Skip to main content
Glama

@mcp-rating/gateway

npm license MCP

Run MCP servers without handing them the API keys in your environment.

Whether a server you add can read your environment (AWS_SECRET_ACCESS_KEY, OPENAI_API_KEY, DATABASE_URL) depends on how your client starts it. The official MCP SDKs pass a short allowlist by default: HOME, PATH, USER and a few more. A client or script that passes its whole environment, often just to forward the one token a server needs, hands over everything. We haven't yet measured which popular clients do which, so we don't name any. The gateway doesn't leave it to the client: it spawns every server with a constructed environment, the SDK's short allowlist (PATH, HOME, USER and a few more) plus only the variables you or its manifest name. Nothing else from your environment is there to read.

Files are a different matter. By default a server still runs as you, so it can read what you can — ~/.ssh, ~/.aws/credentials, a project's .env. Only container isolation (opt-in, needs Docker) closes that. See what each level protects.

The same deliberately malicious MCP server, run twice: started with the whole
environment it steals four planted fake credentials; through the gateway it sees fifteen
variables, none sensitive.

Started with the whole environment

Through the gateway

Environment visible to the server

everything the client had

a short allowlist (PATH, HOME, USER and a few more), and what you name

Credentials in environment variables

all of them

none you didn't name

Credential files (~/.ssh, ~/.aws, .env)

readable

still readable, unless container isolation is on

Reproduce it yourself in about ten seconds: node demo/run-demo.mjs plants two fake credentials and runs the server both ways. It prints the planted values in full and, for anything real it finds in your environment, only the variable's name, never its value. The GIF is generated by node demo/render-gif.mjs from a clean, synthetic environment, so it shows nothing from any real machine.

It is also a meta-server: one entry in your config gives you the whole registry, connected on demand rather than pre-loaded.

{ "mcpServers": { "gateway": { "command": "npx", "args": ["-y", "@mcp-rating/gateway"] } } }

What it costs in context

Context used to be this README's lead argument: 13 meta-tools in place of every configured server's full schema. That assumed the client sends every tool definition on every request. Claude Code, Cursor and Kiro don't by default: they give the model your tools' names and load a definition when it's needed.

We measured all three in October 2026 with ten popular servers' real tool lists, replayed through a stub so that no third-party code ran. Added to every request, compared with no MCP servers:

tools

Claude Code

Claude Code, tool search off

Cursor

Kiro (chars)

3 servers

45

+1,050

+14,143

+266

+3,974

9 servers

125

+3,085

+77,656

+910

+7,693

10 servers

500

+14,853

+183,889

+4,330

+26,398

the gateway

13

+716

+5,595

+342

+3,797

Claude Code 2.1.308 (tokens as the API counts them), Cursor 3.17.21 (its own estimate), Kiro 1.4.26 (characters, from its log). Compare within a column. Most of the ten-server cost is one server with 375 tools.

The gateway also takes more requests: it has to find and connect a server before calling it, and those steps stay in the conversation, so every later request sends them again. Over an eight-turn Claude Code session with default settings, the gateway used about 597,000 prompt tokens. Three servers configured directly used 475,000, nine used 510,000 and ten used 710,000. The gateway drew level with ten at the third or fourth turn, and never with three or nine.

So in these clients, don't use the gateway to save context. It still does when your client sends every definition upfront (Claude Code with tool search off), or against a server with hundreds of tools over a longer session. With a few typical servers, configuring them directly is cheaper.

The full write-up, with the method, the one-task bill and what we don't claim: MCP clients now load tool names, not schemas. Reproduce it with the scripts in demo/: claude-code-tokens.mjs (standing cost), claude-code-whole-bill.mjs (one task), claude-code-session.mjs (eight turns), cursor-standing.mjs and kiro-standing.mjs. Earlier versions of this section claimed 10× less context, then about 3×. Both came from our own harness, which sent every definition, like a client with tool search off.

Related MCP server: Multi-MCP Proxy

How It Works

┌────────────────────┐       ┌──────────────┐       ┌──────────────────┐
│  Claude Desktop /  │ stdio │              │ stdio  │ MCP Server A     │
│  Cursor / Windsurf │◄─────►│  MCP Gateway │◄──────►│ (e.g. filesystem)│
│  (host client)     │       │              │◄──┐    └──────────────────┘
└────────────────────┘       └──────────────┘   │    ┌──────────────────┐
                                    │           └───►│ MCP Server B     │
                                    ▼                │ (e.g. github)    │
                             ┌──────────────┐        └──────────────────┘
                             │ MCP-Rating   │
                             │ Registry API │
                             └──────────────┘

Instead of manually configuring each MCP server in your client, the Gateway:

  1. Discovers servers via the MCP-Rating registry, listing first the ones it can start right now (see below)

  2. Connects to them on-demand: spawns local ones as child processes, and connects hosted ones to the endpoint the registry lists

  3. Proxies their tools through namespaced names (servername__toolname)

  4. Notifies your client when tools are added/removed

Quick Start

With Claude Desktop

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "gateway": {
      "command": "npx",
      "args": ["-y", "@mcp-rating/gateway"]
    }
  }
}

Then ask Claude:

  • "Search for MCP servers that work with databases" (uses mcp_discover)

  • "Connect to the sqlite server" (uses mcp_connect)

  • "Query my database" (calls the proxied tool directly)

Cursor

~/.cursor/mcp.json (or .cursor/mcp.json in a project):

{
  "mcpServers": {
    "gateway": { "command": "npx", "args": ["-y", "@mcp-rating/gateway"] }
  }
}

Claude Code

claude mcp add gateway -- npx -y @mcp-rating/gateway

Windsurf

~/.codeium/windsurf/mcp_config.json, same shape as Cursor:

{
  "mcpServers": {
    "gateway": { "command": "npx", "args": ["-y", "@mcp-rating/gateway"] }
  }
}

Kiro

Add to Kiro (Kiro asks before installing), or ~/.kiro/settings/mcp.json (.kiro/settings/mcp.json in a workspace), same shape as Cursor:

{
  "mcpServers": {
    "gateway": { "command": "npx", "args": ["-y", "@mcp-rating/gateway"] }
  }
}

Kiro runs MCP servers only when you are signed in, and if its MCP Servers panel shows Enable MCP, click it first.

Kiro ignores tools/list_changed. It reads the gateway's tool list once, when it connects, so the tools of a server you connect later are never offered to the agent directly. Ask the agent to call them through mcp_call_tool, using the full slug__tool name that mcp_connect prints. Measured on Kiro 1.4.26 with demo/client-probe.mjs.

Any other MCP client

{ "command": "npx", "args": ["-y", "@mcp-rating/gateway"] }

Restart the client after editing its config — most read it only at startup.

What mcp_discover puts first

An agent can only use a server the gateway can start, so results are ordered by that, keeping relevance order within each group:

  1. Verified: the registry's own harness started it and it listed its tools (✓ Started in our test).

  2. Ready, untested: installable here, or a hosted endpoint that needs no header, and any key it declares is set.

  3. Needs setup: a declared key isn't set, its launcher (uvx, docker) isn't installed, or the hosted endpoint needs a header the gateway can't send yet.

  4. Failed in our test: it didn't start when the registry tried it, with no credentials (✗ Didn't start in our test).

  5. Can't start by slug: no install command and no endpoint recorded.

"Verified" means it started and listed tools, not that every tool works without a key. The harness supplies none. Most of the index has never been tried; that says nothing either way.

Meta-Tools

The gateway exposes 13 built-in tools:

Tool

Description

mcp_discover

Search the MCP-Rating registry; servers the gateway can start now come first

mcp_connect

Connect to a server and make its tools available

mcp_disconnect

Disconnect a server and remove its tools

mcp_list_active

List connected servers and their tools

mcp_server_info

Detailed info about a server, from the registry or a live connection

mcp_call_tool

Call a tool on a connected server

mcp_gateway_health

Diagnostics: version, uptime, connection and registry status

mcp_sandbox

View or customise a server's sandbox manifest (env/network/filesystem)

mcp_audit

The safety audit trail — what sandboxed servers actually did

mcp_profiles

Named connection profiles (work, personal, …)

mcp_groups

Atomic connect/disconnect of server sets

mcp_usage

Call counts, latency and error rates for connected servers

mcp_recommend

Server recommendations based on usage

Trust Tiers

Every connected server is labeled with a trust tier based on its MCP-Rating quality score:

  • [Verified] — High quality + officially verified

  • [Trusted] — Good quality with repository, and an install command or a remote endpoint

  • [Community] — Listed in registry with basic quality

  • [Unverified] — A package MCP Rating doesn't know, from any registry or started by command

A safety score in the risk band caps the tier, as it does on the site: below 50 a server is at most [Community], below 30 it is [Unverified].

What mcp_connect shows, and when it stops

Before anything starts, mcp_connect looks up what MCP Rating knows about the package that would run — from the registry entry, or, for an explicit command or url, from the package itself (npx pkg, uvx pkg, docker run image, the endpoint). A known package started by command is judged as itself, not as [Unverified]. Shown in the confirmation and again once connected:

  • score and trust tier, with the server's page;

  • safety score and each flag with its reason;

  • MCP Rating's own start test: started, didn't start, needs credentials, or not tested;

  • last release and last code push, with where each date comes from.

It stops for a [Community] or [Unverified] server, and, whatever the tier, when the safety score is in the risk band, MCP Rating has delisted the package, or a registry name points at a different package than MCP Rating knows by that name. Where your client supports MCP elicitation, the gateway asks you directly, in a dialog the model can't see or answer (see What needs a person). Elsewhere the warning goes to the agent, and confirmed: true on the retry is a field the model fills in, so it protects you only as far as the model passes it on.

A minimum score

MCP_GATEWAY_MIN_SCORE=60 (or "minQualityScore": 60 in config.json) refuses to connect anything MCP Rating scores below 60, or hasn't scored — by slug, registry name, command or URL alike, so a local node server.js is refused too. confirmed: true doesn't lift it, since an agent can set that itself; only the setting does. It needs MCP Rating among the registries. A value that isn't a whole number from 0 to 100 refuses everything until it is fixed, rather than quietly meaning "no rule".

Registries

By default the gateway searches MCP Rating. It can search any registry that speaks the official MCP Registry API (v0.1) instead, or as well: the official registry, a company's own registry, or MCP Rating's mirror of it.

{
  "mcpServers": {
    "gateway": {
      "command": "npx",
      "args": ["-y", "@mcp-rating/gateway"],
      "env": {
        "MCP_GATEWAY_REGISTRIES": "https://mcprating.io/api/v1,https://registry.acme.internal"
      }
    }
  }
}
  • The list replaces the default. Leave MCP Rating out and the gateway never contacts it for discovery.

  • Each entry is a URL. One ending in /api/v1 is taken as MCP Rating's own API, and anything else as the MCP Registry API. To say which explicitly, write mcprating=URL or mcp-registry=URL.

  • Searches go to every registry and are merged. A server two registries both list appears once, as the first-listed registry has it. A search waits up to 15 seconds; a registry that hasn't answered by then is named in the results, and the rest are shown.

  • Connecting by name. A server from an MCP Registry API registry connects by its registry name, mcp_connect({slug: "io.github.owner/server"}). That works in any later session too.

  • Scores come from MCP Rating only. Quality scores, safety flags and start tests are MCP Rating's. When MCP Rating is one of your registries, a server found in another one gets MCP Rating's record of the same package — the same npm or PyPI package, Docker image or hosted endpoint — in one request per search. It is matched by package, never by name: any registry can give any package a well-known name. Otherwise the server shows as unrated and [Unverified], so connecting it stops first. Numbers another registry puts in its own entries (_meta) are not read: anyone can write them.

  • Warnings that stop a connect. If MCP Rating knows a server's registry name as a different package, or has delisted the package, mcp_discover says so, lists it last, and mcp_connect stops whatever its trust tier.

  • The partner key goes to MCP Rating only, never to another registry.

The official registry's search matches server names only and was slow when this was written (7–40 s per search on 2026-10-14). The gateway asks it for the query's longest word and ranks what comes back by how many of your words match.

Configuration

The gateway reads config from ~/.mcp-gateway/config.json:

{
  "registryApiUrl": "https://mcprating.io/api/v1",
  "proxyTimeoutMs": 30000,
  "maxConnections": 10,
  "logLevel": "info"
}

Environment Variables

Variable

Description

Default

MCP_GATEWAY_REGISTRY_URL

MCP-Rating API base URL

https://mcprating.io/api/v1

MCP_GATEWAY_REGISTRIES

Comma-separated registries to search instead (see Registries)

MCP Rating alone

MCP_GATEWAY_MIN_SCORE

Refuse anything MCP Rating scores below this, or hasn't scored (see A minimum score)

no rule

MCP_GATEWAY_TIMEOUT

Proxy timeout (ms)

30000

MCP_GATEWAY_MAX_CONNECTIONS

Max simultaneous connections

10

MCP_GATEWAY_LOG_LEVEL

Log level (debug/info/warn/error)

info

MCP_GATEWAY_CONTAINER_ISOLATION

Force L2 container isolation on/off

manifest decides

MCP_GATEWAY_AUDIT_LOG

Path for the forensic audit log

disabled

MCP_GATEWAY_HUMAN_APPROVAL

off lets the model decide what otherwise needs a person (see What needs a person)

on

MCP_GATEWAY_PARTNER_KEY

Partner attribution key — enables ad telemetry

unset

MCP_GATEWAY_AD_TRACKING

Set to false to disable ad telemetry outright

unset

MCP_GATEWAY_HTTP_TOKEN

Bearer token for HTTP daemon mode

unset

Security model

The gateway exists so that what a server can see doesn't depend on how your client happens to start it. Two layers push back, and it is worth being precise about what each one does and does not do.

L1 — environment scoping (always on, for stdio servers)

A downstream server receives the MCP SDK's default allowlist (HOME, LOGNAME, PATH, SHELL, TERM, USER on macOS and Linux; PATH, USERPROFILE, APPDATA, TEMP and a few more on Windows), plus only the variable names its manifest allowlists or you pass at connect time. Everything else in the parent environment — AWS_*, OPENAI_API_KEY, DATABASE_URL — is withheld. Exported shell functions (BASH_FUNC_*) are dropped rather than forwarded.

This is genuine enforcement: the child process is spawned with a constructed environment, so there is nothing to opt out of or bypass.

L1 does not restrict files or the network. The server runs as your user: it can read anything you can, including ~/.ssh, ~/.aws/credentials and .env files, and it can connect to any host. A manifest can declare network and filesystem limits, but outside a container nothing enforces them, and the connect summary says "not restricted" rather than listing them.

L2 — container isolation (opt-in)

With MCP_GATEWAY_CONTAINER_ISOLATION=true, community and unknown servers run under docker/podman in an ephemeral container. You can also opt one server in with mcp_sandbox({action: "set", slug: "…", enforcement: "l2-container"}). Inside, the server gets a read-only root, a scratch /tmp, and only the paths its manifest declares mounted from the host. network: "none" gives the container no network at all. Without Docker or Podman, the gateway falls back to L1 and logs that it did.

Network allowlists: read this before relying on them

Allowlists apply only under L2. network: "allowlist" starts a forward proxy and points the container at it via HTTP_PROXY/HTTPS_PROXY. The proxy accepts only tunnels that carry a random credential generated for that connection, which the container receives in those variables. With Docker Desktop it listens on loopback. With Docker on Linux it has to listen on all interfaces, because the container reaches it over the bridge, and the credential is what keeps other machines from using it.

This filters proxy-aware clients only. Node's fetch/undici, axios, and Python requests all honour those variables, which covers most real servers. A program that opens raw TCP sockets, or a compiled binary that ignores proxy environment variables, is not filtered. Treat an allowlist as a guard rail against honest code, not a containment boundary against hostile code. For that, use network: "none".

Giving a server an API key

Put the key in the gateway's env in your client config, not in the chat:

{
  "mcpServers": {
    "gateway": {
      "command": "npx",
      "args": ["-y", "@mcp-rating/gateway"],
      "env": { "GITHUB_TOKEN": "ghp_…" }
    }
  }
}

A server receives it only if its registry entry declares that variable. For one that doesn't, allowlist the name, never the value: mcp_sandbox({action: "set", slug: "…", envAllow: ["GITHUB_TOKEN"]}). That widens what the server gets, so the gateway asks you first.

mcp_connect also accepts env: { NAME: "value" }. That works, but the model has to write the secret into a tool call, which puts it in your chat transcript and your model provider's logs.

When a server asks the model for personal data

A hosted server can ask for an email, a phone number or a card number in an ordinary tool result, and the model is what answers. During our own test runs, a local 31B was asked for an email "to record your free quota" and made one up. No sandbox can see that: it's a request in the content channel.

Since 0.2.6 the gateway checks each tool result for a personal-data term next to a verb of handing it over, in English and Chinese, within its first 1,500 characters. On a match it appends a warning the model reads with the result: ask the user, and never make up a value. It also records personal_data_requested in the audit trail (mcp_audit). It's a heuristic, and it only adds: the server's reply is never changed or blocked.

A missing runtime is an error, not a substitution

If a server's launcher (uvx, docker, python, …) isn't installed, the connect fails with a message naming what to install. Before 0.2.4, a missing launcher was rewritten to npx -y <name>, which ran whatever npm package shared its name. On a machine without Docker, that was the unrelated npm package docker.

Allowlist patterns fail closed: a malformed pattern such as *example.com (missing dot) matches nothing rather than everything. The gateway warns at startup about patterns that will not do what their author intended, including over-broad ones like *.com.

What it doesn't stop: tool poisoning

A server doesn't have to run anything to attack you. Its tool descriptions and results are text that goes straight to your model, and that text can tell the model to read a file through another server and send it somewhere. The data moves through tools you trust, so L1 and L2 don't touch it: they limit what a server's code can do.

A November 2026 measurement ran 45 of these attacks through 12 agent frameworks and 18 models. In 22.9% of runs the model made a call the attacker asked for, from 0.4% to 49.7% depending on the model, and no framework defended against it on purpose. It didn't test this gateway or a client such as Claude Code or Cursor, and we haven't measured either yet.

The gateway passes descriptions and results on as the server wrote them, with a trust label in front of each description. It doesn't scan them, and when a server changes its tool list it forwards the new one without comparing it to the old.

What helps:

  • Connect only what you need.

  • Keep your client's approval prompt on for tool calls.

  • Which model you run matters: in that measurement it mattered far more than which framework.

What needs a person

A poisoned description can tell the model to use the gateway's own tools. So these don't rest on the model's word. The gateway asks you itself, through MCP elicitation: your client shows the question, and the model never sees or answers it.

  • Starting a raw command with mcp_connect({command: …}), whatever it names.

  • Setting environment variables that change what runs on a connect, such as NODE_OPTIONS or LD_PRELOAD.

  • Widening a server's sandbox with mcp_sandbox: more environment variables, more network, more paths, weaker isolation, or a reset that lands somewhere wider. Tightening never asks.

  • Adding a server to a profile or group, which then starts without asking again.

  • Connecting a [Community] or [Unverified] server by slug, and anything else that would have waited on confirmed: true, where your client can ask.

The question shows exactly what would run or change. Only a yes with the box ticked counts: a decline, a dismissal, a timeout after five minutes or an empty accept is a no. Every outcome is in mcp_audit, as approval.

After a no, the gateway won't put that same request to you again until your client restarts, so an agent can't keep raising the dialog until it gets a yes. Changing one argument makes a new question, so after three refusals in a session it stops asking altogether: everything that needs you is refused until the client restarts, and mcp_gateway_health says so. If you didn't expect those requests, check what's connected before you restart. A timeout stops the request but doesn't count, since you may not have seen it, and a yes covers one request, once. Saved launches still start: they were approved when they were saved.

If your client can't ask (it doesn't support elicitation), a raw command and a wider sandbox are refused, and the refusal tells the model how you can change that. A server by slug falls back to the warning and confirmed: true. To go back to letting the model decide everything, set MCP_GATEWAY_HUMAN_APPROVAL=off in the gateway's env in your client config. No tool can change that setting, though a model with a file-editing tool could still edit your client config: this gate covers the gateway's tools, not the rest of your agent. mcp_gateway_health says which mode you're in.

Claude Code 2.1.317 and Kiro both declare elicitation. A launch saved to a profile or group was approved when it was saved, so it starts without asking.

What is not covered

If the host client is SIGKILLed, the gateway cannot run its shutdown path and spawned child processes may be left behind. SIGINT/SIGTERM are handled and disconnect everything cleanly; SIGKILL is untrappable by definition.

Telemetry

Off unless you turn it on. The ad tracker is constructed only when MCP_GATEWAY_PARTNER_KEY is set — with no partner key there is no partner telemetry, and nothing is posted about your connects or tool calls.

If a partner key is set (you are earning attribution revenue), connect and tool-execution events are sent to mcprating.io. Disable it while keeping the key with MCP_GATEWAY_AD_TRACKING=false.

Separately, the gateway calls the configured registries — MCP Rating unless you set MCP_GATEWAY_REGISTRIES — for mcp_discover, mcp_connect and mcp_recommend. That is the lookup you asked for, not background reporting, and each registry you list sees the searches. Usage analytics (mcp_usage) are an in-memory ring buffer and never leave the process.

Development

npm install
npm run dev        # watch mode
npm run typecheck
npm run build
npm test           # unit tests (env scoping, egress proxy, reconnect, mcp_call_tool)

Architecture

The gateway is built on the MCP SDK and uses:

  • StdioServerTransport — communicates with the host client

  • StdioClientTransport — spawns and communicates with downstream servers

  • Dynamic tool registration — McpServer.registerTool() + sendToolListChanged()

  • Tool namespacing — slug__toolname pattern prevents collisions

  • Passthrough Zod schemas — preserves parameter names for host client UI while letting downstream servers validate

License

MIT — see LICENSE.


If this saved you from handing your keys to a stranger's code, a ⭐ helps other people find it.

Available Tools

13 tools
mcp_auditA

View the safety audit trail — a forensics log of what sandboxed MCP servers did and what the sandbox blocked (tool calls, blocked tools, blocked/allowed network egress, connects with granted capabilities). Use securityOnly: true to see only blocks and errors.

NameRequiredDescriptionDefault
slugNoFilter to a single server slug
eventNoFilter to a single event type
limitNoMax events to return (default 50, newest first)
securityOnlyNoShow only security-relevant events (blocks + errored calls)

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations supplied, the description does real work: 'View' establishes a read-only operation, and the parenthetical discloses the exact categories of behavior recorded, including both what servers did and what the sandbox blocked. It omits retention window, whether results span all servers by default, and access prerequisites, which keeps it from a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, leading with what the tool is and following with the one actionable flag. The parenthetical enumeration is dense but each item carries informational weight; nothing is redundant with the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

A read-only query tool with four all-optional params and no output schema — the description covers the conceptual return contents (event categories) and the default sort via the schema. What is missing is the default scope (all servers vs. one slug) and any sense of volume or retention, small gaps for a forensics listing tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so slug, event, limit and their constraints are already documented. The description restates the securityOnly semantics ('only blocks and errors'), which matches rather than extends the schema, and says nothing about combining filters or cursor behavior. Baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('View the safety audit trail') and immediately defines it as a forensics log of sandboxed server activity, enumerating the concrete event kinds (tool calls, blocked tools, egress, connects with capabilities). That distinguishes it in substance from mcp_usage or mcp_list_active, though no sibling is named explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Offers one concrete usage cue — `securityOnly: true` for blocks and errors — which is genuinely helpful routing advice. It gives no when-not guidance and does not contrast itself with mcp_usage or mcp_list_active, so the agent must infer which observability tool to reach for.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_call_toolA

Call a tool on a connected MCP server. Use this when dynamically connected tools aren't directly available. Pass the namespaced tool name (slug__toolName) and arguments.

NameRequiredDescriptionDefault
nameYesNamespaced tool name: "server-slug__tool-name" (as shown by mcp_connect or mcp_list_active)
argumentsNoTool arguments as a JSON object

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden, and it falls short: it does not say what happens on failure, whether arguments are validated against the target tool's schema, what the response looks like, or any permission/timeout concerns. The only behavioral hint is the dynamic-availability condition.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, front-loaded with the action, followed by the usage condition and then the required input format. No waste.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a dispatcher with no output schema and no annotations, the definition covers the essential action and input format but omits error behavior and any indication of the return shape, which would matter for an agent deciding how to handle the result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both parameters are already fully documented ('name' as server-slug__tool-name, 'arguments' as a JSON object). The description restates the namespaced format but adds no syntax or usage detail beyond what the schema provides, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Call a tool on a connected MCP server'), so an agent immediately knows this dispatches a call to a dynamically connected server. It does not, however, explicitly distinguish itself from siblings like mcp_discover or mcp_connect, leaving the routing between meta-tools to inference.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides a clear when-to-use condition: 'when dynamically connected tools aren't directly available.' That is genuine routing guidance, but it names no alternatives (mcp_discover/connect/list_active) and gives no when-not guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_connectA

Connect to an MCP server and make its tools available. Provide either a server slug (from mcp_discover) to look up in the registry, OR an explicit command + args to spawn directly, OR a url for remote servers. An explicit command needs the person's approval, which the gateway asks for itself.

NameRequiredDescriptionDefault
envNoAdditional environment variables for the server process
urlNoURL for remote transports (SSE, WebSocket, Streamable HTTP). Use instead of command for remote servers.
argsNoCommand arguments (e.g., ['-y', '@modelcontextprotocol/server-everything'])
slugNoServer slug from MCP-Rating registry (e.g., '@modelcontextprotocol/inspector')
commandNoExplicit command to spawn (e.g., 'npx'). Use when server is not in registry. The gateway asks the person first, and refuses if the client can't ask.
confirmedNoSet to true to confirm connection to community/unknown trust tier servers, once the user has said yes. Required when the initial connect returns a confirmation warning. Where the client can ask the person directly, the gateway does that instead and this has no effect.
saveProfileNoSet to true to save this connection as an auto-connect profile. The server will auto-reconnect on gateway restart.
transportTypeNoTransport type. Defaults to 'stdio' for command-based, auto-detected from URL scheme if url is provided.

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the behavioral burden and does disclose the key non-obvious trait: explicit commands require human approval and the gateway refuses when the client cannot ask. It does not cover persistence across restarts, duplicate/already-connected behavior, or authentication expectations for remote URLs, which are real gaps for a stateful connection tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, front-loaded with the outcome and then the three input modes. Every sentence carries distinct information and nothing is padded or repeated.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an 8-parameter, state-changing tool with no annotations and no output schema, the definition covers the modes and the approval gate adequately. It leaves the caller unsure what a successful connect returns (connection handle, tool list?) and how failures surface, which an agent would want to know before wiring follow-up calls.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so each parameter is already documented individually, setting the baseline at 3. The description adds the one thing the schema cannot express: that slug, command, and url are alternative modes rather than a flat bag of options, which is a modest but real increment.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource plus the resulting side effect: 'Connect to an MCP server and make its tools available.' It also distinguishes itself from the sibling mcp_discover by naming it as the source of a slug, so an agent can separate discovery from connection without reading either schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It clearly lays out three mutually exclusive invocation paths (registry slug, explicit command + args, or url for remote servers) and points to mcp_discover for slug lookup, which is exactly the routing an agent needs. It stops short of stating when not to use this tool, such as already-connected servers (mcp_list_active) or teardown via mcp_disconnect.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_disconnectA

Disconnect from a connected MCP server and remove its tools. Use mcp_list_active to see connected servers.

NameRequiredDescriptionDefault
slugYesServer slug of the connected server to disconnect

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations, so the description carries the full burden. It usefully discloses that disconnecting removes the server's tools, but it omits whether the server can later be reconnected (mcp_connect exists as a sibling), whether the action is reversible, and whether in-flight tool calls are affected.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, action and effect front-loaded, with the helper pointer second. No waste.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter teardown tool with no output schema, the definition covers what it does, its side effect, and how to obtain the slug. The main remaining gap is the reversibility/reconnect question, which matters given mcp_connect is a sibling.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the single slug parameter is fully documented in the schema, so the description need only be consistent. It refers to "a connected MCP server" without adding format or sourcing detail beyond what the schema and the mcp_list_active pointer provide.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb+resource ("Disconnect from a connected MCP server") with the key side effect stated ("remove its tools"), which cleanly distinguishes it from sibling mcp_connect and the read-oriented mcp_list_active.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It names mcp_list_active as the way to find connected servers, which implicitly tells the agent the prerequisite state (a currently connected server) and where to get the slug. It does not state any when-not-to-use condition or contrast against alternatives like mcp_connect, so it falls short of full routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_discoverA

Search the configured MCP registries (MCP Rating by default) for MCP servers. Returns servers with trust tiers, install information, and MCP Rating's quality scores where it has rated them. Use this to find servers before connecting them with mcp_connect.

NameRequiredDescriptionDefault
limitNoMax results (default 10)
queryYesSearch query (server name, description, or capability)
categoryNoFilter by category slug (e.g., 'developer-tools', 'data-databases')

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations and no output schema, the description carries the full burden and does disclose the return shape (trust tiers, install info, quality scores) and that only configured registries are searched. It omits confirming the operation is read-only and says nothing about rate limits or pagination behavior, which is why it is not a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences with no filler; purpose, return content, and the routing hint are all front-loaded before any elaboration.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description compensates for the missing output schema by naming what results contain, and all three parameters are schema-documented. Small gaps remain around default registry configuration and result pagination/limits beyond the schema's max.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so query, category, and limit are already documented in the schema (baseline 3). The description adds only the registry context ('MCP Rating by default') and nothing about query syntax or category source.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Search the configured MCP registries ... for MCP servers') plus what comes back (trust tiers, install info, quality scores). It is clearly distinguishable from siblings like mcp_server_info, mcp_recommend, and mcp_list_active.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Use this to find servers before connecting them with mcp_connect' gives an explicit use context and names the downstream alternative. It stops short of ruling out competing discovery tools such as mcp_recommend or describing when NOT to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_gateway_healthA

Get gateway diagnostics: version, uptime, connection status, registry reachability, and per-server health.

NameRequiredDescriptionDefault

No parameters

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It helpfully enumerates the diagnostic categories returned, but never states that the operation is a safe read-only check, whether it incurs load on downstream servers, or any auth/latency characteristics.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence that enumerates its contents with zero filler. Every listed item corresponds to real output the caller would receive.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema or annotations exist, so the description must carry the return-value story, and it does by naming each diagnostic field. It stops short of describing format or how per-server health is represented, but for a zero-arg probe this is close to sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so there is nothing to document and the baseline of 4 applies. The description correctly adds no spurious parameter detail.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb (Get) and resource (gateway diagnostics) and enumerates the exact contents returned: version, uptime, connection status, registry reachability, per-server health. This clearly distinguishes it from siblings like mcp_list_active or mcp_server_info, though it never names an alternative explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit when-to-use guidance, no prerequisites, and no mention of alternative tools for related queries. An agent can infer a health/diagnostics use case, but nothing in the text routes it there versus mcp_server_info or mcp_list_active.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_groupsB

Manage server groups for atomic connect/disconnect of sets of servers.

NameRequiredDescriptionDefault
urlNoServer URL (for add_server with SSE/WS/HTTP)
argsNoCommand arguments (for add_server with stdio)
nameNoGroup name (required for all actions except list)
slugNoServer slug to add/remove from a group
actionYesAction: list, create, delete, add_server, remove_server, connect (all in group), disconnect (all in group), show (details)
commandNoExplicit command for the server (for add_server with stdio)
descriptionNoGroup description (optional, for create)
transportTypeNoTransport type (for add_server)

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full behavioral burden. It discloses the useful 'atomic' trait, but says nothing about destructive actions (delete, remove_server), permission requirements, error behavior, or side effects of connect/disconnect.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with zero waste. It is appropriately sized for a tool whose schema carries the parameter detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a multi-action tool with eight parameters, no annotations, and no output schema, one sentence is thin. The schema lists actions but the description does not help an agent understand action categories, destructive operations, or behavioral implications.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents every parameter and action. The description adds no parameter-level meaning beyond that baseline, so a 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear verb+resource ('Manage server groups') and adds the scope 'atomic connect/disconnect of sets of servers'. It does not explicitly distinguish itself from sibling tools like mcp_connect and mcp_disconnect that operate on individual servers, so sibling differentiation is missing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the phrase 'atomic connect/disconnect of sets of servers', suggesting this tool is for group-level operations. However, there is no explicit when-to-use, when-not-to-use, or alternative routing versus mcp_connect/mcp_disconnect.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_list_activeA

List all currently connected MCP servers and their tools.

NameRequiredDescriptionDefault

No parameters

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations, so the description carries the burden, but for a zero-parameter listing tool there is little to disclose. 'List ... currently connected' implies a read-only, non-destructive operation and indicates what is returned; however it does not state auth requirements, whether the listing is cached, or any rate limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler. The core action and scope are stated immediately with nothing wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, and the description compensates by stating what is returned (connected servers and their tools). For a simple no-arg listing tool this is nearly complete; only the boundary against mcp_discover remains unaddressed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes no parameters, so there are no parameter semantics to convey. Baseline for a zero-parameter tool is 4, and the schema (empty object) is consistent with the description's implicit claim of no inputs.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clear specific verb 'List' with a precise resource: 'currently connected MCP servers and their tools'. An agent can distinguish it from most siblings, but the description does not explicitly contrast it with near-neighbors like mcp_discover (unconnected servers) or mcp_server_info (single server).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use guidance and no alternatives named. The 'currently connected' qualifier implicitly suggests it differs from discovery, but the agent must infer when to pick this over mcp_discover or mcp_server_info.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_profilesC

Manage named connection profiles. Profiles are presets of server connections that can be switched between (e.g., 'work', 'personal').

NameRequiredDescriptionDefault
urlNoServer URL (for add_server with SSE/WS/HTTP)
argsNoCommand arguments (for add_server with stdio)
nameNoProfile name (required for create, delete, add_server, remove_server, switch, show)
slugNoServer slug to add/remove from a profile
actionYesAction: list (all profiles), create (new profile), delete, add_server (add a server to profile), remove_server, switch (activate profile), show (details of a profile)
commandNoExplicit command for the server (for add_server with stdio)
descriptionNoProfile description (optional, for create)
transportTypeNoTransport type (for add_server)

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It mentions that profiles can be 'switched between' but does not disclose that actions like delete, remove_server, and switch have destructive or state-changing effects, nor does it describe persistence, permissions, or side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the core purpose and one clarifying definition. There is no filler, and the example parenthetical adds useful context without bloating the description.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a complex multi-action tool (8 parameters, 7 enum actions, no annotations, no output schema), yet the description only gives a high-level summary. It omits action-specific behavior, destructive-action warnings, return information, and usage differentiation, which are necessary for an agent to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already defines all 8 parameters and the action enum. The description adds no additional meaning about parameter interactions or usage beyond what the schema provides. Baseline 3 applies when the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear verb and resource: 'Manage named connection profiles.' It further clarifies with the definition 'presets of server connections' and examples ('work', 'personal'). However, it does not distinguish this tool from possibly related siblings like mcp_groups or mcp_discover, leaving the agent to infer the boundary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given for when to use this tool versus alternatives, when to prefer each action (e.g., create vs add_server), or what prerequisites exist. The description only says 'manage', which is too vague to guide selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_recommendB

Get MCP server recommendations. Pass query to describe a goal or task (e.g. "file sync with cloud storage", "manage GitHub issues"). Omit query to get suggestions based on your recent tool-call patterns.

NameRequiredDescriptionDefault
limitNoMaximum number of recommendations (default 5, max 20)
queryNoFree-text goal or task. When provided, recommends servers that match this intent using semantic/keyword/expansion search. When omitted, recommends based on usage history.
categoryNoOptional category slug to filter (e.g. 'developer-tools', 'data-databases'). Only used with `query`.

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It mentions search modes (semantic/keyword/expansion) and usage-history fallback, but says nothing about permissions, rate limits, ranking behavior, or what the response contains.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two efficient sentences front-load the core action and then explain the query/no-query branches without waste.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only recommendation tool with no annotations and no output schema, the description covers invocation modes but leaves return shape, ranking, and any auth or rate-limit context unaddressed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the schema already documents all three parameters thoroughly, including limits and the category dependency on query. The description's parameter guidance largely repeats the schema, so baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource (get recommendations for MCP servers) clearly. It distinguishes the tool from siblings like mcp_discover and mcp_list_active by focusing on recommendations driven by query or usage patterns, though it doesn't explicitly name how it differs from those siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear conditions for passing query vs omitting it, which covers the main usage modes. However, it doesn't mention when to prefer this over mcp_discover or other siblings that also surface servers.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_sandboxA

View or customize a server's sandbox capability manifest (env/network/filesystem/subprocess access). Use action 'view' to inspect, 'set' to tighten or loosen grants (only the fields you pass change, the rest keep what the server has now or would get by default; applies on next connect), or 'reset' to revert to defaults.

NameRequiredDescriptionDefault
slugYesServer slug (as shown by mcp_list_active or mcp_discover), or its registry name (io.github.owner/server)
actionYesview = inspect manifest; set = override grants; reset = revert to defaults
fsReadNo[set] Absolute paths the server may read
fsWriteNo[set] Absolute paths the server may write
networkNo[set] Network mode. 'none' = no network, 'allowlist' = only listed hosts, 'all' = unrestricted
envAllowNo[set] Environment variable NAMES the server may receive, e.g. ['GITHUB_TOKEN']
subprocessNo[set] Whether the server may spawn subprocesses
enforcementNo[set] Isolation level. l2-container requires Docker/Podman.
networkAllowNo[set] Allowed host:port patterns for allowlist mode, e.g. ['api.github.com:443', '*.example.com']

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does well: it discloses that 'set' is a partial patch ('only the fields you pass change, the rest keep what the server has now or would get by default') and that changes are deferred ('applies on next connect'). These are non-obvious mutation semantics an agent could not infer from the schema. It still omits the permission/authorization requirements and what a failed or rejected grant looks like.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single dense sentence with the purpose front-loaded and the action routing following in priority order. It is long but every clause (partial-update behavior, deferred application) earns its place; only the nested parenthetical stacking costs it a point.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No annotations and no output schema, and for a 9-parameter policy mutation tool the description covers actions and mutation semantics adequately. It does not say what 'view' returns or how enforcement failures surface, but the schema's enum descriptions (e.g. l2-container requires Docker) pick up part of that slack.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all nine parameters, including enum values and the [set] action prefixes. The description's only added parameter meaning is the merge semantics for omitted fields on 'set', which is useful but marginal. Baseline 3 is appropriate when the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb pair (view/customize) and the exact resource (a server's sandbox capability manifest), then enumerates the four policy domains it covers (env/network/filesystem/subprocess). No sibling tool deals with sandbox grants, so the agent can route to it unambiguously.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Maps each action enum value to a purpose: 'view' to inspect, 'set' to tighten or loosen grants, 'reset' to revert to defaults. This tells the agent which action to pick but gives no guidance on when this tool is preferable to adjacent tools like mcp_connect or mcp_profiles, nor any prerequisites.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_server_infoB

Get detailed information about an MCP server from the registry or a currently connected server.

NameRequiredDescriptionDefault
slugYesServer slug (from registry or connected server)

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full disclosure burden. It implies a read operation but says nothing about whether a connection is required, what happens if the slug is not found, permissions, or rate limits. For a lookup tool with zero annotation coverage this is thin.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single efficient sentence that front-loads the verb and resource. Every clause earns its place, though the dual-source phrasing could be tightened.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

A read-only, single-parameter tool with no output schema, so the description could reasonably explain what 'detailed information' is returned. It stops short of that, leaving the return payload unspecified, though the lookup scope is covered.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the single 'slug' parameter is documented in the schema itself, so the description adds no additional meaning. Baseline 3 is appropriate when the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a clear verb ('Get detailed information') and resource ('an MCP server') and clarifies the two lookup sources (registry or connected server). It distinguishes itself reasonably from siblings like mcp_discover and mcp_list_active, though it does not name them explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The mention of 'registry or a currently connected server' implies when this tool applies, but there is no explicit when-to-use guidance or contrast with alternatives such as mcp_discover. Usage is only inferable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_usageC

View usage analytics for connected MCP servers — call counts, latency, error rates, and recent activity.

NameRequiredDescriptionDefault
slugNoFilter stats to a specific server slug. Omit for global stats.
limitNoLimit number of results for 'recent' and 'slow' actions (default: 20)
actionNoAction: stats (default — summary), recent (recent calls), slow (slow calls), reset (clear all data)
thresholdNoLatency threshold in ms for 'slow' action (default: 5000)

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden — and it frames the tool purely as a read-only viewer ('View usage analytics'), while the schema exposes a 'reset' action documented as 'clear all data'. A destructive capability is left undisclosed, which could lead an agent into irreversible data loss. No mention of permissions or reversibility.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence that names the resource first and then the metrics. Zero wasted words and appropriately sized for the tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no annotations, no output schema, and a multi-action tool that includes a destructive 'reset', the description should say more than it does. It omits the existence of non-viewing actions and any warning about data destruction, leaving a significant gap for an agent deciding whether to call it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all four parameters (slug, limit, action, threshold) are already documented in the schema, including enum meanings. The description adds no parameter-level detail beyond what the schema provides; baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a clear verb ('View') and resource ('usage analytics for connected MCP servers') and enumerates the metrics returned (call counts, latency, error rates, recent activity). It is distinguishable from siblings like mcp_gateway_health or mcp_audit, though it does not explicitly contrast with them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to choose this tool over mcp_gateway_health, mcp_audit, or mcp_server_info, nor any stated prerequisites (e.g., that a server must be connected). The description offers no when/when-not context at all.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 2 tool updatesv0.5.0
    • Changedmcp_audit1 field changed
      • changedInput schema / properties / event / enum
        Previous value: -[
        -  "connect",
        -  "tool_call",
        -  "tool_blocked",
        -  "egress_blocked",
        -  "egress_allowed",
        -  "personal_data_requested",
        -  "disconnect"
        -]New value: +[
        +  "connect",
        +  "tool_call",
        +  "tool_blocked",
        +  "egress_blocked",
        +  "egress_allowed",
        +  "personal_data_requested",
        +  "approval",
        +  "disconnect"
        +]
    • Changedmcp_connect2 fields changed
      • changedInput schema / properties / command / description
        Previous value: -"Explicit command to spawn (e.g., 'npx'). Use when server is not in registry."New value: +"Explicit command to spawn (e.g., 'npx'). Use when server is not in registry. The gateway asks the person first, and refuses if the client can't ask."
      • changedInput schema / properties / confirmed / description
        Previous value: -"Set to true to confirm connection to community/unknown trust tier servers. Required when the initial connect returns a confirmation warning."New value: +"Set to true to confirm connection to community/unknown trust tier servers, once the user has said yes. Required when the initial connect returns a confirmation warning. Where the client can ask the person directly, the gateway does that instead and this has no effect."
  2. 2 tool updatesv0.4.1
    • Changedmcp_audit1 field changed
      • changedInput schema / properties / event / enum
        Previous value: -[
        -  "connect",
        -  "tool_call",
        -  "tool_blocked",
        -  "egress_blocked",
        -  "egress_allowed",
        -  "disconnect"
        -]New value: +[
        +  "connect",
        +  "tool_call",
        +  "tool_blocked",
        +  "egress_blocked",
        +  "egress_allowed",
        +  "personal_data_requested",
        +  "disconnect"
        +]
    • Changedmcp_sandbox1 field changed
      • changedInput schema / properties / slug / description
        Previous value: -"Server slug (as shown by mcp_list_active or mcp_discover)"New value: +"Server slug (as shown by mcp_list_active or mcp_discover), or its registry name (io.github.owner/server)"
  3. 13 tool updatesv0.2.3
    • First observedmcp_audit
    • First observedmcp_call_tool
    • First observedmcp_connect
    • First observedmcp_disconnect
    • First observedmcp_discover
    • First observedmcp_gateway_health
    • First observedmcp_groups
    • First observedmcp_list_active
    • First observedmcp_profiles
    • First observedmcp_recommend
    • First observedmcp_sandbox
    • First observedmcp_server_info
    • First observedmcp_usage

TDQS

A3.6/5.0

Scored across 13 tools

Disambiguation4/5

Most tools target clearly distinct operations (discover, connect, disconnect, call, audit, health, usage). The main soft spots are mcp_discover vs mcp_recommend (both 'find me a server') and mcp_list_active vs mcp_server_info (both about connected servers), though descriptions give enough hints to separate them.

Naming Consistency4/5

All tools share a clean mcp_ prefix in snake_case, which is highly predictable. Minor deviation: most are verb-led (mcp_discover, mcp_connect, mcp_call_tool) but several are bare nouns (mcp_profiles, mcp_groups, mcp_usage, mcp_sandbox) with an implied 'manage'.

Tool Count5/5

13 tools sits squarely in the well-scoped range and maps neatly onto the gateway lifecycle. Each tool covers a distinct concern (registry, connections, security, diagnostics, analytics) without redundancy.

Completeness4/5

The connection lifecycle is fully covered: discover, connect, list, inspect, call, sandbox-configure, disconnect, plus audit/health/usage monitoring. Minor gaps exist around credential/auth management and registry publish/remove operations, but core gateway workflows have no dead ends.

Maintenance

ActivityActive
ResponsivenessNo recent community issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    B
    quality
    C
    maintenance
    Dynamic MCP server for Node.js enabling runtime tool creation, management, and execution in isolated sandboxes (Docker or Node).
    8
    8 npm
    1
    MIT
  • A
    license
    Not graded
    quality
    D
    maintenance
    A flexible MCP proxy server that connects to and routes between multiple backend MCP servers over STDIO or SSE, enabling dynamic management and namespacing of tools.
    111
    MIT
  • F
    license
    A
    quality
    D
    maintenance
    Universal MCP proxy server that discovers, searches, and executes tools across all configured MCP servers from a single entry point.
    7
    -
  • F
    license
    Not graded
    quality
    C
    maintenance
    Enables agents to connect to remote MCP servers once, access their tools through a compact MCP endpoint, pair a CLI inside sandboxes, and create watches that turn command or tool output into pollable structured events.
    2
    -