Skip to main content
Glama

@mcp-rating/gateway

npm license MCP

Run MCP servers without handing them the API keys in your environment.

Whether a server you add can read your environment (AWS_SECRET_ACCESS_KEY, OPENAI_API_KEY, DATABASE_URL) depends on how your client starts it. The official MCP SDKs pass a short allowlist by default: HOME, PATH, USER and a few more. A client or script that passes its whole environment, often just to forward the one token a server needs, hands over everything. We haven't yet measured which popular clients do which, so we don't name any. The gateway doesn't leave it to the client: it spawns every server with a constructed environment, the SDK's short allowlist (PATH, HOME, USER and a few more) plus only the variables you or its manifest name. Nothing else from your environment is there to read.

Files are a different matter. By default a server still runs as you, so it can read what you can — ~/.ssh, ~/.aws/credentials, a project's .env. Only container isolation (opt-in, needs Docker) closes that. See what each level protects.

The same deliberately malicious MCP server, run twice: started with the whole
environment it steals four planted fake credentials; through the gateway it sees fifteen
variables, none sensitive.

Started with the whole environment

Through the gateway

Environment visible to the server

everything the client had

a short allowlist (PATH, HOME, USER and a few more), and what you name

Credentials in environment variables

all of them

none you didn't name

Credential files (~/.ssh, ~/.aws, .env)

readable

still readable, unless container isolation is on

Reproduce it yourself in about ten seconds: node demo/run-demo.mjs plants two fake credentials and runs the server both ways. It prints the planted values in full and, for anything real it finds in your environment, only the variable's name, never its value. The GIF is generated by node demo/render-gif.mjs from a clean, synthetic environment, so it shows nothing from any real machine.

It is also a meta-server: one entry in your config gives you the whole registry, connected on demand rather than pre-loaded.

{ "mcpServers": { "gateway": { "command": "npx", "args": ["-y", "@mcp-rating/gateway"] } } }

Why it uses less of your context

Every MCP server you configure statically injects its full tool schema into every turn, whether you use it or not. The gateway exposes 13 meta-tools at a fixed cost and loads a server's tools only once you connect to it.

measured

Median real MCP server

2,587 tokens

10 servers configured statically

~25,900 tokens, every turn

Gateway, flat

2,644 tokens

Roughly 10× less standing overhead at ten servers, and the gap widens with each one you add. One median server already costs about what the entire gateway costs.

But standing overhead is not the bill — here is the break-even

That 10× is what sits in the window. It is not what a conversation costs, because the gateway also adds turns: it has to discover a server and connect to it before using it, every turn re-sends the whole transcript, and mcp_discover output stays in that transcript afterwards.

Measured end to end on gemma-4-31B through vLLM, with the server's own tokenizer rather than an estimate:

tokens

turns

Gateway, cold — discover, connect, then call a tool

17,904

5

Same tool call, server already configured

6,605

2

With one server, the gateway costs 2.7× more than just configuring it. The saving only appears once you have enough servers that carrying all their schemas outweighs the setup. N configured, one actually used, after ten turns of work:

servers

static

gateway

1

25,870

70,524

static wins 2.7×

2

51,740

70,524

static wins 1.4×

4

103,480

70,524

gateway wins 1.5×

10

258,700

70,524

gateway wins 3.7×

20

517,400

70,524

gateway wins 7.3×

Break-even is three to five servers. Below that, a hand-written config is genuinely cheaper and you should use one. Above it the gateway wins, and keeps winning as you add more — but the honest figure at ten servers is about 3× on total tokens, not the 10× you get by counting standing overhead alone.

Honest about the method: measured from the tool schemas of 91 servers this project has connected to and introspected — drawn from the 300 most-downloaded in the registry — summing {name, description, inputSchema} per tool, the payload a client actually receives from tools/list, sized as chars / 4. That is an estimate, not a tokenizer.

Median, not mean, and the distribution is why. The mean is 9,965 tokens, dragged there by a long tail: 19 of the 91 cost over 10,000 tokens and the heaviest — a Spotify server exposing 608 tools — costs 135,666, about 68% of a 200k context window on its own. Quoting the mean would flatter this project's numbers using servers almost nobody installs.

The saving is real precisely because most configured servers sit unused in most conversations — but see the break-even above before assuming it applies to you.

The chars / 4 estimate was checked against three real tokenizers and came in at 0.88×, 0.98× and 1.01× of the true count, so it never reads low.

Reproduce both: node demo/shorts/short2-context.mjs --refresh for the schema corpus, and demo/ollama-probe.mjs for the end-to-end bill —

# gateway cold: must discover and connect first
OLLAMA_HOST=http://host:8000/v1 node demo/ollama-probe.mjs your-model

# baseline: server already attached, like a static config
PRECONNECT=everything-slim OLLAMA_HOST=... node demo/ollama-probe.mjs your-model

Related MCP server: Multi-MCP Proxy

How It Works

┌────────────────────┐       ┌──────────────┐       ┌──────────────────┐
│  Claude Desktop /  │ stdio │              │ stdio  │ MCP Server A     │
│  Cursor / Windsurf │◄─────►│  MCP Gateway │◄──────►│ (e.g. filesystem)│
│  (host client)     │       │              │◄──┐    └──────────────────┘
└────────────────────┘       └──────────────┘   │    ┌──────────────────┐
                                    │           └───►│ MCP Server B     │
                                    ▼                │ (e.g. github)    │
                             ┌──────────────┐        └──────────────────┘
                             │ MCP-Rating   │
                             │ Registry API │
                             └──────────────┘

Instead of manually configuring each MCP server in your client, the Gateway:

  1. Discovers servers via the MCP-Rating registry, listing first the ones it can start right now (see below)

  2. Connects to them on-demand: spawns local ones as child processes, and connects hosted ones to the endpoint the registry lists

  3. Proxies their tools through namespaced names (servername__toolname)

  4. Notifies your client when tools are added/removed

Quick Start

With Claude Desktop

Add to your claude_desktop_config.json:

{
  "mcpServers": {
    "gateway": {
      "command": "npx",
      "args": ["-y", "@mcp-rating/gateway"]
    }
  }
}

Then ask Claude:

  • "Search for MCP servers that work with databases" (uses mcp_discover)

  • "Connect to the sqlite server" (uses mcp_connect)

  • "Query my database" (calls the proxied tool directly)

Cursor

~/.cursor/mcp.json (or .cursor/mcp.json in a project):

{
  "mcpServers": {
    "gateway": { "command": "npx", "args": ["-y", "@mcp-rating/gateway"] }
  }
}

Claude Code

claude mcp add gateway -- npx -y @mcp-rating/gateway

Windsurf

~/.codeium/windsurf/mcp_config.json, same shape as Cursor:

{
  "mcpServers": {
    "gateway": { "command": "npx", "args": ["-y", "@mcp-rating/gateway"] }
  }
}

Any other MCP client

{ "command": "npx", "args": ["-y", "@mcp-rating/gateway"] }

Restart the client after editing its config — most read it only at startup.

What mcp_discover puts first

An agent can only use a server the gateway can start, so results are ordered by that, keeping relevance order within each group:

  1. Verified: the registry's own harness started it and it listed its tools (✓ Started in our test).

  2. Ready, untested: installable here, or a hosted endpoint that needs no header, and any key it declares is set.

  3. Needs setup: a declared key isn't set, its launcher (uvx, docker) isn't installed, or the hosted endpoint needs a header the gateway can't send yet.

  4. Failed in our test: it didn't start when the registry tried it, with no credentials (✗ Didn't start in our test).

  5. Can't start by slug: no install command and no endpoint recorded.

"Verified" means it started and listed tools, not that every tool works without a key. The harness supplies none. Most of the index has never been tried; that says nothing either way.

Meta-Tools

The gateway exposes 13 built-in tools:

Tool

Description

mcp_discover

Search the MCP-Rating registry; servers the gateway can start now come first

mcp_connect

Connect to a server and make its tools available

mcp_disconnect

Disconnect a server and remove its tools

mcp_list_active

List connected servers and their tools

mcp_server_info

Detailed info about a server, from the registry or a live connection

mcp_call_tool

Call a tool on a connected server

mcp_gateway_health

Diagnostics: version, uptime, connection and registry status

mcp_sandbox

View or customise a server's sandbox manifest (env/network/filesystem)

mcp_audit

The safety audit trail — what sandboxed servers actually did

mcp_profiles

Named connection profiles (work, personal, …)

mcp_groups

Atomic connect/disconnect of server sets

mcp_usage

Call counts, latency and error rates for connected servers

mcp_recommend

Server recommendations based on usage

Trust Tiers

Every connected server is labeled with a trust tier based on its MCP-Rating quality score:

  • [Verified] — High quality + officially verified

  • [Trusted] — Good quality with repository, and an install command or a remote endpoint

  • [Community] — Listed in registry with basic quality

  • [Unverified] — A package MCP Rating doesn't know, from any registry or started by command

A safety score in the risk band caps the tier, as it does on the site: below 50 a server is at most [Community], below 30 it is [Unverified].

What mcp_connect shows, and when it asks first

Before anything starts, mcp_connect looks up what MCP Rating knows about the package that would run — from the registry entry, or, for an explicit command or url, from the package itself (npx pkg, uvx pkg, docker run image, the endpoint). A known package started by command is judged as itself, not as [Unverified]. Shown in the confirmation and again once connected:

  • score and trust tier, with the server's page;

  • safety score and each flag with its reason;

  • MCP Rating's own start test: started, didn't start, needs credentials, or not tested;

  • last release and last code push, with where each date comes from.

It asks for confirmation for a [Community] or [Unverified] server, and, whatever the tier, when the safety score is in the risk band, MCP Rating has delisted the package, or a registry name points at a different package than MCP Rating knows by that name.

A minimum score

MCP_GATEWAY_MIN_SCORE=60 (or "minQualityScore": 60 in config.json) refuses to connect anything MCP Rating scores below 60, or hasn't scored — by slug, registry name, command or URL alike, so a local node server.js is refused too. confirmed: true doesn't lift it, since an agent can set that itself; only the setting does. It needs MCP Rating among the registries. A value that isn't a whole number from 0 to 100 refuses everything until it is fixed, rather than quietly meaning "no rule".

Registries

By default the gateway searches MCP Rating. It can search any registry that speaks the official MCP Registry API (v0.1) instead, or as well: the official registry, a company's own registry, or MCP Rating's mirror of it.

{
  "mcpServers": {
    "gateway": {
      "command": "npx",
      "args": ["-y", "@mcp-rating/gateway"],
      "env": {
        "MCP_GATEWAY_REGISTRIES": "https://mcprating.io/api/v1,https://registry.acme.internal"
      }
    }
  }
}
  • The list replaces the default. Leave MCP Rating out and the gateway never contacts it for discovery.

  • Each entry is a URL. One ending in /api/v1 is taken as MCP Rating's own API, and anything else as the MCP Registry API. To say which explicitly, write mcprating=URL or mcp-registry=URL.

  • Searches go to every registry and are merged. A server two registries both list appears once, as the first-listed registry has it. A search waits up to 15 seconds; a registry that hasn't answered by then is named in the results, and the rest are shown.

  • Connecting by name. A server from an MCP Registry API registry connects by its registry name, mcp_connect({slug: "io.github.owner/server"}). That works in any later session too.

  • Scores come from MCP Rating only. Quality scores, safety flags and start tests are MCP Rating's. When MCP Rating is one of your registries, a server found in another one gets MCP Rating's record of the same package — the same npm or PyPI package, Docker image or hosted endpoint — in one request per search. It is matched by package, never by name: any registry can give any package a well-known name. Otherwise the server shows as unrated and [Unverified], so connecting it asks for confirmation. Numbers another registry puts in its own entries (_meta) are not read: anyone can write them.

  • Warnings that stop a connect. If MCP Rating knows a server's registry name as a different package, or has delisted the package, mcp_discover says so, lists it last, and mcp_connect asks for confirmation whatever its trust tier.

  • The partner key goes to MCP Rating only, never to another registry.

The official registry's search matches server names only and was slow when this was written (7–40 s per search on 2026-10-14). The gateway asks it for the query's longest word and ranks what comes back by how many of your words match.

Configuration

The gateway reads config from ~/.mcp-gateway/config.json:

{
  "registryApiUrl": "https://mcprating.io/api/v1",
  "proxyTimeoutMs": 30000,
  "maxConnections": 10,
  "logLevel": "info"
}

Environment Variables

Variable

Description

Default

MCP_GATEWAY_REGISTRY_URL

MCP-Rating API base URL

https://mcprating.io/api/v1

MCP_GATEWAY_REGISTRIES

Comma-separated registries to search instead (see Registries)

MCP Rating alone

MCP_GATEWAY_MIN_SCORE

Refuse anything MCP Rating scores below this, or hasn't scored (see A minimum score)

no rule

MCP_GATEWAY_TIMEOUT

Proxy timeout (ms)

30000

MCP_GATEWAY_MAX_CONNECTIONS

Max simultaneous connections

10

MCP_GATEWAY_LOG_LEVEL

Log level (debug/info/warn/error)

info

MCP_GATEWAY_CONTAINER_ISOLATION

Force L2 container isolation on/off

manifest decides

MCP_GATEWAY_AUDIT_LOG

Path for the forensic audit log

disabled

MCP_GATEWAY_PARTNER_KEY

Partner attribution key — enables ad telemetry

unset

MCP_GATEWAY_AD_TRACKING

Set to false to disable ad telemetry outright

unset

MCP_GATEWAY_HTTP_TOKEN

Bearer token for HTTP daemon mode

unset

Security model

The gateway exists so that what a server can see doesn't depend on how your client happens to start it. Two layers push back, and it is worth being precise about what each one does and does not do.

L1 — environment scoping (always on, for stdio servers)

A downstream server receives the MCP SDK's default allowlist (HOME, LOGNAME, PATH, SHELL, TERM, USER on macOS and Linux; PATH, USERPROFILE, APPDATA, TEMP and a few more on Windows), plus only the variable names its manifest allowlists or you pass at connect time. Everything else in the parent environment — AWS_*, OPENAI_API_KEY, DATABASE_URL — is withheld. Exported shell functions (BASH_FUNC_*) are dropped rather than forwarded.

This is genuine enforcement: the child process is spawned with a constructed environment, so there is nothing to opt out of or bypass.

L1 does not restrict files or the network. The server runs as your user: it can read anything you can, including ~/.ssh, ~/.aws/credentials and .env files, and it can connect to any host. A manifest can declare network and filesystem limits, but outside a container nothing enforces them, and the connect summary says "not restricted" rather than listing them.

L2 — container isolation (opt-in)

With MCP_GATEWAY_CONTAINER_ISOLATION=true, community and unknown servers run under docker/podman in an ephemeral container. You can also opt one server in with mcp_sandbox({action: "set", slug: "…", enforcement: "l2-container"}). Inside, the server gets a read-only root, a scratch /tmp, and only the paths its manifest declares mounted from the host. network: "none" gives the container no network at all. Without Docker or Podman, the gateway falls back to L1 and logs that it did.

Network allowlists: read this before relying on them

Allowlists apply only under L2. network: "allowlist" starts a forward proxy and points the container at it via HTTP_PROXY/HTTPS_PROXY. The proxy accepts only tunnels that carry a random credential generated for that connection, which the container receives in those variables. With Docker Desktop it listens on loopback. With Docker on Linux it has to listen on all interfaces, because the container reaches it over the bridge, and the credential is what keeps other machines from using it.

This filters proxy-aware clients only. Node's fetch/undici, axios, and Python requests all honour those variables, which covers most real servers. A program that opens raw TCP sockets, or a compiled binary that ignores proxy environment variables, is not filtered. Treat an allowlist as a guard rail against honest code, not a containment boundary against hostile code. For that, use network: "none".

Giving a server an API key

Put the key in the gateway's env in your client config, not in the chat:

{
  "mcpServers": {
    "gateway": {
      "command": "npx",
      "args": ["-y", "@mcp-rating/gateway"],
      "env": { "GITHUB_TOKEN": "ghp_…" }
    }
  }
}

A server receives it only if its registry entry declares that variable. For one that doesn't, allowlist the name, never the value: mcp_sandbox({action: "set", slug: "…", envAllow: ["GITHUB_TOKEN"]}).

mcp_connect also accepts env: { NAME: "value" }. That works, but the model has to write the secret into a tool call, which puts it in your chat transcript and your model provider's logs.

When a server asks the model for personal data

A hosted server can ask for an email, a phone number or a card number in an ordinary tool result, and the model is what answers. During our own test runs, a local 31B was asked for an email "to record your free quota" and made one up. No sandbox can see that: it's a request in the content channel.

Since 0.2.6 the gateway checks each tool result for a personal-data term next to a verb of handing it over, in English and Chinese, within its first 1,500 characters. On a match it appends a warning the model reads with the result: ask the user, and never make up a value. It also records personal_data_requested in the audit trail (mcp_audit). It's a heuristic, and it only adds: the server's reply is never changed or blocked.

A missing runtime is an error, not a substitution

If a server's launcher (uvx, docker, python, …) isn't installed, the connect fails with a message naming what to install. Before 0.2.4, a missing launcher was rewritten to npx -y <name>, which ran whatever npm package shared its name. On a machine without Docker, that was the unrelated npm package docker.

Allowlist patterns fail closed: a malformed pattern such as *example.com (missing dot) matches nothing rather than everything. The gateway warns at startup about patterns that will not do what their author intended, including over-broad ones like *.com.

What is not covered

If the host client is SIGKILLed, the gateway cannot run its shutdown path and spawned child processes may be left behind. SIGINT/SIGTERM are handled and disconnect everything cleanly; SIGKILL is untrappable by definition.

Telemetry

Off unless you turn it on. The ad tracker is constructed only when MCP_GATEWAY_PARTNER_KEY is set — with no partner key there is no partner telemetry, and nothing is posted about your connects or tool calls.

If a partner key is set (you are earning attribution revenue), connect and tool-execution events are sent to mcprating.io. Disable it while keeping the key with MCP_GATEWAY_AD_TRACKING=false.

Separately, the gateway calls the configured registries — MCP Rating unless you set MCP_GATEWAY_REGISTRIES — for mcp_discover, mcp_connect and mcp_recommend. That is the lookup you asked for, not background reporting, and each registry you list sees the searches. Usage analytics (mcp_usage) are an in-memory ring buffer and never leave the process.

Development

npm install
npm run dev        # watch mode
npm run typecheck
npm run build
npm test           # unit tests (env scoping, egress proxy, reconnect, mcp_call_tool)

Architecture

The gateway is built on the MCP SDK and uses:

  • StdioServerTransport — communicates with the host client

  • StdioClientTransport — spawns and communicates with downstream servers

  • Dynamic tool registration — McpServer.registerTool() + sendToolListChanged()

  • Tool namespacing — slug__toolname pattern prevents collisions

  • Passthrough Zod schemas — preserves parameter names for host client UI while letting downstream servers validate

License

MIT — see LICENSE.


If this saved you from handing your keys to a stranger's code, a ⭐ helps other people find it.

Available Tools

13 tools
mcp_auditA

View the safety audit trail — a forensics log of what sandboxed MCP servers did and what the sandbox blocked (tool calls, blocked tools, blocked/allowed network egress, connects with granted capabilities). Use securityOnly: true to see only blocks and errors.

ParametersJSON Schema
NameRequiredDescriptionDefault
slugNoFilter to a single server slug
eventNoFilter to a single event type
limitNoMax events to return (default 50, newest first)
securityOnlyNoShow only security-relevant events (blocks + errored calls)

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It discloses what the log captures and how securityOnly narrows it, but says nothing about read-only semantics, event retention/coverage window, ordering, or what happens when filters match nothing — gaps that matter for a forensics tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the resource and its scope, followed by the one actionable filter hint. The parenthetical enumeration is dense but each item earns its place by matching a real event type.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description usefully describes the returned event content, which is the key missing structured information. It stops short of covering ordering/recency limits or the fact that results are capped, though the limit/ordering details do live in the schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all four parameters are already documented, including the securityOnly meaning and the limit default/ordering. The description's securityOnly sentence ('blocks and errors') largely restates the schema, so baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('View the safety audit trail') and immediately scopes it as a forensics log, then enumerates exactly what it contains: tool calls, blocked tools, egress allowed/blocked, connects with granted capabilities. That enumeration maps onto the `event` enum and separates it from analytics-style siblings like mcp_usage.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly tells the agent when to narrow scope: 'Use `securityOnly: true` to see only blocks and errors.' However, it never says when to reach for this tool rather than alternatives such as mcp_usage or mcp_gateway_health, so selection guidance is clear but not complete.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_call_toolA

Call a tool on a connected MCP server. Use this when dynamically connected tools aren't directly available. Pass the namespaced tool name (slug__toolName) and arguments.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesNamespaced tool name: "server-slug__tool-name" (as shown by mcp_connect or mcp_list_active)
argumentsNoTool arguments as a JSON object

TDQS

A3.5/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden, and it falls short: it does not say what happens on failure, whether arguments are validated against the target tool's schema, what the response looks like, or any permission/timeout concerns. The only behavioral hint is the dynamic-availability condition.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, front-loaded with the action, followed by the usage condition and then the required input format. No waste.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a dispatcher with no output schema and no annotations, the definition covers the essential action and input format but omits error behavior and any indication of the return shape, which would matter for an agent deciding how to handle the result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both parameters are already fully documented ('name' as server-slug__tool-name, 'arguments' as a JSON object). The description restates the namespaced format but adds no syntax or usage detail beyond what the schema provides, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Call a tool on a connected MCP server'), so an agent immediately knows this dispatches a call to a dynamically connected server. It does not, however, explicitly distinguish itself from siblings like mcp_discover or mcp_connect, leaving the routing between meta-tools to inference.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides a clear when-to-use condition: 'when dynamically connected tools aren't directly available.' That is genuine routing guidance, but it names no alternatives (mcp_discover/connect/list_active) and gives no when-not guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_connectA

Connect to an MCP server and make its tools available. Provide either a server slug (from mcp_discover) to look up in the registry, OR an explicit command + args to spawn directly, OR a url for remote servers.

ParametersJSON Schema
NameRequiredDescriptionDefault
envNoAdditional environment variables for the server process
urlNoURL for remote transports (SSE, WebSocket, Streamable HTTP). Use instead of command for remote servers.
argsNoCommand arguments (e.g., ['-y', '@modelcontextprotocol/server-everything'])
slugNoServer slug from MCP-Rating registry (e.g., '@modelcontextprotocol/inspector')
commandNoExplicit command to spawn (e.g., 'npx'). Use when server is not in registry.
confirmedNoSet to true to confirm connection to community/unknown trust tier servers. Required when the initial connect returns a confirmation warning.
saveProfileNoSet to true to save this connection as an auto-connect profile. The server will auto-reconnect on gateway restart.
transportTypeNoTransport type. Defaults to 'stdio' for command-based, auto-detected from URL scheme if url is provided.

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden; it discloses the connection outcome (tools become available) but not trust-tier confirmation needs, persistence/reconnect behavior, or auth requirements, which live only in the schema for `confirmed` and `saveProfile`. Useful but incomplete behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the action and immediately followed by the three invocation options. Zero filler, and the most decision-relevant routing info comes first.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an 8-parameter tool with no annotations and no output schema, the description covers the core routing but omits the trust-tier confirmation flow, reconnect/profiles semantics, and error behavior. The rich schema compensates for parameter semantics, but behavioral completeness is thin.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. The description reinforces the slug-vs-command-vs-url selection logic but largely restates what the per-parameter descriptions already say ('Use instead of command for remote servers'), adding only the OR framing.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Connect) and resource (MCP server) plus the effect (make its tools available), and names the sibling mcp_discover as the source of slugs. An agent can distinguish this from mcp_disconnect, mcp_list_active, and mcp_discover without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly lays out three mutually exclusive invocation modes (slug from registry, command+args to spawn, url for remote), which routes the agent to the correct parameter set. It stops short of stating when-not to use it or what to do on failure/confirmation, so not a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_disconnectA

Disconnect from a connected MCP server and remove its tools. Use mcp_list_active to see connected servers.

ParametersJSON Schema
NameRequiredDescriptionDefault
slugYesServer slug of the connected server to disconnect

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations, so the description carries the full burden. It usefully discloses that disconnecting removes the server's tools, but it omits whether the server can later be reconnected (mcp_connect exists as a sibling), whether the action is reversible, and whether in-flight tool calls are affected.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, action and effect front-loaded, with the helper pointer second. No waste.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter teardown tool with no output schema, the definition covers what it does, its side effect, and how to obtain the slug. The main remaining gap is the reversibility/reconnect question, which matters given mcp_connect is a sibling.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the single slug parameter is fully documented in the schema, so the description need only be consistent. It refers to "a connected MCP server" without adding format or sourcing detail beyond what the schema and the mcp_list_active pointer provide.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Specific verb+resource ("Disconnect from a connected MCP server") with the key side effect stated ("remove its tools"), which cleanly distinguishes it from sibling mcp_connect and the read-oriented mcp_list_active.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It names mcp_list_active as the way to find connected servers, which implicitly tells the agent the prerequisite state (a currently connected server) and where to get the slug. It does not state any when-not-to-use condition or contrast against alternatives like mcp_connect, so it falls short of full routing guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_discoverA

Search the configured MCP registries (MCP Rating by default) for MCP servers. Returns servers with trust tiers, install information, and MCP Rating's quality scores where it has rated them. Use this to find servers before connecting them with mcp_connect.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMax results (default 10)
queryYesSearch query (server name, description, or capability)
categoryNoFilter by category slug (e.g., 'developer-tools', 'data-databases')

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations and no output schema, the description carries the full burden and does disclose the return shape (trust tiers, install info, quality scores) and that only configured registries are searched. It omits confirming the operation is read-only and says nothing about rate limits or pagination behavior, which is why it is not a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three tight sentences with no filler; purpose, return content, and the routing hint are all front-loaded before any elaboration.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description compensates for the missing output schema by naming what results contain, and all three parameters are schema-documented. Small gaps remain around default registry configuration and result pagination/limits beyond the schema's max.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so query, category, and limit are already documented in the schema (baseline 3). The description adds only the registry context ('MCP Rating by default') and nothing about query syntax or category source.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Search the configured MCP registries ... for MCP servers') plus what comes back (trust tiers, install info, quality scores). It is clearly distinguishable from siblings like mcp_server_info, mcp_recommend, and mcp_list_active.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Use this to find servers before connecting them with mcp_connect' gives an explicit use context and names the downstream alternative. It stops short of ruling out competing discovery tools such as mcp_recommend or describing when NOT to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_gateway_healthA

Get gateway diagnostics: version, uptime, connection status, registry reachability, and per-server health.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It helpfully enumerates the diagnostic categories returned, but never states that the operation is a safe read-only check, whether it incurs load on downstream servers, or any auth/latency characteristics.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence that enumerates its contents with zero filler. Every listed item corresponds to real output the caller would receive.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema or annotations exist, so the description must carry the return-value story, and it does by naming each diagnostic field. It stops short of describing format or how per-server health is represented, but for a zero-arg probe this is close to sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so there is nothing to document and the baseline of 4 applies. The description correctly adds no spurious parameter detail.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb (Get) and resource (gateway diagnostics) and enumerates the exact contents returned: version, uptime, connection status, registry reachability, per-server health. This clearly distinguishes it from siblings like mcp_list_active or mcp_server_info, though it never names an alternative explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit when-to-use guidance, no prerequisites, and no mention of alternative tools for related queries. An agent can infer a health/diagnostics use case, but nothing in the text routes it there versus mcp_server_info or mcp_list_active.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_groupsB

Manage server groups for atomic connect/disconnect of sets of servers.

ParametersJSON Schema
NameRequiredDescriptionDefault
urlNoServer URL (for add_server with SSE/WS/HTTP)
argsNoCommand arguments (for add_server with stdio)
nameNoGroup name (required for all actions except list)
slugNoServer slug to add/remove from a group
actionYesAction: list, create, delete, add_server, remove_server, connect (all in group), disconnect (all in group), show (details)
commandNoExplicit command for the server (for add_server with stdio)
descriptionNoGroup description (optional, for create)
transportTypeNoTransport type (for add_server)

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full behavioral burden. It discloses the useful 'atomic' trait, but says nothing about destructive actions (delete, remove_server), permission requirements, error behavior, or side effects of connect/disconnect.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with zero waste. It is appropriately sized for a tool whose schema carries the parameter detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a multi-action tool with eight parameters, no annotations, and no output schema, one sentence is thin. The schema lists actions but the description does not help an agent understand action categories, destructive operations, or behavioral implications.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents every parameter and action. The description adds no parameter-level meaning beyond that baseline, so a 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear verb+resource ('Manage server groups') and adds the scope 'atomic connect/disconnect of sets of servers'. It does not explicitly distinguish itself from sibling tools like mcp_connect and mcp_disconnect that operate on individual servers, so sibling differentiation is missing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the phrase 'atomic connect/disconnect of sets of servers', suggesting this tool is for group-level operations. However, there is no explicit when-to-use, when-not-to-use, or alternative routing versus mcp_connect/mcp_disconnect.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_list_activeA

List all currently connected MCP servers and their tools.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations, so the description carries the burden, but for a zero-parameter listing tool there is little to disclose. 'List ... currently connected' implies a read-only, non-destructive operation and indicates what is returned; however it does not state auth requirements, whether the listing is cached, or any rate limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler. The core action and scope are stated immediately with nothing wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, and the description compensates by stating what is returned (connected servers and their tools). For a simple no-arg listing tool this is nearly complete; only the boundary against mcp_discover remains unaddressed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes no parameters, so there are no parameter semantics to convey. Baseline for a zero-parameter tool is 4, and the schema (empty object) is consistent with the description's implicit claim of no inputs.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clear specific verb 'List' with a precise resource: 'currently connected MCP servers and their tools'. An agent can distinguish it from most siblings, but the description does not explicitly contrast it with near-neighbors like mcp_discover (unconnected servers) or mcp_server_info (single server).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use guidance and no alternatives named. The 'currently connected' qualifier implicitly suggests it differs from discovery, but the agent must infer when to pick this over mcp_discover or mcp_server_info.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_profilesC

Manage named connection profiles. Profiles are presets of server connections that can be switched between (e.g., 'work', 'personal').

ParametersJSON Schema
NameRequiredDescriptionDefault
urlNoServer URL (for add_server with SSE/WS/HTTP)
argsNoCommand arguments (for add_server with stdio)
nameNoProfile name (required for create, delete, add_server, remove_server, switch, show)
slugNoServer slug to add/remove from a profile
actionYesAction: list (all profiles), create (new profile), delete, add_server (add a server to profile), remove_server, switch (activate profile), show (details of a profile)
commandNoExplicit command for the server (for add_server with stdio)
descriptionNoProfile description (optional, for create)
transportTypeNoTransport type (for add_server)

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It mentions that profiles can be 'switched between' but does not disclose that actions like delete, remove_server, and switch have destructive or state-changing effects, nor does it describe persistence, permissions, or side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the core purpose and one clarifying definition. There is no filler, and the example parenthetical adds useful context without bloating the description.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a complex multi-action tool (8 parameters, 7 enum actions, no annotations, no output schema), yet the description only gives a high-level summary. It omits action-specific behavior, destructive-action warnings, return information, and usage differentiation, which are necessary for an agent to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already defines all 8 parameters and the action enum. The description adds no additional meaning about parameter interactions or usage beyond what the schema provides. Baseline 3 applies when the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear verb and resource: 'Manage named connection profiles.' It further clarifies with the definition 'presets of server connections' and examples ('work', 'personal'). However, it does not distinguish this tool from possibly related siblings like mcp_groups or mcp_discover, leaving the agent to infer the boundary.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given for when to use this tool versus alternatives, when to prefer each action (e.g., create vs add_server), or what prerequisites exist. The description only says 'manage', which is too vague to guide selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_recommendB

Get MCP server recommendations. Pass query to describe a goal or task (e.g. "file sync with cloud storage", "manage GitHub issues"). Omit query to get suggestions based on your recent tool-call patterns.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoMaximum number of recommendations (default 5, max 20)
queryNoFree-text goal or task. When provided, recommends servers that match this intent using semantic/keyword/expansion search. When omitted, recommends based on usage history.
categoryNoOptional category slug to filter (e.g. 'developer-tools', 'data-databases'). Only used with `query`.

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It mentions search modes (semantic/keyword/expansion) and usage-history fallback, but says nothing about permissions, rate limits, ranking behavior, or what the response contains.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two efficient sentences front-load the core action and then explain the query/no-query branches without waste.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only recommendation tool with no annotations and no output schema, the description covers invocation modes but leaves return shape, ranking, and any auth or rate-limit context unaddressed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the schema already documents all three parameters thoroughly, including limits and the category dependency on query. The description's parameter guidance largely repeats the schema, so baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource (get recommendations for MCP servers) clearly. It distinguishes the tool from siblings like mcp_discover and mcp_list_active by focusing on recommendations driven by query or usage patterns, though it doesn't explicitly name how it differs from those siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear conditions for passing query vs omitting it, which covers the main usage modes. However, it doesn't mention when to prefer this over mcp_discover or other siblings that also surface servers.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_sandboxA

View or customize a server's sandbox capability manifest (env/network/filesystem/subprocess access). Use action 'view' to inspect, 'set' to tighten or loosen grants (only the fields you pass change, the rest keep what the server has now or would get by default; applies on next connect), or 'reset' to revert to defaults.

ParametersJSON Schema
NameRequiredDescriptionDefault
slugYesServer slug (as shown by mcp_list_active or mcp_discover), or its registry name (io.github.owner/server)
actionYesview = inspect manifest; set = override grants; reset = revert to defaults
fsReadNo[set] Absolute paths the server may read
fsWriteNo[set] Absolute paths the server may write
networkNo[set] Network mode. 'none' = no network, 'allowlist' = only listed hosts, 'all' = unrestricted
envAllowNo[set] Environment variable NAMES the server may receive, e.g. ['GITHUB_TOKEN']
subprocessNo[set] Whether the server may spawn subprocesses
enforcementNo[set] Isolation level. l2-container requires Docker/Podman.
networkAllowNo[set] Allowed host:port patterns for allowlist mode, e.g. ['api.github.com:443', '*.example.com']

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does well: it discloses that 'set' is a partial patch ('only the fields you pass change, the rest keep what the server has now or would get by default') and that changes are deferred ('applies on next connect'). These are non-obvious mutation semantics an agent could not infer from the schema. It still omits the permission/authorization requirements and what a failed or rejected grant looks like.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single dense sentence with the purpose front-loaded and the action routing following in priority order. It is long but every clause (partial-update behavior, deferred application) earns its place; only the nested parenthetical stacking costs it a point.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No annotations and no output schema, and for a 9-parameter policy mutation tool the description covers actions and mutation semantics adequately. It does not say what 'view' returns or how enforcement failures surface, but the schema's enum descriptions (e.g. l2-container requires Docker) pick up part of that slack.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all nine parameters, including enum values and the [set] action prefixes. The description's only added parameter meaning is the merge semantics for omitted fields on 'set', which is useful but marginal. Baseline 3 is appropriate when the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb pair (view/customize) and the exact resource (a server's sandbox capability manifest), then enumerates the four policy domains it covers (env/network/filesystem/subprocess). No sibling tool deals with sandbox grants, so the agent can route to it unambiguously.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Maps each action enum value to a purpose: 'view' to inspect, 'set' to tighten or loosen grants, 'reset' to revert to defaults. This tells the agent which action to pick but gives no guidance on when this tool is preferable to adjacent tools like mcp_connect or mcp_profiles, nor any prerequisites.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_server_infoB

Get detailed information about an MCP server from the registry or a currently connected server.

ParametersJSON Schema
NameRequiredDescriptionDefault
slugYesServer slug (from registry or connected server)

TDQS

B3.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full disclosure burden. It implies a read operation but says nothing about whether a connection is required, what happens if the slug is not found, permissions, or rate limits. For a lookup tool with zero annotation coverage this is thin.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single efficient sentence that front-loads the verb and resource. Every clause earns its place, though the dual-source phrasing could be tightened.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

A read-only, single-parameter tool with no output schema, so the description could reasonably explain what 'detailed information' is returned. It stops short of that, leaving the return payload unspecified, though the lookup scope is covered.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and the single 'slug' parameter is documented in the schema itself, so the description adds no additional meaning. Baseline 3 is appropriate when the schema does the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a clear verb ('Get detailed information') and resource ('an MCP server') and clarifies the two lookup sources (registry or connected server). It distinguishes itself reasonably from siblings like mcp_discover and mcp_list_active, though it does not name them explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The mention of 'registry or a currently connected server' implies when this tool applies, but there is no explicit when-to-use guidance or contrast with alternatives such as mcp_discover. Usage is only inferable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_usageC

View usage analytics for connected MCP servers — call counts, latency, error rates, and recent activity.

ParametersJSON Schema
NameRequiredDescriptionDefault
slugNoFilter stats to a specific server slug. Omit for global stats.
limitNoLimit number of results for 'recent' and 'slow' actions (default: 20)
actionNoAction: stats (default — summary), recent (recent calls), slow (slow calls), reset (clear all data)
thresholdNoLatency threshold in ms for 'slow' action (default: 5000)

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden — and it frames the tool purely as a read-only viewer ('View usage analytics'), while the schema exposes a 'reset' action documented as 'clear all data'. A destructive capability is left undisclosed, which could lead an agent into irreversible data loss. No mention of permissions or reversibility.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence that names the resource first and then the metrics. Zero wasted words and appropriately sized for the tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no annotations, no output schema, and a multi-action tool that includes a destructive 'reset', the description should say more than it does. It omits the existence of non-viewing actions and any warning about data destruction, leaving a significant gap for an agent deciding whether to call it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so all four parameters (slug, limit, action, threshold) are already documented in the schema, including enum meanings. The description adds no parameter-level detail beyond what the schema provides; baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a clear verb ('View') and resource ('usage analytics for connected MCP servers') and enumerates the metrics returned (call counts, latency, error rates, recent activity). It is distinguishable from siblings like mcp_gateway_health or mcp_audit, though it does not explicitly contrast with them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to choose this tool over mcp_gateway_health, mcp_audit, or mcp_server_info, nor any stated prerequisites (e.g., that a server must be connected). The description offers no when/when-not context at all.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 2 tool updatesv0.4.1
    • Changedmcp_audit1 field changed
      • changedInput schema / properties / event / enum
        Previous value: -[
        -  "connect",
        -  "tool_call",
        -  "tool_blocked",
        -  "egress_blocked",
        -  "egress_allowed",
        -  "disconnect"
        -]New value: +[
        +  "connect",
        +  "tool_call",
        +  "tool_blocked",
        +  "egress_blocked",
        +  "egress_allowed",
        +  "personal_data_requested",
        +  "disconnect"
        +]
    • Changedmcp_sandbox1 field changed
      • changedInput schema / properties / slug / description
        Previous value: -"Server slug (as shown by mcp_list_active or mcp_discover)"New value: +"Server slug (as shown by mcp_list_active or mcp_discover), or its registry name (io.github.owner/server)"
  2. 13 tool updatesv0.2.3
    • First observedmcp_audit
    • First observedmcp_call_tool
    • First observedmcp_connect
    • First observedmcp_disconnect
    • First observedmcp_discover
    • First observedmcp_gateway_health
    • First observedmcp_groups
    • First observedmcp_list_active
    • First observedmcp_profiles
    • First observedmcp_recommend
    • First observedmcp_sandbox
    • First observedmcp_server_info
    • First observedmcp_usage

TDQS

A3.6/5.0

Scored across 13 tools

Disambiguation4/5

Most tools target clearly distinct concerns (connect/disconnect/list/health/audit/usage/sandbox). The only real overlap is mcp_discover vs mcp_recommend, which both surface servers to connect to, and mcp_server_info vs mcp_list_active, which both expose server details.

Naming Consistency4/5

Every tool uses the same mcp_ prefix and snake_case, giving a strong predictable family. However, it mixes verb_noun forms (list_active, call_tool, gateway_health) with bare-noun names (sandbox, audit, profiles, groups, usage), so the pattern isn't perfectly uniform.

Tool Count5/5

13 tools is well within the ideal range and each maps to a genuine gateway responsibility (discovery, connection lifecycle, sandboxing, auditing, analytics, profiles/groups). Nothing feels padded or missing at the count level.

Completeness4/5

The surface covers the full server-management lifecycle: discover, connect, disconnect, list, inspect, call, plus sandbox, audit, usage, profiles, and groups. Minor gaps exist (e.g., no explicit refresh/reconnect or profile edit/delete semantics), but core workflows are well covered.

Maintenance

ActivityNo data
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    B
    quality
    C
    maintenance
    Dynamic MCP server for Node.js enabling runtime tool creation, management, and execution in isolated sandboxes (Docker or Node).
    8
    13 npm
    1
    MIT
  • A
    license
    Not graded
    quality
    D
    maintenance
    A flexible MCP proxy server that connects to and routes between multiple backend MCP servers over STDIO or SSE, enabling dynamic management and namespacing of tools.
    111
    MIT
  • F
    license
    A
    quality
    D
    maintenance
    Universal MCP proxy server that discovers, searches, and executes tools across all configured MCP servers from a single entry point.
    7
    -
  • F
    license
    Not graded
    quality
    C
    maintenance
    Enables agents to connect to remote MCP servers once, access their tools through a compact MCP endpoint, pair a CLI inside sandboxes, and create watches that turn command or tool output into pollable structured events.
    2
    -