MCP Rating Gateway
Summary: The MCP Rating Gateway is a meta-MCP server that discovers, connects to, and proxies other MCP servers behind one config entry, while scoping their environment access and giving you sandboxing, audit, and usage controls.
Discover servers —
mcp_discoversearches MCP Rating (or other registries) by query/category, ordered by what it can actually start, with trust tiers, scores, and install info.Connect / disconnect —
mcp_connectspawns a local server (slug,command+args, orurl) and exposes its tools namespaced asslug__toolname;mcp_disconnectremoves them. Confirmation is required for Community/Unverified, risky, or delisted packages.Call proxied tools —
mcp_call_toolinvokes any connected server's tool with JSON arguments;mcp_list_activeshows connected servers and their tools.Inspect a server —
mcp_server_inforeturns registry or live-connection details (score, tier, safety flags, start test, release dates).Check health —
mcp_gateway_healthreports version, uptime, connection status, array of registry reachability, and per-server health.Control sandboxing —
mcp_sandboxviews/sets/resets a server's manifest: filesystem read/write paths, network mode and allowlist, allowed env var names, subprocess use, and isolation level (L1 process vs L2 container).Review the audit trail —
mcp_auditshows connects, tool calls, blocked tools, blocked/allowed network egress, and personal-data requests, filterable by server, event type, or security-only.Manage profiles —
mcp_profilescreates, switches, shows, and edits named connection presets (work, personal, …).Manage groups —
mcp_groupscreates server sets and connects/disconnects them atomically.Track usage —
mcp_usagereports call counts, latency, error rates, recent/slow calls (in-memory only; nothing leaves the process).Get recommendations —
mcp_recommendsuggests servers from a free-text goal or from your past tool-call patterns.Keep your keys out of servers — servers are spawned with a short allowlist plus only the env vars you or their manifest name; secrets stay in the gateway's
envunless explicitly allowed by name.Enforce a quality floor —
MCP_GATEWAY_MIN_SCORE(orminQualityScore) refuses anything MCP Rating scores below the threshold or hasn't scored, regardless of how it's launched.
Can connect to and proxy a GitHub MCP server on demand, exposing its tools (e.g. issue, repo, and pull-request operations) through the gateway so they can be called without statically configuring the server.
Can connect to and proxy an MCP server for SQLite databases on demand, allowing an agent to query a local SQLite database through the gateway without statically configuring the server.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@MCP Rating Gatewayfind a Postgres MCP server in the registry and connect to it"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
@mcp-rating/gateway
Run MCP servers without handing them the API keys in your environment.
Whether a server you add can read your environment (AWS_SECRET_ACCESS_KEY,
OPENAI_API_KEY, DATABASE_URL) depends on how your client starts it. The
official MCP SDKs pass a short allowlist by default: HOME, PATH, USER and a
few more. A client or script that passes its whole environment, often just to
forward the one token a server needs, hands over everything. We haven't yet
measured which popular clients do which, so we don't name any. The gateway
doesn't leave it to the client: it spawns every server with a constructed
environment, the SDK's short allowlist (PATH, HOME, USER and a few
more) plus only the variables you or its manifest name. Nothing else from your
environment is there to read.
Files are a different matter. By default a server still runs as you, so it
can read what you can — ~/.ssh, ~/.aws/credentials, a project's .env. Only
container isolation (opt-in, needs Docker) closes that. See
what each level protects.

Started with the whole environment | Through the gateway | |
Environment visible to the server | everything the client had | a short allowlist ( |
Credentials in environment variables | all of them | none you didn't name |
Credential files ( | readable | still readable, unless container isolation is on |
Reproduce it yourself in about ten seconds: node demo/run-demo.mjs plants two fake
credentials and runs the server both ways. It prints the planted values in full and,
for anything real it finds in your environment, only the variable's name, never its
value. The GIF is generated by node demo/render-gif.mjs from a clean, synthetic
environment, so it shows nothing from any real machine.
It is also a meta-server: one entry in your config gives you the whole registry, connected on demand rather than pre-loaded.
{ "mcpServers": { "gateway": { "command": "npx", "args": ["-y", "@mcp-rating/gateway"] } } }Why it uses less of your context
Every MCP server you configure statically injects its full tool schema into every turn, whether you use it or not. The gateway exposes 13 meta-tools at a fixed cost and loads a server's tools only once you connect to it.
measured | |
Median real MCP server | 2,587 tokens |
10 servers configured statically | ~25,900 tokens, every turn |
Gateway, flat | 2,644 tokens |
Roughly 10× less standing overhead at ten servers, and the gap widens with each one you add. One median server already costs about what the entire gateway costs.
But standing overhead is not the bill — here is the break-even
That 10× is what sits in the window. It is not what a conversation costs,
because the gateway also adds turns: it has to discover a server and connect to
it before using it, every turn re-sends the whole transcript, and mcp_discover
output stays in that transcript afterwards.
Measured end to end on gemma-4-31B through vLLM, with the server's own tokenizer rather than an estimate:
tokens | turns | |
Gateway, cold — discover, connect, then call a tool | 17,904 | 5 |
Same tool call, server already configured | 6,605 | 2 |
With one server, the gateway costs 2.7× more than just configuring it. The saving only appears once you have enough servers that carrying all their schemas outweighs the setup. N configured, one actually used, after ten turns of work:
servers | static | gateway | |
1 | 25,870 | 70,524 | static wins 2.7× |
2 | 51,740 | 70,524 | static wins 1.4× |
4 | 103,480 | 70,524 | gateway wins 1.5× |
10 | 258,700 | 70,524 | gateway wins 3.7× |
20 | 517,400 | 70,524 | gateway wins 7.3× |
Break-even is three to five servers. Below that, a hand-written config is genuinely cheaper and you should use one. Above it the gateway wins, and keeps winning as you add more — but the honest figure at ten servers is about 3× on total tokens, not the 10× you get by counting standing overhead alone.
Honest about the method: measured from the tool schemas of 91 servers this
project has connected to and introspected — drawn from the 300 most-downloaded
in the registry — summing {name, description, inputSchema} per tool, the
payload a client actually receives from tools/list, sized as chars / 4. That
is an estimate, not a tokenizer.
Median, not mean, and the distribution is why. The mean is 9,965 tokens, dragged there by a long tail: 19 of the 91 cost over 10,000 tokens and the heaviest — a Spotify server exposing 608 tools — costs 135,666, about 68% of a 200k context window on its own. Quoting the mean would flatter this project's numbers using servers almost nobody installs.
The saving is real precisely because most configured servers sit unused in most conversations — but see the break-even above before assuming it applies to you.
The chars / 4 estimate was checked against three real tokenizers and came in at
0.88×, 0.98× and 1.01× of the true count, so it never reads low.
Reproduce both: node demo/shorts/short2-context.mjs --refresh for the schema
corpus, and demo/ollama-probe.mjs for the end-to-end bill —
# gateway cold: must discover and connect first
OLLAMA_HOST=http://host:8000/v1 node demo/ollama-probe.mjs your-model
# baseline: server already attached, like a static config
PRECONNECT=everything-slim OLLAMA_HOST=... node demo/ollama-probe.mjs your-modelRelated MCP server: Multi-MCP Proxy
How It Works
┌────────────────────┐ ┌──────────────┐ ┌──────────────────┐
│ Claude Desktop / │ stdio │ │ stdio │ MCP Server A │
│ Cursor / Windsurf │◄─────►│ MCP Gateway │◄──────►│ (e.g. filesystem)│
│ (host client) │ │ │◄──┐ └──────────────────┘
└────────────────────┘ └──────────────┘ │ ┌──────────────────┐
│ └───►│ MCP Server B │
▼ │ (e.g. github) │
┌──────────────┐ └──────────────────┘
│ MCP-Rating │
│ Registry API │
└──────────────┘Instead of manually configuring each MCP server in your client, the Gateway:
Discovers servers via the MCP-Rating registry, listing first the ones it can start right now (see below)
Connects to them on-demand: spawns local ones as child processes, and connects hosted ones to the endpoint the registry lists
Proxies their tools through namespaced names (
servername__toolname)Notifies your client when tools are added/removed
Quick Start
With Claude Desktop
Add to your claude_desktop_config.json:
{
"mcpServers": {
"gateway": {
"command": "npx",
"args": ["-y", "@mcp-rating/gateway"]
}
}
}Then ask Claude:
"Search for MCP servers that work with databases" (uses
mcp_discover)"Connect to the sqlite server" (uses
mcp_connect)"Query my database" (calls the proxied tool directly)
Cursor
~/.cursor/mcp.json (or .cursor/mcp.json in a project):
{
"mcpServers": {
"gateway": { "command": "npx", "args": ["-y", "@mcp-rating/gateway"] }
}
}Claude Code
claude mcp add gateway -- npx -y @mcp-rating/gatewayWindsurf
~/.codeium/windsurf/mcp_config.json, same shape as Cursor:
{
"mcpServers": {
"gateway": { "command": "npx", "args": ["-y", "@mcp-rating/gateway"] }
}
}Any other MCP client
{ "command": "npx", "args": ["-y", "@mcp-rating/gateway"] }Restart the client after editing its config — most read it only at startup.
What mcp_discover puts first
An agent can only use a server the gateway can start, so results are ordered by that, keeping relevance order within each group:
Verified: the registry's own harness started it and it listed its tools (
✓ Started in our test).Ready, untested: installable here, or a hosted endpoint that needs no header, and any key it declares is set.
Needs setup: a declared key isn't set, its launcher (
uvx,docker) isn't installed, or the hosted endpoint needs a header the gateway can't send yet.Failed in our test: it didn't start when the registry tried it, with no credentials (
✗ Didn't start in our test).Can't start by slug: no install command and no endpoint recorded.
"Verified" means it started and listed tools, not that every tool works without a key. The harness supplies none. Most of the index has never been tried; that says nothing either way.
Meta-Tools
The gateway exposes 13 built-in tools:
Tool | Description |
| Search the MCP-Rating registry; servers the gateway can start now come first |
| Connect to a server and make its tools available |
| Disconnect a server and remove its tools |
| List connected servers and their tools |
| Detailed info about a server, from the registry or a live connection |
| Call a tool on a connected server |
| Diagnostics: version, uptime, connection and registry status |
| View or customise a server's sandbox manifest (env/network/filesystem) |
| The safety audit trail — what sandboxed servers actually did |
| Named connection profiles (work, personal, …) |
| Atomic connect/disconnect of server sets |
| Call counts, latency and error rates for connected servers |
| Server recommendations based on usage |
Trust Tiers
Every connected server is labeled with a trust tier based on its MCP-Rating quality score:
[Verified] — High quality + officially verified
[Trusted] — Good quality with repository, and an install command or a remote endpoint
[Community] — Listed in registry with basic quality
[Unverified] — A package MCP Rating doesn't know, from any registry or started by command
A safety score in the risk band caps the tier, as it does on the site: below 50 a server is at most [Community], below 30 it is [Unverified].
What mcp_connect shows, and when it asks first
Before anything starts, mcp_connect looks up what MCP Rating knows about the
package that would run — from the registry entry, or, for an explicit command
or url, from the package itself (npx pkg, uvx pkg, docker run image,
the endpoint). A known package started by command is judged as itself, not as
[Unverified]. Shown in the confirmation and again once connected:
score and trust tier, with the server's page;
safety score and each flag with its reason;
MCP Rating's own start test: started, didn't start, needs credentials, or not tested;
last release and last code push, with where each date comes from.
It asks for confirmation for a [Community] or [Unverified] server, and, whatever the tier, when the safety score is in the risk band, MCP Rating has delisted the package, or a registry name points at a different package than MCP Rating knows by that name.
A minimum score
MCP_GATEWAY_MIN_SCORE=60 (or "minQualityScore": 60 in config.json) refuses
to connect anything MCP Rating scores below 60, or hasn't scored — by slug,
registry name, command or URL alike, so a local node server.js is refused too.
confirmed: true doesn't lift it, since an agent can set that itself; only the
setting does. It needs MCP Rating among the registries. A value that isn't a
whole number from 0 to 100 refuses everything until it is fixed, rather than
quietly meaning "no rule".
Registries
By default the gateway searches MCP Rating. It can search any registry that speaks the official MCP Registry API (v0.1) instead, or as well: the official registry, a company's own registry, or MCP Rating's mirror of it.
{
"mcpServers": {
"gateway": {
"command": "npx",
"args": ["-y", "@mcp-rating/gateway"],
"env": {
"MCP_GATEWAY_REGISTRIES": "https://mcprating.io/api/v1,https://registry.acme.internal"
}
}
}
}The list replaces the default. Leave MCP Rating out and the gateway never contacts it for discovery.
Each entry is a URL. One ending in
/api/v1is taken as MCP Rating's own API, and anything else as the MCP Registry API. To say which explicitly, writemcprating=URLormcp-registry=URL.Searches go to every registry and are merged. A server two registries both list appears once, as the first-listed registry has it. A search waits up to 15 seconds; a registry that hasn't answered by then is named in the results, and the rest are shown.
Connecting by name. A server from an MCP Registry API registry connects by its registry name,
mcp_connect({slug: "io.github.owner/server"}). That works in any later session too.Scores come from MCP Rating only. Quality scores, safety flags and start tests are MCP Rating's. When MCP Rating is one of your registries, a server found in another one gets MCP Rating's record of the same package — the same npm or PyPI package, Docker image or hosted endpoint — in one request per search. It is matched by package, never by name: any registry can give any package a well-known name. Otherwise the server shows as unrated and [Unverified], so connecting it asks for confirmation. Numbers another registry puts in its own entries (
_meta) are not read: anyone can write them.Warnings that stop a connect. If MCP Rating knows a server's registry name as a different package, or has delisted the package,
mcp_discoversays so, lists it last, andmcp_connectasks for confirmation whatever its trust tier.The partner key goes to MCP Rating only, never to another registry.
The official registry's search matches server names only and was slow when this was written (7–40 s per search on 2026-10-14). The gateway asks it for the query's longest word and ranks what comes back by how many of your words match.
Configuration
The gateway reads config from ~/.mcp-gateway/config.json:
{
"registryApiUrl": "https://mcprating.io/api/v1",
"proxyTimeoutMs": 30000,
"maxConnections": 10,
"logLevel": "info"
}Environment Variables
Variable | Description | Default |
| MCP-Rating API base URL |
|
| Comma-separated registries to search instead (see Registries) | MCP Rating alone |
| Refuse anything MCP Rating scores below this, or hasn't scored (see A minimum score) | no rule |
| Proxy timeout (ms) |
|
| Max simultaneous connections |
|
| Log level (debug/info/warn/error) |
|
| Force L2 container isolation on/off | manifest decides |
| Path for the forensic audit log | disabled |
| Partner attribution key — enables ad telemetry | unset |
| Set to | unset |
| Bearer token for HTTP daemon mode | unset |
Security model
The gateway exists so that what a server can see doesn't depend on how your client happens to start it. Two layers push back, and it is worth being precise about what each one does and does not do.
L1 — environment scoping (always on, for stdio servers)
A downstream server receives the MCP SDK's default allowlist (HOME, LOGNAME,
PATH, SHELL, TERM, USER on macOS and Linux; PATH, USERPROFILE,
APPDATA, TEMP and a few more on Windows), plus only the variable names
its manifest allowlists or you pass at connect time. Everything else in
the parent environment — AWS_*, OPENAI_API_KEY, DATABASE_URL — is withheld.
Exported shell functions (BASH_FUNC_*) are dropped rather than forwarded.
This is genuine enforcement: the child process is spawned with a constructed environment, so there is nothing to opt out of or bypass.
L1 does not restrict files or the network. The server runs as your user: it
can read anything you can, including ~/.ssh, ~/.aws/credentials and .env
files, and it can connect to any host. A manifest can declare network and
filesystem limits, but outside a container nothing enforces them, and the
connect summary says "not restricted" rather than listing them.
L2 — container isolation (opt-in)
With MCP_GATEWAY_CONTAINER_ISOLATION=true, community and unknown servers run
under docker/podman in an ephemeral container. You can also opt one server
in with mcp_sandbox({action: "set", slug: "…", enforcement: "l2-container"}).
Inside, the server gets a read-only root, a scratch /tmp, and only the paths
its manifest declares mounted from the host. network: "none" gives the
container no network at all. Without Docker or Podman, the gateway falls back to
L1 and logs that it did.
Network allowlists: read this before relying on them
Allowlists apply only under L2. network: "allowlist" starts a forward
proxy and points the container at it via HTTP_PROXY/HTTPS_PROXY. The proxy
accepts only tunnels that carry a random credential generated for that
connection, which the container receives in those variables. With Docker Desktop
it listens on loopback. With Docker on Linux it has to listen on all interfaces,
because the container reaches it over the bridge, and the credential is what
keeps other machines from using it.
This filters proxy-aware clients only. Node's fetch/undici, axios, and Python
requests all honour those variables, which covers most real servers. A program
that opens raw TCP sockets, or a compiled binary that ignores proxy environment
variables, is not filtered. Treat an allowlist as a guard rail against honest
code, not a containment boundary against hostile code. For that, use
network: "none".
Giving a server an API key
Put the key in the gateway's env in your client config, not in the chat:
{
"mcpServers": {
"gateway": {
"command": "npx",
"args": ["-y", "@mcp-rating/gateway"],
"env": { "GITHUB_TOKEN": "ghp_…" }
}
}
}A server receives it only if its registry entry declares that variable. For one
that doesn't, allowlist the name, never the value:
mcp_sandbox({action: "set", slug: "…", envAllow: ["GITHUB_TOKEN"]}).
mcp_connect also accepts env: { NAME: "value" }. That works, but the model has
to write the secret into a tool call, which puts it in your chat transcript and
your model provider's logs.
When a server asks the model for personal data
A hosted server can ask for an email, a phone number or a card number in an ordinary tool result, and the model is what answers. During our own test runs, a local 31B was asked for an email "to record your free quota" and made one up. No sandbox can see that: it's a request in the content channel.
Since 0.2.6 the gateway checks each tool result for a personal-data term next to
a verb of handing it over, in English and Chinese, within its first 1,500
characters. On a match it appends a warning the model reads with the result:
ask the user, and never make up a value. It also records
personal_data_requested in the audit trail (mcp_audit). It's a heuristic,
and it only adds: the server's reply is never changed or blocked.
A missing runtime is an error, not a substitution
If a server's launcher (uvx, docker, python, …) isn't installed, the connect
fails with a message naming what to install. Before 0.2.4, a missing launcher was
rewritten to npx -y <name>, which ran whatever npm package shared its name. On a
machine without Docker, that was the unrelated npm package docker.
Allowlist patterns fail closed: a malformed pattern such as *example.com
(missing dot) matches nothing rather than everything. The gateway warns at
startup about patterns that will not do what their author intended, including
over-broad ones like *.com.
What is not covered
If the host client is SIGKILLed, the gateway cannot run its shutdown path and
spawned child processes may be left behind. SIGINT/SIGTERM are handled and
disconnect everything cleanly; SIGKILL is untrappable by definition.
Telemetry
Off unless you turn it on. The ad tracker is constructed only when
MCP_GATEWAY_PARTNER_KEY is set — with no partner key there is no partner
telemetry, and nothing is posted about your connects or tool calls.
If a partner key is set (you are earning attribution revenue), connect and
tool-execution events are sent to mcprating.io. Disable it while keeping the key
with MCP_GATEWAY_AD_TRACKING=false.
Separately, the gateway calls the configured registries — MCP Rating unless you
set MCP_GATEWAY_REGISTRIES — for mcp_discover, mcp_connect and
mcp_recommend. That is the lookup you asked for, not background reporting, and
each registry you list sees the searches.
Usage analytics (mcp_usage) are an in-memory ring buffer and never leave the
process.
Development
npm install
npm run dev # watch mode
npm run typecheck
npm run build
npm test # unit tests (env scoping, egress proxy, reconnect, mcp_call_tool)Architecture
The gateway is built on the MCP SDK and uses:
StdioServerTransport — communicates with the host client
StdioClientTransport — spawns and communicates with downstream servers
Dynamic tool registration —
McpServer.registerTool()+sendToolListChanged()Tool namespacing —
slug__toolnamepattern prevents collisionsPassthrough Zod schemas — preserves parameter names for host client UI while letting downstream servers validate
License
MIT — see LICENSE.
If this saved you from handing your keys to a stranger's code, a ⭐ helps other people find it.
Available Tools
13 toolsmcp_auditA
View the safety audit trail — a forensics log of what sandboxed MCP servers did and what the sandbox blocked (tool calls, blocked tools, blocked/allowed network egress, connects with granted capabilities). Use securityOnly: true to see only blocks and errors.
| Name | Required | Description | Default |
|---|---|---|---|
| slug | No | Filter to a single server slug | |
| event | No | Filter to a single event type | |
| limit | No | Max events to return (default 50, newest first) | |
| securityOnly | No | Show only security-relevant events (blocks + errored calls) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It discloses what the log captures and how securityOnly narrows it, but says nothing about read-only semantics, event retention/coverage window, ordering, or what happens when filters match nothing — gaps that matter for a forensics tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the resource and its scope, followed by the one actionable filter hint. The parenthetical enumeration is dense but each item earns its place by matching a real event type.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description usefully describes the returned event content, which is the key missing structured information. It stops short of covering ordering/recency limits or the fact that results are capped, though the limit/ordering details do live in the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all four parameters are already documented, including the securityOnly meaning and the limit default/ordering. The description's securityOnly sentence ('blocks and errors') largely restates the schema, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('View the safety audit trail') and immediately scopes it as a forensics log, then enumerates exactly what it contains: tool calls, blocked tools, egress allowed/blocked, connects with granted capabilities. That enumeration maps onto the `event` enum and separates it from analytics-style siblings like mcp_usage.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly tells the agent when to narrow scope: 'Use `securityOnly: true` to see only blocks and errors.' However, it never says when to reach for this tool rather than alternatives such as mcp_usage or mcp_gateway_health, so selection guidance is clear but not complete.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mcp_call_toolA
Call a tool on a connected MCP server. Use this when dynamically connected tools aren't directly available. Pass the namespaced tool name (slug__toolName) and arguments.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Namespaced tool name: "server-slug__tool-name" (as shown by mcp_connect or mcp_list_active) | |
| arguments | No | Tool arguments as a JSON object |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden, and it falls short: it does not say what happens on failure, whether arguments are validated against the target tool's schema, what the response looks like, or any permission/timeout concerns. The only behavioral hint is the dynamic-availability condition.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with the action, followed by the usage condition and then the required input format. No waste.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a dispatcher with no output schema and no annotations, the definition covers the essential action and input format but omits error behavior and any indication of the return shape, which would matter for an agent deciding how to handle the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both parameters are already fully documented ('name' as server-slug__tool-name, 'arguments' as a JSON object). The description restates the namespaced format but adds no syntax or usage detail beyond what the schema provides, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Call a tool on a connected MCP server'), so an agent immediately knows this dispatches a call to a dynamically connected server. It does not, however, explicitly distinguish itself from siblings like mcp_discover or mcp_connect, leaving the routing between meta-tools to inference.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides a clear when-to-use condition: 'when dynamically connected tools aren't directly available.' That is genuine routing guidance, but it names no alternatives (mcp_discover/connect/list_active) and gives no when-not guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mcp_connectA
Connect to an MCP server and make its tools available. Provide either a server slug (from mcp_discover) to look up in the registry, OR an explicit command + args to spawn directly, OR a url for remote servers.
| Name | Required | Description | Default |
|---|---|---|---|
| env | No | Additional environment variables for the server process | |
| url | No | URL for remote transports (SSE, WebSocket, Streamable HTTP). Use instead of command for remote servers. | |
| args | No | Command arguments (e.g., ['-y', '@modelcontextprotocol/server-everything']) | |
| slug | No | Server slug from MCP-Rating registry (e.g., '@modelcontextprotocol/inspector') | |
| command | No | Explicit command to spawn (e.g., 'npx'). Use when server is not in registry. | |
| confirmed | No | Set to true to confirm connection to community/unknown trust tier servers. Required when the initial connect returns a confirmation warning. | |
| saveProfile | No | Set to true to save this connection as an auto-connect profile. The server will auto-reconnect on gateway restart. | |
| transportType | No | Transport type. Defaults to 'stdio' for command-based, auto-detected from URL scheme if url is provided. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden; it discloses the connection outcome (tools become available) but not trust-tier confirmation needs, persistence/reconnect behavior, or auth requirements, which live only in the schema for `confirmed` and `saveProfile`. Useful but incomplete behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the action and immediately followed by the three invocation options. Zero filler, and the most decision-relevant routing info comes first.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an 8-parameter tool with no annotations and no output schema, the description covers the core routing but omits the trust-tier confirmation flow, reconnect/profiles semantics, and error behavior. The rich schema compensates for parameter semantics, but behavioral completeness is thin.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. The description reinforces the slug-vs-command-vs-url selection logic but largely restates what the per-parameter descriptions already say ('Use instead of command for remote servers'), adding only the OR framing.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Connect) and resource (MCP server) plus the effect (make its tools available), and names the sibling mcp_discover as the source of slugs. An agent can distinguish this from mcp_disconnect, mcp_list_active, and mcp_discover without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly lays out three mutually exclusive invocation modes (slug from registry, command+args to spawn, url for remote), which routes the agent to the correct parameter set. It stops short of stating when-not to use it or what to do on failure/confirmation, so not a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mcp_disconnectA
Disconnect from a connected MCP server and remove its tools. Use mcp_list_active to see connected servers.
| Name | Required | Description | Default |
|---|---|---|---|
| slug | Yes | Server slug of the connected server to disconnect |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations, so the description carries the full burden. It usefully discloses that disconnecting removes the server's tools, but it omits whether the server can later be reconnected (mcp_connect exists as a sibling), whether the action is reversible, and whether in-flight tool calls are affected.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, action and effect front-loaded, with the helper pointer second. No waste.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter teardown tool with no output schema, the definition covers what it does, its side effect, and how to obtain the slug. The main remaining gap is the reversibility/reconnect question, which matters given mcp_connect is a sibling.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the single slug parameter is fully documented in the schema, so the description need only be consistent. It refers to "a connected MCP server" without adding format or sourcing detail beyond what the schema and the mcp_list_active pointer provide.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb+resource ("Disconnect from a connected MCP server") with the key side effect stated ("remove its tools"), which cleanly distinguishes it from sibling mcp_connect and the read-oriented mcp_list_active.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It names mcp_list_active as the way to find connected servers, which implicitly tells the agent the prerequisite state (a currently connected server) and where to get the slug. It does not state any when-not-to-use condition or contrast against alternatives like mcp_connect, so it falls short of full routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mcp_discoverA
Search the configured MCP registries (MCP Rating by default) for MCP servers. Returns servers with trust tiers, install information, and MCP Rating's quality scores where it has rated them. Use this to find servers before connecting them with mcp_connect.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max results (default 10) | |
| query | Yes | Search query (server name, description, or capability) | |
| category | No | Filter by category slug (e.g., 'developer-tools', 'data-databases') |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations and no output schema, the description carries the full burden and does disclose the return shape (trust tiers, install info, quality scores) and that only configured registries are searched. It omits confirming the operation is read-only and says nothing about rate limits or pagination behavior, which is why it is not a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences with no filler; purpose, return content, and the routing hint are all front-loaded before any elaboration.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description compensates for the missing output schema by naming what results contain, and all three parameters are schema-documented. Small gaps remain around default registry configuration and result pagination/limits beyond the schema's max.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so query, category, and limit are already documented in the schema (baseline 3). The description adds only the registry context ('MCP Rating by default') and nothing about query syntax or category source.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Search the configured MCP registries ... for MCP servers') plus what comes back (trust tiers, install info, quality scores). It is clearly distinguishable from siblings like mcp_server_info, mcp_recommend, and mcp_list_active.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Use this to find servers before connecting them with mcp_connect' gives an explicit use context and names the downstream alternative. It stops short of ruling out competing discovery tools such as mcp_recommend or describing when NOT to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mcp_gateway_healthA
Get gateway diagnostics: version, uptime, connection status, registry reachability, and per-server health.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It helpfully enumerates the diagnostic categories returned, but never states that the operation is a safe read-only check, whether it incurs load on downstream servers, or any auth/latency characteristics.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence that enumerates its contents with zero filler. Every listed item corresponds to real output the caller would receive.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema or annotations exist, so the description must carry the return-value story, and it does by naming each diagnostic field. It stops short of describing format or how per-server health is represented, but for a zero-arg probe this is close to sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there is nothing to document and the baseline of 4 applies. The description correctly adds no spurious parameter detail.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb (Get) and resource (gateway diagnostics) and enumerates the exact contents returned: version, uptime, connection status, registry reachability, per-server health. This clearly distinguishes it from siblings like mcp_list_active or mcp_server_info, though it never names an alternative explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit when-to-use guidance, no prerequisites, and no mention of alternative tools for related queries. An agent can infer a health/diagnostics use case, but nothing in the text routes it there versus mcp_server_info or mcp_list_active.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mcp_groupsB
Manage server groups for atomic connect/disconnect of sets of servers.
| Name | Required | Description | Default |
|---|---|---|---|
| url | No | Server URL (for add_server with SSE/WS/HTTP) | |
| args | No | Command arguments (for add_server with stdio) | |
| name | No | Group name (required for all actions except list) | |
| slug | No | Server slug to add/remove from a group | |
| action | Yes | Action: list, create, delete, add_server, remove_server, connect (all in group), disconnect (all in group), show (details) | |
| command | No | Explicit command for the server (for add_server with stdio) | |
| description | No | Group description (optional, for create) | |
| transportType | No | Transport type (for add_server) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full behavioral burden. It discloses the useful 'atomic' trait, but says nothing about destructive actions (delete, remove_server), permission requirements, error behavior, or side effects of connect/disconnect.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with zero waste. It is appropriately sized for a tool whose schema carries the parameter detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a multi-action tool with eight parameters, no annotations, and no output schema, one sentence is thin. The schema lists actions but the description does not help an agent understand action categories, destructive operations, or behavioral implications.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents every parameter and action. The description adds no parameter-level meaning beyond that baseline, so a 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear verb+resource ('Manage server groups') and adds the scope 'atomic connect/disconnect of sets of servers'. It does not explicitly distinguish itself from sibling tools like mcp_connect and mcp_disconnect that operate on individual servers, so sibling differentiation is missing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the phrase 'atomic connect/disconnect of sets of servers', suggesting this tool is for group-level operations. However, there is no explicit when-to-use, when-not-to-use, or alternative routing versus mcp_connect/mcp_disconnect.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mcp_list_activeA
List all currently connected MCP servers and their tools.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations, so the description carries the burden, but for a zero-parameter listing tool there is little to disclose. 'List ... currently connected' implies a read-only, non-destructive operation and indicates what is returned; however it does not state auth requirements, whether the listing is cached, or any rate limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler. The core action and scope are stated immediately with nothing wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, and the description compensates by stating what is returned (connected servers and their tools). For a simple no-arg listing tool this is nearly complete; only the boundary against mcp_discover remains unaddressed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes no parameters, so there are no parameter semantics to convey. Baseline for a zero-parameter tool is 4, and the schema (empty object) is consistent with the description's implicit claim of no inputs.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clear specific verb 'List' with a precise resource: 'currently connected MCP servers and their tools'. An agent can distinguish it from most siblings, but the description does not explicitly contrast it with near-neighbors like mcp_discover (unconnected servers) or mcp_server_info (single server).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance and no alternatives named. The 'currently connected' qualifier implicitly suggests it differs from discovery, but the agent must infer when to pick this over mcp_discover or mcp_server_info.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mcp_profilesC
Manage named connection profiles. Profiles are presets of server connections that can be switched between (e.g., 'work', 'personal').
| Name | Required | Description | Default |
|---|---|---|---|
| url | No | Server URL (for add_server with SSE/WS/HTTP) | |
| args | No | Command arguments (for add_server with stdio) | |
| name | No | Profile name (required for create, delete, add_server, remove_server, switch, show) | |
| slug | No | Server slug to add/remove from a profile | |
| action | Yes | Action: list (all profiles), create (new profile), delete, add_server (add a server to profile), remove_server, switch (activate profile), show (details of a profile) | |
| command | No | Explicit command for the server (for add_server with stdio) | |
| description | No | Profile description (optional, for create) | |
| transportType | No | Transport type (for add_server) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It mentions that profiles can be 'switched between' but does not disclose that actions like delete, remove_server, and switch have destructive or state-changing effects, nor does it describe persistence, permissions, or side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the core purpose and one clarifying definition. There is no filler, and the example parenthetical adds useful context without bloating the description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a complex multi-action tool (8 parameters, 7 enum actions, no annotations, no output schema), yet the description only gives a high-level summary. It omits action-specific behavior, destructive-action warnings, return information, and usage differentiation, which are necessary for an agent to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already defines all 8 parameters and the action enum. The description adds no additional meaning about parameter interactions or usage beyond what the schema provides. Baseline 3 applies when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear verb and resource: 'Manage named connection profiles.' It further clarifies with the definition 'presets of server connections' and examples ('work', 'personal'). However, it does not distinguish this tool from possibly related siblings like mcp_groups or mcp_discover, leaving the agent to infer the boundary.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given for when to use this tool versus alternatives, when to prefer each action (e.g., create vs add_server), or what prerequisites exist. The description only says 'manage', which is too vague to guide selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mcp_recommendB
Get MCP server recommendations. Pass query to describe a goal or task (e.g. "file sync with cloud storage", "manage GitHub issues"). Omit query to get suggestions based on your recent tool-call patterns.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of recommendations (default 5, max 20) | |
| query | No | Free-text goal or task. When provided, recommends servers that match this intent using semantic/keyword/expansion search. When omitted, recommends based on usage history. | |
| category | No | Optional category slug to filter (e.g. 'developer-tools', 'data-databases'). Only used with `query`. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It mentions search modes (semantic/keyword/expansion) and usage-history fallback, but says nothing about permissions, rate limits, ranking behavior, or what the response contains.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two efficient sentences front-load the core action and then explain the query/no-query branches without waste.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only recommendation tool with no annotations and no output schema, the description covers invocation modes but leaves return shape, ranking, and any auth or rate-limit context unaddressed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the schema already documents all three parameters thoroughly, including limits and the category dependency on query. The description's parameter guidance largely repeats the schema, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource (get recommendations for MCP servers) clearly. It distinguishes the tool from siblings like mcp_discover and mcp_list_active by focusing on recommendations driven by query or usage patterns, though it doesn't explicitly name how it differs from those siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear conditions for passing query vs omitting it, which covers the main usage modes. However, it doesn't mention when to prefer this over mcp_discover or other siblings that also surface servers.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mcp_sandboxA
View or customize a server's sandbox capability manifest (env/network/filesystem/subprocess access). Use action 'view' to inspect, 'set' to tighten or loosen grants (only the fields you pass change, the rest keep what the server has now or would get by default; applies on next connect), or 'reset' to revert to defaults.
| Name | Required | Description | Default |
|---|---|---|---|
| slug | Yes | Server slug (as shown by mcp_list_active or mcp_discover), or its registry name (io.github.owner/server) | |
| action | Yes | view = inspect manifest; set = override grants; reset = revert to defaults | |
| fsRead | No | [set] Absolute paths the server may read | |
| fsWrite | No | [set] Absolute paths the server may write | |
| network | No | [set] Network mode. 'none' = no network, 'allowlist' = only listed hosts, 'all' = unrestricted | |
| envAllow | No | [set] Environment variable NAMES the server may receive, e.g. ['GITHUB_TOKEN'] | |
| subprocess | No | [set] Whether the server may spawn subprocesses | |
| enforcement | No | [set] Isolation level. l2-container requires Docker/Podman. | |
| networkAllow | No | [set] Allowed host:port patterns for allowlist mode, e.g. ['api.github.com:443', '*.example.com'] |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does well: it discloses that 'set' is a partial patch ('only the fields you pass change, the rest keep what the server has now or would get by default') and that changes are deferred ('applies on next connect'). These are non-obvious mutation semantics an agent could not infer from the schema. It still omits the permission/authorization requirements and what a failed or rejected grant looks like.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single dense sentence with the purpose front-loaded and the action routing following in priority order. It is long but every clause (partial-update behavior, deferred application) earns its place; only the nested parenthetical stacking costs it a point.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No annotations and no output schema, and for a 9-parameter policy mutation tool the description covers actions and mutation semantics adequately. It does not say what 'view' returns or how enforcement failures surface, but the schema's enum descriptions (e.g. l2-container requires Docker) pick up part of that slack.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all nine parameters, including enum values and the [set] action prefixes. The description's only added parameter meaning is the merge semantics for omitted fields on 'set', which is useful but marginal. Baseline 3 is appropriate when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb pair (view/customize) and the exact resource (a server's sandbox capability manifest), then enumerates the four policy domains it covers (env/network/filesystem/subprocess). No sibling tool deals with sandbox grants, so the agent can route to it unambiguously.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Maps each action enum value to a purpose: 'view' to inspect, 'set' to tighten or loosen grants, 'reset' to revert to defaults. This tells the agent which action to pick but gives no guidance on when this tool is preferable to adjacent tools like mcp_connect or mcp_profiles, nor any prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mcp_server_infoB
Get detailed information about an MCP server from the registry or a currently connected server.
| Name | Required | Description | Default |
|---|---|---|---|
| slug | Yes | Server slug (from registry or connected server) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full disclosure burden. It implies a read operation but says nothing about whether a connection is required, what happens if the slug is not found, permissions, or rate limits. For a lookup tool with zero annotation coverage this is thin.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single efficient sentence that front-loads the verb and resource. Every clause earns its place, though the dual-source phrasing could be tightened.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
A read-only, single-parameter tool with no output schema, so the description could reasonably explain what 'detailed information' is returned. It stops short of that, leaving the return payload unspecified, though the lookup scope is covered.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the single 'slug' parameter is documented in the schema itself, so the description adds no additional meaning. Baseline 3 is appropriate when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a clear verb ('Get detailed information') and resource ('an MCP server') and clarifies the two lookup sources (registry or connected server). It distinguishes itself reasonably from siblings like mcp_discover and mcp_list_active, though it does not name them explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The mention of 'registry or a currently connected server' implies when this tool applies, but there is no explicit when-to-use guidance or contrast with alternatives such as mcp_discover. Usage is only inferable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mcp_usageC
View usage analytics for connected MCP servers — call counts, latency, error rates, and recent activity.
| Name | Required | Description | Default |
|---|---|---|---|
| slug | No | Filter stats to a specific server slug. Omit for global stats. | |
| limit | No | Limit number of results for 'recent' and 'slow' actions (default: 20) | |
| action | No | Action: stats (default — summary), recent (recent calls), slow (slow calls), reset (clear all data) | |
| threshold | No | Latency threshold in ms for 'slow' action (default: 5000) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden — and it frames the tool purely as a read-only viewer ('View usage analytics'), while the schema exposes a 'reset' action documented as 'clear all data'. A destructive capability is left undisclosed, which could lead an agent into irreversible data loss. No mention of permissions or reversibility.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence that names the resource first and then the metrics. Zero wasted words and appropriately sized for the tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no annotations, no output schema, and a multi-action tool that includes a destructive 'reset', the description should say more than it does. It omits the existence of non-viewing actions and any warning about data destruction, leaving a significant gap for an agent deciding whether to call it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all four parameters (slug, limit, action, threshold) are already documented in the schema, including enum meanings. The description adds no parameter-level detail beyond what the schema provides; baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a clear verb ('View') and resource ('usage analytics for connected MCP servers') and enumerates the metrics returned (call counts, latency, error rates, recent activity). It is distinguishable from siblings like mcp_gateway_health or mcp_audit, though it does not explicitly contrast with them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to choose this tool over mcp_gateway_health, mcp_audit, or mcp_server_info, nor any stated prerequisites (e.g., that a server must be connected). The description offers no when/when-not context at all.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
2 tool updates
v0.4.1- Changed
mcp_audit1 field changed- changed
Input schema / properties / event / enumPrevious value: -[ - "connect", - "tool_call", - "tool_blocked", - "egress_blocked", - "egress_allowed", - "disconnect" -]New value: +[ + "connect", + "tool_call", + "tool_blocked", + "egress_blocked", + "egress_allowed", + "personal_data_requested", + "disconnect" +]
- Changed
mcp_sandbox1 field changed- changed
Input schema / properties / slug / descriptionPrevious value: -"Server slug (as shown by mcp_list_active or mcp_discover)"New value: +"Server slug (as shown by mcp_list_active or mcp_discover), or its registry name (io.github.owner/server)"
13 tool updates
v0.2.3- First observed
mcp_audit - First observed
mcp_call_tool - First observed
mcp_connect - First observed
mcp_disconnect - First observed
mcp_discover - First observed
mcp_gateway_health - First observed
mcp_groups - First observed
mcp_list_active - First observed
mcp_profiles - First observed
mcp_recommend - First observed
mcp_sandbox - First observed
mcp_server_info - First observed
mcp_usage
TDQS
Scored across 13 tools
Most tools target clearly distinct concerns (connect/disconnect/list/health/audit/usage/sandbox). The only real overlap is mcp_discover vs mcp_recommend, which both surface servers to connect to, and mcp_server_info vs mcp_list_active, which both expose server details.
Every tool uses the same mcp_ prefix and snake_case, giving a strong predictable family. However, it mixes verb_noun forms (list_active, call_tool, gateway_health) with bare-noun names (sandbox, audit, profiles, groups, usage), so the pattern isn't perfectly uniform.
13 tools is well within the ideal range and each maps to a genuine gateway responsibility (discovery, connection lifecycle, sandboxing, auditing, analytics, profiles/groups). Nothing feels padded or missing at the count level.
The surface covers the full server-management lifecycle: discover, connect, disconnect, list, inspect, call, plus sandbox, audit, usage, profiles, and groups. Minor gaps exist (e.g., no explicit refresh/reconnect or profile edit/delete semantics), but core workflows are well covered.
Maintenance
Related MCP Connectors
Publish and discover MCP servers via the official MCP Registry. Powered by HAPI MCP server.
Trust, freshness, policy, and discovery layer for public MCP servers.
Search, vet & assemble MCP servers from your agent: verified tools, risk labels, and trust scores.
MCP server for your apps' tools and custom tools, plus hosted AI agents and approval-gated workflows
Related MCP Servers
- AlicenseBqualityCmaintenanceDynamic MCP server for Node.js enabling runtime tool creation, management, and execution in isolated sandboxes (Docker or Node).813 npm1MIT
- AlicenseNot gradedqualityDmaintenanceA flexible MCP proxy server that connects to and routes between multiple backend MCP servers over STDIO or SSE, enabling dynamic management and namespacing of tools.111MIT
- FlicenseAqualityDmaintenanceUniversal MCP proxy server that discovers, searches, and executes tools across all configured MCP servers from a single entry point.7-
- FlicenseNot gradedqualityCmaintenanceEnables agents to connect to remote MCP servers once, access their tools through a compact MCP endpoint, pair a CLI inside sandboxes, and create watches that turn command or tool output into pollable structured events.2-