Skip to main content
Glama

AGIW MCP

A careful coding workflow on your own local models, for any MCP-capable assistant.

CI Licence: Apache-2.0 Python 3.10+ Node.js 22+ Dependencies: none

AGIW MCP is a small local server for the Model Context Protocol. Add it to Claude Code, Factory or OpenCode, and your assistant gets three things:

Readiness check

Say "initiate online code mode". It checks this machine and answers READY, or names the one thing to fix first.

Nisi workflow

One model drafts, checks and tests run, a second model reviews, and a short repair loop follows. You get proposed file contents and a report. It runs on your local models.

Jev checks

Optional advisory questions before and after a task (risk, missing detail, unbacked claims), answered by TypeSafe's Jev model. Nothing is sent until you consent.

Python standard library only, plus Node.js for Nisi. No telemetry.

Quick start

1. Install

pipx install git+https://github.com/louiscalata/agiw-mcp

2. Point it at your local model server. You need an OpenAI-compatible server on your own machine (for example LM Studio) and two different models: an author and a reviewer. Save this as config.json in ~/Library/Application Support/agiw-mcp/ (macOS) or ~/.config/agiw-mcp/ (Linux):

{
  "model_base_url": "http://127.0.0.1:1234/v1",
  "author_model": "your-author-model-id",
  "reviewer_model": "your-reviewer-model-id"
}

3. Add it to your assistant

claude mcp add agiw-mcp -- agiw-mcp

(Factory and OpenCode are under Setup details.)

4. Say "initiate online code mode". The assistant runs the readiness check and tells you what, if anything, is missing.

Related MCP server: Local-MCP-Bridge

What it will and won't do

  • It proposes; it never edits. Nisi receives file contents in the request and returns proposed contents. It never reads or writes your project files and never runs generated code. You decide what to apply.

  • Local models only. The model server must be on 127.0.0.1 or ::1. Hostnames, HTTPS and other addresses are refused.

  • Jev is opt-in. You grant consent yourself, in a terminal. Your assistant cannot grant it for you. Jev's answers are advisory, not a verdict.

  • One request at a time, on one machine. No fleet, queue or background jobs.

  • No telemetry. The only local record is a Jev activity log of hashes, sizes and outcome codes, never your text.

Tools

Tool

What it does

agiw_readiness

Checks prerequisites in order and returns READY or the first missing one with its fix. Starts nothing.

agiw_status

Versions, configuration and which prerequisites are met. No secrets.

agiw_consent

Shows exactly what Jev would receive, or revokes consent. Granting is terminal-only.

agiw_jev_pre

Advisory Jev questions about a task before you start (task text up to 12 KB).

agiw_jev_post

Advisory Jev questions about a result or report (truncated to 12 KB).

agiw_nisi_run

One Nisi v0.2.0 workflow run on the file contents you supply, with your local models.

A typical task: agiw_jev_pre → agiw_nisi_run → you review the proposed files → agiw_jev_post.

Setup details

  • Python 3.10 or newer.

  • Node.js 22 or newer on the PATH of the program that starts agiw-mcp (your MCP client).

  • A local OpenAI-compatible chat server that supports JSON-schema structured output (response_format: {"type": "json_schema"}), listening on http://127.0.0.1:<port>/v1 or http://[::1]:<port>/v1.

  • Two different models. The review is only independent if the reviewer is a different model. Use the exact IDs that GET <model_base_url>/models lists: Nisi refuses a response whose model field differs from the configured ID.

Try it without installing:

uvx --from git+https://github.com/louiscalata/agiw-mcp agiw-mcp --version

OS

Config directory

macOS

~/Library/Application Support/agiw-mcp

Linux

$XDG_CONFIG_HOME/agiw-mcp (default ~/.config/agiw-mcp)

Windows

%APPDATA%\agiw-mcp

All keys in config.json are optional; unknown keys are refused. Besides the three shown in the quick start: keychain_service (default agiw-mcp), keychain_account (default typesafe), jev_model (default jev-1.14.0), max_output_tokens (default 4096), reasoning_effort (unset by default) and require_ticket (default false).

require_ticket: true makes agiw_nisi_run refuse any request without a claim ticket.

reasoning_effort (none, low, medium or high) is added to each Nisi chat request. Set it to none for reasoning models such as Qwen 3 or Granite 4 on LM Studio: under JSON-schema output they otherwise spend their tokens on hidden reasoning and return empty answers.

The model settings can come from the environment instead: AGIW_MCP_BASE_URL (or the legacy AGIW_MCP_MODEL_BASE_URL, used only when AGIW_MCP_BASE_URL is unset), AGIW_MCP_AUTHOR_MODEL, AGIW_MCP_REVIEWER_MODEL, AGIW_MCP_REASONING_EFFORT.

Config key

Environment variable

Precedence and validation

model_base_url

AGIW_MCP_BASE_URL

AGIW_MCP_BASE_URL, then legacy AGIW_MCP_MODEL_BASE_URL, then the config file, then http://127.0.0.1:1234/v1. Only HTTP loopback literals (127.0.0.1 or [::1]) are accepted; for a server on port 1235, use http://127.0.0.1:1235/v1.

reviewer_base_url

AGIW_MCP_REVIEWER_BASE_URL

Optional. AGIW_MCP_REVIEWER_BASE_URL, then the config file, then unset, which means the reviewer uses model_base_url. Set it to send the reviewer's requests to a different local server, for example http://127.0.0.1:1245/v1. Same loopback-only rule as model_base_url.

Check your setup at any time:

agiw-mcp --version
agiw-mcp readiness

Jev needs your own TypeSafe API key. agiw-mcp looks for it in this order and never stores it in a plain file:

  1. The environment variable TYPESAFE_API_KEY, set in the MCP client's environment for this server.

  2. The macOS Keychain. Type the key at the prompt (not on the command line, where it would be saved in your shell history):

    security add-generic-password -s agiw-mcp -a typesafe -w
  3. The Linux Secret Service (GNOME Keyring, KWallet), which also prompts:

    secret-tool store --label='agiw-mcp TypeSafe' service agiw-mcp account typesafe

On Windows, use the environment variable. On macOS, the readiness check verifies presence without reading the key. On Linux, secret-tool lookup returns the value, which agiw-mcp discards.

The Jev tools refuse to run until you consent:

agiw-mcp consent show      # exactly what is sent, and to where
agiw-mcp consent grant     # interactive; type I agree and press Return
agiw-mcp consent revoke

The confirmation is case-insensitive. In order, the prompt trims outer whitespace, strips leading and trailing straight single or double quote characters, removes all trailing periods, trims outer whitespace again, and compares the result case-insensitively with i agree. For example, I AGREE, 'I agree', I agree... and "I agree." are accepted; "I agree". is not, because quote stripping happens before period removal. Extra words or a different space between the two words are not accepted. Non-interactive input is refused, and an unrecognized confirmation records nothing.

Consent is tied to a hash of the disclosure text, so if a later version changes what is sent, you are asked again. See SECURITY.md.

Claude Code

claude mcp add agiw-mcp -- agiw-mcp

With the model settings in the environment:

claude mcp add agiw-mcp -e AGIW_MCP_AUTHOR_MODEL=your-author-model-id \
  -e AGIW_MCP_REVIEWER_MODEL=your-reviewer-model-id -- agiw-mcp

Factory (droid)

droid mcp add agiw-mcp agiw-mcp

or in ~/.factory/mcp.json:

{
  "mcpServers": {
    "agiw-mcp": { "type": "stdio", "command": "agiw-mcp", "args": [] }
  }
}

OpenCode (opencode.json or opencode.jsonc):

{
  "mcp": {
    "agiw-mcp": { "type": "local", "command": ["agiw-mcp"], "enabled": true }
  }
}

If the client cannot find agiw-mcp, use the absolute path that command -v agiw-mcp prints, and make sure node is on that client's PATH.

agiw_nisi_run takes task (required), files (a list of {path, content} with relative paths), new_files (paths the author may create), acceptance_criteria, assertions ({path, contains} or {path, not_contains}), repair_budget (0 to 3, default 1), timeout_seconds (30 to 1800, default 600) and an optional ticket.

A ticket is {ticketId, claimState, writeScope, owner}. Only claimState Granted or Active is admitted; writeScope is a list of scope keys or /-separated paths. Before Node is started or a temporary folder is created, the ticket is admitted all-or-nothing: it is refused (TICKET_SCOPE_CONFLICT) if any scope equals, contains or is contained in a scope of a ticket already admitted, by this or another agiw-mcp process. Scopes are compared ignoring case and Unicode normalization (README.md and readme.MD are the same scope). Scope parts that Windows would alias are refused (TICKET_INVALID) rather than normalized: parts ending in . or a space (calc.py.), parts containing :, and device names such as CON, NUL, COM1 or LPT1 with any extension. The ticket is released when the run ends. Admission state lives in tickets/ under the config directory, or in AGIW_MCP_TICKET_DIR (an absolute path). On macOS and Linux that directory must not be a symlink and must be owned by you with mode 0700 (a looser mode is tightened if possible), and every directory above it, including through symlinks, must be owned by you or root and not writable by group or others unless sticky (like /tmp); otherwise admission is refused (TICKET_REGISTRY_UNSAFE). A run's locks are released only from the directory they were created in. Locks left by a crashed process are not cleaned up automatically; they refuse later admissions until removed. On Windows, ticket admission is disabled for now: any ticket is refused (TICKET_UNSUPPORTED_PLATFORM) before the state directory is touched, until agiw-mcp can check the directory for reparse points, ownership and permissions. Runs without a ticket still work on Windows unless require_ticket is true. Refusals name only the ticket id.

Its static checks parse Python (ast.parse), JavaScript (node --check) and JSON; other file types get structural checks only, and the result says which files were parsed. Its tests are: at least one file changed, no proposed file is empty, and your assertions. Limits: 64 files, 256 KB per file, 512 KB in total.

Requests are handled one at a time: while a Nisi run is in progress (up to its timeout), other requests wait. Nisi's COMPLETED means the configured checks, tests and review passed; it is not a guarantee of correctness.

claude mcp remove agiw-mcp          # or remove it from your client's config
pipx uninstall agiw-mcp

Then delete the config directory listed above, and the Keychain or Secret Service item if you created one:

security delete-generic-password -s agiw-mcp -a typesafe     # macOS
secret-tool clear service agiw-mcp account typesafe          # Linux

Development

python3 scripts/scrub_check.py
PYTHONDONTWRITEBYTECODE=1 python3 -B -m unittest discover -s tests -v

The tests never reach the network: the model server and Jev are fakes on 127.0.0.1, test mode refuses non-loopback URLs, and a socket guard blocks any other connection. Without Node 22+, a fake runner covers the Python side. Binding the loopback fakes needs local port binding to be allowed.

Security and licence

Security model and how to report a problem: SECURITY.md.

Apache-2.0. See LICENSE, NOTICE and PROVENANCE.md. The vendored Nisi v0.2.0 package keeps its own LICENSE and manifest in src/agiw_mcp/vendor/nisi/.

Available Tools

6 tools
agiw_jev_postJev post-analysis (advisory)A

Send a result or report (truncated to 12 KB) to Jev at TypeSafe with fixed questions about self-contradiction, unbacked claims, risk of acting on it and misclassified findings. Advisory, not a verdict. Refused unless consent is recorded and a key is available. Never retried automatically.

NameRequiredDescriptionDefault
reportYes

TDQS

A4.1/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With annotations only covering safety flags, the description adds the operationally critical facts: input truncation at 12 KB, an external service (openWorld) at TypeSafe, the consent/key access gate, and 'Never retried automatically.' Those are exactly the traits annotations cannot convey and directly affect a caller's error handling.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three compact sentences, each earning its place: destination and payload, analysis scope, then the advisory nature and access constraints. The truncation limit is front-loaded right on the payload noun.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, yet the description tells the agent what the service will answer (the four fixed questions) and that the answer is advisory. A short note on the shape of the response or the failure mode when consent/key is missing would make it fully self-sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single `report` parameter has 0% schema description coverage, so the description must compensate. It usefully discloses the 12 KB truncation limit, but says nothing about expected content, format, or what happens to the truncated remainder, leaving the bulk of semantics to inference.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Send a result or report') and a specific destination ('Jev at TypeSafe'), plus the exact analytical questions asked (self-contradiction, unbacked claims, risk, misclassified findings). This clearly separates it from the sibling agiw_jev_pre, though the differentiation is carried mostly by the pre/post naming rather than an explicit contrast.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Advisory, not a verdict' sets the trust level, and 'Refused unless consent is recorded and a key is available' names the prerequisite gates an agent must satisfy before calling. It lacks an explicit when-not or a pointer to agiw_jev_pre/'agiw_consent', so it is clear context rather than full routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

agiw_jev_preJev pre-analysis (advisory)A

Send a task description (at most 12 KB) to Jev at TypeSafe with fixed questions about risk, blockers, missing detail, irreversible actions and reliance on old reports. Returns Jev's answers and which are flagged. Advisory, not a verdict. Refused unless consent is recorded and a key is available. Never retried automatically.

NameRequiredDescriptionDefault
taskYes

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds substantial context beyond the annotations: the payload leaves the boundary to a third party at TypeSafe, has a hard 12 KB cap, can be refused for missing consent/key, and is never retried automatically — an important non-obvious trait given idempotentHint=false. It also discloses the return shape (answers plus flagged items) and that results are advisory, not a verdict.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four tight sentences, each carrying distinct information — payload, destination, questions asked, return shape, advisory status, preconditions, retry policy. The core purpose is front-loaded with no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter external-call tool with no output schema, the description covers who receives the data, what is asked, what comes back, refusal conditions, and the epistemic weight of the result. Nothing an agent needs to invoke it safely is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must carry the load, and it does: the single 'task' parameter is characterized as a task description with a 12 KB ceiling matching the schema maxLength. It does not describe expected internal structure or formatting conventions for the payload, so it falls just short of full compensation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a concrete verb and resource: send a task description to a named external service (Jev at TypeSafe) for pre-analysis against fixed questions. The 'pre' framing plus 'Advisory' makes it distinguishable from agiw_jev_post, though it never names that sibling explicitly to route the agent.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear preconditions ('Refused unless consent is recorded and a key is available') and sets expectations ('Advisory, not a verdict'), which tells the agent this is not a gate. It does not explicitly say when to choose this over agiw_jev_post or agiw_readiness.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

agiw_nisi_runRun one Nisi workflow locallyA
Read-only

Run one Nisi v0.2.0 workflow (draft, syntax check, tests, independent review, bounded repair) on file CONTENTS you pass in, using the configured local author and reviewer models. Runs in a private temporary directory that is removed afterwards. Never reads or writes project files and never executes generated code; returns proposed contents and Nisi's report for you to review and apply yourself. Tests are the built-in checks (some file changed, no empty file) plus optional contains/not_contains assertions.

NameRequiredDescriptionDefault
taskYesWhat to change, in plain language.
filesNoCurrent contents of the files the models may change (relative paths).
ticketNoOptional claim ticket (required when config require_ticket is true). Admitted before the run starts, refused if its write scope overlaps an admitted ticket, released afterwards.
new_filesNoRelative paths the author may create.
assertionsNo
repair_budgetNo
timeout_secondsNo
acceptance_criteriaNo

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Very strong disclosure beyond the annotations: a private temporary directory that is removed afterwards, no reads or writes of project files, no execution of generated code, and the return contract (proposed contents plus Nisi's report). It also describes ticket lifecycle behavior — admitted before the run, refused on write-scope overlap, released afterwards — which the annotations cannot convey. All of this is consistent with readOnlyHint=true and openWorldHint=false.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, front-loaded with what the tool does, then safety constraints, then test semantics — no wasted clauses. The sentences are long and densely packed, which slightly strains readability, but every clause carries substantive information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description does the necessary work of stating what comes back (proposed contents and Nisi's report) and what does not happen on disk, which is exactly what an agent needs before committing to a run. Gaps remain around failure modes beyond ticket refusal, timeout behavior, and repair_budget/acceptance_criteria semantics for an 8-parameter tool with nested objects.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 50%, so the description must carry more weight. It does add meaning for 'files' (current contents the models may change), the ticket flow, and assertions ('contains/not_contains' alongside built-in checks), but it is silent on acceptance_criteria, timeout_seconds, repair_budget (only 'bounded repair' is hinted at, no default of 1 or cap of 3), and new_files. Adequate but incomplete given the coverage gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb and resource — 'Run one Nisi v0.2.0 workflow' — and enumerates the pipeline stages (draft, syntax check, tests, independent review, bounded repair), plus the crucial input distinction that it operates on 'file CONTENTS you pass in' rather than a project path. That is clearly separable from sibling tools like agiw_status, agiw_readiness, and agiw_jev_*.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description establishes the usage context well: the caller supplies file contents, the run is sandboxed in a temp directory, and the caller is expected to 'review and apply yourself.' It also states the conditional ticket requirement is governed by config. However, it never names an alternative tool or states explicit when-not-to-use-this conditions relative to the agiw_* siblings, so it stops short of full routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

agiw_readinessOnline code mode readinessA
Read-only

The "initiate online code mode" check. Only checks, never starts work. Returns READY, or the FIRST missing prerequisite with an exact fix, in this order: Python, configuration, Node.js 22+, vendored Nisi hashes, local OpenAI-compatible model server listing two distinct configured models, consent recorded, TypeSafe API key present (macOS: presence checked without reading it; Linux: secret-tool lookup returns it but agiw-mcp discards it).

NameRequiredDescriptionDefault

No parameters

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare readOnlyHint=true and openWorldHint=false; the description far exceeds them by enumerating the ordered prerequisites checked and specifying the return contract (READY, or the FIRST failure with an exact fix). It also discloses sensitive handling behavior — macOS key presence checked without reading it, Linux secret-tool output discarded by agiw-mcp — which an agent could not infer elsewhere.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose is front-loaded in the first clause and every subsequent clause carries distinct information — the ready/fail contract, the ordered list, and the platform-specific key handling. The prerequisite sequence and the parenthetical platform detail would read better as a list than as one long run-on sentence.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description carries the full burden and does so: it defines the return states, the deterministic ordering of failures, and what each check inspects. An agent can decide whether to call it and interpret the result without additional documentation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so there is nothing extra for the description to document; baseline applies. The description correctly spends its words on the check sequence and return values instead of restating an empty schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Names a specific verb (check) and resource (online code mode readiness) and immediately scopes it: "Only checks, never starts work." That single exclusion separates it from mutation-oriented siblings such as agiw_nisi_run or agiw_nev_post without needing to open their schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

"The 'initiate online code mode' check" plus "never starts work" makes the pre-flight use case clear and rules out using it as a launcher. However, it never names an alternative tool (agiw_status, agiw_nisi_run) or states explicitly when to skip this call, so the routing is implied rather than spelled out.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

agiw_statusAGIW MCP statusB
Read-only

Versions, configuration (home directory shown as ~) and which prerequisites are met. Contains no secrets and starts no work.

NameRequiredDescriptionDefault

No parameters

TDQS

B3.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already establish readOnlyHint=true and openWorldHint=false, yet the description still adds genuinely useful behavioral context: it discloses that the output contains no secrets, that the home directory is redacted to '~', and that the call starts no work. That is real value beyond the structured fields for a diagnostic tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One dense sentence with every clause earning its place — the safety note and redaction note are both operationally relevant. It reads as a fragment rather than a complete sentence, which slightly weakens front-loading of the primary purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-param, read-only diagnostic with no output schema, the description covers roughly what the caller will receive and reassures about side effects. However, it leaves the response shape unspecified and, more importantly, leaves the overlap with agiw_readiness unresolved, which is the main thing an agent needs to resolve before calling.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so per the baseline there is nothing for the description to disambiguate. The description correctly adds no parameter discussion, which is the right call.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description is a noun-phrase list of what the tool surfaces (versions, configuration, prerequisite status) rather than a verb+resource statement of what it does. It is not a tautology of the name, but it also gives no basis for distinguishing it from the sibling agiw_readiness, which plausibly covers the same 'prerequisites are met' territory.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance, no stated preconditions, and no mention of alternatives. An agent facing agiw_status vs agiw_readiness vs agiw_consent gets no routing signal from this text at all.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 1 tool update
    • Changedagiw_nisi_run1 field changed
      • addedInput schema / properties / ticket
        Added value: +{
        +  "additionalProperties": false,
        +  "description": "Optional claim ticket (required when config require_ticket is true). Admitted before the run starts, refused if its write scope overlaps an admitted ticket, released afterwards.",
        +  "properties": {
        +    "claimState": {
        +      "description": "Only Granted or Active is admitted.",
        +      "type": "string"
        +    },
        +    "owner": {
        +      "maxLength": 256,
        +      "type": "string"
        +    },
        +    "ticketId": {
        +      "maxLength": 128,
        +      "type": "string"
        +    },
        +    "writeScope": {
        +      "items": {
        +        "maxLength": 256,
        +        "type": "string"
        +      },
        +      "maxItems": 64,
        +      "minItems": 1,
        +      "type": "array"
        +    }
        +  },
        +  "required": [
        +    "ticketId",
        +    "claimState",
        +    "writeScope",
        +    "owner"
        +  ],
        +  "type": "object"
        +}
  2. 6 tool updatesv0.1.0
    • First observedagiw_consent
    • First observedagiw_jev_post
    • First observedagiw_jev_pre
    • First observedagiw_nisi_run
    • First observedagiw_readiness
    • First observedagiw_status

TDQS

A3.9/5.0

Scored across 6 tools

Disambiguation4/5

Each tool targets a distinct phase: readiness gate, informational status, consent management, isolated workflow execution, and pre/post Jev review. The main overlap is agiw_readiness vs agiw_status, both of which report on prerequisites, though descriptions differentiate them (ordered gate with a fix vs. a snapshot of versions/config).

Naming Consistency4/5

All names share a consistent agiw_ prefix, snake_case, and a domain_action shape (agiw_jev_pre, agiw_jev_post, agiw_nisi_run). Minor deviation: agiw_readiness, agiw_status, and agiw_consent are noun-only with no action verb, but they remain readable and predictable.

Tool Count5/5

Six tools is well-scoped for a gate-and-review server: two diagnostic tools, one execution tool, one consent tool, and a pre/post review pair. Every tool has a clear purpose with no filler.

Completeness4/5

The lifecycle (check readiness, run workflow, review before/after via Jev) is fully covered, and read-only-by-design behavior is explicit. The notable gap is that consent can only be granted out-of-band in a terminal, so an agent cannot complete that step itself; there is also no tool to list or inspect prior Jev/nisi results.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers