Baron
This server exposes Baron's MCP interface for working with issues, branches/PRs, and workflow recipes through normalized, provider-agnostic tools.
Issue read (
baron_issue_read): fetch a single issue by id, query by role/typeRole/assignee/iteration, list iterations, and classify items.Issue write (
baron_issue_write): create, update, comment on, assign, link, and set iteration on work items using abstract roles that map to provider states/types.Issue move (
baron_issue_move): transition items across semantic roles, reconcile stale labels, and block/unblock them independently of their role.SCM read (
baron_scm_read): get PR status/checks/review decision and find the PR for a branch (open/merged/closed/all).SCM write (
baron_scm_write): create branches, create PRs (with linked-issue relations), comment on PRs, mark PRs ready, and merge PRs.Recipes (
baron_recipe_list/baron_recipe_run): discover and run packaged multi-step workflows liketask-start/task-finishwith enforced step order and required inputs.Memory (
baron_memory_append/baron_memory_query): store durable learnings and follow-ups, then query them by tag/text/status/limit.Escape hatch (
baron_native_request): make raw authenticated REST calls to providers bound in the policy, as a last resort when normalized tools don't cover the need.
Provides integration with GitHub for issue tracking, source control, CI, and deployments through normalized ports, enabling creation and management of issues, branches, pull requests, CI runs, and deployments.
Provides a notify port for sending notifications to Slack, allowing agents to post messages and updates through the Baron MCP server.
Baron
Let your coding agent write to your work tracker — and keep the same flow when you change trackers. Baron is an open-source layer that turns issues, branches, PRs, CI runs, and deployments into one normalized contract, so your agent never learns a vendor's API, states, or column names.

The problem
AI coding agents bake one vendor's API and one team's process into prompts. The moment your issues live in Azure DevOps but your code is on GitHub, or your board columns aren't literally "To Do / Done", or you switch trackers next quarter — the prompts break, and the agent falls back to raw, vendor-specific tools. You've hardcoded vendor lock-in into the way you work.
Related MCP server: Jira - GitHub MCP Server
What Baron does
Plenty of tools let an agent read your tracker. Baron is about the other direction: writing — creating work items, moving them, cutting branches, opening and merging PRs — which is where an agent does damage when it guesses a vendor's state machine wrong.
The agent speaks one abstract vocabulary in terms of roles (backlog → ready → in_progress → in_review → done; blocking is an orthogonal flag, so a blocked item keeps the role the work is
actually in), and Baron translates to each provider's real API, states, and
quirks. You confirm that mapping once, at baron init, and it is committed to your repo as
configuration — not re-guessed by the model on every call.
Each port binds to a provider independently, so issues on Azure DevOps, scm on GitHub, and
notify on Slack is a normal setup rather than a special case.
What it looks like
You: Start work on STORE-142.
Baron ▸ runs the task-start recipe as a single call:
✓ Loaded STORE-142 "Add rate limiting to the login endpoint" (type role: task)
✓ Checked it: not done, has a canonical branch, not assigned to someone else
✓ Branched feature/STORE-142 from the repo's default branch
✓ Moved STORE-142 → in_progress, assigned to you
✓ Commented on the item: "Started work — on branch feature/STORE-142."That same prompt on Azure DevOps sets the work item state to Active; on GitHub it applies an
in-progress label — because in_progress is a role, not a vendor state.
The checks matter as much as the actions: if the item is already done, belongs to someone else, or is a container that should never be branched, the run stops before anything is created. The branch name is derived by Baron from the item's type role, so every agent and every recipe derives the same name for the same item instead of inventing one.
Why it's different
Capability ports, not "a tracker."
issues/scm/ci/deploy/notify, each bound to a provider independently — so a consumer mixes providers rather than betting on one vendor spanning everything.Normalize, don't raw-proxy. New capabilities become first-class normalized ports; a clearly labeled provider-native escape hatch is the explicit last resort, never the default path.
Capability gaps are never silent. When a provider lacks something (say, native issue hierarchy), Baron either emulates it (e.g. labels), degrades with a warning, or errors loudly — decided by policy, never swallowed.
Workflows are recipes, not prompts. Multi-step flows (
task-start,task-finish,task-land,ship) are declarative YAML executed as a single call, with guards that stop a run before it mutates anything. The order lives in the recipe rather than being improvised per run.
The first of those is the one worth reading about rather than being told: You can't set a status in Jira walks through why a work tracker cannot be normalized by mapping four states onto everything — Jira refuses to set a status at all and makes you discover the permitted transitions first, Linear's workflow states belong to a team rather than the workspace, GitHub has no hierarchy to map. It is the argument this design answers.
Quick start
Published to npm — no clone, no build. From inside your project:
# 1. Configure — one command. Auto-detects owner/repo from your git remote, offers to sign you in
# through your browser (or paste a token instead), writes .baron/credentials (gitignored) +
# .baron/policy.json (issues + scm bound).
npx -y @lonca/baron-cli@latest init --provider github # or: --provider azure-devops
# 2. Check the policy against the live provider (drift → exit 1)
npx -y @lonca/baron-cli@latest doctor
# 3. Run a workflow recipe
npx -y @lonca/baron-cli@latest run --recipe task-start # by name; or pass a pathOn GitHub, step 1 opens the approval page and you confirm a short code — no permission list to read,
no boxes to tick, no token to paste. Pasting a fine-grained token is still offered, because it is a
narrower credential than any OAuth scope and an install that wants the tighter one should not have to
fight the friendlier path to get it. Either way baron doctor verifies what the credential can
actually do before you start work.
Or drive it from an agent — install the Claude Code plugin (MCP server + workflow skills in one):
/plugin marketplace add loncadev/baron
/plugin install baron@baronSee Getting started for the full walkthrough. Contributing to Baron
itself? Run from source with pnpm baron … — see CONTRIBUTING.
Or wire the MCP server into your agent and call the tools directly across every port —
baron_issue_write op=create, baron_scm_write op=pr_create, baron_ci_read op=runs, baron_deploy_read op=deployments,
baron_notify_send, plus baron_recipe_run for whole workflows. In Claude Code, the plugin also
ships per-recipe skills (/baron:task-start, /baron:ship). See docs/mcp.md.
The server is listed in the official MCP Registry as io.github.loncadev/baron, and runs as a
container for anyone who would rather not have Node on the host — see
docs/mcp.md.
New to it? The Azure DevOps setup walkthrough is copy-paste from
scratch (PAT scopes, init → doctor → MCP, troubleshooting).
Providers
Provider | Ports |
Azure DevOps |
|
GitHub |
|
Jira |
|
Linear |
|
Slack |
|
GitLab is on the roadmap — adding a provider never changes how the agent talks to Baron, which is the whole point. Until it lands, that name describes intent, not support.
Documentation
Guide | What it covers |
Install, prerequisites, first | |
From-scratch, copy-paste setup on Azure DevOps + Claude Code. | |
From-scratch setup on Linear: per-team scoped states, branches from GitHub. | |
From-scratch setup on Jira Cloud: workflow-gated transitions and transition screens. | |
Ports, roles, capability gaps, the knowledge loop — the mental model. | |
| |
| |
Writing YAML recipes: | |
The MCP tools and the Claude Code plugin. | |
Hands-on: wire the MCP server to a real project + a verification checklist. | |
Which provider supports which port and capability. | |
Ready-to-record 60-second demo (Claude Code or CLI). |
The full design decision record is in ARCHITECTURE.md; the contributor working contract is CLAUDE.md, contribution terms are in CONTRIBUTING.md, and the publish playbook is RELEASING.md.
Status
v1 is built end-to-end: the issues, scm, ci, and deploy ports across Azure DevOps and
GitHub plus notify via Slack, the config engine (baron init / doctor), a multi-port MCP
server, the YAML recipe engine + baron run, the knowledge loop, and a Claude Code plugin. Every
adapter passes a network-free conformance suite; the Azure DevOps ports are additionally
live-validated against a real project.
Baron now also runs this repository — its issues, branches, and pull requests move through its own GitHub adapter. That is a working proof, not adoption: Baron is young and has not yet been put through a stack it did not grow up on. If you run it against yours, the resulting bug report is the most useful thing you could send. What is planned next, and what is deliberately out of scope, is in ROADMAP.md.
License
Open-core. The core, the adapters (Azure DevOps, GitHub, Linear, Slack), the recipes, and the CLI/MCP server are licensed under Apache-2.0. Future commercial-tier features (SSO, secret-manager integrations, multi-team governance, audit) will ship under a separate commercial license — see ARCHITECTURE.md decision #20.
Available Tools
10 toolsbaron_issue_moveA
Move a work item through the workflow, or flag it. ops: transition (id, role) — the semantic role layer, resolving an abstract role to the provider’s native state/column/label; reconcile (id) — clear a role label the provider’s own state contradicts, commanding no role; block (id, reason — required) and unblock (id, optional reason), which set and clear an ORTHOGONAL flag and leave the role alone, so an item keeps the role it is blocked in.
| Name | Required | Description | Default |
|---|---|---|---|
| id | No | ||
| op | Yes | Which operation to perform. | |
| role | No | ||
| reason | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Since no annotations are provided, the description must carry the full burden. It discloses key behaviors: `block` and `unblock` set an orthogonal flag and leave the role alone, `reconcile` clears a role the provider contradicts, and `transition` resolves an abstract role to the native state. This is well-detailed for the complexity.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is informative but somewhat dense and run-on, with parenthetical comments that could be structured more clearly. It front-loads the primary action but could benefit from breaking into bullet points for readability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of four distinct operations with nuanced behaviors (orthogonal flags, role resolution), the description covers the essential semantics well. There is no output schema, but the description implies each op has a specific return (e.g., `block` sets a flag), which is adequate for agent invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 25%, so the description must add meaning. It explains the `op` parameter's four valid values in detail and mentions `reason` is required for `block`. However, it does not cover parameters like `id` or `role` beyond what the schema provides (e.g., format constraints for `id`), and the empty `role` and `reason` descriptions in the schema are not supplemented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states that the tool moves a work item through the workflow or flags it, listing four specific ops (transition, reconcile, block, unblock) with brief explanations. It distinguishes itself from sibling tools like baron_issue_read and baron_issue_write by focusing on workflow transitions and flagging, not reading or writing issue data.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides basic context for when to use each operation (e.g., `transition` for moving an item, `block` for flagging) but does not explicitly state when to use this tool versus alternatives or when not to use it. It lacks guidance on prerequisites or common pitfalls.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
baron_issue_readA
Read work items. ops: get (id) → one normalized issue; query (role / typeRole / assignee, @me allowed / iteration, @current allowed / limit) → a filtered list; iterations (no args) → the provider's sprints, each with a current flag, empty where the provider has none.
| Name | Required | Description | Default |
|---|---|---|---|
| id | No | ||
| op | Yes | Which operation to perform. | |
| role | No | ||
| limit | No | ||
| assignee | No | ||
| typeRole | No | ||
| iteration | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Describes the output for get (one normalized issue), query (filtered list), and iterations (sprints with current flag). Mentions allowed special values like '@me' and '@current'. However, the 'classify' operation is absent, and no side effects, error conditions, or rate limits are disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with a clear front-loaded purpose ('Read work items') and structured enumeration of operations. It is concise but could be better organized (e.g., bullet list) and is missing the 'classify' operation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 7 parameters, no output schema, and no annotations, the description covers the main operations well but omits the 'classify' operation entirely. It also lacks details on pagination, error handling, or authentication needed for a fully complete profile.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With only 14% schema description coverage, the description adds significant meaning: it associates parameters with operations (e.g., id for get, role/typeRole/assignee/iteration/limit for query) and explains special values. However, the 'classify' operation's parameters are not described.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states the tool reads work items and details three operations (get, query, iterations) with their specific actions. However, the 'classify' operation from the schema is not mentioned, leaving its purpose unclear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is for reading via the phrase 'Read work items' and the sibling tools indicate write/move variants. No explicit guidance on when to use or when not to use this tool, nor alternatives are named.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
baron_issue_writeA
Change a work item’s content. ops: create (title, typeRole, optional body/parentId/labels/initialRole); update (id, title and/or body — a patch, omitted fields are left alone); comment (id, body); assign (id, assignee — @me allowed); link (fromId, toId, type); set_iteration (id, iteration — @current allowed). Roles and type roles are abstract: the active policy maps them to the provider’s own states and types.
| Name | Required | Description | Default |
|---|---|---|---|
| id | No | ||
| op | Yes | Which operation to perform. | |
| body | No | ||
| toId | No | ||
| type | No | ||
| title | No | ||
| fromId | No | ||
| labels | No | ||
| assignee | No | ||
| parentId | No | ||
| typeRole | No | ||
| iteration | No | ||
| initialRole | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It transparently explains that 'update' is a patch operation (omitted fields left alone) and that roles and type roles are abstract (mapped by policy). However, it does not mention potential side effects like permission requirements, rate limits, or what happens on failure (e.g., partial success across multiple ops).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact (about 50 words) and front-loaded with the core purpose. Each sentence earns its place, though the last sentence about roles could be slightly more concise. The structure clearly groups operations with their parameters, making it scannable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (6 operations, 13 parameters, no output schema or annotations), the description is fairly complete for typical usage scenarios. It covers all operations and key parameter dependencies. However, it could mention return behavior (e.g., does create return the new ID?) and error handling to fully address the gap left by the missing output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 13 parameters but only 8% description coverage (one enum documented per schema). The description compensates significantly by explaining which parameters apply to which operation (e.g., parentId for create, assignee for assign, iteration for set_iteration) and adding semantics like '@me' and '@current' allowed values. This adds substantial meaning beyond the bare schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool is for changing a work item's content and enumerates six specific operations (create, update, comment, assign, link, set_iteration) with their required parameters. This distinguishes it from siblings like baron_issue_read (which likely reads rather than writes) and baron_issue_move (which probably relocates issues rather than altering content).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides per-operation parameter needs (e.g., 'create' needs title, typeRole; 'update' needs id, title and/or body), which guides when to use each variant. However, it lacks explicit exclusion guidance or direct comparisons to sibling tools like baron_issue_read or baron_issue_move for scenarios where reading or moving would be more appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
baron_memory_appendB
Record something durable in Baron's own store (not a provider's). ops: learning (title, body, optional tags) — a decision worth keeping; followup (title, optional body/tags) — an open loop to come back to.
| Name | Required | Description | Default |
|---|---|---|---|
| op | Yes | Which operation to perform. | |
| body | No | ||
| tags | No | ||
| title | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries full burden. It only says 'durable' but omits key behavioral traits: side effects, permissions, success/error behavior, idempotency, or storage limits. This is insufficient for a mutation tool with 4 parameters and no output schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences front-load the core purpose and then detail operations efficiently. No extraneous words. The colon-based structure is somewhat dense but still clear. Very minor improvement possible by separating operation specs more clearly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (4 params, enum, no output schema, no annotations), the description covers purpose and operation variants but lacks return value hints, error conditions, prerequisites, and parameter constraints (e.g., tag format, body length). The title-required contradiction further reduces completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds meaning to the 'op' enum by explaining field requirements per operation (e.g., 'learning' requires title+body, 'followup' requires title with optional body/tags). However, it contradicts the schema by implying 'title' is always required while the schema marks only 'op' as required. Other parameters (body, tags) get no additional semantics beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states this tool records data durably in Baron's own store, distinguishing it from siblings like baron_memory_query (querying) and baron_issue_write (issue tracking). It also details two specific operations ('learning' and 'followup') with field requirements, making the purpose highly specific.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage context by specifying 'not a provider's store' and briefly defining each operation, but does not explicitly guide when to choose this tool over siblings (e.g., baron_memory_query for retrieval) or when not to use it. No exclusions or alternatives are named.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
baron_memory_queryA
Read Baron's own store. ops: learning (optional tag/text/limit); followup (optional status/tag/limit).
| Name | Required | Description | Default |
|---|---|---|---|
| op | Yes | Which operation to perform. | |
| tag | No | ||
| text | No | ||
| limit | No | ||
| status | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It confirms read-only intent via 'Read' and lists optional parameters, but omits critical behavioral traits: return format, pagination behavior, default values for omitted params, authentication requirements, and what 'learning' vs 'followup' specifically query. Minimal disclosure beyond basic operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with front-loaded purpose and compact operation details using backticks and semicolons. Every word serves a purpose with no filler. Efficient and scannable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite 5 parameters and no output schema/annotations, the description does not explain the semantics of 'learning' and 'followup' operations, expected return values, or any constraints. A query tool lacking return format or operation semantics leaves the agent with significant gaps. Incomplete for the complexity level.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 20% (op described). The description adds meaning by grouping parameters per operation: learning (tag, text, limit) and followup (status, tag, limit). This clarifies which parameters are relevant for each op, compensating for the schema's lack of per-parameter descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool reads Baron's own store, uses specific verbs 'learning' and 'followup', and distinguishes it from sibling tools like baron_memory_append (write) and other issue/SCM tools. 'Read Baron's own store' plus operation listing makes the purpose specific and unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is for querying memory store but provides no explicit guidance on when to use this versus sibling tools (e.g., baron_issue_read for issues). No alternatives or exclusions are mentioned, leaving the agent to infer context from tool names alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
baron_native_requestA
ESCAPE HATCH — a raw, authenticated, NON-PORTABLE provider REST call. Last resort for when no normalized tool (issue/scm/ci/notify) covers the need. You supply the provider-native method + path (+ query/body); Baron only attaches the base URL + auth and returns the (size-capped) response. Prefer the normalized tools — this is provider-specific and will not port to another provider. Only providers bound in the active policy are reachable.
| Name | Required | Description | Default |
|---|---|---|---|
| body | No | JSON request body (any shape). | |
| path | Yes | Provider-relative path, including any required api-version query. | |
| query | No | ||
| method | Yes | HTTP method (GET/POST/PATCH/…). | |
| provider | Yes | A provider bound in the policy. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description must disclose all behavioral traits. It states that Baron attaches base URL + auth and caps response size, and that the call is non-portable. However, it omits details on error handling, potential destructive side-effects (since METHOD can be DELETE/PATCH), or response format. More disclosure would be needed for complete transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact (3 sentences) and front-loaded with the key concept 'ESCAPE HATCH'. Every sentence serves a purpose: stating what it is, when to use, and what the user provides vs what Baron handles. No fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has 5 parameters (3 required), no output schema, and nested objects. The description explains the high-level flow and constraints but does not detail what the response looks like (beyond 'size-capped'), error responses, or format of body/query parameters. For an escape hatch, some missing details may be acceptable but the response shape is left ambiguous.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 80% (4 of 5 parameters have descriptions). The description adds meaning by explaining that the user supplies the provider-native method+path+query/body and that Baron only adds the base URL and auth. It reinforces the role of each parameter in the tool's execution, going beyond the schema's brief descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states 'raw, authenticated, NON-PORTABLE provider REST call' and positions itself as an 'ESCAPE HATCH — last resort' contrasting with the normalized sibling tools (issue/scm/ci/notify). This clearly distinguishes the tool's purpose from the sibling list.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides explicit when-to-use ('Last resort for when no normalized tool covers the need') and when-not-to-use ('Prefer the normalized tools — this is provider-specific and will not port'). It also mentions constraints: 'Only providers bound in the active policy are reachable.' This gives the agent clear guidance on alternatives and limitations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
baron_recipe_listA
List the runnable recipes (built-ins + project recipes) with their declared inputs. Call this to discover what baron_recipe_run accepts before running a workflow.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses that the tool lists built-ins and project recipes with inputs, implying a read-only listing. However, it does not explicitly state that the operation is safe, non-destructive, or if any authentication is required. The behavioral detail is adequate but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, zero wasted words. The first sentence states the primary function, the second provides usage guidance. It is front-loaded and efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list tool with no parameters and no output schema, the description is complete. It specifies the scope (built-ins + project recipes), the output content (declared inputs), and the intended use case (discovery before running). No additional information is needed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters and schema coverage is 100% (vacuous). The baseline for 0 parameters is 4. The description adds meaning beyond the empty schema by explaining what the tool lists and its purpose, which is sufficient.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists runnable recipes (built-ins and project recipes) with their declared inputs. It distinguishes itself from the sibling `baron_recipe_run` by explicitly mentioning what the tool discovers for that run tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly tells when to use the tool: 'Call this to discover what `baron_recipe_run` accepts before running a workflow.' This provides clear context and links to the sibling tool, guiding the agent to use it as a prerequisite step.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
baron_recipe_runA
Run a named recipe end-to-end as ONE deterministic, rule-enforced workflow (the engine — not you — enforces the step order). Supply all required inputs (from baron_recipe_list) in inputs; a missing required input errors rather than prompting. Prefer this over composing the individual issue/scm/ci tools yourself for a packaged workflow. Returns the run context as JSON, and — when the recipe had anything to say — a SECOND text block with its messages. Read that block: it is where a recipe reports what it could not verify (task-land warns there when it merged past checks it could not see).
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Recipe name (e.g. task-start). | |
| inputs | No | Values for the recipe's `ask` inputs, keyed by input name. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It discloses deterministic execution, rule-enforced step order, automatic error on missing inputs, dual return format (JSON context + optional text block), and explains the text block's purpose ('reports what it could not verify'). No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four sentences covering action, behavior, input requirements, return format, and usage preference. It is concise and front-loaded, though the dense paragraph could benefit from slight structural separation (e.g., breaking out return format). No redundant content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (recipe execution, deterministic workflow, two-part return) and no output schema, the description is nearly complete. It covers what it does, how to use it, what to expect, and what the text block means. It does not mention error handling for missing recipes or non-existent inputs, but that is implied by the deterministic nature.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% (both parameters have descriptions). The description adds value beyond the schema by explaining that required inputs come from baron_recipe_list and that missing them causes errors rather than prompting. This context helps the agent prepare inputs correctly.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'Run a named recipe end-to-end as ONE deterministic, rule-enforced workflow' – a clear verb+resource pairing. It explicitly distinguishes from sibling tools by advising 'Prefer this over composing the individual issue/scm/ci tools yourself for a packaged workflow.'
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit when-to-use guidance ('Prefer this over composing...'), instructs to supply inputs from baron_recipe_list, warns that missing required inputs error rather than prompt, and tells the agent to read the second text block for verification messages. This fully covers selection and invocation context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
baron_scm_readA
Read source-control state. ops: pr_status (pullRequestId) → normalized state, review decision, mergeability and a checks rollup; pr_for_branch (sourceBranch, optional state — open default / merged / closed / all) → the most recent matching PR or null. open is the idempotency probe before creating one; merged is the drift probe.
| Name | Required | Description | Default |
|---|---|---|---|
| op | Yes | Which operation to perform. | |
| state | No | ||
| sourceBranch | No | ||
| pullRequestId | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description carries the full burden. It explains the return values for each operation (normalized state, review decision, mergeability, checks rollup; most recent PR or null) and mentions null return for pr_for_branch. However, it does not disclose error handling, rate limits, or authentication requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single paragraph but is well-structured with inline code formatting for operations. It front-loads the primary purpose and efficiently packs details. Could be improved with bullet points, but remains clear and concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has no output schema, so the description must explain return values. It does so for both operations and adds usage hints (e.g., idempotency probe). Missing details on error conditions or empty results (e.g., what happens if pullRequestId is not found), but overall sufficient for a simple read tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 25% (only 'op' has a schema description). The tool description compensates by explaining the meaning and usage of all parameters: it describes the two op values and their associated parameters (pullRequestId, sourceBranch, state) with clear semantics, adding significant value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description begins with 'Read source-control state,' clearly stating the verb and resource. It then enumerates two distinct operations with detailed outputs, differentiating it from sibling tools like 'baron_scm_write'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage patterns (e.g., 'open is the idempotency probe before creating one' suggests use before baron_scm_write) but does not explicitly state when to use this tool vs alternatives or when not to use it. No direct reference to sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
baron_scm_writeA
Change source-control state. ops: branch_create (name, optional fromBranch — idempotent); pr_create (title, sourceBranch, optional targetBranch/body/draft/assignees/autoComplete, plus linkedIssueKey and linkedIssueRelation — closes finishes the item on merge, relates only references it); pr_thread (pullRequestId, body); pr_ready (pullRequestId) — take it out of draft; pr_merge (pullRequestId, optional strategy/deleteSourceBranch). A provider that declines a merge surfaces as MERGE_FAILED rather than a false success.
| Name | Required | Description | Default |
|---|---|---|---|
| op | Yes | Which operation to perform. | |
| body | No | ||
| name | No | ||
| draft | No | ||
| title | No | ||
| strategy | No | ||
| assignees | No | ||
| fromBranch | No | ||
| autoComplete | No | ||
| sourceBranch | No | ||
| targetBranch | No | ||
| pullRequestId | No | ||
| linkedIssueKey | No | ||
| deleteSourceBranch | No | ||
| linkedIssueRelation | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description explains important behavioral aspects: branch_create is idempotent, pr_create's linkedIssueRelation semantics, and that a provider-declined merge surfaces as MERGE_FAILED rather than a false success. This is valuable since no annotations are provided, and it goes beyond just listing parameters.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise given the complexity (5 operations, 15 parameters) and organizes information per operation with parentheses. It front-loads the overall purpose. A minor improvement would be breaking into a list for readability, but it remains compact.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex tool with 15 parameters and no output schema, the description provides sufficient context for each operation's semantics and parameters. It covers idempotency, merge failure behavior, and link relations. The only gap is the response format (e.g., what is returned on success), but with no output schema, the description could include that.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is very low (7%), so the description must compensate. It does so by grouping parameters per operation and explaining semantics for key parameters (fromBranch, linkedIssueKey, linkedIssueRelation, strategy, deleteSourceBranch). However, some parameters like body, draft, assignees, autoComplete are only mentioned in passing without full detail.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool's purpose as changing source-control state and lists the five distinct operations with their required and optional parameters. It distinguishes itself from siblings like baron_scm_read (which likely reads state) and other baron tools focused on issues, recipes, or memory.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear guidance on when to use each operation and the effect of parameters (e.g., 'closes' finishes the item on merge, 'relates' only references it for linkedIssueRelation; 'idempotent' for branch_create). However, it does not explicitly contrast with baron_scm_read or other siblings for deciding when to write vs. read.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
10 tool updates
v0.1.0- First observed
baron_issue_move - First observed
baron_issue_read - First observed
baron_issue_write - First observed
baron_memory_append - First observed
baron_memory_query - First observed
baron_native_request - First observed
baron_recipe_list - First observed
baron_recipe_run - First observed
baron_scm_read - First observed
baron_scm_write
TDQS
Each tool targets a distinct domain (issues, SCM, recipes, memory, native requests) with clear read/write/move separation. No overlap in purpose; operations are well-bounded.
All tools follow the pattern 'baron_<domain>_<action>' with consistent lowercase and underscores. Action verbs (read, write, move, list, run, append, query) are uniform; only 'native_request' deviates but is a clearly labeled escape hatch.
Ten tools cover the core functionality (issue lifecycle, SCM operations, orchestrated recipes, persistent memory, and an escape hatch) without bloat. Each tool earns its place for the server's scope.
Missing direct delete for issues and branch/commit listing for SCM; query capabilities are somewhat limited. Recipes and the native request escape hatch plug some gaps, but core CRUD and SCM browsing have notable omissions.
Maintenance
Related MCP Connectors
The AI orchestration agent for modern software teams.
- mcp-serverOAuthcom.make
Give your AI agents the tools to build, manage, and run automation workflows.
Connect AI assistants to GitHub - manage repos, issues, PRs, and workflows through natural language.
Connect, monitor, and control AI agents — tasks, approvals, schedules, and governance.
Related MCP Servers
- -licenseBqualityNot gradedmaintenanceEnables AI-driven orchestration of GitHub development workflows including automated issue analysis, code generation, code review, and PR creation through multiple specialized agents. Integrates with GitHub Actions to automate the complete development process from issue to pull request.7-
- AlicenseNot gradedqualityDmaintenanceEnables end-to-end automation of developer workflows from Jira issue tracking to GitHub pull requests through natural language, allowing developers to search issues, create branches, commit changes, and manage PRs directly from their IDE.2MIT
- AlicenseNot gradedqualityAmaintenanceEnables AI agents to deploy code to any hosting provider by creating PRs, building, and verifying health checks, all from a single natural language command.1MIT
- AlicenseBqualityAmaintenanceSelf-hosted coding agent that runs Claude Code or Codex in your own infrastructure and works from Slack. Exposes codebase investigation, file edits, branch and PR creation, allowlisted command execution, CI status and an audit log as MCP tools, keeping every credential behind the tool layer instead of handing it to the model.1292MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/loncadev/baron'
If you have feedback or need assistance with the MCP directory API, please join our Discord server