MCP Rating Gateway
A meta-MCP gateway for discovering, connecting to, and calling tools on MCP servers with security, audit, and management features.
Search configured registries for MCP servers and get recommendations by query or usage.
Connect by registry slug, explicit command, or remote URL; disconnect, list active servers, and inspect server details/health.
Call tools on connected servers via namespaced names and receive tool-list updates.
View and customize sandbox manifests for environment, filesystem, network, subprocess, and container isolation.
Review security audit events, including tool calls, blocks, egress, personal-data requests, and approvals.
Manage profiles and groups for connecting sets of servers atomically.
View usage analytics such as call counts, latency, errors, and recent/slow calls.
Can connect to and proxy a GitHub MCP server on demand, exposing its tools (e.g. issue, repo, and pull-request operations) through the gateway so they can be called without statically configuring the server.
Can connect to and proxy an MCP server for SQLite databases on demand, allowing an agent to query a local SQLite database through the gateway without statically configuring the server.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@MCP Rating Gatewayfind a Postgres MCP server in the registry and connect to it"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
@mcp-rating/gateway
Run MCP servers without handing them the API keys in your environment.
Whether a server you add can read your environment (AWS_SECRET_ACCESS_KEY,
OPENAI_API_KEY, DATABASE_URL) depends on how your client starts it. The
official MCP SDKs pass a short allowlist by default: HOME, PATH, USER and a
few more. A client or script that passes its whole environment, often just to
forward the one token a server needs, hands over everything. We haven't yet
measured which popular clients do which, so we don't name any. The gateway
doesn't leave it to the client: it spawns every server with a constructed
environment, the SDK's short allowlist (PATH, HOME, USER and a few
more) plus only the variables you or its manifest name. Nothing else from your
environment is there to read.
Files are a different matter. By default a server still runs as you, so it
can read what you can — ~/.ssh, ~/.aws/credentials, a project's .env. Only
container isolation (opt-in, needs Docker) closes that. See
what each level protects.

Started with the whole environment | Through the gateway | |
Environment visible to the server | everything the client had | a short allowlist ( |
Credentials in environment variables | all of them | none you didn't name |
Credential files ( | readable | still readable, unless container isolation is on |
Reproduce it yourself in about ten seconds: node demo/run-demo.mjs plants two fake
credentials and runs the server both ways. It prints the planted values in full and,
for anything real it finds in your environment, only the variable's name, never its
value. The GIF is generated by node demo/render-gif.mjs from a clean, synthetic
environment, so it shows nothing from any real machine.
It is also a meta-server: one entry in your config gives you the whole registry, connected on demand rather than pre-loaded.
{ "mcpServers": { "gateway": { "command": "npx", "args": ["-y", "@mcp-rating/gateway"] } } }What it costs in context
Context used to be this README's lead argument: 13 meta-tools in place of every configured server's full schema. That assumed the client sends every tool definition on every request. Claude Code, Cursor and Kiro don't by default: they give the model your tools' names and load a definition when it's needed.
We measured all three in October 2026 with ten popular servers' real tool lists, replayed through a stub so that no third-party code ran. Added to every request, compared with no MCP servers:
tools | Claude Code | Claude Code, tool search off | Cursor | Kiro (chars) | |
3 servers | 45 | +1,050 | +14,143 | +266 | +3,974 |
9 servers | 125 | +3,085 | +77,656 | +910 | +7,693 |
10 servers | 500 | +14,853 | +183,889 | +4,330 | +26,398 |
the gateway | 13 | +716 | +5,595 | +342 | +3,797 |
Claude Code 2.1.308 (tokens as the API counts them), Cursor 3.17.21 (its own estimate), Kiro 1.4.26 (characters, from its log). Compare within a column. Most of the ten-server cost is one server with 375 tools.
The gateway also takes more requests: it has to find and connect a server before calling it, and those steps stay in the conversation, so every later request sends them again. Over an eight-turn Claude Code session with default settings, the gateway used about 597,000 prompt tokens. Three servers configured directly used 475,000, nine used 510,000 and ten used 710,000. The gateway drew level with ten at the third or fourth turn, and never with three or nine.
So in these clients, don't use the gateway to save context. It still does when your client sends every definition upfront (Claude Code with tool search off), or against a server with hundreds of tools over a longer session. With a few typical servers, configuring them directly is cheaper.
The full write-up, with the method, the one-task bill and what we don't claim:
MCP clients now load tool names, not schemas.
Reproduce it with the scripts in
demo/:
claude-code-tokens.mjs (standing cost), claude-code-whole-bill.mjs (one
task), claude-code-session.mjs (eight turns), cursor-standing.mjs and
kiro-standing.mjs. Earlier versions of this section claimed 10× less context,
then about 3×. Both came from our own harness, which sent every definition, like
a client with tool search off.
Related MCP server: Multi-MCP Proxy
How It Works
┌────────────────────┐ ┌──────────────┐ ┌──────────────────┐
│ Claude Desktop / │ stdio │ │ stdio │ MCP Server A │
│ Cursor / Windsurf │◄─────►│ MCP Gateway │◄──────►│ (e.g. filesystem)│
│ (host client) │ │ │◄──┐ └──────────────────┘
└────────────────────┘ └──────────────┘ │ ┌──────────────────┐
│ └───►│ MCP Server B │
▼ │ (e.g. github) │
┌──────────────┐ └──────────────────┘
│ MCP-Rating │
│ Registry API │
└──────────────┘Instead of manually configuring each MCP server in your client, the Gateway:
Discovers servers via the MCP-Rating registry, listing first the ones it can start right now (see below)
Connects to them on-demand: spawns local ones as child processes, and connects hosted ones to the endpoint the registry lists
Proxies their tools through namespaced names (
servername__toolname)Notifies your client when tools are added/removed
Quick Start
With Claude Desktop
Add to your claude_desktop_config.json:
{
"mcpServers": {
"gateway": {
"command": "npx",
"args": ["-y", "@mcp-rating/gateway"]
}
}
}Then ask Claude:
"Search for MCP servers that work with databases" (uses
mcp_discover)"Connect to the sqlite server" (uses
mcp_connect)"Query my database" (calls the proxied tool directly)
Cursor
~/.cursor/mcp.json (or .cursor/mcp.json in a project):
{
"mcpServers": {
"gateway": { "command": "npx", "args": ["-y", "@mcp-rating/gateway"] }
}
}Claude Code
claude mcp add gateway -- npx -y @mcp-rating/gatewayWindsurf
~/.codeium/windsurf/mcp_config.json, same shape as Cursor:
{
"mcpServers": {
"gateway": { "command": "npx", "args": ["-y", "@mcp-rating/gateway"] }
}
}Kiro
Add to Kiro
(Kiro asks before installing), or ~/.kiro/settings/mcp.json (.kiro/settings/mcp.json
in a workspace), same shape as Cursor:
{
"mcpServers": {
"gateway": { "command": "npx", "args": ["-y", "@mcp-rating/gateway"] }
}
}Kiro runs MCP servers only when you are signed in, and if its MCP Servers panel shows Enable MCP, click it first.
Kiro ignores tools/list_changed. It reads the gateway's tool list once, when it
connects, so the tools of a server you connect later are never offered to the
agent directly. Ask the agent to call them through mcp_call_tool, using the
full slug__tool name that mcp_connect prints. Measured on Kiro 1.4.26 with
demo/client-probe.mjs.
Any other MCP client
{ "command": "npx", "args": ["-y", "@mcp-rating/gateway"] }Restart the client after editing its config — most read it only at startup.
What mcp_discover puts first
An agent can only use a server the gateway can start, so results are ordered by that, keeping relevance order within each group:
Verified: the registry's own harness started it and it listed its tools (
✓ Started in our test).Ready, untested: installable here, or a hosted endpoint that needs no header, and any key it declares is set.
Needs setup: a declared key isn't set, its launcher (
uvx,docker) isn't installed, or the hosted endpoint needs a header the gateway can't send yet.Failed in our test: it didn't start when the registry tried it, with no credentials (
✗ Didn't start in our test).Can't start by slug: no install command and no endpoint recorded.
"Verified" means it started and listed tools, not that every tool works without a key. The harness supplies none. Most of the index has never been tried; that says nothing either way.
Meta-Tools
The gateway exposes 13 built-in tools:
Tool | Description |
| Search the MCP-Rating registry; servers the gateway can start now come first |
| Connect to a server and make its tools available |
| Disconnect a server and remove its tools |
| List connected servers and their tools |
| Detailed info about a server, from the registry or a live connection |
| Call a tool on a connected server |
| Diagnostics: version, uptime, connection and registry status |
| View or customise a server's sandbox manifest (env/network/filesystem) |
| The safety audit trail — what sandboxed servers actually did |
| Named connection profiles (work, personal, …) |
| Atomic connect/disconnect of server sets |
| Call counts, latency and error rates for connected servers |
| Server recommendations based on usage |
Trust Tiers
Every connected server is labeled with a trust tier based on its MCP-Rating quality score:
[Verified] — High quality + officially verified
[Trusted] — Good quality with repository, and an install command or a remote endpoint
[Community] — Listed in registry with basic quality
[Unverified] — A package MCP Rating doesn't know, from any registry or started by command
A safety score in the risk band caps the tier, as it does on the site: below 50 a server is at most [Community], below 30 it is [Unverified].
What mcp_connect shows, and when it stops
Before anything starts, mcp_connect looks up what MCP Rating knows about the
package that would run — from the registry entry, or, for an explicit command
or url, from the package itself (npx pkg, uvx pkg, docker run image,
the endpoint). A known package started by command is judged as itself, not as
[Unverified]. Shown in the confirmation and again once connected:
score and trust tier, with the server's page;
safety score and each flag with its reason;
MCP Rating's own start test: started, didn't start, needs credentials, or not tested;
last release and last code push, with where each date comes from.
It stops for a [Community] or [Unverified] server, and, whatever the tier, when
the safety score is in the risk band, MCP Rating has delisted the
package, or a registry name points at a different package than MCP Rating knows
by that name. Where your client supports MCP elicitation, the gateway asks you
directly, in a dialog the model can't see or answer (see
What needs a person). Elsewhere the warning goes to the
agent, and confirmed: true on the retry is a field the model fills in, so it
protects you only as far as the model passes it on.
A minimum score
MCP_GATEWAY_MIN_SCORE=60 (or "minQualityScore": 60 in config.json) refuses
to connect anything MCP Rating scores below 60, or hasn't scored — by slug,
registry name, command or URL alike, so a local node server.js is refused too.
confirmed: true doesn't lift it, since an agent can set that itself; only the
setting does. It needs MCP Rating among the registries. A value that isn't a
whole number from 0 to 100 refuses everything until it is fixed, rather than
quietly meaning "no rule".
Registries
By default the gateway searches MCP Rating. It can search any registry that speaks the official MCP Registry API (v0.1) instead, or as well: the official registry, a company's own registry, or MCP Rating's mirror of it.
{
"mcpServers": {
"gateway": {
"command": "npx",
"args": ["-y", "@mcp-rating/gateway"],
"env": {
"MCP_GATEWAY_REGISTRIES": "https://mcprating.io/api/v1,https://registry.acme.internal"
}
}
}
}The list replaces the default. Leave MCP Rating out and the gateway never contacts it for discovery.
Each entry is a URL. One ending in
/api/v1is taken as MCP Rating's own API, and anything else as the MCP Registry API. To say which explicitly, writemcprating=URLormcp-registry=URL.Searches go to every registry and are merged. A server two registries both list appears once, as the first-listed registry has it. A search waits up to 15 seconds; a registry that hasn't answered by then is named in the results, and the rest are shown.
Connecting by name. A server from an MCP Registry API registry connects by its registry name,
mcp_connect({slug: "io.github.owner/server"}). That works in any later session too.Scores come from MCP Rating only. Quality scores, safety flags and start tests are MCP Rating's. When MCP Rating is one of your registries, a server found in another one gets MCP Rating's record of the same package — the same npm or PyPI package, Docker image or hosted endpoint — in one request per search. It is matched by package, never by name: any registry can give any package a well-known name. Otherwise the server shows as unrated and [Unverified], so connecting it stops first. Numbers another registry puts in its own entries (
_meta) are not read: anyone can write them.Warnings that stop a connect. If MCP Rating knows a server's registry name as a different package, or has delisted the package,
mcp_discoversays so, lists it last, andmcp_connectstops whatever its trust tier.The partner key goes to MCP Rating only, never to another registry.
The official registry's search matches server names only and was slow when this was written (7–40 s per search on 2026-10-14). The gateway asks it for the query's longest word and ranks what comes back by how many of your words match.
Configuration
The gateway reads config from ~/.mcp-gateway/config.json:
{
"registryApiUrl": "https://mcprating.io/api/v1",
"proxyTimeoutMs": 30000,
"maxConnections": 10,
"logLevel": "info"
}Environment Variables
Variable | Description | Default |
| MCP-Rating API base URL |
|
| Comma-separated registries to search instead (see Registries) | MCP Rating alone |
| Refuse anything MCP Rating scores below this, or hasn't scored (see A minimum score) | no rule |
| Proxy timeout (ms) |
|
| Max simultaneous connections |
|
| Log level (debug/info/warn/error) |
|
| Force L2 container isolation on/off | manifest decides |
| Path for the forensic audit log | disabled |
|
| on |
| Partner attribution key — enables ad telemetry | unset |
| Set to | unset |
| Bearer token for HTTP daemon mode | unset |
Security model
The gateway exists so that what a server can see doesn't depend on how your client happens to start it. Two layers push back, and it is worth being precise about what each one does and does not do.
L1 — environment scoping (always on, for stdio servers)
A downstream server receives the MCP SDK's default allowlist (HOME, LOGNAME,
PATH, SHELL, TERM, USER on macOS and Linux; PATH, USERPROFILE,
APPDATA, TEMP and a few more on Windows), plus only the variable names
its manifest allowlists or you pass at connect time. Everything else in
the parent environment — AWS_*, OPENAI_API_KEY, DATABASE_URL — is withheld.
Exported shell functions (BASH_FUNC_*) are dropped rather than forwarded.
This is genuine enforcement: the child process is spawned with a constructed environment, so there is nothing to opt out of or bypass.
L1 does not restrict files or the network. The server runs as your user: it
can read anything you can, including ~/.ssh, ~/.aws/credentials and .env
files, and it can connect to any host. A manifest can declare network and
filesystem limits, but outside a container nothing enforces them, and the
connect summary says "not restricted" rather than listing them.
L2 — container isolation (opt-in)
With MCP_GATEWAY_CONTAINER_ISOLATION=true, community and unknown servers run
under docker/podman in an ephemeral container. You can also opt one server
in with mcp_sandbox({action: "set", slug: "…", enforcement: "l2-container"}).
Inside, the server gets a read-only root, a scratch /tmp, and only the paths
its manifest declares mounted from the host. network: "none" gives the
container no network at all. Without Docker or Podman, the gateway falls back to
L1 and logs that it did.
Network allowlists: read this before relying on them
Allowlists apply only under L2. network: "allowlist" starts a forward
proxy and points the container at it via HTTP_PROXY/HTTPS_PROXY. The proxy
accepts only tunnels that carry a random credential generated for that
connection, which the container receives in those variables. With Docker Desktop
it listens on loopback. With Docker on Linux it has to listen on all interfaces,
because the container reaches it over the bridge, and the credential is what
keeps other machines from using it.
This filters proxy-aware clients only. Node's fetch/undici, axios, and Python
requests all honour those variables, which covers most real servers. A program
that opens raw TCP sockets, or a compiled binary that ignores proxy environment
variables, is not filtered. Treat an allowlist as a guard rail against honest
code, not a containment boundary against hostile code. For that, use
network: "none".
Giving a server an API key
Put the key in the gateway's env in your client config, not in the chat:
{
"mcpServers": {
"gateway": {
"command": "npx",
"args": ["-y", "@mcp-rating/gateway"],
"env": { "GITHUB_TOKEN": "ghp_…" }
}
}
}A server receives it only if its registry entry declares that variable. For one
that doesn't, allowlist the name, never the value:
mcp_sandbox({action: "set", slug: "…", envAllow: ["GITHUB_TOKEN"]}). That widens
what the server gets, so the gateway asks you first.
mcp_connect also accepts env: { NAME: "value" }. That works, but the model has
to write the secret into a tool call, which puts it in your chat transcript and
your model provider's logs.
When a server asks the model for personal data
A hosted server can ask for an email, a phone number or a card number in an ordinary tool result, and the model is what answers. During our own test runs, a local 31B was asked for an email "to record your free quota" and made one up. No sandbox can see that: it's a request in the content channel.
Since 0.2.6 the gateway checks each tool result for a personal-data term next to
a verb of handing it over, in English and Chinese, within its first 1,500
characters. On a match it appends a warning the model reads with the result:
ask the user, and never make up a value. It also records
personal_data_requested in the audit trail (mcp_audit). It's a heuristic,
and it only adds: the server's reply is never changed or blocked.
A missing runtime is an error, not a substitution
If a server's launcher (uvx, docker, python, …) isn't installed, the connect
fails with a message naming what to install. Before 0.2.4, a missing launcher was
rewritten to npx -y <name>, which ran whatever npm package shared its name. On a
machine without Docker, that was the unrelated npm package docker.
Allowlist patterns fail closed: a malformed pattern such as *example.com
(missing dot) matches nothing rather than everything. The gateway warns at
startup about patterns that will not do what their author intended, including
over-broad ones like *.com.
What it doesn't stop: tool poisoning
A server doesn't have to run anything to attack you. Its tool descriptions and results are text that goes straight to your model, and that text can tell the model to read a file through another server and send it somewhere. The data moves through tools you trust, so L1 and L2 don't touch it: they limit what a server's code can do.
A November 2026 measurement ran 45 of these attacks through 12 agent frameworks and 18 models. In 22.9% of runs the model made a call the attacker asked for, from 0.4% to 49.7% depending on the model, and no framework defended against it on purpose. It didn't test this gateway or a client such as Claude Code or Cursor, and we haven't measured either yet.
The gateway passes descriptions and results on as the server wrote them, with a trust label in front of each description. It doesn't scan them, and when a server changes its tool list it forwards the new one without comparing it to the old.
What helps:
Connect only what you need.
Keep your client's approval prompt on for tool calls.
Which model you run matters: in that measurement it mattered far more than which framework.
What needs a person
A poisoned description can tell the model to use the gateway's own tools. So these don't rest on the model's word. The gateway asks you itself, through MCP elicitation: your client shows the question, and the model never sees or answers it.
Starting a raw command with
mcp_connect({command: …}), whatever it names.Setting environment variables that change what runs on a connect, such as
NODE_OPTIONSorLD_PRELOAD.Widening a server's sandbox with
mcp_sandbox: more environment variables, more network, more paths, weaker isolation, or aresetthat lands somewhere wider. Tightening never asks.Adding a server to a profile or group, which then starts without asking again.
Connecting a [Community] or [Unverified] server by slug, and anything else that would have waited on
confirmed: true, where your client can ask.
The question shows exactly what would run or change. Only a yes with the box ticked
counts: a decline, a dismissal, a timeout after five minutes or an empty accept is a no.
Every outcome is in mcp_audit, as approval.
After a no, the gateway won't put that same request to you again until your client
restarts, so an agent can't keep raising the dialog until it gets a yes. Changing one
argument makes a new question, so after three refusals in a session it stops asking
altogether: everything that needs you is refused until the client restarts, and
mcp_gateway_health says so. If you didn't expect those requests, check what's connected
before you restart. A timeout stops the request but doesn't count, since you may not have
seen it, and a yes covers one request, once. Saved launches still start: they were
approved when they were saved.
If your client can't ask (it doesn't support elicitation), a raw command and a
wider sandbox are refused, and the refusal tells the model how you can change that. A
server by slug falls back to the warning and confirmed: true. To go back to letting
the model decide everything, set MCP_GATEWAY_HUMAN_APPROVAL=off in the gateway's
env in your client config. No tool can change that setting, though a model with a
file-editing tool could still edit your client config: this gate covers the gateway's
tools, not the rest of your agent. mcp_gateway_health says which mode you're in.
Claude Code 2.1.317 and Kiro both declare elicitation. A launch saved to a profile or group was approved when it was saved, so it starts without asking.
What is not covered
If the host client is SIGKILLed, the gateway cannot run its shutdown path and
spawned child processes may be left behind. SIGINT/SIGTERM are handled and
disconnect everything cleanly; SIGKILL is untrappable by definition.
Telemetry
Off unless you turn it on. The ad tracker is constructed only when
MCP_GATEWAY_PARTNER_KEY is set — with no partner key there is no partner
telemetry, and nothing is posted about your connects or tool calls.
If a partner key is set (you are earning attribution revenue), connect and
tool-execution events are sent to mcprating.io. Disable it while keeping the key
with MCP_GATEWAY_AD_TRACKING=false.
Separately, the gateway calls the configured registries — MCP Rating unless you
set MCP_GATEWAY_REGISTRIES — for mcp_discover, mcp_connect and
mcp_recommend. That is the lookup you asked for, not background reporting, and
each registry you list sees the searches.
Usage analytics (mcp_usage) are an in-memory ring buffer and never leave the
process.
Development
npm install
npm run dev # watch mode
npm run typecheck
npm run build
npm test # unit tests (env scoping, egress proxy, reconnect, mcp_call_tool)Architecture
The gateway is built on the MCP SDK and uses:
StdioServerTransport — communicates with the host client
StdioClientTransport — spawns and communicates with downstream servers
Dynamic tool registration —
McpServer.registerTool()+sendToolListChanged()Tool namespacing —
slug__toolnamepattern prevents collisionsPassthrough Zod schemas — preserves parameter names for host client UI while letting downstream servers validate
License
MIT — see LICENSE.
If this saved you from handing your keys to a stranger's code, a ⭐ helps other people find it.
Available Tools
13 toolsmcp_auditA
View the safety audit trail — a forensics log of what sandboxed MCP servers did and what the sandbox blocked (tool calls, blocked tools, blocked/allowed network egress, connects with granted capabilities). Use securityOnly: true to see only blocks and errors.
| Name | Required | Description | Default |
|---|---|---|---|
| slug | No | Filter to a single server slug | |
| event | No | Filter to a single event type | |
| limit | No | Max events to return (default 50, newest first) | |
| securityOnly | No | Show only security-relevant events (blocks + errored calls) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations supplied, the description does real work: 'View' establishes a read-only operation, and the parenthetical discloses the exact categories of behavior recorded, including both what servers did and what the sandbox blocked. It omits retention window, whether results span all servers by default, and access prerequisites, which keeps it from a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, leading with what the tool is and following with the one actionable flag. The parenthetical enumeration is dense but each item carries informational weight; nothing is redundant with the schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
A read-only query tool with four all-optional params and no output schema — the description covers the conceptual return contents (event categories) and the default sort via the schema. What is missing is the default scope (all servers vs. one slug) and any sense of volume or retention, small gaps for a forensics listing tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so slug, event, limit and their constraints are already documented. The description restates the securityOnly semantics ('only blocks and errors'), which matches rather than extends the schema, and says nothing about combining filters or cursor behavior. Baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('View the safety audit trail') and immediately defines it as a forensics log of sandboxed server activity, enumerating the concrete event kinds (tool calls, blocked tools, egress, connects with capabilities). That distinguishes it in substance from mcp_usage or mcp_list_active, though no sibling is named explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Offers one concrete usage cue — `securityOnly: true` for blocks and errors — which is genuinely helpful routing advice. It gives no when-not guidance and does not contrast itself with mcp_usage or mcp_list_active, so the agent must infer which observability tool to reach for.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mcp_call_toolA
Call a tool on a connected MCP server. Use this when dynamically connected tools aren't directly available. Pass the namespaced tool name (slug__toolName) and arguments.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Namespaced tool name: "server-slug__tool-name" (as shown by mcp_connect or mcp_list_active) | |
| arguments | No | Tool arguments as a JSON object |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden, and it falls short: it does not say what happens on failure, whether arguments are validated against the target tool's schema, what the response looks like, or any permission/timeout concerns. The only behavioral hint is the dynamic-availability condition.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with the action, followed by the usage condition and then the required input format. No waste.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a dispatcher with no output schema and no annotations, the definition covers the essential action and input format but omits error behavior and any indication of the return shape, which would matter for an agent deciding how to handle the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both parameters are already fully documented ('name' as server-slug__tool-name, 'arguments' as a JSON object). The description restates the namespaced format but adds no syntax or usage detail beyond what the schema provides, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Call a tool on a connected MCP server'), so an agent immediately knows this dispatches a call to a dynamically connected server. It does not, however, explicitly distinguish itself from siblings like mcp_discover or mcp_connect, leaving the routing between meta-tools to inference.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides a clear when-to-use condition: 'when dynamically connected tools aren't directly available.' That is genuine routing guidance, but it names no alternatives (mcp_discover/connect/list_active) and gives no when-not guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mcp_connectA
Connect to an MCP server and make its tools available. Provide either a server slug (from mcp_discover) to look up in the registry, OR an explicit command + args to spawn directly, OR a url for remote servers. An explicit command needs the person's approval, which the gateway asks for itself.
| Name | Required | Description | Default |
|---|---|---|---|
| env | No | Additional environment variables for the server process | |
| url | No | URL for remote transports (SSE, WebSocket, Streamable HTTP). Use instead of command for remote servers. | |
| args | No | Command arguments (e.g., ['-y', '@modelcontextprotocol/server-everything']) | |
| slug | No | Server slug from MCP-Rating registry (e.g., '@modelcontextprotocol/inspector') | |
| command | No | Explicit command to spawn (e.g., 'npx'). Use when server is not in registry. The gateway asks the person first, and refuses if the client can't ask. | |
| confirmed | No | Set to true to confirm connection to community/unknown trust tier servers, once the user has said yes. Required when the initial connect returns a confirmation warning. Where the client can ask the person directly, the gateway does that instead and this has no effect. | |
| saveProfile | No | Set to true to save this connection as an auto-connect profile. The server will auto-reconnect on gateway restart. | |
| transportType | No | Transport type. Defaults to 'stdio' for command-based, auto-detected from URL scheme if url is provided. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral burden and does disclose the key non-obvious trait: explicit commands require human approval and the gateway refuses when the client cannot ask. It does not cover persistence across restarts, duplicate/already-connected behavior, or authentication expectations for remote URLs, which are real gaps for a stateful connection tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, front-loaded with the outcome and then the three input modes. Every sentence carries distinct information and nothing is padded or repeated.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an 8-parameter, state-changing tool with no annotations and no output schema, the definition covers the modes and the approval gate adequately. It leaves the caller unsure what a successful connect returns (connection handle, tool list?) and how failures surface, which an agent would want to know before wiring follow-up calls.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so each parameter is already documented individually, setting the baseline at 3. The description adds the one thing the schema cannot express: that slug, command, and url are alternative modes rather than a flat bag of options, which is a modest but real increment.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource plus the resulting side effect: 'Connect to an MCP server and make its tools available.' It also distinguishes itself from the sibling mcp_discover by naming it as the source of a slug, so an agent can separate discovery from connection without reading either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It clearly lays out three mutually exclusive invocation paths (registry slug, explicit command + args, or url for remote servers) and points to mcp_discover for slug lookup, which is exactly the routing an agent needs. It stops short of stating when not to use this tool, such as already-connected servers (mcp_list_active) or teardown via mcp_disconnect.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mcp_disconnectA
Disconnect from a connected MCP server and remove its tools. Use mcp_list_active to see connected servers.
| Name | Required | Description | Default |
|---|---|---|---|
| slug | Yes | Server slug of the connected server to disconnect |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations, so the description carries the full burden. It usefully discloses that disconnecting removes the server's tools, but it omits whether the server can later be reconnected (mcp_connect exists as a sibling), whether the action is reversible, and whether in-flight tool calls are affected.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, action and effect front-loaded, with the helper pointer second. No waste.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter teardown tool with no output schema, the definition covers what it does, its side effect, and how to obtain the slug. The main remaining gap is the reversibility/reconnect question, which matters given mcp_connect is a sibling.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the single slug parameter is fully documented in the schema, so the description need only be consistent. It refers to "a connected MCP server" without adding format or sourcing detail beyond what the schema and the mcp_list_active pointer provide.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb+resource ("Disconnect from a connected MCP server") with the key side effect stated ("remove its tools"), which cleanly distinguishes it from sibling mcp_connect and the read-oriented mcp_list_active.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It names mcp_list_active as the way to find connected servers, which implicitly tells the agent the prerequisite state (a currently connected server) and where to get the slug. It does not state any when-not-to-use condition or contrast against alternatives like mcp_connect, so it falls short of full routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mcp_discoverA
Search the configured MCP registries (MCP Rating by default) for MCP servers. Returns servers with trust tiers, install information, and MCP Rating's quality scores where it has rated them. Use this to find servers before connecting them with mcp_connect.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Max results (default 10) | |
| query | Yes | Search query (server name, description, or capability) | |
| category | No | Filter by category slug (e.g., 'developer-tools', 'data-databases') |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations and no output schema, the description carries the full burden and does disclose the return shape (trust tiers, install info, quality scores) and that only configured registries are searched. It omits confirming the operation is read-only and says nothing about rate limits or pagination behavior, which is why it is not a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences with no filler; purpose, return content, and the routing hint are all front-loaded before any elaboration.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description compensates for the missing output schema by naming what results contain, and all three parameters are schema-documented. Small gaps remain around default registry configuration and result pagination/limits beyond the schema's max.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so query, category, and limit are already documented in the schema (baseline 3). The description adds only the registry context ('MCP Rating by default') and nothing about query syntax or category source.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Search the configured MCP registries ... for MCP servers') plus what comes back (trust tiers, install info, quality scores). It is clearly distinguishable from siblings like mcp_server_info, mcp_recommend, and mcp_list_active.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Use this to find servers before connecting them with mcp_connect' gives an explicit use context and names the downstream alternative. It stops short of ruling out competing discovery tools such as mcp_recommend or describing when NOT to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mcp_gateway_healthA
Get gateway diagnostics: version, uptime, connection status, registry reachability, and per-server health.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It helpfully enumerates the diagnostic categories returned, but never states that the operation is a safe read-only check, whether it incurs load on downstream servers, or any auth/latency characteristics.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence that enumerates its contents with zero filler. Every listed item corresponds to real output the caller would receive.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema or annotations exist, so the description must carry the return-value story, and it does by naming each diagnostic field. It stops short of describing format or how per-server health is represented, but for a zero-arg probe this is close to sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there is nothing to document and the baseline of 4 applies. The description correctly adds no spurious parameter detail.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb (Get) and resource (gateway diagnostics) and enumerates the exact contents returned: version, uptime, connection status, registry reachability, per-server health. This clearly distinguishes it from siblings like mcp_list_active or mcp_server_info, though it never names an alternative explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit when-to-use guidance, no prerequisites, and no mention of alternative tools for related queries. An agent can infer a health/diagnostics use case, but nothing in the text routes it there versus mcp_server_info or mcp_list_active.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mcp_groupsB
Manage server groups for atomic connect/disconnect of sets of servers.
| Name | Required | Description | Default |
|---|---|---|---|
| url | No | Server URL (for add_server with SSE/WS/HTTP) | |
| args | No | Command arguments (for add_server with stdio) | |
| name | No | Group name (required for all actions except list) | |
| slug | No | Server slug to add/remove from a group | |
| action | Yes | Action: list, create, delete, add_server, remove_server, connect (all in group), disconnect (all in group), show (details) | |
| command | No | Explicit command for the server (for add_server with stdio) | |
| description | No | Group description (optional, for create) | |
| transportType | No | Transport type (for add_server) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full behavioral burden. It discloses the useful 'atomic' trait, but says nothing about destructive actions (delete, remove_server), permission requirements, error behavior, or side effects of connect/disconnect.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with zero waste. It is appropriately sized for a tool whose schema carries the parameter detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a multi-action tool with eight parameters, no annotations, and no output schema, one sentence is thin. The schema lists actions but the description does not help an agent understand action categories, destructive operations, or behavioral implications.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents every parameter and action. The description adds no parameter-level meaning beyond that baseline, so a 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear verb+resource ('Manage server groups') and adds the scope 'atomic connect/disconnect of sets of servers'. It does not explicitly distinguish itself from sibling tools like mcp_connect and mcp_disconnect that operate on individual servers, so sibling differentiation is missing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the phrase 'atomic connect/disconnect of sets of servers', suggesting this tool is for group-level operations. However, there is no explicit when-to-use, when-not-to-use, or alternative routing versus mcp_connect/mcp_disconnect.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mcp_list_activeA
List all currently connected MCP servers and their tools.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations, so the description carries the burden, but for a zero-parameter listing tool there is little to disclose. 'List ... currently connected' implies a read-only, non-destructive operation and indicates what is returned; however it does not state auth requirements, whether the listing is cached, or any rate limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler. The core action and scope are stated immediately with nothing wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, and the description compensates by stating what is returned (connected servers and their tools). For a simple no-arg listing tool this is nearly complete; only the boundary against mcp_discover remains unaddressed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes no parameters, so there are no parameter semantics to convey. Baseline for a zero-parameter tool is 4, and the schema (empty object) is consistent with the description's implicit claim of no inputs.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clear specific verb 'List' with a precise resource: 'currently connected MCP servers and their tools'. An agent can distinguish it from most siblings, but the description does not explicitly contrast it with near-neighbors like mcp_discover (unconnected servers) or mcp_server_info (single server).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance and no alternatives named. The 'currently connected' qualifier implicitly suggests it differs from discovery, but the agent must infer when to pick this over mcp_discover or mcp_server_info.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mcp_profilesC
Manage named connection profiles. Profiles are presets of server connections that can be switched between (e.g., 'work', 'personal').
| Name | Required | Description | Default |
|---|---|---|---|
| url | No | Server URL (for add_server with SSE/WS/HTTP) | |
| args | No | Command arguments (for add_server with stdio) | |
| name | No | Profile name (required for create, delete, add_server, remove_server, switch, show) | |
| slug | No | Server slug to add/remove from a profile | |
| action | Yes | Action: list (all profiles), create (new profile), delete, add_server (add a server to profile), remove_server, switch (activate profile), show (details of a profile) | |
| command | No | Explicit command for the server (for add_server with stdio) | |
| description | No | Profile description (optional, for create) | |
| transportType | No | Transport type (for add_server) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It mentions that profiles can be 'switched between' but does not disclose that actions like delete, remove_server, and switch have destructive or state-changing effects, nor does it describe persistence, permissions, or side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the core purpose and one clarifying definition. There is no filler, and the example parenthetical adds useful context without bloating the description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a complex multi-action tool (8 parameters, 7 enum actions, no annotations, no output schema), yet the description only gives a high-level summary. It omits action-specific behavior, destructive-action warnings, return information, and usage differentiation, which are necessary for an agent to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already defines all 8 parameters and the action enum. The description adds no additional meaning about parameter interactions or usage beyond what the schema provides. Baseline 3 applies when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear verb and resource: 'Manage named connection profiles.' It further clarifies with the definition 'presets of server connections' and examples ('work', 'personal'). However, it does not distinguish this tool from possibly related siblings like mcp_groups or mcp_discover, leaving the agent to infer the boundary.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given for when to use this tool versus alternatives, when to prefer each action (e.g., create vs add_server), or what prerequisites exist. The description only says 'manage', which is too vague to guide selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mcp_recommendB
Get MCP server recommendations. Pass query to describe a goal or task (e.g. "file sync with cloud storage", "manage GitHub issues"). Omit query to get suggestions based on your recent tool-call patterns.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of recommendations (default 5, max 20) | |
| query | No | Free-text goal or task. When provided, recommends servers that match this intent using semantic/keyword/expansion search. When omitted, recommends based on usage history. | |
| category | No | Optional category slug to filter (e.g. 'developer-tools', 'data-databases'). Only used with `query`. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It mentions search modes (semantic/keyword/expansion) and usage-history fallback, but says nothing about permissions, rate limits, ranking behavior, or what the response contains.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two efficient sentences front-load the core action and then explain the query/no-query branches without waste.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only recommendation tool with no annotations and no output schema, the description covers invocation modes but leaves return shape, ranking, and any auth or rate-limit context unaddressed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the schema already documents all three parameters thoroughly, including limits and the category dependency on query. The description's parameter guidance largely repeats the schema, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource (get recommendations for MCP servers) clearly. It distinguishes the tool from siblings like mcp_discover and mcp_list_active by focusing on recommendations driven by query or usage patterns, though it doesn't explicitly name how it differs from those siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear conditions for passing query vs omitting it, which covers the main usage modes. However, it doesn't mention when to prefer this over mcp_discover or other siblings that also surface servers.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mcp_sandboxA
View or customize a server's sandbox capability manifest (env/network/filesystem/subprocess access). Use action 'view' to inspect, 'set' to tighten or loosen grants (only the fields you pass change, the rest keep what the server has now or would get by default; applies on next connect), or 'reset' to revert to defaults.
| Name | Required | Description | Default |
|---|---|---|---|
| slug | Yes | Server slug (as shown by mcp_list_active or mcp_discover), or its registry name (io.github.owner/server) | |
| action | Yes | view = inspect manifest; set = override grants; reset = revert to defaults | |
| fsRead | No | [set] Absolute paths the server may read | |
| fsWrite | No | [set] Absolute paths the server may write | |
| network | No | [set] Network mode. 'none' = no network, 'allowlist' = only listed hosts, 'all' = unrestricted | |
| envAllow | No | [set] Environment variable NAMES the server may receive, e.g. ['GITHUB_TOKEN'] | |
| subprocess | No | [set] Whether the server may spawn subprocesses | |
| enforcement | No | [set] Isolation level. l2-container requires Docker/Podman. | |
| networkAllow | No | [set] Allowed host:port patterns for allowlist mode, e.g. ['api.github.com:443', '*.example.com'] |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does well: it discloses that 'set' is a partial patch ('only the fields you pass change, the rest keep what the server has now or would get by default') and that changes are deferred ('applies on next connect'). These are non-obvious mutation semantics an agent could not infer from the schema. It still omits the permission/authorization requirements and what a failed or rejected grant looks like.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single dense sentence with the purpose front-loaded and the action routing following in priority order. It is long but every clause (partial-update behavior, deferred application) earns its place; only the nested parenthetical stacking costs it a point.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No annotations and no output schema, and for a 9-parameter policy mutation tool the description covers actions and mutation semantics adequately. It does not say what 'view' returns or how enforcement failures surface, but the schema's enum descriptions (e.g. l2-container requires Docker) pick up part of that slack.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all nine parameters, including enum values and the [set] action prefixes. The description's only added parameter meaning is the merge semantics for omitted fields on 'set', which is useful but marginal. Baseline 3 is appropriate when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb pair (view/customize) and the exact resource (a server's sandbox capability manifest), then enumerates the four policy domains it covers (env/network/filesystem/subprocess). No sibling tool deals with sandbox grants, so the agent can route to it unambiguously.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Maps each action enum value to a purpose: 'view' to inspect, 'set' to tighten or loosen grants, 'reset' to revert to defaults. This tells the agent which action to pick but gives no guidance on when this tool is preferable to adjacent tools like mcp_connect or mcp_profiles, nor any prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mcp_server_infoB
Get detailed information about an MCP server from the registry or a currently connected server.
| Name | Required | Description | Default |
|---|---|---|---|
| slug | Yes | Server slug (from registry or connected server) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full disclosure burden. It implies a read operation but says nothing about whether a connection is required, what happens if the slug is not found, permissions, or rate limits. For a lookup tool with zero annotation coverage this is thin.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single efficient sentence that front-loads the verb and resource. Every clause earns its place, though the dual-source phrasing could be tightened.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
A read-only, single-parameter tool with no output schema, so the description could reasonably explain what 'detailed information' is returned. It stops short of that, leaving the return payload unspecified, though the lookup scope is covered.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the single 'slug' parameter is documented in the schema itself, so the description adds no additional meaning. Baseline 3 is appropriate when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a clear verb ('Get detailed information') and resource ('an MCP server') and clarifies the two lookup sources (registry or connected server). It distinguishes itself reasonably from siblings like mcp_discover and mcp_list_active, though it does not name them explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The mention of 'registry or a currently connected server' implies when this tool applies, but there is no explicit when-to-use guidance or contrast with alternatives such as mcp_discover. Usage is only inferable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
mcp_usageC
View usage analytics for connected MCP servers — call counts, latency, error rates, and recent activity.
| Name | Required | Description | Default |
|---|---|---|---|
| slug | No | Filter stats to a specific server slug. Omit for global stats. | |
| limit | No | Limit number of results for 'recent' and 'slow' actions (default: 20) | |
| action | No | Action: stats (default — summary), recent (recent calls), slow (slow calls), reset (clear all data) | |
| threshold | No | Latency threshold in ms for 'slow' action (default: 5000) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden — and it frames the tool purely as a read-only viewer ('View usage analytics'), while the schema exposes a 'reset' action documented as 'clear all data'. A destructive capability is left undisclosed, which could lead an agent into irreversible data loss. No mention of permissions or reversibility.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence that names the resource first and then the metrics. Zero wasted words and appropriately sized for the tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no annotations, no output schema, and a multi-action tool that includes a destructive 'reset', the description should say more than it does. It omits the existence of non-viewing actions and any warning about data destruction, leaving a significant gap for an agent deciding whether to call it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all four parameters (slug, limit, action, threshold) are already documented in the schema, including enum meanings. The description adds no parameter-level detail beyond what the schema provides; baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a clear verb ('View') and resource ('usage analytics for connected MCP servers') and enumerates the metrics returned (call counts, latency, error rates, recent activity). It is distinguishable from siblings like mcp_gateway_health or mcp_audit, though it does not explicitly contrast with them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to choose this tool over mcp_gateway_health, mcp_audit, or mcp_server_info, nor any stated prerequisites (e.g., that a server must be connected). The description offers no when/when-not context at all.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
2 tool updates
v0.5.0- Changed
mcp_audit1 field changed- changed
Input schema / properties / event / enumPrevious value: -[ - "connect", - "tool_call", - "tool_blocked", - "egress_blocked", - "egress_allowed", - "personal_data_requested", - "disconnect" -]New value: +[ + "connect", + "tool_call", + "tool_blocked", + "egress_blocked", + "egress_allowed", + "personal_data_requested", + "approval", + "disconnect" +]
- Changed
mcp_connect2 fields changed- changed
Input schema / properties / command / descriptionPrevious value: -"Explicit command to spawn (e.g., 'npx'). Use when server is not in registry."New value: +"Explicit command to spawn (e.g., 'npx'). Use when server is not in registry. The gateway asks the person first, and refuses if the client can't ask." - changed
Input schema / properties / confirmed / descriptionPrevious value: -"Set to true to confirm connection to community/unknown trust tier servers. Required when the initial connect returns a confirmation warning."New value: +"Set to true to confirm connection to community/unknown trust tier servers, once the user has said yes. Required when the initial connect returns a confirmation warning. Where the client can ask the person directly, the gateway does that instead and this has no effect."
2 tool updates
v0.4.1- Changed
mcp_audit1 field changed- changed
Input schema / properties / event / enumPrevious value: -[ - "connect", - "tool_call", - "tool_blocked", - "egress_blocked", - "egress_allowed", - "disconnect" -]New value: +[ + "connect", + "tool_call", + "tool_blocked", + "egress_blocked", + "egress_allowed", + "personal_data_requested", + "disconnect" +]
- Changed
mcp_sandbox1 field changed- changed
Input schema / properties / slug / descriptionPrevious value: -"Server slug (as shown by mcp_list_active or mcp_discover)"New value: +"Server slug (as shown by mcp_list_active or mcp_discover), or its registry name (io.github.owner/server)"
13 tool updates
v0.2.3- First observed
mcp_audit - First observed
mcp_call_tool - First observed
mcp_connect - First observed
mcp_disconnect - First observed
mcp_discover - First observed
mcp_gateway_health - First observed
mcp_groups - First observed
mcp_list_active - First observed
mcp_profiles - First observed
mcp_recommend - First observed
mcp_sandbox - First observed
mcp_server_info - First observed
mcp_usage
TDQS
Scored across 13 tools
Most tools target clearly distinct operations (discover, connect, disconnect, call, audit, health, usage). The main soft spots are mcp_discover vs mcp_recommend (both 'find me a server') and mcp_list_active vs mcp_server_info (both about connected servers), though descriptions give enough hints to separate them.
All tools share a clean mcp_ prefix in snake_case, which is highly predictable. Minor deviation: most are verb-led (mcp_discover, mcp_connect, mcp_call_tool) but several are bare nouns (mcp_profiles, mcp_groups, mcp_usage, mcp_sandbox) with an implied 'manage'.
13 tools sits squarely in the well-scoped range and maps neatly onto the gateway lifecycle. Each tool covers a distinct concern (registry, connections, security, diagnostics, analytics) without redundancy.
The connection lifecycle is fully covered: discover, connect, list, inspect, call, sandbox-configure, disconnect, plus audit/health/usage monitoring. Minor gaps exist around credential/auth management and registry publish/remove operations, but core gateway workflows have no dead ends.
Maintenance
Related MCP Connectors
Publish and discover MCP servers via the official MCP Registry. Powered by HAPI MCP server.
Trust, freshness, policy, and discovery layer for public MCP servers.
Search, vet & assemble MCP servers from your agent: verified tools, risk labels, and trust scores.
MCP server for your apps' tools and custom tools, plus hosted AI agents and approval-gated workflows
Related MCP Servers
- AlicenseBqualityCmaintenanceDynamic MCP server for Node.js enabling runtime tool creation, management, and execution in isolated sandboxes (Docker or Node).88 npm1MIT
- AlicenseNot gradedqualityDmaintenanceA flexible MCP proxy server that connects to and routes between multiple backend MCP servers over STDIO or SSE, enabling dynamic management and namespacing of tools.111MIT
- FlicenseAqualityDmaintenanceUniversal MCP proxy server that discovers, searches, and executes tools across all configured MCP servers from a single entry point.7-
- FlicenseNot gradedqualityCmaintenanceEnables agents to connect to remote MCP servers once, access their tools through a compact MCP endpoint, pair a CLI inside sandboxes, and create watches that turn command or tool output into pollable structured events.2-