Skip to main content
Glama

@mcp-rating/gateway

npm license MCP tests

Run MCP servers without handing them your API keys.

Adding an MCP server to your client today spawns somebody else's code with your entire environment attached — AWS_SECRET_ACCESS_KEY, OPENAI_API_KEY, DATABASE_URL, everything in your shell. The gateway spawns them with a constructed environment instead: PATH, HOME, and only the variables you or its manifest name. Nothing else is there to read.

The same deliberately malicious MCP server, run twice: on a raw spawn it reads every
variable in the shell; through the gateway it sees fifteen, none sensitive.

Raw spawn (every MCP client today)

Through the gateway

Environment visible to the server

your entire shell

PATH, HOME, and what you name

Credentials readable

all of them

none

Reproduce it yourself in about ten seconds — node demo/run-demo.mjs plants two fake credentials, reads your real environment, and prints only the count and the planted values. Nothing of yours is displayed.

It is also a meta-server: one entry in your config gives you the whole registry, connected on demand rather than pre-loaded.

{ "mcpServers": { "gateway": { "command": "npx", "args": ["-y", "@mcp-rating/gateway"] } } }

Why it uses less of your context

Every MCP server you configure statically injects its full tool schema into every turn, whether you use it or not. The gateway exposes 13 meta-tools at a fixed cost and loads a server's tools only once you connect to it.

measured

Median real MCP server

2,587 tokens

10 servers configured statically

~25,900 tokens, every turn

Gateway, flat

2,644 tokens

Roughly 10× less standing overhead at ten servers, and the gap widens with each one you add. One median server already costs about what the entire gateway costs.

But standing overhead is not the bill — here is the break-even

That 10× is what sits in the window. It is not what a conversation costs, because the gateway also adds turns: it has to discover a server and connect to it before using it, every turn re-sends the whole transcript, and mcp_discover output stays in that transcript afterwards.

Measured end to end on gemma-4-31B through vLLM, with the server's own tokenizer rather than an estimate:

tokens

turns

Gateway, cold — discover, connect, then call a tool

17,904

5

Same tool call, server already configured

6,605

2

With one server, the gateway costs 2.7× more than just configuring it. The saving only appears once you have enough servers that carrying all their schemas outweighs the setup. N configured, one actually used, after ten turns of work:

servers

static

gateway

1

25,870

70,524

static wins 2.7×

2

51,740

70,524

static wins 1.4×

4

103,480

70,524

gateway wins 1.5×

10

258,700

70,524

gateway wins 3.7×

20

517,400

70,524

gateway wins 7.3×

Break-even is three to five servers. Below that, a hand-written config is genuinely cheaper and you should use one. Above it the gateway wins, and keeps winning as you add more — but the honest figure at ten servers is about 3× on total tokens, not the 10× you get by counting standing overhead alone.

Honest about the method: measured from the tool schemas of 91 servers this project has connected to and introspected — drawn from the 300 most-downloaded in the registry — summing {name, description, inputSchema} per tool, the payload a client actually receives from tools/list, sized as chars / 4. That is an estimate, not a tokenizer.

Median, not mean, and the distribution is why. The mean is 9,965 tokens, dragged there by a long tail: 19 of the 91 cost over 10,000 tokens and the heaviest — a Spotify server exposing 608 tools — costs 135,666, about 68% of a 200k context window on its own. Quoting the mean would flatter this project's numbers using servers almost nobody installs.

The saving is real precisely because most configured servers sit unused in most conversations — but see the break-even above before assuming it applies to you.

The chars / 4 estimate was checked against three real tokenizers and came in at 0.88×, 0.98× and 1.01× of the true count, so it never reads low.

Reproduce both: node demo/shorts/short2-context.mjs --refresh for the schema corpus, and demo/ollama-probe.mjs for the end-to-end bill —

# gateway cold: must discover and connect first
OLLAMA_HOST=http://host:8000/v1 node demo/ollama-probe.mjs your-model

# baseline: server already attached, like a static config
PRECONNECT=everything-slim OLLAMA_HOST=... node demo/ollama-probe.mjs your-model

Related MCP server: Multi-MCP Proxy

How It Works

┌────────────────────┐       ┌──────────────┐       ┌──────────────────┐
│  Claude Desktop /  │ stdio │              │ stdio  │ MCP Server A     │
│  Cursor / Windsurf │◄─────►│  MCP Gateway │◄──────►│ (e.g. filesystem)│
│  (host client)     │       │              │◄──┐    └──────────────────┘
└────────────────────┘       └──────────────┘   │    ┌──────────────────┐
                                    │           └───►│ MCP Server B     │
                                    ▼                │ (e.g. github)    │
                             ┌──────────────┐        └──────────────────┘
                             │ MCP-Rating   │
                             │ Registry API │
                             └──────────────┘

Instead of manually configuring each MCP server in your client, the Gateway:

  1. Discovers servers via the MCP-Rating registry

  2. Connects to them on-demand (spawns as child processes)

  3. Proxies their tools through namespaced names (servername__toolname)

  4. Notifies your client when tools are added/removed

Quick Start

With Claude Desktop

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "gateway": {
      "command": "npx",
      "args": ["-y", "@mcp-rating/gateway"]
    }
  }
}

Then ask Claude:

  • "Search for MCP servers that work with databases" (uses mcp_discover)

  • "Connect to the sqlite server" (uses mcp_connect)

  • "Query my database" (calls the proxied tool directly)

Cursor

~/.cursor/mcp.json (or .cursor/mcp.json in a project):

{
  "mcpServers": {
    "gateway": { "command": "npx", "args": ["-y", "@mcp-rating/gateway"] }
  }
}

Claude Code

claude mcp add gateway -- npx -y @mcp-rating/gateway

Windsurf

~/.codeium/windsurf/mcp_config.json, same shape as Cursor:

{
  "mcpServers": {
    "gateway": { "command": "npx", "args": ["-y", "@mcp-rating/gateway"] }
  }
}

Any other MCP client

{ "command": "npx", "args": ["-y", "@mcp-rating/gateway"] }

Restart the client after editing its config — most read it only at startup.

Meta-Tools

The gateway exposes 13 built-in tools:

Tool

Description

mcp_discover

Search the MCP-Rating registry for MCP servers

mcp_connect

Connect to a server and make its tools available

mcp_disconnect

Disconnect a server and remove its tools

mcp_list_active

List connected servers and their tools

mcp_server_info

Detailed info about a server, from the registry or a live connection

mcp_call_tool

Call a tool on a connected server

mcp_gateway_health

Diagnostics: version, uptime, connection and registry status

mcp_sandbox

View or customise a server's sandbox manifest (env/network/filesystem)

mcp_audit

The safety audit trail — what sandboxed servers actually did

mcp_profiles

Named connection profiles (work, personal, …)

mcp_groups

Atomic connect/disconnect of server sets

mcp_usage

Call counts, latency and error rates for connected servers

mcp_recommend

Server recommendations based on usage

Trust Tiers

Every connected server is labeled with a trust tier based on its MCP-Rating quality score:

  • [Verified] — High quality + officially verified

  • [Trusted] — Good quality with repository and install command

  • [Community] — Listed in registry with basic quality

  • [Unverified] — Unknown origin (manually connected)

Configuration

The gateway reads config from ~/.mcp-gateway/config.json:

{
  "registryApiUrl": "https://mcprating.io/api/v1",
  "proxyTimeoutMs": 30000,
  "maxConnections": 10,
  "logLevel": "info"
}

Environment Variables

Variable

Description

Default

MCP_GATEWAY_REGISTRY_URL

MCP-Rating API base URL

https://mcprating.io/api/v1

MCP_GATEWAY_TIMEOUT

Proxy timeout (ms)

30000

MCP_GATEWAY_MAX_CONNECTIONS

Max simultaneous connections

10

MCP_GATEWAY_LOG_LEVEL

Log level (debug/info/warn/error)

info

MCP_GATEWAY_CONTAINER_ISOLATION

Force L2 container isolation on/off

manifest decides

MCP_GATEWAY_AUDIT_LOG

Path for the forensic audit log

disabled

MCP_GATEWAY_PARTNER_KEY

Partner attribution key — enables ad telemetry

unset

MCP_GATEWAY_AD_TRACKING

Set to false to disable ad telemetry outright

unset

MCP_GATEWAY_HTTP_TOKEN

Bearer token for HTTP daemon mode

unset

Security model

The gateway exists because plain MCP hands every server your whole environment. Two layers push back, and it is worth being precise about what each one does and does not do.

L1 — environment scoping (always on, for stdio servers)

A downstream server receives PATH, HOME and friends, plus only the variable names its manifest allowlists or you pass at connect time. Everything else in the parent environment — AWS_*, OPENAI_API_KEY, DATABASE_URL — is withheld. Exported shell functions (BASH_FUNC_*) are dropped rather than forwarded.

This is genuine enforcement: the child process is spawned with a constructed environment, so there is nothing to opt out of or bypass.

L2 — container isolation (opt-in)

When a manifest requests it, or MCP_GATEWAY_CONTAINER_ISOLATION=true, the server runs under docker/podman with an ephemeral container.

Network allowlists: read this before relying on them

network: "allowlist" starts an in-process forward proxy and points the child at it via HTTP_PROXY/HTTPS_PROXY.

This filters proxy-aware clients only. Node's fetch/undici, axios, and Python requests all honour those variables, which covers most real servers. A program that opens raw TCP sockets, or a compiled binary that ignores proxy environment variables, is not filtered. Treat allowlists in L1 as a guard rail against honest code, not a containment boundary against hostile code — for that you need L2 with container network namespacing.

Allowlist patterns fail closed: a malformed pattern such as *example.com (missing dot) matches nothing rather than everything. The gateway warns at startup about patterns that will not do what their author intended, including over-broad ones like *.com.

What is not covered

If the host client is SIGKILLed, the gateway cannot run its shutdown path and spawned child processes may be left behind. SIGINT/SIGTERM are handled and disconnect everything cleanly; SIGKILL is untrappable by definition.

Telemetry

Off unless you turn it on. The ad tracker is constructed only when MCP_GATEWAY_PARTNER_KEY is set — with no partner key there is no partner telemetry, and nothing is posted about your connects or tool calls.

If a partner key is set (you are earning attribution revenue), connect and tool-execution events are sent to mcprating.io. Disable it while keeping the key with MCP_GATEWAY_AD_TRACKING=false.

Separately, the gateway calls the MCP-Rating registry API for mcp_discover and mcp_recommend — that is the lookup you asked for, not background reporting. Usage analytics (mcp_usage) are an in-memory ring buffer and never leave the process.

Development

npm install
npm run dev        # watch mode
npm run typecheck
npm run build
npm test           # sandbox unit tests (env scoping + egress allowlist)

Architecture

The gateway is built on the MCP SDK and uses:

  • StdioServerTransport — communicates with the host client

  • StdioClientTransport — spawns and communicates with downstream servers

  • Dynamic tool registration — McpServer.registerTool() + sendToolListChanged()

  • Tool namespacing — slug__toolname pattern prevents collisions

  • Passthrough Zod schemas — preserves parameter names for host client UI while letting downstream servers validate

License

MIT — see LICENSE.


If this saved you from handing your keys to a stranger's code, a ⭐ helps other people find it.

Available Tools

13 tools
mcp_auditB

View the safety audit trail — a forensics log of what sandboxed MCP servers did and what the sandbox blocked (tool calls, blocked tools, blocked/allowed network egress, connects with granted capabilities). Use securityOnly: true to see only blocks and errors.

ParametersJSON Schema
NameRequiredDescriptionDefault
slugNoFilter to a single server slug
eventNoFilter to a single event type
limitNoMax events to return (default 50, newest first)
securityOnlyNoShow only security-relevant events (blocks + errored calls)

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It does disclose what the log contains (tool calls, blocked tools, allowed/blocked egress, connects with granted capabilities), but it says nothing about read-only-ness being guaranteed, retention limits, or pagination behavior beyond the schema's limit field.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the core purpose and followed by the one actionable flag. The parenthetical event list is dense but every element maps to real event types, so little is wasted, though the em-dash construction makes it slightly heavy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has four optional params, no annotations, and no output schema, so the description should ideally say more about what a returned audit record looks like or how results are ordered/paginated. It covers the content categories and the key flag but leaves return shape and scope limits to inference.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the baseline is 3 and the schema already documents all four parameters. The description's event enumeration largely restates the schema's enum values, adding only a small interpretive nuance ('connects with granted capabilities'), so it does not materially exceed the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb and resource ('View the safety audit trail') and scopes it as a forensics log of sandboxed server activity versus sandbox blocks, which clearly separates it from siblings like mcp_usage or mcp_sandbox. It never names an alternative sibling explicitly, so the differentiation is implied rather than stated, keeping it below a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage guidance is limited to the parameter-level hint 'Use `securityOnly: true` to see only blocks and errors' rather than any when-to-use-this-vs-another-tool statement. An agent can infer this is the forensics/compliance view, but no exclusion or alternative routing is given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_call_toolA

Call a tool on a connected MCP server. Use this when dynamically connected tools aren't directly available. Pass the namespaced tool name (slug__toolName) and arguments.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesNamespaced tool name: "server-slug__tool-name" (as shown by mcp_connect or mcp_list_active)
argumentsNoTool arguments as a JSON object

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden, and it falls short: it does not say what happens on failure, whether arguments are validated against the target tool's schema, what the response looks like, or any permission/timeout concerns. The only behavioral hint is the dynamic-availability condition.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, front-loaded with the action, followed by the usage condition and then the required input format. No waste.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a dispatcher with no output schema and no annotations, the definition covers the essential action and input format but omits error behavior and any indication of the return shape, which would matter for an agent deciding how to handle the result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both parameters are already fully documented ('name' as server-slug__tool-name, 'arguments' as a JSON object). The description restates the namespaced format but adds no syntax or usage detail beyond what the schema provides, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Call a tool on a connected MCP server'), so an agent immediately knows this dispatches a call to a dynamically connected server. It does not, however, explicitly distinguish itself from siblings like mcp_discover or mcp_connect, leaving the routing between meta-tools to inference.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides a clear when-to-use condition: 'when dynamically connected tools aren't directly available.' That is genuine routing guidance, but it names no alternatives (mcp_discover/connect/list_active) and gives no when-not guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_connectA

Connect to an MCP server and make its tools available. Provide either a server slug (from mcp_discover) to look up in the registry, OR an explicit command + args to spawn directly, OR a url for remote servers.

ParametersJSON Schema
NameRequiredDescriptionDefault
envNoAdditional environment variables for the server process
urlNoURL for remote transports (SSE, WebSocket, Streamable HTTP). Use instead of command for remote servers.
argsNoCommand arguments (e.g., ['-y', '@modelcontextprotocol/server-everything'])
slugNoServer slug from MCP-Rating registry (e.g., '@modelcontextprotocol/inspector')
commandNoExplicit command to spawn (e.g., 'npx'). Use when server is not in registry.
confirmedNoSet to true to confirm connection to community/unknown trust tier servers. Required when the initial connect returns a confirmation warning.
saveProfileNoSet to true to save this connection as an auto-connect profile. The server will auto-reconnect on gateway restart.
transportTypeNoTransport type. Defaults to 'stdio' for command-based, auto-detected from URL scheme if url is provided.

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden; it discloses the connection outcome (tools become available) but not trust-tier confirmation needs, persistence/reconnect behavior, or auth requirements, which live only in the schema for `confirmed` and `saveProfile`. Useful but incomplete behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the action and immediately followed by the three invocation options. Zero filler, and the most decision-relevant routing info comes first.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an 8-parameter tool with no annotations and no output schema, the description covers the core routing but omits the trust-tier confirmation flow, reconnect/profiles semantics, and error behavior. The rich schema compensates for parameter semantics, but behavioral completeness is thin.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. The description reinforces the slug-vs-command-vs-url selection logic but largely restates what the per-parameter descriptions already say ('Use instead of command for remote servers'), adding only the OR framing.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Connect) and resource (MCP server) plus the effect (make its tools available), and names the sibling mcp_discover as the source of slugs. An agent can distinguish this from mcp_disconnect, mcp_list_active, and mcp_discover without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly lays out three mutually exclusive invocation modes (slug from registry, command+args to spawn, url for remote), which routes the agent to the correct parameter set. It stops short of stating when-not to use it or what to do on failure/confirmation, so not a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_disconnectA

Disconnect from a connected MCP server and remove its tools. Use mcp_list_active to see connected servers.

ParametersJSON Schema
NameRequiredDescriptionDefault
slugYesServer slug of the connected server to disconnect

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations, so the description carries the full burden. It usefully discloses that disconnecting removes the server's tools, but it omits whether the server can later be reconnected (mcp_connect exists as a sibling), whether the action is reversible, and whether in-flight tool calls are affected.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, action and effect front-loaded, with the helper pointer second. No waste.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter teardown tool with no output schema, the definition covers what it does, its side effect, and how to obtain the slug. The main remaining gap is the reversibility/reconnect question, which matters given mcp_connect is a sibling.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the single slug parameter is fully documented in the schema, so the description need only be consistent. It refers to "a connected MCP server" without adding format or sourcing detail beyond what the schema and the mcp_list_active pointer provide.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb+resource ("Disconnect from a connected MCP server") with the key side effect stated ("remove its tools"), which cleanly distinguishes it from sibling mcp_connect and the read-oriented mcp_list_active.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It names mcp_list_active as the way to find connected servers, which implicitly tells the agent the prerequisite state (a currently connected server) and where to get the slug. It does not state any when-not-to-use condition or contrast against alternatives like mcp_connect, so it falls short of full routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_discoverA

Search the MCP-Rating registry for MCP servers. Returns servers with quality scores, trust tiers, and install information. Use this to find servers before connecting them with mcp_connect.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMax results (default 10)
queryYesSearch query (server name, description, or capability)
categoryNoFilter by category slug (e.g., 'developer-tools', 'data-databases')

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It implies a read-only search and discloses return content ('quality scores, trust tiers, and install information'), which is useful. However, it omits behavioral details such as authentication requirements, rate limits, result ordering, or pagination, leaving meaningful gaps for a tool with zero annotation coverage.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tightly written sentences with zero waste. The purpose is front-loaded, followed by return contents and usage guidance. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple search tool with complete schema coverage and no output schema, the description adequately explains what returns and when to use it. It does not cover result ordering, default limits, or error behavior, but those are minor given the tool's simplicity and the schema's parameter documentation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all three parameters (query, limit, category) are already documented in the schema. The description adds no parameter-specific meaning, such as syntax hints or default behaviors beyond the schema. Baseline 3 is appropriate when the schema fully handles parameter documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: 'Search the MCP-Rating registry for MCP servers.' It distinguishes itself from mcp_connect by naming it as the follow-up step. However, it does not differentiate from other discovery-adjacent siblings like mcp_recommend or mcp_server_info, which prevents a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides clear usage context: 'Use this to find servers before connecting them with mcp_connect.' This tells the agent when to invoke it and the intended workflow. It stops short of exclusions or naming alternatives within the search space (e.g., mcp_recommend), so it is a strong 4 rather than a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_gateway_healthA

Get gateway diagnostics: version, uptime, connection status, registry reachability, and per-server health.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It helpfully enumerates the diagnostic categories returned, but never states that the operation is a safe read-only check, whether it incurs load on downstream servers, or any auth/latency characteristics.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence that enumerates its contents with zero filler. Every listed item corresponds to real output the caller would receive.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema or annotations exist, so the description must carry the return-value story, and it does by naming each diagnostic field. It stops short of describing format or how per-server health is represented, but for a zero-arg probe this is close to sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so there is nothing to document and the baseline of 4 applies. The description correctly adds no spurious parameter detail.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb (Get) and resource (gateway diagnostics) and enumerates the exact contents returned: version, uptime, connection status, registry reachability, per-server health. This clearly distinguishes it from siblings like mcp_list_active or mcp_server_info, though it never names an alternative explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit when-to-use guidance, no prerequisites, and no mention of alternative tools for related queries. An agent can infer a health/diagnostics use case, but nothing in the text routes it there versus mcp_server_info or mcp_list_active.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_groupsB

Manage server groups for atomic connect/disconnect of sets of servers.

ParametersJSON Schema
NameRequiredDescriptionDefault
urlNoServer URL (for add_server with SSE/WS/HTTP)
argsNoCommand arguments (for add_server with stdio)
nameNoGroup name (required for all actions except list)
slugNoServer slug to add/remove from a group
actionYesAction: list, create, delete, add_server, remove_server, connect (all in group), disconnect (all in group), show (details)
commandNoExplicit command for the server (for add_server with stdio)
descriptionNoGroup description (optional, for create)
transportTypeNoTransport type (for add_server)

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full behavioral burden. It discloses the useful 'atomic' trait, but says nothing about destructive actions (delete, remove_server), permission requirements, error behavior, or side effects of connect/disconnect.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with zero waste. It is appropriately sized for a tool whose schema carries the parameter detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a multi-action tool with eight parameters, no annotations, and no output schema, one sentence is thin. The schema lists actions but the description does not help an agent understand action categories, destructive operations, or behavioral implications.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents every parameter and action. The description adds no parameter-level meaning beyond that baseline, so a 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear verb+resource ('Manage server groups') and adds the scope 'atomic connect/disconnect of sets of servers'. It does not explicitly distinguish itself from sibling tools like mcp_connect and mcp_disconnect that operate on individual servers, so sibling differentiation is missing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the phrase 'atomic connect/disconnect of sets of servers', suggesting this tool is for group-level operations. However, there is no explicit when-to-use, when-not-to-use, or alternative routing versus mcp_connect/mcp_disconnect.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_list_activeA

List all currently connected MCP servers and their tools.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations, so the description carries the burden, but for a zero-parameter listing tool there is little to disclose. 'List ... currently connected' implies a read-only, non-destructive operation and indicates what is returned; however it does not state auth requirements, whether the listing is cached, or any rate limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler. The core action and scope are stated immediately with nothing wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, and the description compensates by stating what is returned (connected servers and their tools). For a simple no-arg listing tool this is nearly complete; only the boundary against mcp_discover remains unaddressed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes no parameters, so there are no parameter semantics to convey. Baseline for a zero-parameter tool is 4, and the schema (empty object) is consistent with the description's implicit claim of no inputs.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clear specific verb 'List' with a precise resource: 'currently connected MCP servers and their tools'. An agent can distinguish it from most siblings, but the description does not explicitly contrast it with near-neighbors like mcp_discover (unconnected servers) or mcp_server_info (single server).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use guidance and no alternatives named. The 'currently connected' qualifier implicitly suggests it differs from discovery, but the agent must infer when to pick this over mcp_discover or mcp_server_info.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_profilesC

Manage named connection profiles. Profiles are presets of server connections that can be switched between (e.g., 'work', 'personal').

ParametersJSON Schema
NameRequiredDescriptionDefault
urlNoServer URL (for add_server with SSE/WS/HTTP)
argsNoCommand arguments (for add_server with stdio)
nameNoProfile name (required for create, delete, add_server, remove_server, switch, show)
slugNoServer slug to add/remove from a profile
actionYesAction: list (all profiles), create (new profile), delete, add_server (add a server to profile), remove_server, switch (activate profile), show (details of a profile)
commandNoExplicit command for the server (for add_server with stdio)
descriptionNoProfile description (optional, for create)
transportTypeNoTransport type (for add_server)

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It mentions that profiles can be 'switched between' but does not disclose that actions like delete, remove_server, and switch have destructive or state-changing effects, nor does it describe persistence, permissions, or side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the core purpose and one clarifying definition. There is no filler, and the example parenthetical adds useful context without bloating the description.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a complex multi-action tool (8 parameters, 7 enum actions, no annotations, no output schema), yet the description only gives a high-level summary. It omits action-specific behavior, destructive-action warnings, return information, and usage differentiation, which are necessary for an agent to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already defines all 8 parameters and the action enum. The description adds no additional meaning about parameter interactions or usage beyond what the schema provides. Baseline 3 applies when the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear verb and resource: 'Manage named connection profiles.' It further clarifies with the definition 'presets of server connections' and examples ('work', 'personal'). However, it does not distinguish this tool from possibly related siblings like mcp_groups or mcp_discover, leaving the agent to infer the boundary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given for when to use this tool versus alternatives, when to prefer each action (e.g., create vs add_server), or what prerequisites exist. The description only says 'manage', which is too vague to guide selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_recommendB

Get MCP server recommendations. Pass query to describe a goal or task (e.g. "file sync with cloud storage", "manage GitHub issues"). Omit query to get suggestions based on your recent tool-call patterns.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum number of recommendations (default 5, max 20)
queryNoFree-text goal or task. When provided, recommends servers that match this intent using semantic/keyword/expansion search. When omitted, recommends based on usage history.
categoryNoOptional category slug to filter (e.g. 'developer-tools', 'data-databases'). Only used with `query`.

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It mentions search modes (semantic/keyword/expansion) and usage-history fallback, but says nothing about permissions, rate limits, ranking behavior, or what the response contains.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two efficient sentences front-load the core action and then explain the query/no-query branches without waste.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only recommendation tool with no annotations and no output schema, the description covers invocation modes but leaves return shape, ranking, and any auth or rate-limit context unaddressed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the schema already documents all three parameters thoroughly, including limits and the category dependency on query. The description's parameter guidance largely repeats the schema, so baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource (get recommendations for MCP servers) clearly. It distinguishes the tool from siblings like mcp_discover and mcp_list_active by focusing on recommendations driven by query or usage patterns, though it doesn't explicitly name how it differs from those siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear conditions for passing query vs omitting it, which covers the main usage modes. However, it doesn't mention when to prefer this over mcp_discover or other siblings that also surface servers.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_sandboxA

View or customize a server's sandbox capability manifest (env/network/filesystem/subprocess access). Use action 'view' to inspect, 'set' to tighten or loosen grants (applies on next connect), or 'reset' to revert to defaults.

ParametersJSON Schema
NameRequiredDescriptionDefault
slugYesServer slug (as shown by mcp_list_active or mcp_discover)
actionYesview = inspect manifest; set = override grants; reset = revert to defaults
fsReadNo[set] Absolute paths the server may read
fsWriteNo[set] Absolute paths the server may write
networkNo[set] Network mode. 'none' = no network, 'allowlist' = only listed hosts, 'all' = unrestricted
envAllowNo[set] Environment variable NAMES the server may receive, e.g. ['GITHUB_TOKEN']
subprocessNo[set] Whether the server may spawn subprocesses
enforcementNo[set] Isolation level. l2-container requires Docker/Podman.
networkAllowNo[set] Allowed host:port patterns for allowlist mode, e.g. ['api.github.com:443', '*.example.com']

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full behavioral burden. It helpfully discloses that changes are deferred ('applies on next connect') and that reset restores defaults, but it omits whether 'set' merges with or replaces existing grants, whether changes are reversible, and any auth/confirmation requirements — a meaningful gap for a security-sensitive mutation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, front-loaded sentence covering scope, the three actions, and the deferred-application constraint. No filler or padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 9-parameter, multi-action tool with full schema coverage and no output schema, the description covers purpose, actions, and timing. The one material omission is set/replace merge semantics for the grant fields, which matters for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents every parameter, including enum meanings and example values. The description's mention of env/network/filesystem/subprocess categories adds framing but no semantics beyond what the schema provides, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (view/customize) and a specific resource (a server's sandbox capability manifest), and immediately names the capability domains (env/network/filesystem/subprocess). This is clearly distinguishable from siblings like mcp_connect or mcp_server_info.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains all three actions and their intent, and adds the key usage condition that 'set' grants apply on next connect, which tells an agent when in the lifecycle to call it. It does not name sibling tools as alternatives or state prerequisites (e.g. server must be discovered/known).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_server_infoB

Get detailed information about an MCP server from the registry or a currently connected server.

ParametersJSON Schema
NameRequiredDescriptionDefault
slugYesServer slug (from registry or connected server)

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full disclosure burden. It implies a read operation but says nothing about whether a connection is required, what happens if the slug is not found, permissions, or rate limits. For a lookup tool with zero annotation coverage this is thin.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single efficient sentence that front-loads the verb and resource. Every clause earns its place, though the dual-source phrasing could be tightened.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

A read-only, single-parameter tool with no output schema, so the description could reasonably explain what 'detailed information' is returned. It stops short of that, leaving the return payload unspecified, though the lookup scope is covered.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the single 'slug' parameter is documented in the schema itself, so the description adds no additional meaning. Baseline 3 is appropriate when the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a clear verb ('Get detailed information') and resource ('an MCP server') and clarifies the two lookup sources (registry or connected server). It distinguishes itself reasonably from siblings like mcp_discover and mcp_list_active, though it does not name them explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The mention of 'registry or a currently connected server' implies when this tool applies, but there is no explicit when-to-use guidance or contrast with alternatives such as mcp_discover. Usage is only inferable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_usageC

View usage analytics for connected MCP servers — call counts, latency, error rates, and recent activity.

ParametersJSON Schema
NameRequiredDescriptionDefault
slugNoFilter stats to a specific server slug. Omit for global stats.
limitNoLimit number of results for 'recent' and 'slow' actions (default: 20)
actionNoAction: stats (default — summary), recent (recent calls), slow (slow calls), reset (clear all data)
thresholdNoLatency threshold in ms for 'slow' action (default: 5000)

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden — and it frames the tool purely as a read-only viewer ('View usage analytics'), while the schema exposes a 'reset' action documented as 'clear all data'. A destructive capability is left undisclosed, which could lead an agent into irreversible data loss. No mention of permissions or reversibility.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence that names the resource first and then the metrics. Zero wasted words and appropriately sized for the tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no annotations, no output schema, and a multi-action tool that includes a destructive 'reset', the description should say more than it does. It omits the existence of non-viewing actions and any warning about data destruction, leaving a significant gap for an agent deciding whether to call it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all four parameters (slug, limit, action, threshold) are already documented in the schema, including enum meanings. The description adds no parameter-level detail beyond what the schema provides; baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a clear verb ('View') and resource ('usage analytics for connected MCP servers') and enumerates the metrics returned (call counts, latency, error rates, recent activity). It is distinguishable from siblings like mcp_gateway_health or mcp_audit, though it does not explicitly contrast with them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to choose this tool over mcp_gateway_health, mcp_audit, or mcp_server_info, nor any stated prerequisites (e.g., that a server must be connected). The description offers no when/when-not context at all.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 13 tool updatesv0.2.3
    • First observedmcp_audit
    • First observedmcp_call_tool
    • First observedmcp_connect
    • First observedmcp_disconnect
    • First observedmcp_discover
    • First observedmcp_gateway_health
    • First observedmcp_groups
    • First observedmcp_list_active
    • First observedmcp_profiles
    • First observedmcp_recommend
    • First observedmcp_sandbox
    • First observedmcp_server_info
    • First observedmcp_usage

TDQS

A3.6/5.0

Scored across 13 tools

Disambiguation4/5

Most tools have clearly distinct purposes (connect vs disconnect vs call vs audit vs sandbox). However, mcp_discover and mcp_recommend both surface servers to connect to, and mcp_server_info overlaps somewhat with mcp_discover and mcp_list_active for information retrieval, creating mild boundary ambiguity.

Naming Consistency4/5

All tools share a consistent 'mcp_' prefix and mostly follow an action-oriented pattern (mcp_discover, mcp_connect, mcp_call_tool). Minor deviations like mcp_gateway_health and mcp_server_info use noun_noun rather than verb_noun, but the set remains predictable and readable.

Tool Count5/5

13 tools is well-scoped for a gateway managing server discovery, connection lifecycle, sandboxing, auditing, and analytics. Each tool appears to earn its place with no obvious redundancy.

Completeness4/5

The surface covers discovery, connect/disconnect, listing, info, tool invocation, health, sandbox, audit, profiles, groups, usage, and recommendations—a strong lifecycle. Minor gaps exist, such as no explicit reconnect/refresh or per-server tool-schema introspection beyond what mcp_server_info implies.

Maintenance

ActivityActive
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    B
    quality
    C
    maintenance
    Dynamic MCP server for Node.js enabling runtime tool creation, management, and execution in isolated sandboxes (Docker or Node).
    8
    3 npm
    1
    MIT
  • A
    license
    Not graded
    quality
    D
    maintenance
    A flexible MCP proxy server that connects to and routes between multiple backend MCP servers over STDIO or SSE, enabling dynamic management and namespacing of tools.
    110
    MIT
  • F
    license
    A
    quality
    D
    maintenance
    Universal MCP proxy server that discovers, searches, and executes tools across all configured MCP servers from a single entry point.
    7
    -
  • F
    license
    Not graded
    quality
    B
    maintenance
    Enables developers to build MCP servers with registry-managed tool metadata, runtime hot-reloading, pluggable authentication and authorization, per-audience tool views, and resilient stateless operation.
    -