload"New value: +"Operation-specific compact schema, e.g. execute" - changed
Input schema / properties / tools / descriptionPrevious value: -"Individual tool names to enable or disable"New value: +"Tool names for enable/disable"
- Changed
write1 field changed- changed
Input schema / properties / file_path / descriptionPrevious value: -"File to write. Relative paths use the configured workspace or MCP client root"New value: +"File path; relative to workspace/MCP root"
1 tool update
v0.9.6- Changed
toolbox3 fields changed- added
Input schema / properties / compactAdded value: +{ + "description": "Return a reduced input schema: true or false. Pair with tool_operation for operation-specific fields", + "type": "boolean" +} - added
Input schema / properties / schema_handleAdded value: +{ + "description": "Handle returned by an earlier describe; matching handles return only an unchanged acknowledgement", + "type": "string" +} - added
Input schema / properties / tool_operationAdded value: +{ + "description": "Target tool operation for compact describe, for example execute or upload", + "type": "string" +}
53 tool updates
v0.9.5- Removed
analyze - Removed
backup - Removed
bash - Removed
checksum - Removed
codegraph - Removed
compress - Removed
convert_encoding - Removed
copy - Removed
debug - Removed
decompress - Removed
delete - Removed
diff - Removed
dnslookup - Removed
download - Changed
edit3 fields changed- added
Input schema / properties / dry_run / typeAdded value: +"boolean" - changed
Input schema / properties / file_path / descriptionPrevious value: -"Absolute path to the file to edit"New value: +"File to edit. Relative paths use the configured workspace or MCP client root" - added
Input schema / properties / replace_all / typeAdded value: +"boolean"
- Removed
envvar - Removed
externalip - Removed
file_info - Removed
find_tools - Removed
firewall - Changed
glob8 fields changed- added
Input schema / properties / cursorAdded value: +{ + "description": "Opaque continuation cursor returned by a previous glob call", + "type": "string" +} - added
Input schema / properties / include_hiddenAdded value: +{ + "description": "Traverse hidden directories. Explicit hidden roots are always searched. Default: false", + "type": "boolean" +} - added
Input schema / properties / include_ignoredAdded value: +{ + "description": "Traverse generated/vendor directories such as node_modules, vendor, target, build, and dist. Default: false", + "type": "boolean" +} - added
Input schema / properties / limitAdded value: +{ + "description": "Maximum paths returned per page. Default: 200, Max: 5000", + "type": "integer" +} - added
Input schema / properties / max_output_charsAdded value: +{ + "description": "Maximum returned text characters. Default: 32768, Max: 131072", + "type": "integer" +} - changed
Input schema / properties / path / descriptionPrevious value: -"Directory to search in (absolute path). Defaults to current directory if empty"New value: +"Directory to search. Defaults to configured workspace, MCP client root, or current directory" - changed
Input schema / properties / relative_paths / descriptionPrevious value: -"Return paths relative to the search directory instead of absolute paths. Saves tokens in output: true or false. Default: false"New value: +"Return paths relative to the search directory. Default: true" - added
Input schema / properties / relative_paths / typeAdded value: +[ + "null", + "boolean" +]
- Changed
grep21 fields changed- changed
Input schema / properties / after / descriptionPrevious value: -"Lines of context after each match (like grep -A). Overrides context. Default: 0"New value: +"Lines after each match. Overrides context. Default: 0, Max: 1000" - added
Input schema / properties / after / typeAdded value: +"integer" - changed
Input schema / properties / before / descriptionPrevious value: -"Lines of context before each match (like grep -B). Overrides context. Default: 0"New value: +"Lines before each match. Overrides context. Default: 0, Max: 1000" - added
Input schema / properties / before / typeAdded value: +"integer" - changed
Input schema / properties / context / descriptionPrevious value: -"Lines of context before and after each match (like grep -C). Default: 0"New value: +"Lines before and after each match (like grep -C). Default: 0, Max: 1000" - added
Input schema / properties / context / typeAdded value: +"integer" - added
Input schema / properties / cursorAdded value: +{ + "description": "Opaque continuation cursor returned by a previous grep call. Not supported with context lines", + "type": "string" +} - changed
Input schema / properties / ignore_case / descriptionPrevious value: -"Case insensitive search: true or false. Default: false"New value: +"Case-insensitive search. Default: false" - added
Input schema / properties / ignore_case / typeAdded value: +"boolean" - added
Input schema / properties / include_hiddenAdded value: +{ + "description": "Search hidden directories. Explicitly provided hidden roots are always searched. Default: false", + "type": "boolean" +} - added
Input schema / properties / include_ignoredAdded value: +{ + "description": "Search common generated/vendor directories instead of skipping them. Default: false", + "type": "boolean" +} - added
Input schema / properties / max_line_charsAdded value: +{ + "description": "Maximum characters per matching/context line. Default: 4000, Max: 32768", + "type": "integer" +} - added
Input schema / properties / max_output_charsAdded value: +{ + "description": "Maximum total result characters. Default: 32768, Max: 131072", + "type": "integer" +} - changed
Input schema / properties / max_results / descriptionPrevious value: -"Maximum number of matching lines/files to return. Default: 100"New value: +"Maximum matching lines/files per page. Default: 100, Max: 100000" - added
Input schema / properties / max_results / typeAdded value: +"integer" - added
Input schema / properties / output_formatAdded value: +{ + "description": "Content layout: compact (group matches by file, default) or classic (path:line:text on every line)", + "type": "string" +} - changed
Input schema / properties / output_mode / descriptionPrevious value: -"Output mode: 'content' (matching lines with path:line:text, default), 'files_with_matches' (file paths only), 'count' (match count per file)"New value: +"Output mode: content (default), files_with_matches, or count" - changed
Input schema / properties / path / descriptionPrevious value: -"File or directory to search in (absolute path). Defaults to current directory"New value: +"File or directory to search. Defaults to configured workspace, MCP client root, or current directory" - changed
Input schema / properties / recursive / descriptionPrevious value: -"Recurse into subdirectories: true or false. Default: true"New value: +"Recurse into subdirectories. Default: true" - added
Input schema / properties / recursive / typeAdded value: +[ + "null", + "boolean" +] - added
Input schema / properties / relative_pathsAdded value: +{ + "description": "Return paths relative to the search root. Default: true for directory searches", + "type": [ + "null", + "boolean" + ] +}
- Removed
httpreq - Removed
ipc - Removed
jsonquery - Changed
listdir12 fields changed- added
Input schema / properties / counts_onlyAdded value: +{ + "description": "Return matching directory/file counts without listing names: true or false. Default: false", + "type": "boolean" +} - added
Input schema / properties / cursorAdded value: +{ + "description": "Opaque continuation cursor returned by a previous listdir call", + "type": "string" +} - added
Input schema / properties / directories_onlyAdded value: +{ + "description": "Return directories only while still traversing them: true or false. Default: false", + "type": "boolean" +} - added
Input schema / properties / files_onlyAdded value: +{ + "description": "Return files only: true or false. Default: false", + "type": "boolean" +} - added
Input schema / properties / includeAdded value: +{ + "description": "Additional entry-name glob patterns. An entry is included when any pattern matches", + "items": { + "type": "string" + }, + "type": [ + "null", + "array" + ] +} - changed
Input schema / properties / max_depth / descriptionPrevious value: -"Maximum depth for tree traversal. Default: 3"New value: +"Maximum depth for traversal. Default: 3" - added
Input schema / properties / max_depth / typeAdded value: +"integer" - added
Input schema / properties / max_entriesAdded value: +{ + "description": "Maximum entries to return per page. Default: 500, maximum: 10000", + "type": "integer" +} - added
Input schema / properties / name_patternAdded value: +{ + "description": "Glob matched against each entry name, for example A* or *.go", + "type": "string" +} - changed
Input schema / properties / path / descriptionPrevious value: -"Absolute path to the directory to list"New value: +"Directory to list. Relative paths use the configured workspace or MCP client root" - changed
Input schema / properties / relative_paths / descriptionPrevious value: -"Show the root as '.' instead of the full absolute path. Saves tokens in output: true or false. Default: false"New value: +"Show paths relative to the root. Saves tokens: true or false. Default: false" - added
Input schema / properties / relative_paths / typeAdded value: +"boolean"
- Removed
memtool - Removed
mkdir - Changed
multiedit2 fields changed- added
Input schema / properties / dry_run / typeAdded value: +"boolean" - changed
Input schema / properties / file_path / descriptionPrevious value: -"Absolute path to the file to edit"New value: +"File to edit. Relative paths use the configured workspace or MCP client root"
- Changed
multiread14 fields changed- added
Input schema / properties / allAdded value: +{ + "description": "Remove the default per-file line limit. The total character budget still applies. Default: false", + "type": "boolean" +} - changed
Input schema / properties / file_paths / descriptionPrevious value: -"List of absolute file paths to read. All files use the global offset/limit. Use 'files' instead for per-file ranges"New value: +"File paths to read. All files use the global offset/limit. Use files for per-file ranges" - changed
Input schema / properties / files / items / properties / limit / descriptionPrevious value: -"Max lines to read. Default: 0 (all)"New value: +"Max lines to read. Default: 200. Set 0 to remove the line limit" - added
Input schema / properties / files / items / properties / limit / typeAdded value: +[ + "null", + "integer" +] - added
Input schema / properties / files / items / properties / offset / typeAdded value: +[ + "null", + "integer" +] - changed
Input schema / properties / files / items / properties / path / descriptionPrevious value: -"Absolute file path"New value: +"Absolute or workspace-relative file path" - added
Input schema / properties / include_hashAdded value: +{ + "description": "Include per-file SHA-256 hashes. Default: false", + "type": "boolean" +} - changed
Input schema / properties / limit / descriptionPrevious value: -"Maximum number of lines to read per file. Default: 0 (all)"New value: +"Maximum lines per file. Default: 200. Set 0 or all=true to remove the line limit" - added
Input schema / properties / limit / typeAdded value: +[ + "null", + "integer" +] - added
Input schema / properties / max_line_charsAdded value: +{ + "description": "Maximum characters returned from one line. Default: 4000, Max: 32768", + "type": "integer" +} - added
Input schema / properties / max_output_charsAdded value: +{ + "description": "Maximum total returned text characters across all files. Default: 32768, Max: 131072", + "type": "integer" +} - changed
Input schema / properties / offset / descriptionPrevious value: -"Line number to start reading from (1-based). Negative = from end (e.g. -5 = last 5 lines). Default: 1"New value: +"Line number to start from (1-based, negative = from end). Default: 1" - added
Input schema / properties / offset / typeAdded value: +[ + "null", + "integer" +] - changed
Input schema / properties / paths / descriptionPrevious value: -"Alias for file_paths"New value: +"Compatibility alias for file_paths; prefer file_paths"
- Removed
mysql - Changed
patch2 fields changed- added
Input schema / properties / dry_run / typeAdded value: +"boolean" - changed
Input schema / properties / file_path / descriptionPrevious value: -"Absolute path to the file to patch"New value: +"File to patch. Relative paths use the configured workspace or MCP client root"
- Removed
portcheck - Removed
procexec - Removed
prockill - Removed
proclist - Changed
read13 fields changed- added
Input schema / properties / allAdded value: +{ + "description": "Remove the default line limit. The max_output_chars safety budget still applies. Default: false", + "type": "boolean" +} - changed
Input schema / properties / end_line / descriptionPrevious value: -"End line number (1-based, inclusive). Sets limit = end_line - start_line + 1 when used with start_line"New value: +"Inclusive end line used with start_line" - added
Input schema / properties / end_line / typeAdded value: +[ + "null", + "integer" +] - changed
Input schema / properties / file_path / descriptionPrevious value: -"Absolute or relative path to the file to read"New value: +"Absolute or workspace-relative path to the file to read" - added
Input schema / properties / include_hashAdded value: +{ + "description": "Include SHA-256 for optimistic edit concurrency. Default: true", + "type": [ + "null", + "boolean" + ] +} - changed
Input schema / properties / limit / descriptionPrevious value: -"Maximum number of lines to read. Default: 0 (all)"New value: +"Maximum lines to return. Default: 400. Set 0 or all=true to remove the line limit; the character budget still applies" - added
Input schema / properties / limit / typeAdded value: +[ + "null", + "integer" +] - added
Input schema / properties / max_line_charsAdded value: +{ + "description": "Maximum characters returned from one line. Default: 4000, Max: 32768", + "type": "integer" +} - added
Input schema / properties / max_output_charsAdded value: +{ + "description": "Maximum returned text characters. Default: 32768, Max: 131072", + "type": "integer" +} - changed
Input schema / properties / offset / descriptionPrevious value: -"Line offset. Integer (1-based, negative=from end), string range 'start-end', or [start,end] array. Default: 0 (all)"New value: +"Line offset. Integer (1-based, negative=from end), string range 'start-end', or [start,end] array. Default: 1" - changed
Input schema / properties / path / descriptionPrevious value: -"Alias for file_path"New value: +"Compatibility alias for file_path; prefer file_path" - changed
Input schema / properties / start_line / descriptionPrevious value: -"Alias for offset (1-based line number to start reading from)"New value: +"Compatibility alias for offset; prefer offset" - added
Input schema / properties / start_line / typeAdded value: +[ + "null", + "integer" +]
- Removed
redis - Removed
regexreplace - Removed
rename - Removed
set_config - Removed
sftp - Removed
sloc - Removed
ssh - Removed
sysinfo - Removed
tlscheck - Removed
tomlquery - Added
toolbox - Removed
webfetch - Removed
websearch - Removed
wintool - Changed
write1 field changed- changed
Input schema / properties / file_path / descriptionPrevious value: -"Absolute path to the file to write"New value: +"File to write. Relative paths use the configured workspace or MCP client root"
- Removed
yamlquery
53 tool updates
v0.8.7- Added
agent_tool_help - Added
analyze - Added
backup - Added
bash - Added
checksum - Added
codegraph - Added
compress - Added
convert_encoding - Added
copy - Added
debug - Added
decompress - Added
delete - Added
diff - Added
dnslookup - Added
download - Added
edit - Added
envvar - Added
externalip - Added
file_info - Added
find_tools - Added
firewall - Added
glob - Added
grep - Added
httpreq - Added
ipc - Added
jsonquery - Added
listdir - Added
memtool - Added
mkdir - Added
multiedit - Added
multiread - Added
mysql - Added
patch - Added
portcheck - Added
procexec - Added
prockill - Added
proclist - Added
read - Added
redis - Added
regexreplace - Added
rename - Added
set_config - Added
sftp - Added
sloc - Added
ssh - Added
sysinfo - Added
tlscheck - Added
tomlquery - Added
webfetch - Added
websearch - Added
wintool - Added
write - Added
yamlquery
TDQS
Scored across 11 tools
edit/multiedit/patch and read/multiread are closely related, but the descriptions clearly distinguish single-vs-multiple edits, direct reading, and unified-diff application. glob, grep, and listdir have distinct search/listing roles, while toolbox/help are recognizably meta tools.
Most tool names are lowercase single tokens, and multiedit/multiread follow a consistent compound pattern, but agent_tool_help uses underscored prefixed naming and listdir is not separated as list_dir. There is no clear verb_noun convention, though the set remains readable.
11 tools is well-scoped for a file/coding-agent MCP. The core file operations are joined by useful multi-file and meta-discovery helpers, with no excessive tool count.
The surface covers reading, writing, editing, patching, searching, listing, and multi-file operations. It lacks explicit delete, rename, or move tools, which is a minor gap for full file lifecycle coverage.
Maintenance
Related MCP Connectors
Shared control plane for AI coding agents — tasks, memory, decisions, file locks. 12 tools.
13 free utility tools for AI agents: web text, markdown, hashing, IDs, dates, units, JSON.
Image & PDF tools for AI agents: compress, convert, resize, PDF, AI vision, pipeline.
Persistent memory and knowledge management for AI agents with semantic search and 50+ tools.
Related MCP Servers
- AlicenseNot gradedqualityFmaintenanceEnables secure local filesystem operations and interactive terminal sessions for AI assistants. Provides 12 tools for file management, directory operations, code searching, and running interactive REPLs with security protections.9 npmMIT
- AlicenseNot gradedqualityDmaintenanceProvides AI assistants with 28 developer tools across file, git, code analysis, HTTP, and system domains, enabling tasks like file editing, repository management, code analysis, and shell command execution.11 npm2MIT
- AlicenseAqualityDmaintenanceEnables AI agents to autonomously navigate a codebase by listing directories, reading files, searching code, and running whitelisted commands.57 npmISC
- FlicenseNot gradedqualityDmaintenanceEnables AI assistants to safely interact with the file system through a set of tools for reading, writing, deleting, copying, moving files, and managing directories.-