AGIW MCP
This server provides a local MCP coding workflow: readiness/status checks, opt-in TypeSafe Jev advisory checks, and local Nisi drafting/review runs on supplied file contents.
Check whether the machine is ready for “initiate online code mode,” returning READY or the first missing prerequisite and its fix.
Report versions, configuration (home shown as ~), and prerequisite status without exposing secrets.
Show or revoke Jev consent; consent can only be granted by the user in a terminal.
Send task text or a report to TypeSafe’s Jev model for advisory risk, missing-detail, and unbacked-claim checks, only with recorded consent and an API key.
Run one Nisi v0.2.0 workflow locally using configured author/reviewer models, with syntax checks, basic tests, optional assertions, bounded repair, and optional claim tickets.
Return proposed file contents and a report for the user to review and apply; it does not read/write project files or execute generated code.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@AGIW MCPinitiate online code mode and check my local setup"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
AGIW MCP
A careful coding workflow on your own local models, for any MCP-capable assistant.
AGIW MCP is a small local server for the Model Context Protocol. Add it to Claude Code, Factory or OpenCode, and your assistant gets three things:
Readiness check | Say "initiate online code mode". It checks this machine and answers |
Nisi workflow | One model drafts, checks and tests run, a second model reviews, and a short repair loop follows. You get proposed file contents and a report. It runs on your local models. |
Jev checks | Optional advisory questions before and after a task (risk, missing detail, unbacked claims), answered by TypeSafe's Jev model. Nothing is sent until you consent. |
Python standard library only, plus Node.js for Nisi. No telemetry.
Quick start
1. Install
pipx install git+https://github.com/louiscalata/agiw-mcp2. Point it at your local model server. You need an OpenAI-compatible server on
your own machine (for example LM Studio) and two different models: an author and a
reviewer. Save this as config.json in ~/Library/Application Support/agiw-mcp/
(macOS) or ~/.config/agiw-mcp/ (Linux):
{
"model_base_url": "http://127.0.0.1:1234/v1",
"author_model": "your-author-model-id",
"reviewer_model": "your-reviewer-model-id"
}3. Add it to your assistant
claude mcp add agiw-mcp -- agiw-mcp(Factory and OpenCode are under Setup details.)
4. Say "initiate online code mode". The assistant runs the readiness check and tells you what, if anything, is missing.
Related MCP server: Local-MCP-Bridge
What it will and won't do
It proposes; it never edits. Nisi receives file contents in the request and returns proposed contents. It never reads or writes your project files and never runs generated code. You decide what to apply.
Local models only. The model server must be on
127.0.0.1or::1. Hostnames, HTTPS and other addresses are refused.Jev is opt-in. You grant consent yourself, in a terminal. Your assistant cannot grant it for you. Jev's answers are advisory, not a verdict.
One request at a time, on one machine. No fleet, queue or background jobs.
No telemetry. The only local record is a Jev activity log of hashes, sizes and outcome codes, never your text.
Tools
Tool | What it does |
| Checks prerequisites in order and returns |
| Versions, configuration and which prerequisites are met. No secrets. |
| Shows exactly what Jev would receive, or revokes consent. Granting is terminal-only. |
| Advisory Jev questions about a task before you start (task text up to 12 KB). |
| Advisory Jev questions about a result or report (truncated to 12 KB). |
| One Nisi v0.2.0 workflow run on the file contents you supply, with your local models. |
A typical task: agiw_jev_pre → agiw_nisi_run → you review the proposed files →
agiw_jev_post.
Setup details
Python 3.10 or newer.
Node.js 22 or newer on the
PATHof the program that startsagiw-mcp(your MCP client).A local OpenAI-compatible chat server that supports JSON-schema structured output (
response_format: {"type": "json_schema"}), listening onhttp://127.0.0.1:<port>/v1orhttp://[::1]:<port>/v1.Two different models. The review is only independent if the reviewer is a different model. Use the exact IDs that
GET <model_base_url>/modelslists: Nisi refuses a response whosemodelfield differs from the configured ID.
Try it without installing:
uvx --from git+https://github.com/louiscalata/agiw-mcp agiw-mcp --versionOS | Config directory |
macOS |
|
Linux |
|
Windows |
|
All keys in config.json are optional; unknown keys are refused. Besides the three
shown in the quick start: keychain_service (default agiw-mcp), keychain_account
(default typesafe), jev_model (default jev-1.14.0), max_output_tokens
(default 4096), reasoning_effort (unset by default) and require_ticket (default false).
require_ticket: true makes agiw_nisi_run refuse any request without a claim ticket.
reasoning_effort (none, low, medium or high) is added to each Nisi chat request. Set it
to none for reasoning models such as Qwen 3 or Granite 4 on LM Studio: under JSON-schema output they
otherwise spend their tokens on hidden reasoning and return empty answers.
The model settings can come from the environment instead:
AGIW_MCP_BASE_URL (or the legacy AGIW_MCP_MODEL_BASE_URL, used only when
AGIW_MCP_BASE_URL is unset), AGIW_MCP_AUTHOR_MODEL, AGIW_MCP_REVIEWER_MODEL,
AGIW_MCP_REASONING_EFFORT.
Config key | Environment variable | Precedence and validation |
|
|
|
|
| Optional. |
Check your setup at any time:
agiw-mcp --version
agiw-mcp readinessJev needs your own TypeSafe API key. agiw-mcp looks for it in this order and never stores it in a plain file:
The environment variable
TYPESAFE_API_KEY, set in the MCP client's environment for this server.The macOS Keychain. Type the key at the prompt (not on the command line, where it would be saved in your shell history):
security add-generic-password -s agiw-mcp -a typesafe -wThe Linux Secret Service (GNOME Keyring, KWallet), which also prompts:
secret-tool store --label='agiw-mcp TypeSafe' service agiw-mcp account typesafe
On Windows, use the environment variable. On macOS, the readiness check
verifies presence without reading the key. On Linux, secret-tool lookup
returns the value, which agiw-mcp discards.
The Jev tools refuse to run until you consent:
agiw-mcp consent show # exactly what is sent, and to where
agiw-mcp consent grant # interactive; type I agree and press Return
agiw-mcp consent revokeThe confirmation is case-insensitive. In order, the prompt trims outer
whitespace, strips leading and trailing straight single or double quote
characters, removes all trailing periods, trims outer whitespace again, and
compares the result case-insensitively with i agree. For example, I AGREE,
'I agree', I agree... and "I agree." are accepted; "I agree". is not,
because quote stripping happens before period removal. Extra words or a
different space between the two words are not accepted. Non-interactive input
is refused, and an unrecognized confirmation records nothing.
Consent is tied to a hash of the disclosure text, so if a later version changes what is sent, you are asked again. See SECURITY.md.
Claude Code
claude mcp add agiw-mcp -- agiw-mcpWith the model settings in the environment:
claude mcp add agiw-mcp -e AGIW_MCP_AUTHOR_MODEL=your-author-model-id \
-e AGIW_MCP_REVIEWER_MODEL=your-reviewer-model-id -- agiw-mcpFactory (droid)
droid mcp add agiw-mcp agiw-mcpor in ~/.factory/mcp.json:
{
"mcpServers": {
"agiw-mcp": { "type": "stdio", "command": "agiw-mcp", "args": [] }
}
}OpenCode (opencode.json or opencode.jsonc):
{
"mcp": {
"agiw-mcp": { "type": "local", "command": ["agiw-mcp"], "enabled": true }
}
}If the client cannot find agiw-mcp, use the absolute path that
command -v agiw-mcp prints, and make sure node is on that client's PATH.
agiw_nisi_run takes task (required), files (a list of {path, content} with
relative paths), new_files (paths the author may create), acceptance_criteria,
assertions ({path, contains} or {path, not_contains}), repair_budget (0 to 3,
default 1), timeout_seconds (30 to 1800, default 600) and an optional ticket.
A ticket is {ticketId, claimState, writeScope, owner}. Only claimState Granted or
Active is admitted; writeScope is a list of scope keys or /-separated paths. Before
Node is started or a temporary folder is created, the ticket is admitted all-or-nothing: it
is refused (TICKET_SCOPE_CONFLICT) if any scope equals, contains or is contained in a scope
of a ticket already admitted, by this or another agiw-mcp process. Scopes are compared
ignoring case and Unicode normalization (README.md and readme.MD are the same scope).
Scope parts that Windows would alias are refused (TICKET_INVALID) rather than normalized:
parts ending in . or a space (calc.py.), parts containing :, and device names such as
CON, NUL, COM1 or LPT1 with any extension. The ticket is released when the run ends.
Admission state lives in tickets/ under the config directory, or in AGIW_MCP_TICKET_DIR
(an absolute path). On macOS and Linux that directory must not be a symlink and must be owned
by you with mode 0700 (a looser mode is tightened if possible), and every directory above
it, including through symlinks, must be owned by you or root and not writable by group or
others unless sticky (like /tmp); otherwise admission is refused (TICKET_REGISTRY_UNSAFE).
A run's locks are released only from the directory they were created in. Locks left by a
crashed process are not cleaned up automatically; they refuse later admissions until removed.
On Windows, ticket admission is disabled for now: any ticket is refused
(TICKET_UNSUPPORTED_PLATFORM) before the state directory is touched, until agiw-mcp can
check the directory for reparse points, ownership and permissions. Runs without a ticket
still work on Windows unless require_ticket is true.
Refusals name only the ticket id.
Its static checks parse Python (ast.parse), JavaScript (node --check) and JSON;
other file types get structural checks only, and the result says which files were
parsed. Its tests are: at least one file changed, no proposed file is empty, and your
assertions. Limits: 64 files, 256 KB per file, 512 KB in total.
Requests are handled one at a time: while a Nisi run is in progress (up to its
timeout), other requests wait. Nisi's COMPLETED means the configured checks, tests
and review passed; it is not a guarantee of correctness.
claude mcp remove agiw-mcp # or remove it from your client's config
pipx uninstall agiw-mcpThen delete the config directory listed above, and the Keychain or Secret Service item if you created one:
security delete-generic-password -s agiw-mcp -a typesafe # macOS
secret-tool clear service agiw-mcp account typesafe # LinuxDevelopment
python3 scripts/scrub_check.py
PYTHONDONTWRITEBYTECODE=1 python3 -B -m unittest discover -s tests -vThe tests never reach the network: the model server and Jev are fakes on 127.0.0.1, test mode refuses non-loopback URLs, and a socket guard blocks any other connection. Without Node 22+, a fake runner covers the Python side. Binding the loopback fakes needs local port binding to be allowed.
Security and licence
Security model and how to report a problem: SECURITY.md.
Apache-2.0. See LICENSE, NOTICE and PROVENANCE.md.
The vendored Nisi v0.2.0 package keeps its own LICENSE and manifest in
src/agiw_mcp/vendor/nisi/.
Available Tools
6 toolsagiw_consentConsent for Jev (TypeSafe)A
Show or revoke consent to send text to TypeSafe for the Jev checks. "show" returns exactly what is sent. Consent cannot be granted through this tool: only the user can grant it, by running agiw-mcp consent grant in a terminal.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds useful behavioral context beyond annotations, especially the privacy-relevant point that `show` returns exactly what is sent and the restriction that granting consent is impossible here. It does not contradict the annotations, but it omits the consequences of revoking consent or whether revocation is immediate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short, front-loaded, and every sentence adds value. It moves directly from the operation to the `show` behavior and then the critical grant limitation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter consent tool with annotations and no output schema, the description is largely complete: it explains the two actions, the `show` payload, and the grant limitation. The main missing context is what `revoke` changes operationally and whether it affects subsequent Jev checks.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is one required parameter with an enum (`show`/`revoke`) and 0% schema description coverage. The description meaningfully explains `show` output and the grant restriction, but it does not add much semantic detail for `revoke` beyond the action name.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb pair and resource: show or revoke consent to send text to TypeSafe for Jev checks. It is clearly distinct from sibling tools such as agiw_status or agiw_nisi_run, though it does not explicitly name or differentiate against agiw_jev_pre/agiw_jev_post.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It clearly states an important usage boundary: consent cannot be granted through this tool and must be granted by the user via `agiw-mcp consent grant` in a terminal. It also explains that `show` returns exactly what is sent, but it does not explicitly describe when to prefer revoke or what operational impact revoking has.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
agiw_jev_postJev post-analysis (advisory)A
Send a result or report (truncated to 12 KB) to Jev at TypeSafe with fixed questions about self-contradiction, unbacked claims, risk of acting on it and misclassified findings. Advisory, not a verdict. Refused unless consent is recorded and a key is available. Never retried automatically.
| Name | Required | Description | Default |
|---|---|---|---|
| report | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With annotations only covering safety flags, the description adds the operationally critical facts: input truncation at 12 KB, an external service (openWorld) at TypeSafe, the consent/key access gate, and 'Never retried automatically.' Those are exactly the traits annotations cannot convey and directly affect a caller's error handling.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three compact sentences, each earning its place: destination and payload, analysis scope, then the advisory nature and access constraints. The truncation limit is front-loaded right on the payload noun.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, yet the description tells the agent what the service will answer (the four fixed questions) and that the answer is advisory. A short note on the shape of the response or the failure mode when consent/key is missing would make it fully self-sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single `report` parameter has 0% schema description coverage, so the description must compensate. It usefully discloses the 12 KB truncation limit, but says nothing about expected content, format, or what happens to the truncated remainder, leaving the bulk of semantics to inference.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Send a result or report') and a specific destination ('Jev at TypeSafe'), plus the exact analytical questions asked (self-contradiction, unbacked claims, risk, misclassified findings). This clearly separates it from the sibling agiw_jev_pre, though the differentiation is carried mostly by the pre/post naming rather than an explicit contrast.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Advisory, not a verdict' sets the trust level, and 'Refused unless consent is recorded and a key is available' names the prerequisite gates an agent must satisfy before calling. It lacks an explicit when-not or a pointer to agiw_jev_pre/'agiw_consent', so it is clear context rather than full routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
agiw_jev_preJev pre-analysis (advisory)A
Send a task description (at most 12 KB) to Jev at TypeSafe with fixed questions about risk, blockers, missing detail, irreversible actions and reliance on old reports. Returns Jev's answers and which are flagged. Advisory, not a verdict. Refused unless consent is recorded and a key is available. Never retried automatically.
| Name | Required | Description | Default |
|---|---|---|---|
| task | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Adds substantial context beyond the annotations: the payload leaves the boundary to a third party at TypeSafe, has a hard 12 KB cap, can be refused for missing consent/key, and is never retried automatically — an important non-obvious trait given idempotentHint=false. It also discloses the return shape (answers plus flagged items) and that results are advisory, not a verdict.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four tight sentences, each carrying distinct information — payload, destination, questions asked, return shape, advisory status, preconditions, retry policy. The core purpose is front-loaded with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter external-call tool with no output schema, the description covers who receives the data, what is asked, what comes back, refusal conditions, and the epistemic weight of the result. Nothing an agent needs to invoke it safely is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description must carry the load, and it does: the single 'task' parameter is characterized as a task description with a 12 KB ceiling matching the schema maxLength. It does not describe expected internal structure or formatting conventions for the payload, so it falls just short of full compensation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a concrete verb and resource: send a task description to a named external service (Jev at TypeSafe) for pre-analysis against fixed questions. The 'pre' framing plus 'Advisory' makes it distinguishable from agiw_jev_post, though it never names that sibling explicitly to route the agent.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear preconditions ('Refused unless consent is recorded and a key is available') and sets expectations ('Advisory, not a verdict'), which tells the agent this is not a gate. It does not explicitly say when to choose this over agiw_jev_post or agiw_readiness.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
agiw_nisi_runRun one Nisi workflow locallyARead-only
Run one Nisi v0.2.0 workflow (draft, syntax check, tests, independent review, bounded repair) on file CONTENTS you pass in, using the configured local author and reviewer models. Runs in a private temporary directory that is removed afterwards. Never reads or writes project files and never executes generated code; returns proposed contents and Nisi's report for you to review and apply yourself. Tests are the built-in checks (some file changed, no empty file) plus optional contains/not_contains assertions.
| Name | Required | Description | Default |
|---|---|---|---|
| task | Yes | What to change, in plain language. | |
| files | No | Current contents of the files the models may change (relative paths). | |
| ticket | No | Optional claim ticket (required when config require_ticket is true). Admitted before the run starts, refused if its write scope overlaps an admitted ticket, released afterwards. | |
| new_files | No | Relative paths the author may create. | |
| assertions | No | ||
| repair_budget | No | ||
| timeout_seconds | No | ||
| acceptance_criteria | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Very strong disclosure beyond the annotations: a private temporary directory that is removed afterwards, no reads or writes of project files, no execution of generated code, and the return contract (proposed contents plus Nisi's report). It also describes ticket lifecycle behavior — admitted before the run, refused on write-scope overlap, released afterwards — which the annotations cannot convey. All of this is consistent with readOnlyHint=true and openWorldHint=false.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, front-loaded with what the tool does, then safety constraints, then test semantics — no wasted clauses. The sentences are long and densely packed, which slightly strains readability, but every clause carries substantive information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description does the necessary work of stating what comes back (proposed contents and Nisi's report) and what does not happen on disk, which is exactly what an agent needs before committing to a run. Gaps remain around failure modes beyond ticket refusal, timeout behavior, and repair_budget/acceptance_criteria semantics for an 8-parameter tool with nested objects.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 50%, so the description must carry more weight. It does add meaning for 'files' (current contents the models may change), the ticket flow, and assertions ('contains/not_contains' alongside built-in checks), but it is silent on acceptance_criteria, timeout_seconds, repair_budget (only 'bounded repair' is hinted at, no default of 1 or cap of 3), and new_files. Adequate but incomplete given the coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb and resource — 'Run one Nisi v0.2.0 workflow' — and enumerates the pipeline stages (draft, syntax check, tests, independent review, bounded repair), plus the crucial input distinction that it operates on 'file CONTENTS you pass in' rather than a project path. That is clearly separable from sibling tools like agiw_status, agiw_readiness, and agiw_jev_*.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description establishes the usage context well: the caller supplies file contents, the run is sandboxed in a temp directory, and the caller is expected to 'review and apply yourself.' It also states the conditional ticket requirement is governed by config. However, it never names an alternative tool or states explicit when-not-to-use-this conditions relative to the agiw_* siblings, so it stops short of full routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
agiw_readinessOnline code mode readinessARead-only
The "initiate online code mode" check. Only checks, never starts work. Returns READY, or the FIRST missing prerequisite with an exact fix, in this order: Python, configuration, Node.js 22+, vendored Nisi hashes, local OpenAI-compatible model server listing two distinct configured models, consent recorded, TypeSafe API key present (macOS: presence checked without reading it; Linux: secret-tool lookup returns it but agiw-mcp discards it).
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only declare readOnlyHint=true and openWorldHint=false; the description far exceeds them by enumerating the ordered prerequisites checked and specifying the return contract (READY, or the FIRST failure with an exact fix). It also discloses sensitive handling behavior — macOS key presence checked without reading it, Linux secret-tool output discarded by agiw-mcp — which an agent could not infer elsewhere.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose is front-loaded in the first clause and every subsequent clause carries distinct information — the ready/fail contract, the ordered list, and the platform-specific key handling. The prerequisite sequence and the parenthetical platform detail would read better as a list than as one long run-on sentence.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description carries the full burden and does so: it defines the return states, the deterministic ordering of failures, and what each check inspects. An agent can decide whether to call it and interpret the result without additional documentation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there is nothing extra for the description to document; baseline applies. The description correctly spends its words on the check sequence and return values instead of restating an empty schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Names a specific verb (check) and resource (online code mode readiness) and immediately scopes it: "Only checks, never starts work." That single exclusion separates it from mutation-oriented siblings such as agiw_nisi_run or agiw_nev_post without needing to open their schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
"The 'initiate online code mode' check" plus "never starts work" makes the pre-flight use case clear and rules out using it as a launcher. However, it never names an alternative tool (agiw_status, agiw_nisi_run) or states explicitly when to skip this call, so the routing is implied rather than spelled out.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
agiw_statusAGIW MCP statusBRead-only
Versions, configuration (home directory shown as ~) and which prerequisites are met. Contains no secrets and starts no work.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already establish readOnlyHint=true and openWorldHint=false, yet the description still adds genuinely useful behavioral context: it discloses that the output contains no secrets, that the home directory is redacted to '~', and that the call starts no work. That is real value beyond the structured fields for a diagnostic tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One dense sentence with every clause earning its place — the safety note and redaction note are both operationally relevant. It reads as a fragment rather than a complete sentence, which slightly weakens front-loading of the primary purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-param, read-only diagnostic with no output schema, the description covers roughly what the caller will receive and reassures about side effects. However, it leaves the response shape unspecified and, more importantly, leaves the overlap with agiw_readiness unresolved, which is the main thing an agent needs to resolve before calling.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so per the baseline there is nothing for the description to disambiguate. The description correctly adds no parameter discussion, which is the right call.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description is a noun-phrase list of what the tool surfaces (versions, configuration, prerequisite status) rather than a verb+resource statement of what it does. It is not a tautology of the name, but it also gives no basis for distinguishing it from the sibling agiw_readiness, which plausibly covers the same 'prerequisites are met' territory.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no stated preconditions, and no mention of alternatives. An agent facing agiw_status vs agiw_readiness vs agiw_consent gets no routing signal from this text at all.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
1 tool update
- Changed
agiw_nisi_run1 field changed- added
Input schema / properties / ticketAdded value: +{ + "additionalProperties": false, + "description": "Optional claim ticket (required when config require_ticket is true). Admitted before the run starts, refused if its write scope overlaps an admitted ticket, released afterwards.", + "properties": { + "claimState": { + "description": "Only Granted or Active is admitted.", + "type": "string" + }, + "owner": { + "maxLength": 256, + "type": "string" + }, + "ticketId": { + "maxLength": 128, + "type": "string" + }, + "writeScope": { + "items": { + "maxLength": 256, + "type": "string" + }, + "maxItems": 64, + "minItems": 1, + "type": "array" + } + }, + "required": [ + "ticketId", + "claimState", + "writeScope", + "owner" + ], + "type": "object" +}
6 tool updates
v0.1.0- First observed
agiw_consent - First observed
agiw_jev_post - First observed
agiw_jev_pre - First observed
agiw_nisi_run - First observed
agiw_readiness - First observed
agiw_status
TDQS
Scored across 6 tools
Each tool targets a distinct phase: readiness gate, informational status, consent management, isolated workflow execution, and pre/post Jev review. The main overlap is agiw_readiness vs agiw_status, both of which report on prerequisites, though descriptions differentiate them (ordered gate with a fix vs. a snapshot of versions/config).
All names share a consistent agiw_ prefix, snake_case, and a domain_action shape (agiw_jev_pre, agiw_jev_post, agiw_nisi_run). Minor deviation: agiw_readiness, agiw_status, and agiw_consent are noun-only with no action verb, but they remain readable and predictable.
Six tools is well-scoped for a gate-and-review server: two diagnostic tools, one execution tool, one consent tool, and a pre/post review pair. Every tool has a clear purpose with no filler.
The lifecycle (check readiness, run workflow, review before/after via Jev) is fully covered, and read-only-by-design behavior is explicit. The notable gap is that consent can only be granted out-of-band in a terminal, so an agent cannot complete that step itself; there is also no tool to list or inspect prior Jev/nisi results.
Maintenance
Related MCP Connectors
Remote MCP for Gemini upgrade evals, prompt regressions, output diffs, and eval receipts.
MCP server for your apps' tools and custom tools, plus hosted AI agents and approval-gated workflows
A paid remote MCP for OpenAI Codex agent coordination MCP, built to return verdicts, receipts, usage
Remote MCP for tool license checks, vendor policy review, alternatives, and license receipts.
Related MCP Servers
- AlicenseNot gradedqualityBmaintenanceEnables local static analysis of deployed AI model artifacts over MCP, exposing audit, diff, capabilities, and rule-explanation tools without uploading model bytes.199 npm2Apache 2.0
- AlicenseAqualityBmaintenanceEnables MCP-compatible AI clients to securely access explicitly authorized local project files and run approved development commands with bounded execution and audit logging.1MIT
- AlicenseAqualityBmaintenanceEnables AI assistants to securely operate on a local workstation through MCP by exposing file, shell, and workspace management tools.10MIT
- AlicenseNot gradedqualityAmaintenanceEnables AI assistants to securely inspect, search, edit, build, and test explicitly authorized local development projects over MCP, with sandboxed filesystem access and sensitive-file protection.2AGPL 3.0