Skip to main content
Glama
kumarganduri

legwork-mcp

by kumarganduri
OverviewSchemaSourceRelated ServersDiscussionsAdmin
Python
Local

install_tool

Idempotent

Install a GitHub repo as a sandboxed MCP tool: Legwork scans source for hidden payloads, builds and self-tests it, then reports tool names and how to call them.

Instructions

Install a GitHub repo, usually one picked with find_tools, as a tool on the user's computer: Legwork scans its source for hidden payloads, then builds and self-tests it in a sandbox. Grants are read-only folders and/or network, within the limits the user started Legwork with; ask only for what the task needs. Waits up to 45 seconds; if the build is still running it says so, and install_status follows it. A repo already installed with the same grants is reused, not rebuilt. Replies with the new tools' names and how to call them.

Input Schema

TableJSON Schema
NameRequiredDescriptionDefault
repoYesowner/repo (or its GitHub URL), e.g. 'jsvine/pdfplumber'
commitNooptional: a full 40-character commit SHA or a tag (e.g. v1.2.0) to build exactly that, instead of the default branch as it is now
previewNotrue: install nothing; say which commit would be built and how it would be installed, so the user can approve that exact commit
allow_netNowhether the tool may use the internet while it runs (installs always can). Omitted: keeps an earlier grant, or no
allow_readNofolders the tool may read, read-only, e.g. ['~/Downloads']. Omitted: keeps what an earlier install of this repo was granted, or none

Schema Changelog

Changes observed during successful MCP inspections.

  1. Changed3 schema fields changedv0.1.1
    • changedInput schema / properties / allow_net / description
      Previous value: -"whether the tool may use the network"New value: +"whether the tool may use the internet while it runs (installs always can). Omitted: keeps an earlier grant, or no"
    • changedInput schema / properties / allow_read / description
      Previous value: -"folders the tool may read"New value: +"folders the tool may read, read-only, e.g. ['~/Downloads']. Omitted: keeps what an earlier install of this repo was granted, or none"
    • changedInput schema / properties / repo / description
      Previous value: -"owner/repo from find_tools"New value: +"owner/repo (or its GitHub URL), e.g. 'jsvine/pdfplumber'"
  2. First observedv0.1.0

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations cover safety hints, but the description adds substantial behavioral context beyond them: source scanning for hidden payloads, sandbox build and self-test, grants constrained to the user's Legwork limits, a 45-second wait with install_status as the fallback, and idempotent reuse of an already-installed repo. This is exactly the extra detail annotations cannot carry.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but front-loaded, leading with what it does before covering grants, wait behavior, reuse, and the reply shape. Every sentence carries information; slightly long, but nothing is filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description compensates by stating that replies contain the new tools' names and how to call them, and by explaining the timeout/install_status handoff. Combined with the 100%-covered input schema, an agent has everything needed to invoke and follow up correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the baseline is 3, but the description adds real meaning: it clarifies that grants are read-only folders/network within pre-established user limits, that omitted grants persist from an earlier install, and that preview installs nothing and reports the exact commit. These reinforce and contextualize the schema fields.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (install) and resource (a GitHub repo as a tool), plus the source of the repo (usually picked with find_tools). An agent can immediately distinguish it from use_tool, find_tools, and install_status.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Routes the agent to find_tools as the usual preceding step and explains the preview path for user approval. It gives strong context on grants ('ask only for what the task needs') but does not state explicit when-not conditions or spell out all sibling alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server

Other Tools