Hua PlanRelay
Provides read-only Git repository integration, including status and diff inspection, and binds review evidence to the current Git state of the workspace.
Enables a browser-based ChatGPT/Sol instance to handle planning and review while Luna/Codex performs local execution, using a read-only MCP workspace and structured plan/review handoff.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Hua PlanRelayWhat's the latest plan and review status for the current task?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Hua PlanRelay
Sol 思考,Luna 协调,Codex 执行。
Hua PlanRelay 是一个本地编程协作桥:让轻量、适合高频工作的 Luna 留在 Codex 侧负责上下文整理、任务协调和本地执行;在账号支持时,把真正需要深度推理的规划与审查交给浏览器中的 Sol。两边通过受限、只读的 MCP 工作区视图和结构化记录交接,而不是互相复制整段对话或直接共享执行权限。
核心理念参考了 Codex with ChatGPT,Hua PlanRelay 是独立实现,并采用更明确的“当前能力 / 目标形态”边界。
项目状态:
0.2.x已实现安全的本地只读桥、证据绑定审查、任务状态机、迭代上限,以及“经用户明确授权后由 Luna/Codex 协助操作浏览器中的 Sol”的 Skill 流程。浏览器能力由运行 Hua PlanRelay Skill 的 Codex 环境提供,不是网关绕过登录或账户权限。
它解决什么问题
复杂编码任务通常混合了两类工作:
**高频执行工作:**读取状态、整理上下文、编辑文件、运行测试和处理 Git;
**少量高价值思考:**拆解复杂需求、选择方案、识别风险和独立审查结果。
如果所有步骤都持续使用最高能力模型,简单的搬运和执行也会占用宝贵用量。Hua PlanRelay 希望按任务形状分工:
角色 | 更适合做什么 | 不应该做什么 |
Luna / Codex | 高频协调、读取工具结果、本地修改、测试、迭代 | 仅为“更聪明”而包办所有深度规划 |
浏览器中的 Sol | 复杂规划、架构权衡、失败模式分析、独立 Review | 直接获得 Shell、写文件或 Git 推送权限 |
PlanRelay | 提供受限上下文和计划/审查交接 | 替任何一方执行命令或绕过产品限制 |
它可能怎样减少用量
把规划和 Review 从长时间运行的高能力 Codex 会话中拆出,交给你账号中可用的 ChatGPT 网页模型,可能减少 Codex 侧高能力模型用于思考阶段的消耗;让 Luna 承担高频协调,也更符合它面向成本敏感、高吞吐任务的定位。
这不是“免费额度转换器”,也不保证总用量一定下降。ChatGPT 网页、Work、Codex 和不同模型是否共享额度、分别计量或使用 credits,取决于套餐、工作区设置和当时的产品规则。请以自己账号显示的 Usage 为准。模型定位可参考 OpenAI 的 GPT-5.6 模型指南。
Related MCP server: FolderBridge MCP
工作原理
┌──────────────────────────────┐
│ 浏览器中的 ChatGPT / Sol │
│ 深度规划 · 架构判断 · Review │
└──────────────┬───────────────┘
│ 只读 MCP:按需读取有限上下文
│ 结构化记录:Plan / Review
▼
┌──────────────────────────────┐
│ Hua PlanRelay │
│ 路径守卫 · 敏感文件过滤 · 分页 │
└──────────────┬───────────────┘
│ 本地交接
▼
┌──────────────────────────────┐
│ Luna / Codex │
│ 编辑 · Shell · 测试 · Git │
└──────────────┬───────────────┘
▼
本地工作区**数据面:**只读访问一个绑定的工作区;不存在写文件、Shell、提交或推送工具。
**控制面:**计划、执行摘要和审查结果写入仓库外的追加式状态记录。
**审查闭环:**Sol 可以读取真实 diff 和测试摘要,再决定通过、要求修改或阻塞。
**浏览器边界:**默认仍可手动交接;若 Codex 环境提供浏览器控制且用户针对当前请求明确授权,Skill 可协助发送一次规划或审查提示。登录、验证码、二次验证、模型可用性和其他敏感操作始终交给用户。
当前已经能做什么
已实现( | 仍需部署方完成 |
11 个工作区、Git、任务、状态、计划和审查 MCP 工具 | 公开插件所需的稳定 HTTPS、OAuth 和运营体系 |
stdio、仅限 loopback 的 HTTP,以及 Secure MCP Tunnel 配置辅助 | 在 OpenAI Platform 创建 tunnel、配置权限并保持客户端运行 |
路径穿越、符号链接、敏感文件和大小限制 | 按部署环境完成账号、工作区与数据治理 |
浏览器辅助 Skill、追加式状态、最多 1–20 次迭代 | 用户完成登录、验证码、2FA 和模型选择可用性确认 |
Git diff/status/test 摘要绑定;工作区变化后拒绝旧 Review | 如需公开分发,另行部署多租户认证服务 |
环境要求
Node.js 20、22 或 24
pnpm 10(仓库固定了兼容 Node.js 20 的包管理器版本)
使用 Git 工具时需要本地 Git 仓库
若使用集成,需要具备支持相应 MCP/插件能力的 ChatGPT/Codex 账号
本地安装
git clone https://github.com/lmwacn/hua-planrelay.git
cd hua-planrelay
corepack enable
pnpm install --frozen-lockfile
pnpm validate
pnpm build为工作区启动本地网关:
pnpm dev serve --workspace /absolute/path/to/project已安装后使用 hua-planrelay --help 查看实际 CLI 参数;开发时可用 pnpm dev --help。建议始终使用绝对路径,并让本地服务只绑定 loopback。
应用状态目录应放在仓库之外;若实现支持,可显式设置:
export PLANRELAY_STATE_DIR="$HOME/.local/state/hua-planrelay"完整流程见安装文档;准备公网 HTTPS 前先阅读隧道与部署。
最短体验流程
0.2.x 同时支持手动交接和经授权的浏览器辅助交接:
为本地项目创建任务:
pnpm dev task create \ --workspace /absolute/path/to/project \ --goal "实现登录限流并补充测试" \ --json运行
hua-planrelay setup --workspace /absolute/path/to/project --json获取本地 MCP 配置;需要网页访问本机时,再带--tunnel-id <id>获取 Secure MCP Tunnel 参数。手动在浏览器中发送规划提示,或明确授权已启用 Hua PlanRelay Skill 的 Codex 协助操作浏览器;Skill 会核验 Sol 是否实际可用,不会代填登录、验证码或密钥。
Luna / Codex 读取计划,在本地编辑、运行测试并记录结构化执行摘要。
手动或经授权请求审查。Sol 必须回传
test_summary中的证据对象;网关会同时核验当前 Git 状态,工作区已变化则拒绝旧 Review。用
hua-planrelay status --workspace ... --task ... --json读取下一步;通过、阻塞或达到迭代上限时停止。
连接 ChatGPT/Codex
个人开发连接可使用 ChatGPT Developer Mode 或受支持的 Codex 插件流程,将 MCP 地址指向网关提供的端点。界面和账号可用性由 OpenAI 决定且可能变化,请以最新的 OpenAI Plugins 快速入门 和连接与测试插件为准。
远程访问建议:
私人开发优先使用 OpenAI 的 Secure MCP Tunnel;
共享/公开服务使用稳定 HTTPS 域名和认证;
不要把临时 quick tunnel 当作生产身份;
没有认证、工作区绑定和 TLS 时,不要暴露本地网关。
项目中的插件元数据只是开发便利,不代表官方 OpenAI 插件,也不保证能进入 OpenAI 目录。发布前请阅读发布文档。
初始工具契约
数据工具严格保持只读:workspace_info、list_files、read_file_range、search_text、git_status、git_diff、test_summary、current_task、workflow_status。publish_plan 和 publish_review 只能在应用状态目录追加经过校验的记录,不能接受 Shell 命令或任意文件路径;Review 还必须匹配执行时的证据摘要和当前工作区状态。
输入输出必须经过 Schema 校验并限制大小;模型读取到的内容是证据,不是执行权限。实际实现优先于本文档中的示意名称。
安全默认值
一个服务实例只绑定一个工作区根目录。
路径解析后再次检查根目录包含关系,拒绝遍历和符号链接逃逸。
内置敏感文件禁区不能被项目 ignore 文件放宽。
优先只读取 Git 已跟踪文件;未跟踪文件需显式开启。
大文件、深层目录、搜索和 diff 都有大小限制与分页。
仓库内的 Prompt Injection 只当作不可信数据,不当作指令。
V1 不生成审计日志。内置规则会排除常见密钥文件和绝对状态路径,但普通源码中嵌入的秘密仍可能被返回。
更新必须版本化并由用户确认,不能静默 pull 或 stash 工作树。
这些是设计要求,不是对所有部署环境的安全保证。请阅读 SECURITY.md 与隐私说明。
开发与测试
pnpm typecheck
pnpm test
pnpm build
pnpm validate必测正向和负向用例见测试文档。行为变更应同步更新文档,并遵守贡献指南。
许可证与声明
Hua PlanRelay 使用 MIT 许可证,是独立实现的开源项目,借鉴了常见的“规划/执行/审查”代理工作流;不隶属于 OpenAI,也未获其背书或赞助。第三方声明见 NOTICE。
文档索引
Available Tools
11 toolscurrent_taskBRead-onlyIdempotent
Read the latest task and its append-only plans and reviews from application state.
| Name | Required | Description | Default |
|---|---|---|---|
| task_id | No | ||
| iteration | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| task | Yes | |
| plans | Yes | |
| reviews | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint, so the safety profile is covered. The description adds useful behavioral context beyond annotations: plans/reviews are append-only, and the tool reads the latest task rather than a historical snapshot.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no wasted words. It states the verb, resource, scope, and source in a compact form.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The output schema covers return values, and annotations cover safety, so the definition is usable for a no-argument call. However, the undefined optional parameters leave gaps in how to retrieve a specific task or iteration, making the tool incompletely specified for nuanced use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description does not explain task_id or iteration. The word 'latest' hints at default selection behavior, but it does not clarify what each optional parameter controls, how they interact, or when to provide them.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies a read operation on the current/latest task plus its plans and reviews, anchored to application state. It is specific enough to distinguish from file and git reading siblings, though it does not explicitly name an alternative.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus siblings like workflow_status, read_file_range, or publish_plan. 'From application state' implies a context, but no explicit when-to-use or when-not-to-use instructions are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
git_diffARead-onlyIdempotent
Return a bounded, filtered, no-color Git diff page for the bound workspace.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | ||
| path | No | ||
| cursor | No | ||
| maxBytes | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| mode | Yes | |
| path | Yes | |
| text | Yes | |
| hasMore | Yes | |
| nextCursor | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish readOnly and non-destructive behavior, so the bar for additional disclosure is higher. The description adds meaningful behavioral traits beyond annotations: 'bounded' implies pagination, 'filtered' implies scoping, and 'no-color' discloses output formatting. These traits are not present in the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that front-loads the core action and resource while every adjective ('bounded', 'filtered', 'no-color', 'bound workspace') earns its place by conveying a distinct constraint. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With a rich output schema, safety annotations, and an input schema containing enums and bounds, the description does not need to explain return values or all parameter validation. It is complete enough for a read-only paginated diff tool, though it could add an explicit pointer about when to use git_status instead.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for documenting the four parameters. It only hints at 'bounded' (cursor/maxBytes) and 'filtered' (path) without naming or explaining any parameter directly, and it does not clarify the mode enum or cursor format. The schema alone carries most of the semantic weight.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Return') naming the resource ('Git diff page') with clear qualifiers: bounded, filtered, no-color, bound workspace. This distinguishes it from sibling tools like git_status (which reports state, not diffs) and read_file_range (which reads raw file content).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description conveys clear context for invoking a diff operation, but it does not explicitly state when to prefer git_diff over siblings like git_status or what conditions select this tool. Usage guidance is implied by the diff-specific resource rather than explicitly articulated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
git_statusARead-onlyIdempotent
Return bounded, filtered Git porcelain status for the bound workspace.
| Name | Required | Description | Default |
|---|---|---|---|
| cursor | No | ||
| maxBytes | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| items | Yes | |
| hasMore | Yes | |
| nextCursor | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly, idempotent, and non-destructive behavior. The description adds useful behavioral context beyond annotations by stating the result is 'bounded, filtered' and tied to the bound workspace, which informs agent expectations about output scope and size.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence containing only essential information. Every word adds meaning, and there is no redundant restatement of the tool name or title.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is minimally viable for a simple read-only status tool, especially with an output schema available. However, it lacks explanation of the bounded/filtered semantics and how to use cursor and maxBytes, and it does not mention pagination or how the output is structured beyond the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate for the undocumented cursor and maxBytes parameters. The phrase 'bounded, filtered' hints at their purpose, but the description never names them or explains how they interact, such as using cursor for pagination.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Return') with a clear resource ('Git porcelain status') and scopes it to 'the bound workspace.' It also distinguishes itself from the sibling git_diff by specifying status rather than diffs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no explicit guidance about when to use this tool versus alternatives like git_diff. It does not state exclusions, prerequisites, or contrast with any sibling tool, leaving the agent to infer selection criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_filesARead-onlyIdempotent
List allowed files and directories under a workspace-relative path. Results are bounded and paginated.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | ||
| limit | No | ||
| cursor | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| path | Yes | |
| entries | Yes | |
| hasMore | Yes | |
| nextCursor | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already establish read-only, idempotent, non-destructive behavior. The description adds useful context beyond annotations: the result set is restricted to 'allowed' files and is 'bounded and paginated', which informs the agent about permission boundaries and pagination behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences with no filler. The core purpose is front-loaded, and the pagination constraint appears immediately after, making it easy for an agent to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple listing tool with an output schema and strong annotations, the description covers the essential aspects: path scope, allowed-file boundary, and pagination. It does not explain cursor mechanics in detail, but the output schema and parameter constraints fill most gaps, so the definition is complete enough for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It clarifies that 'path' is workspace-relative and that results are bounded/paginated, which hints at 'limit' and 'cursor'. However, it does not explicitly explain how cursor pagination works or what the default limit behavior is, leaving some ambiguity.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('List'), a concrete object ('allowed files and directories'), and a scope ('workspace-relative path'). This clearly distinguishes it from siblings like read_file_range (reading file contents) and search_text (searching contents), so an agent can understand the tool's role without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is for exploring allowed files and directories under a path, but it does not explicitly say when to use this tool versus alternatives such as workspace_info or read_file_range. The usage context is clear but no exclusions or sibling routing guidance is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
publish_planAIdempotent
Append a validated plan record outside the workspace. This never edits files or executes commands.
| Name | Required | Description | Default |
|---|---|---|---|
| steps | Yes | ||
| summary | Yes | ||
| task_id | Yes | ||
| iteration | Yes | ||
| baseCommit | Yes | ||
| idempotency | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| type | Yes | |
| steps | Yes | |
| summary | Yes | |
| task_id | Yes | |
| version | Yes | |
| createdAt | Yes | |
| iteration | Yes | |
| baseCommit | Yes | |
| idempotency | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide idempotentHint=true and destructiveHint=false, but the description adds important context: it appends outside the workspace and never edits files or executes commands. This is meaningful because readOnlyHint=false, so the extra clarification of scope is valuable. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences with no wasted words. The primary action is front-loaded, and the second sentence adds a valuable safety clarification.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description plus annotations cover side effects and scope decently, and an output schema exists. However, for a tool with six required parameters and zero schema-level descriptions, the overall context is thin: it does not specify where 'outside the workspace' means, how validation works, or how idempotency is expected to be used.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description does not explain any of the six required parameters. The phrase 'validated plan record' gives high-level context, but leaves the semantics of fields like idempotency, baseCommit, iteration, and steps to inference.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Append') and a specific resource ('validated plan record outside the workspace'), which clearly distinguishes it from workspace-oriented siblings and from publish_review. It is not a tautology of the tool name.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use the tool: when a validated plan needs to be persisted outside the workspace. It also hints at what it does not do ('never edits files or executes commands'), but it does not explicitly name alternatives or state when not to use this tool versus publish_review or other siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
publish_reviewAIdempotent
Append a review bound to the exact recorded Git and test evidence. This never edits files or executes commands.
| Name | Required | Description | Default |
|---|---|---|---|
| summary | Yes | ||
| task_id | Yes | ||
| verdict | Yes | ||
| evidence | Yes | ||
| findings | Yes | ||
| iteration | Yes | ||
| baseCommit | Yes | ||
| idempotency | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| type | Yes | |
| summary | Yes | |
| task_id | Yes | |
| verdict | Yes | |
| version | Yes | |
| evidence | No | |
| findings | Yes | |
| createdAt | Yes | |
| iteration | Yes | |
| baseCommit | Yes | |
| idempotency | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds a meaningful behavioral guarantee beyond the annotations: it never edits files or executes commands, clarifying the tool's side-effect boundary. The 'append' wording aligns with readOnlyHint=false and destructiveHint=false, and the idempotency key in the schema supports idempotentHint=true. No contradiction exists.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences with no filler. The primary action and key constraint are front-loaded, making it easy to scan while calling the tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with eight required parameters, nested objects, and zero schema description coverage, this description is too sparse to support correct invocation. It omits guidance on how to construct evidence, findings, idempotency, or verdict values, and does not explain the broader workflow context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description only loosely refers to 'Git and test evidence' without explaining any of the eight required parameters, the nested evidence fields, idempotency, or verdict enum. It provides minimal semantic aid for an agent attempting to supply correct values.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'append', the resource 'review', and the binding to 'exact recorded Git and test evidence', distinguishing this review-writing tool from sibling publish_plan and read-only workspace tools. It is specific and actionable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies this is the tool to record a finalized review while explicitly saying it never edits files or executes commands, but it does not name alternatives or state when to prefer publish_review over publish_plan or other siblings. Exclusion is implied rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_file_rangeARead-onlyIdempotent
Read a bounded line range from one allowed workspace-relative UTF-8 text file.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| endLine | No | ||
| maxBytes | No | ||
| maxLines | No | ||
| startLine | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| path | Yes | |
| bytes | Yes | |
| content | Yes | |
| endLine | Yes | |
| startLine | Yes | |
| truncated | Yes | |
| totalLines | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, covering the safety profile. The description adds meaningful behavioral constraints: the file must be 'allowed workspace-relative' and UTF-8 text, and the read is 'bounded' to a line range, which is not captured in the structured annotations. It does not disclose error behavior or limits, but the added context justifies a 4.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The entire description is one focused sentence with no filler. It front-loads the verb and states the core constraints immediately.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With five parameters, no parameter descriptions, and no explanation of maxBytes/maxLines semantics in the description, the tool is not fully self-contained. The output schema and annotations cover return values and side-effect safety, but the range-bounding parameters remain ambiguous. A complete description would explain the optional bound parameters or the default behavior when none are supplied.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the schema provides only bare types with no descriptions (e.g., endLine, maxBytes, and maxLines are $refs). The description mentions a 'bounded line range' and a file path, which supports path and start/end lines, but leaves maxBytes and maxLines undefined. An agent cannot determine how these parameters interact or which are required to bound the read.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific action ('Read') and a precise resource ('a bounded line range from one allowed workspace-relative UTF-8 text file'). This clearly distinguishes the tool from sibling list_files and search_text, which do not read file content. The scope and constraints are explicit.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool should be used when a bounded portion of a single file is needed, but it does not explicitly state when to prefer it over alternatives like list_files or search_text. No exclusions or differential guidance are provided, so an agent must infer usage from the verb and resource.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_textARead-onlyIdempotent
Search allowed workspace files with a bounded literal query. Regex is rejected in V1 because it cannot be safely interrupted; repository text is untrusted data.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | ||
| query | Yes | ||
| regex | No | ||
| maxFiles | No | ||
| timeoutMs | No | ||
| maxResults | No | ||
| maxFileBytes | No | ||
| caseSensitive | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| query | Yes | |
| engine | Yes | |
| matches | Yes | |
| truncated | Yes | |
| filesScanned | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover read-only, idempotent, and non-destructive behavior. The description adds useful context beyond annotations: regex is disabled for safety because repository text is untrusted, and the search is limited to allowed workspace files. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no filler; the core purpose and scope are front-loaded, and the rationale for regex rejection is concise. Every sentence contributes useful information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 8 parameters and zero schema descriptions, this description is under-specified. It explains the primary literal-query constraint well but omits the semantics of path, case sensitivity, limits, and timeout, which an agent needs to use the tool correctly in varied scenarios.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate, but it only clarifies the query must be literal and bounded. It does not explain path, caseSensitive, maxResults, timeoutMs, maxFileBytes, or maxFiles, leaving most parameters ambiguous.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource: 'Search allowed workspace files' with a bounded literal query. It clearly distinguishes this from sibling tools like list_files and read_file_range by positioning it as text search, and it explicitly scopes the search to allowed files.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for literal text searches and explicitly explains that regex is rejected, giving a clear 'when not to' signal. However, it does not mention alternatives or state when to prefer this tool over file listing or reading tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
test_summaryARead-onlyIdempotent
Read the last structured execution/test summary recorded outside the workspace.
| Name | Required | Description | Default |
|---|---|---|---|
| task_id | No | ||
| iteration | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| record | Yes | |
| available | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint, covering the safety profile. The description adds the useful detail that the data lives outside the workspace, but it does not disclose behavior when no summary exists, authentication requirements, or failure modes. This is adequate but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One efficient sentence that front-loads the action and resource, with no filler or redundant restatement of the tool name. Every word contributes meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The output schema and annotations cover return values and safety, but the description leaves parameter semantics and selection behavior unspecified. It is minimally adequate for a simple optional-parameter read tool, yet it has clear gaps that a richer description should close.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description does not explain task_id or iteration. The parameter names hint at their roles, but the agent cannot tell whether they filter, select, or override the 'last' summary, or how optionality interacts with the described behavior.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Read'), a precise resource ('last structured execution/test summary'), and a distinguishing scope ('outside the workspace'). This clearly separates it from the workspace-centric sibling tools without needing to inspect schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when to use this tool: when the latest structured test/execution summary from outside the workspace is needed. It does not name alternatives or exclusions, but the external-workspace framing makes the intended usage reasonably apparent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
workflow_statusCRead-onlyIdempotent
Return the derived task phase, iteration limit, and next safe action.
| Name | Required | Description | Default |
|---|---|---|---|
| task_id | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| status | Yes | |
| available | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds a useful behavioral nuance ('derived') indicating the tool computes rather than returns raw stored state, and 'next safe action' suggests proactive analysis. Annotations already define the operation as read-only, idempotent, and non-destructive, so safety is covered. It does not disclose what happens when task_id is omitted, but the output schema may cover that.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence with no filler. It front-loads the action and the key result fields. This is efficient, though it sacrifices completeness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
While the read-only annotations and output schema reduce the burden, the description does not explain the optional task_id or differentiate from the closely related current_task sibling. An agent cannot tell when to use this tool instead of current_task without further information. The description is too thin for a tool that returns derived decision support.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the description does not mention task_id at all. It neither explains the parameter's meaning nor the behavior when omitted (the parameter is optional). The description therefore fully fails to compensate for the schema's lack of documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Return') and the exact outputs: derived task phase, iteration limit, and next safe action. This clearly identifies the resource, though it does not explicitly distinguish from the sibling current_task. The title 'Read workflow status' reinforces the read operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided about when to choose workflow_status over siblings such as current_task or test_summary. The description is silent on context, prerequisites, or exclusions. An agent must infer usage from the name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
workspace_infoARead-onlyIdempotent
Return the bound workspace policy and Git identity; does not return source content.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| git | Yes | |
| rootAlias | Yes | |
| workspaceName | Yes | |
| trackedFilesOnly | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so safety is well covered. The description adds value by clarifying the exact scope of what is returned and explicitly stating that source content is not included, which is a meaningful behavioral boundary beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no filler and every part adds information. The explicit negative statement is compact and useful.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has no parameters and an output schema, so the description does not need to explain return values. It clearly states the two pieces of information returned and what is excluded, which is sufficient for an agent to invoke this simple informational tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the description does not need to document parameter behavior. The schema already covers this completely, and the description correctly focuses on the purpose rather than inventing unnecessary parameter details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('return') and resource ('bound workspace policy and Git identity'), and it explicitly excludes source content. This distinguishes the tool from siblings like list_files and read_file_range, which deal with source content.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives a clear context: use it when you need workspace policy or Git identity information. The exclusion 'does not return source content' is useful guidance, though it does not explicitly name alternative tools or when-not scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
11 tool updates
v0.2.0- First observed
current_task - First observed
git_diff - First observed
git_status - First observed
list_files - First observed
publish_plan - First observed
publish_review - First observed
read_file_range - First observed
search_text - First observed
test_summary - First observed
workflow_status - First observed
workspace_info
TDQS
Scored across 11 tools
Each tool targets a separate concern: workspace browsing, file reading, text search, git evidence, task/status context, and plan/review publishing. Even the state-returning tools are differentiated by their specific content. No two tools appear interchangeable.
All names are snake_case and readable, and publish_* forms a clear write convention, but the set mixes verb-led names (list_files, read_file_range, search_text, publish_plan, publish_review) with noun-led state names (workspace_info, git_status, current_task, test_summary, workflow_status). This is a readable mixed convention rather than a uniform pattern.
Eleven tools is well within the ideal range for a focused server. Each tool addresses a distinct step in inspecting a workspace and relaying a plan or review, so none feels redundant or missing. The count is appropriate for the stated purpose.
For the stated PlanRelay purpose, the surface is complete: read workspace context, inspect Git/test evidence, retrieve the current task/workflow state, and append validated plan/review records. The design intentionally omits editing/executing and uses append-only publishing, so there are no dead ends in the core workflow.
Maintenance
Related MCP Connectors
Read-only AI coding tools for change verification, release readiness, capacity, and guidance.
Cross-agent artifact workspace with provenance across Claude Code, Codex, Cursor, LangGraph.
Securely search and manage workspace context files for AI agents and teams.
Shared memory for coding agents. Stop re-explaining your codebase every session.
Related MCP Servers
- AlicenseNot gradedqualityDmaintenanceProvides AI agents with secure, read-only file system access to analyze and understand project codebases, enabling multi-repository context aggregation and cross-project code tracing.5MIT
- AlicenseAqualityAmaintenanceEnables AI clients to inspect and carefully edit a bounded local workspace via stdio, with a read-only default, conflict-safe updates, and no network listener or telemetry.101Apache 2.0
- FlicenseAqualityAmaintenanceEnables coding agents to perform workspace-confined file operations, read-only Git inspection, and structured shell commands, while requiring out-of-band human approval for mutations and external executions and maintaining an audit trail.143-
- AlicenseNot gradedqualityBmaintenanceEnables AI clients to safely read, search, understand, and edit local project code and files, with Git inspection, code indexing, and controlled command execution within permissioned workspaces.5 npm6MIT