tianshu-mcp
This server is an MCP-based orchestration layer that lets you dispatch development tasks to external AI agents (Codex, TraeWork, ZCode, or CLI profiles) and manage the full develop → verify → rework loop asynchronously.
Dispatch tasks:
run_taskstarts an agent task (optionally withautoVerifyandautoFixRounds), returns ataskIdimmediately, and supports agent-specific parameters likemodel,mode,planDoc,designSystem,reasoningLevel, andallowCreateProject.Continue and recover:
continue_taskresumes tasks stuck inneeds_userstates (e.g., ZCode questions, Codex user confirmation, login-required scenarios).Monitor progress:
query_taskpolls status/progress/recent log tail;list_tasksfilters historical tasks by project/status.Get reports:
get_task_reportreturns the full acceptance report (report.md) for a task round.Cancel running tasks:
cancel_taskkills CLI processes or attempts a bounded GUI stop for desktop agents, removes queued tasks, and handles terminal tasks gracefully.Verify objectively:
verify_taskruns command checks and code analysis against the git baseline without modifying source; optionalextraChecks,baselineRef, andchecksModeallow temporary check overrides.Rework failed work:
rework_taskre-enqueues failed/needs_attention tasks with feedback for another attempt.Visual acceptance:
prepare_visual_baselinecreates screenshot/import-based visual baseline candidates;approve_visual_baselinefinalizes them after user review, with digest verification and approval notes.Inspect adapters:
get_profilesshows agent adapters and executable discovery results.Operational guarantees: async task contract, per-project serial queues with global concurrency limits, path safety checks, no API-key storage/forwarding, and strict stdio MCP transport (logs go to stderr only).
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@tianshu-mcpHave Codex implement the login page in D:/my-app, verify and rework up to 2 rounds"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
tianshu-mcp
视觉验收(v0.5.0 起,含 v0.5.4 可选 AI 内容校验):中文指南 · 验证记录 · 最新发布说明。
天枢 × AI-Agent 编排 MCP server
由天枢(Tianshu)当作标准 MCP server 接入,调度外部 AI-Agent(Codex 桌面端、TraeWork/TRAE SOLO CN、ZCode 均经 CDP 驱动桌面 UI)完成 项目开发 → 验收 → 失败返修 → 再验收 的闭环(架构可横向扩展)。
天枢官方仓库:github.com/huiliyi37/Tianshu-harness —— 基于 harness 工程的终端编程智能体运行时(TUI × GUI),本 MCP 作为其 MCP server 接入。
English · 简体中文
这是什么
天枢的角色是总指挥;本 MCP server 是调度层 + 执行面 + 客观验收仪;外部 AI-Agent(Codex / TraeWork / ZCode GUI)是执行开发的「工人」。
11 个 MCP 工具:
run_task / continue_task / query_task / list_tasks / get_task_report / cancel_task / verify_task / rework_task / get_profiles,外加视觉验收的prepare_visual_baseline / approve_visual_baseline异步契约:
run_task秒回taskId,长任务用query_task轮询(长任务不卡tools/call)。客观验收:自动命令检查(typecheck/lint/test/build,缺则跳过 + 技术栈推导)+ 程序化代码分析(变更清单/diffstat/TODO·debugger·密钥形态等可疑标记),全部相对 git 基线,不自动 commit/stash。验收引擎 fail-closed:测试命令退出码为 0 但输出显示零用例时判失败;git 项目默认要求相对动工前基线产生变更(纯分析任务可在
.tianshu-mcp/acceptance.json设"requireChanges": false显式关闭)。验收并行度:命令检查默认有界并行(
verifyConcurrency,默认 2、范围 1–4)。检查项之间有顺序依赖时(后续检查读取 build 产物、带--fix、共享缓存目录)请设1完全退化为串行;项目级.tianshu-mcp/acceptance.json可覆盖,server 级在config.json。报告与日志格式不变(结果按声明顺序返回)。失败返修闭环:自动返修(
autoFixRounds)+ 手动rework_task;验收失败时自动生成修复计划文件并回填给 agent;轮次用尽 →needs_attention等天枢裁决。执行面:
driver: "gui"由显式 adapter 驱动桌面 UI(Codex / TraeWork / ZCode 各自使用隔离的 CDP 流程);driver: "spawn"走外部 CLI 子进程。无项目派发(ZCode,issue #12):
run_task的projectPath可省略——ZCode 在default工作区承接任务,不登记/导入项目、不采集 Git 基线、不执行项目验收(结果以verificationNotApplicable: "no_project"结构化标注,verify_task/get_task_report返回不适用说明)。配套allowCreateProject: false可在目标目录未登记时于任何导入副作用之前停止派发。详见 ZCode CDP 适配器。调度纪律:每项目串行队列 + 全局并发上限(默认 2,可配)。
可选 AI 内容校验(v0.5.4,默认关闭):校验图片或页面截图内容是否符合你显式声明的期望描述。判定完全委托给你自备的本地命令(MCP 不读取、不存储、不转发任何密钥,也不内置模型客户端),默认仅告警、逐规则可升级为致败;采样多数票 + 任务级缓存防抖,票不集中或低于置信度阈值判
uncertain(永不阻塞、不触发返修)。配置与命令契约见 视觉验收。不碰密钥:各 agent 用自己的登录态;本 server 不保存/转发任何 API key。可选 AI 内容校验同样不引入凭证管理——判定命令自己管密钥(见 SECURITY.md)。
可扩展:新 agent = 一个 profile(数据)+(如需)一个 adapter 文件,零改编排核心。
想理解内部结构:见 ARCHITECTURE.md(分层模型、模块边界、状态机、验收流水线、扩展点与已知缺口)。
Related MCP server: agent-pool-mcp
快速开始
前置条件
项 | 要求 |
Node.js | ≥ 20(CI 覆盖 20 / 22 / 24) |
包管理器 | npm(仓库含 |
操作系统 | Windows / macOS / Linux(CI 三平台矩阵验证) |
Git | 可选;验收的基线分析在 git 仓库内更完整 |
数据目录默认 ~/.tianshu-mcp,可用环境变量 TIANSHU_MCP_HOME 覆盖;首次启动自动创建。
从源码构建
git clone https://github.com/lanlan0811/tianshu-mcp.git
cd tianshu-mcp
npm ci
npm run build # sync-version + tsc → dist/
npm test # 647 项测试:67 个文件,含 Codex/ZCode/TraeWork 单元/假 CDP/重启/恢复/返修闭环与视觉验收安装 npm 包
npx -y tianshu-mcp # 免安装直接拉起
# 或
npm install -g tianshu-mcp在天枢里添加(推荐)
天枢「设置 → MCP 服务器 → 添加」,按下面填写即可(传输方式选 stdio(本地进程)):
字段 | npm 分发(推荐) | 本地开发 |
服务器 ID |
|
|
传输方式 |
|
|
命令 |
|
|
参数(空格分隔) |
|
|
服务器 ID 即工具前缀:填
tianshu-mcp后工具名为mcp__tianshu-mcp__run_task等 11 个。参数按空格分隔填写,不要加引号;本地开发模式请把
<仓库绝对路径>换成真实绝对路径(如D:/Trae项目/tianshu-mcp/dist/index.js)。界面未提供环境变量输入框;如需自定义数据目录,改用下面的
config.json方式设置TIANSHU_MCP_HOME。添加后连接成功即完成;新开会话即可看到 11 个工具。
或改 config.json(可配环境变量)
配置为天枢 MCP server(本地开发模式):
{
"mcp": {
"servers": {
"tianshu-mcp": {
"command": "node",
"args": ["<仓库绝对路径>/dist/index.js"],
"env": { "TIANSHU_MCP_HOME": "<仓库绝对路径>/.tianshu-mcp" }
}
}
}
}新开会话后,工具面出现 mcp__tianshu-mcp__run_task 等 11 个工具。用 stub 预演(不碰真实登录态)→ 切 codex 跑真实任务:
run_task(projectPath=D:/xxx/my-app, task=「…任务书…」, agentId=codex,
model=「GPT-5.6 Sol」, reasoningLevel=「高」, autoVerify=true, autoFixRounds=5)
→ taskId → query_task(taskId) 轮询 → succeeded / failed / needs_attention → get_task_report 读报告
codex现为桌面端 GUI 驱动(driver=gui+activation=msix-com):Codex 是 MSIX 商店包, 其ChatGPT.exe无法直接启动(被策略拒绝),须经 COM 激活并注入专属--user-data-dir后方可 用 CDP 驱动。可传planDoc/designSystem拼进初始指令。详见 docs/codex-gui-cdp.md 与 真机验收记录。项目未在 Codex 侧登记时会自动登记,无需手动建项目。 Codex 停在「等待用户确认」界面(方案确认卡/订阅结账页等)会转needs_user(user_confirmation), 用户在 Codex 窗口处理完后调continue_task(taskId)恢复观察;cancel_task会经 CDP 点击停止并 有界等待 GUI 空闲,派发前若受管实例仍在运行会先尽力停止,仍不空闲则以instance_busy拒绝派发。
驱动 TraeWork 时可用 model 与 mode:
run_task(projectPath=D:/xxx/my-app, agentId=traework, task=「切换到 Code 模式,实现登录接口」,
model=GLM-5.3, mode=Code, autoVerify=true, autoFixRounds=2)
mode支持Work/Code/Design;不传时从任务书文本识别(如「切换到 Code 模式」),识别不到则保持Work。 TraeWork 的三种模式各自维护独立的项目绑定,因此实现顺序为「新建会话 → 切到目标模式 → 在目标模式内绑定项目」。
驱动 ZCode 时,model 必须使用精确的 供应商/模型,且不能传 mode:
run_task(projectPath=D:/xxx/my-app, agentId=zcode, task=「按 `./plan.md` 完成开发」,
model=DeepSeek/deepseek-flash, autoVerify=true)ZCode 提问、需要登录、旧实例无 CDP、系统权限不足,或自动恢复未完成(needs_user/setup_recovery)时进入 needs_user;处理后调用 continue_task(taskId, message) 恢复——确认文本不发给模型,无锚点的环境恢复会补发完整原任务、上下文与已验证引用,且不消耗返修轮数。模型选择已适配 ZCode 3.11.2:直选平铺模型优先,展开 provider/family 分组兜底,新旧布局均兼容。完整约束见 docs/zcode-cdp.md。
工具面(11 个)
工具 | 能力 / 审批 | 作用 |
| write + 审批 | 派活(可带自动验收/自动返修),异步返回 |
| write + 审批 | 恢复 |
| read | 轮询状态 / 进度 / 日志尾 |
| read | 历史任务过滤列表 |
| read | 某轮验收报告全文( |
| write + 审批 | 取消运行中任务:CLI agent kill 进程树;GUI agent 经 CDP 点击停止并在 |
| read | 对任务/项目路径做一次验收(不改源码) |
| write + 审批 | 手动返修(把失败报告喂回同一 agent) |
| read | 查看 agent 适配与可执行探测结果 |
| write + 审批 | 截图或导入参考图,生成待审阅候选和摘要 |
| write + 审批 | 用户审阅后校验摘要并写入基准与审批记录 |
返回统一为「人类可读文本 +
---tianshu-mcp-meta---JSON 块」,便于宿主正则抽取。
路径安全闸门(v0.4.0 起):
projectPath在提交时校验——必须绝对路径、目录必须存在、符号链接经 realpath 归一(回执明示解析来源);主目录本身与系统/根级目录直接拒绝,防止 worker 写权限覆盖整棵系统子树;git 仓库有未提交变更时回执附带共处警示。
无项目派发(ZCode 专用,v0.5.2 起):省略
projectPath时任务在 ZCode 的default工作区运行,跳过项目登记、Git 基线、项目快照、项目锁与项目验收(终态标注not_applicable: no_project)。allowCreateProject=false可禁止自动导入未登记的项目。详见 docs/zcode-cdp.md。
日志与 stdio 契约
本 server 是标准 MCP stdio server,严格遵守传输契约:
stdout 只承载 MCP JSON-RPC 消息。任何诊断日志都不会写入 stdout——否则会破坏 JSON-RPC 流,导致严格客户端握手或工具调用失败。
所有级别日志(DEBUG/INFO/WARN/ERROR)写入 stderr,同时追加到数据目录下的
logs/server.log(UTF-8,ISO 时间戳,含级别标签)。因此 stderr 里出现
INFO/WARN不代表服务器出错;它是正常诊断信息。只有启动失败(tianshu-mcp 启动失败:)才是致命错误,并会以非 0 退出码结束。
数据目录默认 ~/.tianshu-mcp(可用 TIANSHU_MCP_HOME 覆盖),日志文件位于 <数据目录>/logs/server.log。
排查连接问题时以 server.log 为准;不要因为 stderr 有输出就判定 server 异常。
文档
文档 | 内容 |
架构说明:分层模型与模块边界、启动装配、数据目录、状态机、验收与返修流水线、Agent 驱动层契约、GUI 实例生命周期、跨平台策略、安全红线、扩展点、已知缺口 | |
天枢 config.json 两种接入模式、UI/API 操作、冒烟步骤、FAQ | |
agent profiles 字段说明 + 真实机器样例(codex M2 定稿) | |
各 Agent 能力调研矩阵(Codex/Zcode/TraeWork/扩展位) | |
TraeWork GUI 驱动(CDP):原理、配置、模式切换、选择器、安全红线、踩坑记录、验证记录 | |
ZCode GUI 驱动:安装探测、精确项目/模型、完全访问、暂停继续、验收返修与双平台状态 | |
ZCode Windows 真机开发、同会话返修与提问续跑验收记录 | |
Codex 桌面端 GUI 驱动:MSIX COM 激活、CDP 接管、选择器、运行检测、验收返修 | |
Codex Windows 真机验收记录(含验收失败→自动生成计划→返修通过闭环) | |
v0.5.4 发布说明(可选 AI 视觉内容校验:自备命令委托、多数票防抖、默认仅告警) | |
v0.5.3 发布说明(ZCode 真机回访修复:实例跨 server 驻留、新建任务切页、发送失败归因) | |
v0.5.2 发布说明(ZCode 无项目派发与 | |
v0.5.1 发布说明(技能/验证文档补齐、平台证据归档、锁文件版本同步;无运行时变更) | |
v0.5.0 发布说明(可选视觉验收模块:截图对比、图片规格、基准批准、离线报告) | |
视觉验收入门与完整配置:三种页面来源、基准候选/批准、规则冻结、阈值排查,以及可选 AI 内容校验(命令契约、原因码、防抖与数据外发声明) | |
视觉验收验证进度:Windows 10 完整功能矩阵、macOS Intel/Apple Silicon 平台证据,以及 v0.5.4 AI 内容校验的判定桩端到端记录 | |
上述验证的原始机器可读记录(环境 JSON、矩阵结果、测试输出与 macOS CI 摘要) | |
v0.4.1 发布说明(技能文档对齐 v0.4.0 工具面 + 贡献者名录) | |
v0.3.4 发布说明(ZCode 项目/模型回读、初始化恢复与会话发送确认,issue #8/#9/#10) | |
ZCode #8/#9/#10 Windows 真机验收记录(冷导入、已导入复用、同任务恢复) | |
v0.3.3 发布说明(ZCode 3.11.2 适配 + 验收引擎 fail-closed) | |
v0.3.2 发布说明(Codex 等待用户检测 + cancel 真停 GUI) | |
v0.3.1 发布说明(技能文档重写 + 发布自动化修复) | |
v0.3.0 发布说明(Codex 桌面端 GUI 适配,含 BREAKING) | |
v0.2.0 发布说明(ZCode GUI 统一闭环) | |
项目级 | |
v0.1.9 发布说明(TraeWork 任务进行中检测与实例保留) | |
v0.1.10 发布说明(修复 stdio 日志污染:诊断日志统一走 stderr) | |
v0.1.8 发布说明(原子写并发缺陷修复) | |
v0.1.7 发布说明(绑定根因:原生路径) | |
v0.1.6 发布说明(项目文件夹绑定修复) | |
v0.1.5 发布说明(模式切换、README/图标、发布产物) | |
npm 发布步骤与凭证说明 | |
M2 真实 codex 冒烟记录(run_task→verify_task 通过 + 缺陷修复) | |
M2 codex rework 闭环记录(失败→rework_task→再验收,含物证) | |
天枢宿主真实接入实测(DoD #6:2 servers / 10 tools) | |
issue #1 桌面宿主重连验收(天枢 v3.16.1:10 tools + 真实工具调用) | |
DoD #7:npm 发布 tianshu-mcp@0.1.1 + npx 拉起连通记录 | |
DoD #8:真实天枢会话实测(技能加载 + 工具面 + 全闭环) | |
S7 二次整改真实会话复测记录 | |
教天枢编排本 MCP 的技能(含使用示例) |
英文文档见 README.en.md 与 ARCHITECTURE.en.md;完整文档地图与状态快照见 HANDOFF.md。
里程碑状态
M1 — 核心引擎 + stub-agent 全链路 ✅
8 工具、TaskManager 状态机/队列/并发闸/cancel(kill tree)/事件流落盘
验收引擎(git 基线/diff、默认集推导、命令 runner、代码分析、report.md/json)
fix-loop 自动返修 + needs_attention;技能自检安装(已在本机真实
~/.rivet/skills验证)stub-agent 三剧本(good/fix-on-first/never)集成测试 + 协议测试
M2 — 真实 Codex CLI 冒烟 + rework 闭环 ✅(2026-09-07)
真实
codex exec跑通run_task → query_task → verify_task(m2-smoke-record.md)真实 失败→rework_task→再验收 succeeded 闭环(m2-rework-record.md,物证
docs/m2-evidence/)修复冒烟暴露的 3 个真实缺陷(Windows npm 垫片 / spawn 日志竞态崩溃 / codex flags 互斥)并各加回归测试
Zcode 无头接口(Z1)实测定论:ZCode 桌面无随包 headless CLI → unsupported
R1–R8 / S1–S6 — 两轮验收整改 ✅(取消/超时/基线归因/参数语义/热加载/CI 加固)— 72 测试
工程 / CI ✅
GitHub Actions:
CI(build-testubuntu/windows/macos × Node 20/22/24 +pack-check,另加visual-browser真实浏览器矩阵 ubuntu/windows/macos-15-intel/macos-15 × Node 20/22/24,随 v0.5.1 tag 全绿)与Release(tag 触发)均绿技能自检安装已在本机真实
~/.rivet/skills/tianshu-mcp验证生效且幂等npm 包名
tianshu-mcp自 v0.1.1 起持续发布(当前0.5.4)
天枢宿主真实接入(DoD #6) ✅(2026-09-07,host-integration-record.md)
在真实
D:\Tianshu桌面宿主mcp.servers配置本地模式 → sidecarMCP: 2 servers connected, 10 tools(含本 server 8 工具),spawn 子进程并 stdio 连通实测暴露并修复技能安装源路径 bug(fileURLToPath,提交 55cf2d0)
M3 — TraeWork 调研 + 全套交付 ✅(2026-09-07,npm 已发布)
T1 定论:本机 TRAE SOLO CN v1.107.1 实测 无无头可编程 agent 接口(仅 VS Code 家族 CLI;见 adapter-matrix.md)
npm 已发布:
tianshu-mcp@0.1.1起(npx -y tianshu-mcp拉起 8 工具连通,见 dod7-release-record.md)
M4 — TraeWork GUI 驱动接入(CDP) ✅(2026-09-08,见 traework-cdp.md)— 153 测试
结论更正:无头 CLI 确实不存在,但
--remote-debugging-port可驱动聊天 UI;traework改为driver=gui/status=ready能力:启动/复用实例 → 新建会话 → 绑定项目文件夹(下拉命中优先,未命中走受限 computer-use 原生对话框)→ 可选指定模型 → 任务书回读校验后发送 → 轮询到完成 → 自动验收 → 失败生成修复计划并同会话返修
安全:默认复用用户实例、绝不按进程树强杀、终止前核对命令行;computer-use 仅允许 TraeWork 文件夹对话框
真机验证:
run_task(agentId=traework, model=GLM-5.3, autoVerify=true)驱动 TraeWork 创建文件并验收通过
M5 — 模式切换 + v0.1.5 发布 ✅(2026-09-08,见 release-v0.1.5.md)— 167 测试
run_task新增mode(Work/Code/Design),显式参数 + 任务书文本兜底;三种模式真机端到端验证通过实测关键点:三种模式各自维护独立项目绑定 → 顺序改为「新建会话 → 切模式 → 在目标模式绑定项目」
README 重写(中英双语 + 技术栈勋章 + 专属 SVG 图标/横幅)
M6 — 项目文件夹绑定修复 + v0.1.6 ✅(2026-09-08,见 release-v0.1.6.md)— 172 测试
修复三处叠加缺陷:footer 点击未确认弹窗、检测被 PowerShell 冷启动吃光预算、CJK 路径被控制台代码页破坏
新增非 Work 模式绑定回落 Work 重试;真机验证「不在下拉的新项目 + mode=Code」全链路通过
M7 — 绑定根因修复 + v0.1.7 ✅(2026-09-08,见 release-v0.1.7.md)— 178 测试
真根因:MCP 传规范化路径(
d:/a/b)被 Windows 原生选择器拒绝 → 改用toNativeWindowsPath()(D:\a\b)配套:写入后
WM_GETTEXT回读校验、hwnd 贯穿传递、遗留对话框清理
M8 — 原子写并发缺陷修复 + v0.1.8 ✅(2026-09-08,见 release-v0.1.8.md)— 181 测试
writeJsonAtomic/writeTextAtomic临时文件名并发共用 → 随机后缀 + rename 退避重试(CI windows/Node20 偶发失败真根因)
M9 — TraeWork 任务进行中检测 + v0.1.9 ✅(2026-09-09,见 release-v0.1.9.md)— 196 测试
停止按钮 / loading task tail 成为权威运行信号,优先于完成标志;稳定轮数只启动空闲计时(默认 10 分钟)才返回
idleCDP 断线收敛全部 pending + 单次命令 15s 超时;异常结束(idle/timeout/aborted/cdp_lost)保留实例并写
agentEndReason/keptInstance
M10 — stdio 日志污染修复 + v0.1.10 ✅(2026-09-10,见 release-v0.1.10.md)— issue #1
统一 Logger 所有级别改走 stderr,stdout 只承载 MCP JSON-RPC 消息
新增严格 stdio 冒烟(真实进程字节流校验,6 场景)、Node 24 CI 覆盖与安装包协议门禁
M11 — ZCode GUI 统一闭环 + v0.2.0(2026-09-11,见 release-v0.2.0.md)— 262 测试
Windows 真机通过开发、受控失败后同会话返修、
AskUserQuestion → continue_task三个场景;验收记录macOS 真机未补齐,内置 profile 依计划保持
research
M12 — Codex 桌面端 GUI 适配 + v0.3.0(2026-09-12,见 release-v0.3.0.md)— 340 测试
破坏性:
agentId=codex由codex exec无头改为桌面端 GUI 驱动(COM 激活 + CDP)真机通过:已登记项目全链路、未登记项目自动登记全链路、验收失败→自动生成计划→返修通过闭环
真实业务验收:驱动 Codex 开发「切水果小游戏」并通过验收,无头浏览器实测可玩;验收记录
macOS 未验证,内置状态
research
M13 — 技能文档对齐 + 发布自动化修复 + v0.3.1(2026-09-12,见 release-v0.3.1.md)
技能自检安装文档(SKILL.md / usage-examples.md)对照 v0.3.0 工具面逐项重写(codex GUI 参数、needs_user 处理、verify/list 用法)
Release 正文双语合成、Full Changelog 与 CI 链接修复、Gitee 发行版纳入自动化
M14 — Codex 等待用户检测 + 取消真停 GUI + v0.3.2(2026-09-12,修复 issue #5 / #6,见 release-v0.3.2.md)
issue #5:Codex 停在「等待用户确认」界面不再死锁在
running——停止按钮可见且对话哈希gui.stallTimeoutMs(默认 5 分钟)不变 → 转needs_user(user_confirmation);新增可配置gui.selectors.userGate界面检测;continue_task扩展支持 codex(user_confirmation重新观察 /login_required重派)issue #6:
cancel_task对 GUI agent 经 CDP 尽力点击停止并在gui.cancelWaitMs(默认 15s)内有界等待 GUI 空闲后才落cancelled;派发前检测受管实例运行态,仍运行则以instance_busy拒绝,杜绝新旧 turn 交叠
M15 — ZCode 3.11.2 适配 + 验收引擎 fail-closed + v0.3.3(2026-09-12,修复 issue #4 / #7,见 release-v0.3.3.md)— 366 测试
issue #4:模型菜单同时兼容
group-provider与 3.11.2group-family分组,直选平铺模型优先、分组展开兜底;项目绑定改以 composer 复选项为主判据,回读校验触发器文本 + 完整路径,失败最多两轮幂等重试;添加项目前先收起残留菜单并重试issue #7:测试检查退出码 0 但输出零用例时改判失败;git 项目默认要求相对基线产生变更(
requireChanges: false可显式关闭),零用例与零变更不再假绿{PROGRAMFILES}占位符统一大写且环境变量展开大小写不敏感
M16 — ZCode 项目/模型回读加固 + 初始化共同截止时间恢复 + 无锚点会话发送确认 + v0.3.4(2026-09-13,修复 issue #8 / #9 / #10,见 release-v0.3.4.md)— 407 测试
issue #8 / #10:项目触发器按「用户覆盖 → 主选择器 → 精确备用」逐级定位,本级歧义即停;绑定以完整规范化路径为唯一依据;添加项目前先收起残留菜单,原生操作超时后先复检副作用,不盲目重放整段导入
issue #9:无锚点的环境恢复补发完整原任务 / 上下文 / 已验证引用,环境确认文本不发给模型;发送确认与会话识别共用一次有界观察窗口(默认 60s),优先任务标记、其次唯一新会话差集,无法定位则保留
session_lost/send_unknown现场且不自动重发模型回读解码稳定属性、排除隐藏 / 透明 / 裁剪旧值;初始化引入共同截止时间预算(总计 120s、探测 30s、操作 60s、重试 2 次);macOS 探测失败 fail-closed,不再伪装成「没有既有面板」
M17 — macOS 双驱动打通 + projectPath 安全闸门 + 工程性能 + v0.4.0(2026-09-13,来自 PR #11)— 443 测试
macOS 打通:
codex(spawn .app + CDP)与zcode(进程标题改写适配 + macOS 窗口面板驱动)GUI 基本闭环均真机验证通过(发现 → 绑定 → 发送 → 运行证据 → 验收 PASS →succeeded);取消/返修/continue_task/新建项目矩阵补齐前 macOS 保持researchcodex-cli 无头路径:macOS 经
driver=spawn用户 profile 走codex exec(⚠️ ≤0.130.0 签名证书已被吊销,需 ≥0.154.0)——见「macOS 无头路径:codex-cli」projectPath 安全闸门:realpath 归一 + 主目录/系统根目录拒绝 + 脏仓共处警示——见「路径安全闸门」
修复:
get_profiles漏列用户自定义 profile;zcode macOSneedsPermission误报;normalizeProjectPath符号链接歧义;CDP 轮询在 renderer 替换/瞬时无响应时重连工程:
execFileSync/spawnSync全量异步化(消除 Windows 轮询期事件循环冻结);验收命令有界并行(verifyConcurrency);测试套件 267s → 51s
M18 — 技能文档对齐 v0.4.0 工具面 + 贡献者名录 + v0.4.1(2026-09-13)— 443 测试
skills/tianshu-mcp/逐项补齐 v0.3.3 → v0.4.0 的工具面变化:projectPath 安全闸门、硬失败错误码速查表、setup_recovery等待类型、codex-cli 无头路径、ready/research状态语义、验收默认并行 2 与requireChanges门禁;usage-examples 新增错误码表、meta 字段全表、项目级验收配置模板与codex-cli示例双语 README 新增贡献者名录(头像 + 名字,按首次参与顺序)
本版本无代码行为变更,升级无需迁移
M19 — 可选视觉验收模块 + v0.5.0(2026-09-14)— 486 测试
页面截图对比:三种互斥页面来源(已有服务/命令启动/临时静态托管)、三种截图模式、声明式交互步骤、稳定化采样与显式屏蔽、pixelmatch 抗锯齿排除与连通区域标注;尺寸不一致直接失败
静态图片规格:编码格式/扩展名一致性、完整解码、EXIF 方向归一宽高、宽高比/字节数/DPI/真实透明像素;不支持格式明确报告
基准两阶段与冻结:候选准备 → 用户批准写入;缺基准不得判通过;自动返修禁止批准;任务动工前冻结配置与基准摘要并每轮核对
MCP/CLI:新增
prepare_visual_baseline/approve_visual_baseline与tianshu-mcp visual子命令族;CLI 在 stdio 连接前分流报告与恢复:
VerifyReport新增可选visual与离线 HTML(状态过滤、透明叠加、区域定位);视觉阻塞进needs_attention,rework_task先重新验收、仅真实缺陷才消耗返修预算门禁:CI 新增真实浏览器四系统三 Node 矩阵与生产包独立消费者验收;release 要求目标提交存在成功 CI,缺少 Gitee 凭据时阻塞不冒充成功
M20 — 技能/验证文档对齐 + 平台证据归档 + v0.5.1(2026-09-14)— 486 测试
技能文档逐项对齐代码实况:11 工具表(补能力/审批列)、视觉验收独立成节、错误码补
setup_recovery、修正 agent 状态语义与get_task_report/repair-plan的文档偏差归档视觉验收平台证据:Windows 10 本机完整功能矩阵 9/9(
npm run evidence:visual:windows)、macOS 15 真机 Intel x64 与 Apple Silicon arm64 各 10 文件 51 用例修复
package-lock.json根包版本滞后(v0.5.0 时为0.4.1)本版本无运行时行为变更,升级无需迁移
M21 — ZCode 无项目派发(issue #12)+ v0.5.2(2026-09-14)— 525 测试
run_task.projectPath变可选:省略时 ZCode 在default(无项目)工作区承接任务,不登记/导入项目、不采集 Git 基线、不冻结项目快照、不进入项目锁与项目验收;终态以not_applicable: no_project结构化标注(详见 v0.5.2 发布说明)新增 ZCode 专用可选参数
allowCreateProject:false时目标目录未登记即在任何导入副作用之前停止派发,返回project_not_registered统一 ZCode 项目触发器就绪判据(未挂载 / 不可见或被裁剪 / 不唯一 / 禁用 / 被遮挡 / 就绪六态),新增
gui.projectTriggerTimeoutMs(默认 15s),修正错误信息失实真机发现并修复两个缺陷:
projectPath未在 MCP schema 层放开、缺少「不在项目中工作」切换;补齐 Windows 10 真机验收证据
M22 — ZCode 真机回访修复(issue #12 第二轮)+ v0.5.3(2026-09-15)— 532 测试
修复 Windows 上 ZCode / Codex 桌面实例跨 server 退出驻留失效:三处 GUI 实例统一走
guiInstanceSpawnOptions()(无条件detached+unref),此前 Windows 分支导致 MCP server 一退出 GUI 就被连坐杀掉修复顶部「新建任务」点击返回成功却不切页、随后静默空等 30 秒:改以「项目触发器已挂载」验证草稿真的建立,失败回退侧栏
task-new-button,两者都失败才setup_failedfail-closed修复窗口被遮挡时发送失败归因误导:识别 Chromium 节流(
visibilityState=hidden)并报「窗口不在前台」及置于前台的操作指引本版本为 PATCH,既有调用方签名与报告格式保持向后兼容(详见 v0.5.3 发布说明)
M23 — 视觉验收第二阶段「AI 视觉内容校验」(issue #13)+ v0.5.4(2026-09-16)— 644 测试
内容校验维度:
visual.contents[](图片内容规则)与pages[].content(页面语义校验)与既有像素/规格检查平行,作为kind:"content"独立结果项进入统一报告与离线 HTML;pages[].pixel:false的语义-only 页面豁免基准要求凭证零管理:MCP 不读取/存储/转发任何密钥、不实现模型客户端;判定完全委托用户自备命令(占位符模板 + stdout 末行 JSON),期望文本经临时文件传递以规避转义与审计日志
防抖与门禁:采样多数票 + 任务目录级输入哈希缓存(键含命令二进制身份,升级自备 CLI 即失效);新增
uncertain状态,票不集中或低于minConfidence时既不致败也不触发返修;内容项默认仅告警,逐规则blocking:true才升级为致败fail-closed:启用后命令不可解析/env 引用缺失 → 整轮
configurationError且不产出结果行;单项命令失败仅产生 blocked 告警项,并在整轮消息与返修计划的「仅告警项(不必修复)」小节可见缺陷修复:返修计划不再把
optional:true的失败列为「必须修复」CLI/诊断:新增
visual content probe <project> [ruleId]与visual content cache clear <taskId>;visual doctor新增内容命令解析与预算对比两项 finding
Agent 适配现状
agentId | driver / adapter | status | 说明 |
|
| ready(macOS 为 | Codex 桌面端 GUI(Windows:MSIX COM 激活 + CDP;macOS:spawn .app + CDP);支持 |
|
| research | CDP GUI adapter 已实现且 Windows 真机闭环通过;已适配 ZCode 3.11.2 模型菜单与项目绑定(v0.3.3),并加固项目/模型回读与初始化恢复(v0.3.4);支持无项目派发与 |
|
| ready | CDP 驱动 TRAE SOLO CN 桌面 UI;三种面板模式真机验证通过 |
|
| 仅测试 |
|
新增 agent 通常只需加一个 profile,详见 docs/agent-profiles.md 与 CONTRIBUTING.md。
macOS 无头路径:codex-cli(用户 profile)
内置 codex 走桌面端 GUI 驱动;macOS 通道已打通(spawn .app + CDP,基本闭环已真机验证,见「Agent 适配现状」),取消/返修矩阵补齐前保持 research。若不想依赖 GUI 自动化,codex CLI 无头模式在 macOS 全程可用——无需改 server 代码,在数据目录加一个 driver=spawn 的用户 profile 即可(即 v0.3.0 前内置 codex 的 M2 定稿参数)。
前置条件:
codex CLI(
npm i -g @openai/codex)。⚠️ 请保持最新:≤0.130.0 的签名证书已被吊销,macOS Gatekeeper 在执行时直接 SIGKILL(Killed: 9);≥0.154.0 实测正常。已
codex login(复用~/.codex登录态)。
~/.tianshu-mcp/agent-profiles.json:
{
"profiles": {
"codex-cli": {
"displayName": "Codex CLI (OpenAI 无头)",
"type": "cli",
"driver": "spawn",
"status": "ready",
"command": null,
"argsTemplate": ["exec", "<prompt:arg>", "--skip-git-repo-check", "--sandbox", "workspace-write"],
"promptMode": "arg",
"cwd": "task",
"env": {},
"timeoutMs": 1800000,
"killTree": "taskkill",
"authNote": "复用 ~/.codex 登录态;勿与 --approve-for-me 同用(实测互斥)",
"executableDiscovery": {
"dirs": ["/opt/homebrew/bin", "/usr/local/bin"],
"fileNames": ["codex"],
"fallbackCommand": "codex"
}
}
}
}用法与内置 agent 一致:
run_task(projectPath=/path/to/项目, agentId=codex-cli, task="任务书", autoVerify=true, autoFixRounds=2)行为与限制:
get_profiles会列出codex-cli并探测 PATH 上的codex可执行(v0.4.0 起;此前用户自定义 profile 可用但不显示)。model参数对 spawn agent 不生效——CLI 使用~/.codex/config.toml的默认模型;要锁模型可在argsTemplate追加"-m", "<模型名>"。写入被
workspace-write沙箱限制在项目目录内;POSIX 下取消/超时自动对进程组 SIGTERM→SIGKILL(killTree值在非 Windows 平台被忽略)。已实测:2026-09-13 macOS arm64 真机闭环(
run_task→codex exec→ 自动验收 PASS →succeeded)。
推荐用法(给天枢的提示语)
"在项目 D:\xxx 用 codex 实现『任务』。先跑 run_task(autoVerify:true, autoFixRounds:2),完成后用 query_task 看结果;若报告显示 needs_attention,把 get_task_report 的失败项摘要作为 feedback 调 rework_task 再验一轮;全部通过后向我汇报 changedFiles 与 diffstat。"
"在项目 D:\xxx 用 traework、mode=Code 实现『任务』;它会先切到 Code 模式再绑定项目,然后发任务、自动验收,失败自动生成修复计划并返修。"
开源协作
文档 | 内容 |
项目交接文档:当前状态快照、架构导览、硬性红线、已知限制、接手建议 | |
版本变更日志(v0.1.0 → v0.5.4) | |
开发环境、工程规范、提交与发布流程、如何新增 agent | |
安全模型(凭证零管理/命令白名单/进程与桌面自动化边界)与私密报告渠道 | |
贡献者行为准则 | |
Apache License 2.0(详细说明见下节) |
主仓库:https://github.com/lanlan0811/tianshu-mcp(GitHub)
镜像仓库:https://gitee.com/lan0811/tianshu-mcp(Gitee)
问题反馈:Bug / 功能请求走仓库 Issue 模板;安全漏洞请按 SECURITY.md 私密报告,不要开公开 Issue。
贡献者
感谢以下通过 Issue 与 PR 为本项目做出贡献的社区成员(按首次参与顺序排列):
英文版对应文档见 README.en.md。
许可
本项目以 Apache License 2.0 发布,完整法律文本见 LICENSE。版权归 tianshu-mcp 贡献者所有(Copyright 2026 tianshu-mcp contributors)。
授予你的权利
商业使用:可在商业产品与服务中使用;
修改:可自由修改源码;
分发:可再分发原始或修改后的版本;
私用:可在组织内部私有使用;
专利使用:贡献者授予你实施其贡献所涉专利的许可(受下述终止条款约束)。
你必须履行的义务
保留声明:分发时须随附 LICENSE 全文,并保留其中的版权、许可与免责声明;
标注修改:若修改了文件,须在修改的文件中附带显著的「已修改」声明;
保留 NOTICE:若原作品含 NOTICE 文件,分发时须保留其内容(本项目当前无 NOTICE 文件);
不得附加限制:不得对本许可授予的权利附加额外限制。
明确不授予 / 授权终止
商标:本许可不授予任何商标、商号或服务标记的使用权;
专利终止:若你对本项目或其贡献者发起专利诉讼(包括交叉诉讼与反诉),本许可授予你的专利授权自动终止。
免责声明
软件按 「现状」 提供,不附带任何明示或暗示的担保,包括但不限于适销性、特定用途适用性和非侵权担保。在任何情况下,作者或版权持有人均不对因软件、软件的使用或其他交易而产生的任何索赔、损害或其他责任负责(无论是在合同诉讼、侵权诉讼还是其他诉讼中)。
第三方依赖许可
运行时依赖均为 MIT 许可,与 Apache-2.0 兼容:
依赖 | 许可 | 用途 |
MIT | MCP 协议实现 | |
MIT | 外部输入校验 | |
MIT | 跨平台子进程 |
开发依赖(TypeScript、ESLint、Prettier、Vitest、Vite、tsx 等)各自遵循其开源许可,且不随 npm 发布产物分发。
与安全边界的关系
本 MCP 不保存、不读取、不转发任何 AI-Agent 的 API key 或登录态(详见 SECURITY.md)。许可条款不改变这一设计边界。
Available Tools
11 toolsapprove_visual_baselineapprove_visual_baselineADestructive
仅在用户明确审阅并授权后批准视觉基准。必须核对候选摘要与批准说明;自动返修禁止调用。宿主必须实施实际审批控制。
| Name | Required | Description | Default |
|---|---|---|---|
| taskId | No | ||
| candidateId | Yes | ||
| approvalNote | Yes | ||
| expectedDigest | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With destructiveHint=true and readOnlyHint=false, the safety profile is already known, and the description adds value by requiring verification of the candidate digest and approval note and by mandating real human approval control. It does not describe the destructive effect itself, but the annotations already flag it.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, each carrying a distinct constraint: human authorization, verification responsibility, and host-level control. Nothing is padded and the important restriction is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive approval action with no output schema, the description covers the critical safety and eligibility context. It omits the return value and exact effect of approval, but the name, annotations, and schema patterns cover enough for a cautious agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It only hints at two of four parameters ('candidate summary' and 'approval note') and leaves taskId and expectedDigest semantics implicit. An agent needs to infer parameter roles from names and schema patterns.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names the action and resource ('approve visual baseline') and adds a defining precondition: it may only run after explicit user review and authorization. It does not fully define what approving does to the baseline, but it is enough to distinguish the operation from read-only or preparation tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear when-to-use conditions ('after user explicitly reviewed and authorized') and an explicit exclusion ('automated rework must not call'). It names no specific sibling alternative, so it stops short of the top score, but an agent can decide when the tool is appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cancel_taskcancel_taskADestructive
取消运行中任务:CLI agent 终止进程树;GUI agent(codex 等)尽力点击界面停止按钮并等待 GUI 空闲(有界超时),未确认停止时结果中明示。排队中任务直接移除;终态任务无动作。
| Name | Required | Description | Default |
|---|---|---|---|
| reason | No | ||
| taskId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Adds substantial context beyond annotations: CLI agents kill the process tree while GUI agents best-effort click a stop button with a bounded timeout, and unconfirmed stops are surfaced in the result. This discloses mechanism, timeout bounds, and failure reporting for a destructive operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single dense sentence-cluster that front-loads mechanism (CLI/GUI) then state handling. Every clause carries information, though the GUI branch could be tightened slightly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description usefully notes that unconfirmed stops are reported in the result. It covers destructive behavior and edge states well, but leaves the optional reason parameter unaddressed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must carry parameter meaning, but it mentions neither taskId nor reason. The purpose implies taskId identifies the target, yet the optional 'reason' parameter is entirely undocumented in both schema and description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (取消/cancel) and resource (任务/task), and goes further by defining behavior per task state (running, queued, terminal). An agent can immediately distinguish this from siblings like continue_task or rework_task.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The state-based breakdown (running vs queued vs terminal) implies when the tool is appropriate, and 'no action for terminal tasks' warns of a no-op. However, it never explicitly names an alternative tool or states conditions for choosing cancel over verify_task/rework_task.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
continue_taskcontinue_taskA
恢复处于 needs_user 的任务。zcode:agent_question 时 message 发往原会话,关闭旧实例/登录/系统权限场景中 message 仅作已处理确认。codex:user_confirmation 时重新接入观察 GUI 内运行(不发送消息);login_required 时复检环境后重发任务书。
| Name | Required | Description | Default |
|---|---|---|---|
| taskId | Yes | ||
| message | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only give the safety profile (non-read-only, non-destructive, closed-world); the description goes further and discloses that message is routed to the original session in one case, is merely an acknowledgment in others, and is not sent at all under codex user_confirmation. That is genuinely useful behavioral context beyond the annotations, though it omits side effects like state transitions after resume.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core purpose, then colon-delimited branches keyed to source (zcode/codex) and state. Dense but essentially waste-free; only the framework-specific jargon adds reading cost.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema and no parameter documentation exist, so the description bears the burden and largely meets it by enumerating the branch behaviors an agent must anticipate. It still leaves return values and failure handling unstated, which for a mutation tool is a modest gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must carry parameter meaning, and it does for `message`: it is sent to the original session, downgraded to an ack, or not transmitted depending on source/state. `taskId` is never explicitly defined, but it is trivially inferable as the needs_user task identifier.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource plus the gating state: '恢复处于 needs_user 的任务' (resume a task in needs_user state). That condition implicitly separates it from run_task/rework_task/verify_task, but no sibling is named outright, so it stops short of full differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The 'needs_user' precondition is an implicit when-to-use rule, and the zcode/codex branches explain what happens per source state (agent_question, user_confirmation, login_required). However, it never names an alternative tool or states when NOT to use continue_task (e.g. for a task in another state, use run_task/rework_task instead).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_profilesget_profilesARead-only
查看当前 agent 适配与可执行探测结果(含未安装/调研占位提示)。
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark the tool as read-only and non-destructive, and the description is consistent with that. It adds useful behavioral context by disclosing that the output includes uninstalled/research placeholder hints and reflects the current state.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, front-loaded with the verb, and includes parenthetical detail about placeholder hints without padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a no-parameter, read-only inspection tool with annotations covering safety, the description is nearly complete. It does not specify return format, but no output schema exists and the output content is summarized sufficiently for invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters and an empty schema, so there is no parameter semantics burden on the description. Per the baseline for 0-param tools, the description need not add parameter detail.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the verb '查看' and names a specific resource: current agent adaptation and executable detection results, including placeholder hints for uninstalled/research items. It is clearly distinct from the task-oriented sibling tools, though it does not explicitly name an alternative.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit 'use when' or 'instead of' statement. However, the description's focus on current agent profiles and the task-related sibling tool names make the intended usage reasonably inferable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_task_reportget_task_reportBRead-only
取某轮验收报告全文(report.md)。round 缺省取最新一轮。
| Name | Required | Description | Default |
|---|---|---|---|
| round | No | ||
| taskId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, so the description is not required to state safety. It adds the behavior of defaulting to the latest round when round is omitted, which is useful. However, it does not disclose anything about error conditions or what happens if no report exists for a round, but given the read-only nature and simplicity, a 3 is appropriate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, focused sentence that conveys the core action and the one non-obvious parameter behavior. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only retrieval with annotations covering safety, the description covers the essential behavior (what it returns, round default). It does not describe the output format, but since there is no output schema, that would be nice, but the phrase 'full text (report.md)' gives a strong hint. Minor gaps remain, so a 4 is fair.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must compensate. It explains the round parameter's default behavior, which is valuable. taskId is not described, but its meaning is implied by the tool name and schema (string). It does not add syntax or format details, so a 3 reflects partial compensation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States the verb 'get' and the resource 'acceptance report' (report.md), and clarifies it's for a specific round. It does not explicitly differentiate from siblings like query_task or list_tasks, which could also return task-related data, so it loses a point for not naming an alternative.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus siblings. The description only mentions the round default behavior but does not state prerequisites, exclusions, or alternatives. An agent cannot infer when to prefer this over query_task or list_tasks.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_taskslist_tasksARead-only
列出历史任务(可按项目路径 / 状态过滤,limit 默认 50)。
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| status | No | ||
| projectPath | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the read-only safety profile is covered. The description adds the historical scope and filter support, but does not disclose pagination behavior or whether the results are limited to certain statuses beyond the stated filters.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single compact sentence that front-loads the verb and resource before optional filtering details. Every element earns its place and there is no redundant repetition of the tool name or title.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only list operation with no required parameters and no output schema, the description covers purpose, filters, and default limit. It does not describe the exact return shape, but the tool name and 'list tasks' phrasing make the core behavior sufficiently clear.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the description names all three parameters and their roles: projectPath and status are filters, and limit defaults to 50. This adds meaningful semantics beyond the bare schema, though it does not enumerate valid status values or projectPath formatting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb (列出/list) and resource (历史任务/historical tasks), and states the filter dimensions. This clearly distinguishes it from siblings like run_task, cancel_task, query_task, and get_task_report.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool by framing it as a way to list historical tasks with optional filters. However, it does not explicitly state when to prefer this over query_task or get_task_report, leaving some selection to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
prepare_visual_baselineprepare_visual_baselineB
准备视觉基准候选,返回摘要与预览;不采用正式基准。需要用户授权。
| Name | Required | Description | Default |
|---|---|---|---|
| caseIds | No | ||
| imports | No | ||
| projectPath | Yes | ||
| viewportIds | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare mutability and non-destructiveness, but the description adds that user authorization is required and that it returns a summary and preview. However, it does not disclose any side effects beyond not adopting the baseline, such as whether it reads or writes files, or affects task state. So it provides some context but not deep behavioral detail.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is brief and to the point. The key information (purpose, non-adoption, auth requirement) is front-loaded. It does not include fluff. However, it could be slightly more structured to list parameters, but overall it is concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 4 parameters and no parameter descriptions, the description is incomplete. It does not explain what each parameter is for, how they interact, or expectations (e.g., if projectPath is required, how to specify imports). The absence of output schema also means the description should clarify return structure, which it only vaguely does with 'summary and preview'.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. The description does not explain any parameter semantics (e.g., what caseIds, imports, viewportIds mean). It only mentions 'prepare', which gives no parameter-level insight. This is a significant gap given the lack of schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('prepare') and resource ('visual baseline'), and clarifies it is a candidate, not a formal baseline. It distinguishes itself from sibling 'approve_visual_baseline' by indicating it is not adopting the baseline. However, it doesn't explicitly contrast with other siblings like 'get_task_report'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implicitly conveys the purpose through 'candidate', but it does not provide explicit when-to-use guidance or mention alternatives. It lacks exclusions, e.g., when to use 'approve_visual_baseline' instead. The user authorization requirement is mentioned, which is a usage prerequisite.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
query_taskquery_taskARead-only
查询任务状态 / 进度 / 最近日志尾部(默认 agent.log 末 40 行)。返回任务 meta 与日志片段。
| Name | Required | Description | Default |
|---|---|---|---|
| taskId | Yes | ||
| tailLines | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, and the description adds useful behavioral context: the default 40-line tail of agent.log and the returned data shape (task meta + log snippet). This goes beyond the annotations without contradicting them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences, front-loaded with the primary purpose and followed by the return format. Every clause adds information and there is no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only tool with one required parameter and no output schema, the description supplies purpose, return contents, and a behavioral default. It is sufficient for an agent to call it correctly, though it does not mention error behavior or handling of very large tailLines.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description carries the burden for explaining parameters. It implicitly clarifies tailLines via '默认 agent.log 末 40 行' and makes taskId's role obvious through '查询任务状态'. It does not fully enumerate constraints, but provides enough meaning for correct use.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb '查询' (query) on the task resource and clearly enumerates what it provides: status, progress, recent log tail, task meta, and log snippet. It is specific and understandable, though it does not explicitly differentiate from siblings like get_task_report or list_tasks.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit guidance about when to use this tool versus alternatives such as get_task_report or list_tasks. The read-only nature and log-tail focus imply a use case, but no exclusions or alternative routing are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
rework_taskrework_taskADestructive
手动返修:把终态任务(failed/needs_attention)重新入队续跑,同一 agent/项目与轮次记账。feedback 为追加指示(建议带上一次验收失败摘要)。
| Name | Required | Description | Default |
|---|---|---|---|
| taskId | Yes | ||
| feedback | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare destructiveHint=true and readOnlyHint=false. The description adds meaningful context: it re-enqueues and continues, affects accounting, and advises on feedback content (include last failure summary). No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single compact sentence that front-loads the action and condition, then addresses the feedback parameter. No filler, every phrase earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Complete for a mutation tool without output schema. Covers what it does, when to use, and parameter guidance. Does not mention return value or side effects like task state changes, but that is not critical for a rework operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 0% description coverage, so the description must compensate. It explains feedback as additional instructions with a suggestion, but taskId is left to the name and obviousness. Provides some added meaning but not full coverage for both parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb 'rework' (re-enqueue) on a task resource, with an explicit condition: terminal states (failed/needs_attention). It also mentions same agent/project and round accounting, which differentiates it from generic run_task. No ambiguity or tautology.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Clearly implies when to use: when a task is in failed/needs_attention terminal state and needs to continue. Does not explicitly name alternatives or exclusions, but the state condition is a strong usage signal that distinguishes it from running new tasks or querying.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
run_taskrun_taskB
派活:启动外部 AI-Agent 开发任务并可自动验收返修,异步返回 taskId。ZCode 要求 model=供应商/模型,不支持 mode;TraeWork 的 model 可选并支持 Work/Code/Design mode。task/context 内的 ZCode 项目路径引用会在发送前校验。
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | ||
| task | Yes | ||
| model | No | ||
| agentId | No | ||
| context | No | ||
| planDoc | No | ||
| autoVerify | No | ||
| projectPath | No | ||
| designSystem | No | ||
| autoFixRounds | No | ||
| taskTimeoutMs | No | ||
| reasoningLevel | No | ||
| allowCreateProject | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false, openWorldHint=true, and destructiveHint=false, indicating a mutating operation with side effects. The description adds context that the task runs externally, returns asynchronously, includes auto-acceptance/rework, and validates ZCode project path references before sending. This adds meaningful behavioral context beyond annotations, though it does not disclose failure modes or resource consumption.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact, with the core purpose front-loaded in the first clause ('启动外部 AI-Agent 开发任务并可自动验收返修,异步返回 taskId'), followed by provider-specific details and a validation note. The structure is efficient with no redundancy, though it could be broken into clearer sentences for readability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 13 parameters and no output schema, the description is incomplete. It does not explain return value details beyond taskId, does not mention how to fetch results (e.g., via get_task_report), and leaves many parameter semantics unexplained. The provider-specific guidance helps but does not make the tool fully usable without additional documentation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It explains model and mode semantics for both providers (required vs optional, mode support), and mentions path validation for task/context. However, it leaves many parameters (autoVerify, autoFixRounds, taskTimeoutMs, reasoningLevel, allowCreateProject, planDoc, designSystem, agentId) undocumented, providing only partial compensation for the schema gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool launches external AI-Agent development tasks with auto-verification and rework, returning taskId asynchronously. The verb 'launch' plus resource 'external AI-Agent development task' makes the core action explicit. It does not explicitly differentiate from sibling tools like continue_task or rework_task, but the launch/dispatch nature is evident from the wording.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides provider-specific guidance (ZCode vs TraeWork) for parameter values but does not explain when to use this tool versus alternatives such as continue_task or rework_task. There is no mention of prerequisites or conditions that would select this tool over a sibling, leaving tool-selection guidance entirely implicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
verify_taskverify_taskBRead-only
对已完成任务或项目路径执行一次验收(不改源码):自动命令检查 + 代码分析(相对 git 基线)。可用 extraChecks 临时加验。需任务/项目二选一。
| Name | Required | Description | Default |
|---|---|---|---|
| taskId | No | ||
| checksMode | No | ||
| baselineRef | No | ||
| extraChecks | No | ||
| projectPath | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false. The description adds '不改源码' (does not modify source code), reinforcing the read-only nature, and explains the check process (automatic commands + code analysis) and the ability to add extraChecks. This adds behavioral context beyond annotations without contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and front-loaded with the core purpose. It uses two sentences plus a requirement note, with no redundant phrasing. The key scoping (not modifying source) is placed early, and the parameter requirement is stated clearly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 5 parameters, no output schema, and no explicit sibling differentiation, the description is incomplete. It does not clarify the behavior of checksMode, the role of baselineRef, expected output format, or potential side effects beyond read-only. It leaves critical details for the agent to infer, which is risky for a verification tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description carries the burden for explaining parameters. It explains taskId/projectPath (must choose one) and extraChecks (temporary additions), but omits checksMode (append/replace) and baselineRef (git baseline). These are significant gaps that could lead to incorrect usage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb (perform acceptance check), the resource (completed task or project path), and the method (command checks + code analysis relative to git baseline). It distinguishes itself from siblings like run_task (execution) and get_task_report (report retrieval) by its focus on verification, though it does not explicitly name alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives a usage context: for completed tasks or project paths, and requires a choice between taskId and projectPath. However, it does not explicitly state when to prefer this over siblings like get_task_report or rework_task, leaving some inference to the agent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
3 tool updates
v0.5.3- Added
approve_visual_baseline - Added
prepare_visual_baseline - Changed
run_task2 fields changed- added
Input schema / properties / allowCreateProjectAdded value: +{ + "type": "boolean" +} - changed
Input schema / requiredPrevious value: -[ - "projectPath", - "task" -]New value: +[ + "task" +]
2 tool updates
v0.3.1- Added
continue_task - Changed
run_task3 fields changed- added
Input schema / properties / designSystemAdded value: +{ + "minLength": 1, + "type": "string" +} - added
Input schema / properties / planDocAdded value: +{ + "minLength": 1, + "type": "string" +} - added
Input schema / properties / reasoningLevelAdded value: +{ + "enum": [ + "低", + "中", + "高", + "low", + "medium", + "high" + ], + "type": "string" +}
4 tool updates
v0.1.9- Changed
get_task_report2 fields changed- removed
Input schema / properties / round / exclusiveMinimumRemoved value: -0 - added
Input schema / properties / round / minimumAdded value: +0
- Changed
rework_task1 field changed- removed
Input schema / properties / roundRemoved value: -{ - "exclusiveMinimum": 0, - "type": "integer" -}
- Changed
run_task2 fields changed- added
Input schema / properties / modeAdded value: +{ + "enum": [ + "Work", + "Code", + "Design" + ], + "type": "string" +} - added
Input schema / properties / modelAdded value: +{ + "minLength": 1, + "type": "string" +}
- Changed
verify_task2 fields changed- added
Input schema / properties / baselineRef / minLengthAdded value: +1 - added
Input schema / properties / checksModeAdded value: +{ + "enum": [ + "append", + "replace" + ], + "type": "string" +}
8 tool updates
v0.1.0- First observed
cancel_task - First observed
get_profiles - First observed
get_task_report - First observed
list_tasks - First observed
query_task - First observed
rework_task - First observed
run_task - First observed
verify_task
TDQS
Scored across 11 tools
Most tools have clear boundaries: task lifecycle (run/cancel/continue/rework/query/list/verify) vs. visual baseline (prepare/approve) vs. report/profile. The only mild overlap is verify_task vs. get_task_report (both relate to acceptance), but verify runs a new check while get_task_report reads an existing report.
Tool names mostly follow a verb_noun pattern (get_task_report, prepare_visual_baseline, approve_visual_baseline, cancel_task, continue_task, list_tasks, query_task, rework_task, verify_task). Minor inconsistency: run_task is verb_noun but get_profiles is verb_noun too; all are snake_case and readable. The slight mix of 'task' vs 'tasks' (list_tasks plural vs others singular) is a small deviation.
11 tools is well within the ideal 3-15 range and each tool maps to a distinct operation in the task-management and visual-baseline workflow. The count feels appropriate for the server's purpose: task lifecycle management plus baseline approval.
The task lifecycle is well covered: create (run_task), query (query_task/list_tasks), cancel, continue, rework, verify, and report retrieval. Minor gaps: no explicit delete/archive task tool, and visual baseline has prepare/approve but no explicit reject or list-baselines tool, though these may be intentionally omitted.
Maintenance
Related MCP Connectors
AI-powered spec-to-task decomposition and execution orchestration for coding agents.
AI work orchestration for plans, tasks, teams, and coding-agent dispatch.
Project registry, behavioral specs, and engineering threads for AI coding agent workflows.
- projectsOAuthcloud.tri2b
Task tracking built for coding agents. Work is leased, so two agents never take the same SubTask.
Related MCP Servers
- AlicenseAqualityCmaintenanceA task-based AI orchestrator that bridges AI models (Gemini, Claude, OpenAI) with local environments, operating as an interactive CLI and an MCP server for structured autonomous development.25 npmMIT
- AlicenseAqualityDmaintenanceMulti-agent orchestration server that enables parallel task delegation, sequential pipelines, cron scheduling, and cross-model peer review via CLI providers like Codex, Antigravity, OpenCode, and Claude Code.4216 npm5MIT
- AlicenseNot gradedqualityDmaintenanceFacilitates autonomous AI agent collaboration on software projects through file-based task management and inter-agent communication via the Model Context Protocol.4 npmMIT
- AlicenseNot gradedqualityAmaintenanceCoordinates parallel AI coding agents by providing task ownership, scoped file locks, handoffs, and verification workflows.MIT