mcp-ssh-tool
The mcp-ssh-tool server enables autonomous SSH-based remote system management through natural language commands via MCP clients (e.g., GitHub Copilot, VS Code).
SSH Session Management
Open, close, list, and ping SSH sessions
Authenticate via password, SSH key (inline, path, or auto-discovery), or SSH agent
List and resolve hosts/aliases from
~/.ssh/configConnection pooling with TTL and LRU eviction
Command Execution
Run arbitrary commands (
proc_exec) with optional working directory, environment variables, and timeoutExecute commands with sudo privileges (
proc_sudo)
File System Operations (via SFTP or shell fallback)
Read, write, stat, list, create directories, remove, and rename/move files and directories
Configuration & Automation
Ensure packages are installed or removed (
ensure_package)Ensure services are started, stopped, restarted, enabled, or disabled (
ensure_service)Add or remove specific lines in config files (
ensure_lines_in_file)Apply unified diff patches to remote files (
patch_apply)
System Information & Metrics
Detect OS, distro, package manager, init system, and shell (
os_detect)Retrieve server metrics in JSON or Prometheus format
Additional Highlights
Automatic fallback to shell-based file ops for BusyBox/Dropbear (embedded) systems without SFTP
Sensitive data redaction in logs and configurable host key verification
Supports Linux, macOS, and Windows targets
Enables natural language SSH automation within GitHub Copilot, allowing for autonomous file operations and command execution on remote servers.
Supports the remote installation and management of the htop system monitoring tool via automated package management commands.
Provides comprehensive management of Linux-based systems, including process execution with sudo privileges, service control, and file system operations.
Facilitates SSH connectivity and remote command execution on macOS environments using POSIX shell wrappers.
Allows for the remote management of NGINX web servers, including configuration file editing and service state control.
Enables automated package management and system administration specifically tailored for Ubuntu server environments.
mcp-ssh-tool
Production-grade MCP SSH automation for operators, developers, and AI clients. mcp-ssh-tool opens persistent SSH sessions and exposes safe, structured tools for command execution, file operations, transfers, tunnels, package/service management, metrics, resources, and guided prompts.
v2 is secure by default: strict host-key verification is on, root login is off, raw sudo is policy-gated, destructive commands and filesystem mutations are denied unless policy allows them, and remote HTTP starts on loopback only unless bearer auth and allowed origins are configured.
Why This Server
Trust: central policy engine, structured audit events, redacted logs, strict host keys, and machine-readable errors.
MCP quality: stdio for local clients, Streamable HTTP for remote clients, legacy SSE only behind an explicit compatibility flag.
AI-friendly tools: stable output schemas,
structuredContent, annotations for read-only/destructive/idempotent behavior, resources, and curated prompts.Operations: session TTL/eviction, command timeouts, transfer checksum verification, real SSH forwarding, Prometheus metrics, and OpenTelemetry hooks.
Portability: SFTP first, POSIX/BusyBox-aware shell fallbacks for basic file operations, and explicit support boundaries.
Quick Start
Run without installing:
pnpm dlx mcp-ssh-tool --versionOr install globally:
pnpm add --global mcp-ssh-toolAdd a stdio MCP server to your client:
{
"servers": {
"ssh-mcp": {
"type": "stdio",
"command": "mcp-ssh-tool",
"args": []
}
}
}Use it from your MCP client:
Open a safe SSH session to prod-1 as deploy, inspect host capabilities, then show disk usage.Requirements
Node.js
22.22.2+or24.15.0+(LTS only)SSH access to target hosts
A populated
known_hostsfile for strict host verification, or an explicit per-session host-key policy
Transports
Mode | Command | Use When |
stdio |
| Local desktop clients such as ChatGPT, Claude Desktop, VS Code, Cursor, or Codex. |
Streamable HTTP |
| Remote MCP clients, reverse proxies, or Inspector sessions. |
legacy SSE |
| Temporary v1 compatibility only. Prefer Streamable HTTP. |
Non-loopback HTTP startup is refused unless --bearer-token-file, allowed origins, and SSH_MCP_HTTP_PUBLIC_URL are configured.
No-Custody Remote Agent Mode
For public ChatGPT connector deployments, enable the remote-agent control plane instead of asking users for SSH credentials:
SSHAUTOMATOR_REMOTE_AGENT_CONTROL_PLANE=true \
PUBLIC_BASE_URL=https://sshautomator.example.com \
MCP_RESOURCE_URL=https://sshautomator.example.com/mcp \
mcp-ssh-tool http --host 0.0.0.0 --port 3000Remote mode adds OAuth/DCR endpoints, a protected /mcp endpoint, agent enrollment APIs, and outbound WebSocket agent connections. ChatGPT receives OAuth-scoped MCP access. The platform stores identity, policy, audit records, OAuth metadata, hashed one-time tokens, and agent public keys; it does not store user SSH private keys, SSH passwords, root passwords, or cloud login credentials.
Enroll an agent on the user's own host:
npx --yes --package mcp-ssh-tool@latest mcp-ssh-agent enroll --server https://sshautomator.example.com --token <one-time-token> --alias prod-1
npx --yes --package mcp-ssh-tool@latest mcp-ssh-agent runThe agent verifies signed control-plane action envelopes, enforces local policy, executes bounded actions, signs results, and returns them over the outbound connection. See docs/ARCHITECTURE.md, docs/CHATGPT_CONNECTOR.md, and docs/AGENT_INSTALL.md.
Secure Defaults
Area | v2 Default |
Host keys |
|
Root SSH login | denied |
Raw | denied unless |
Destructive commands | denied unless |
Destructive fs operations | allowed only under policy prefixes, denied elsewhere |
Local transfer paths |
|
HTTP bind |
|
Legacy SSE | disabled |
File reads | size-limited by |
Command output | bounded by |
Transfers | bounded by |
Per-session policyMode: "explain" returns a plan/verdict without executing. Use it before mutations when an AI client needs to summarize risk.
Policy Example
Set SSH_MCP_POLICY_FILE=/etc/mcp-ssh-tool/policy.json:
{
"mode": "enforce",
"allowRootLogin": false,
"allowRawSudo": false,
"allowDestructiveCommands": false,
"allowDestructiveFs": false,
"allowedHosts": ["^prod-[0-9]+\\.example\\.com$"],
"commandAllow": ["^(uname|df|uptime|systemctl status)\\b"],
"commandDeny": ["rm\\s+-rf\\s+/", "shutdown", "reboot"],
"pathAllowPrefixes": ["/tmp", "/var/tmp", "/home/deploy"],
"pathDenyPrefixes": ["/etc/shadow", "/etc/sudoers", "/boot", "/dev", "/proc"],
"localPathAllowPrefixes": ["/var/tmp/mcp-ssh-tool"],
"localPathDenyPrefixes": []
}Simple deploys can use environment overrides such as SSH_MCP_ALLOW_RAW_SUDO=true, SSH_MCP_ALLOWED_HOSTS=prod-1.example.com, SSH_MCP_PATH_ALLOW_PREFIXES=/tmp,/home/deploy, or SSH_MCP_LOCAL_PATH_ALLOW_PREFIXES=/var/tmp/mcp-ssh-tool.
Core Tools
ssh_open_session,ssh_close_session,ssh_list_sessions,ssh_ping,ssh_list_configured_hosts,ssh_resolve_hostproc_exec,proc_sudo,proc_exec_streamfs_read,fs_write,fs_list,fs_stat,fs_mkdirp,fs_rmrf,fs_renamefile_upload,file_downloadensure_package,ensure_service,ensure_lines_in_file,patch_applyos_detect,get_metricstunnel_local_forward,tunnel_remote_forward,tunnel_list,tunnel_close
All tools return text plus stable structuredContent. Tool metadata includes titles, output schemas, and annotations that disclose read-only, destructive, idempotent, and external side-effect behavior.
Resources And Prompts
Resources:
mcp-ssh-tool://sessions/activemcp-ssh-tool://metrics/jsonmcp-ssh-tool://metrics/prometheusmcp-ssh-tool://ssh-config/hostsmcp-ssh-tool://policy/effectivemcp-ssh-tool://audit/recentmcp-ssh-tool://capabilities/support-matrix
Prompts:
safe-connectinspect-host-capabilitiesplan-mutationmanaged-config-change
Support Matrix
Target | Status |
Linux | Full support. |
macOS/BSD | Session, process, fs, and transfer supported; package/service helpers only where tested. |
BusyBox/dropbear | Experimental for session, process, and basic fs fallbacks. |
Windows SSH targets | Experimental for session, process, fs, and transfer; no |
Client Examples
ChatGPT or Claude Desktop:
{
"mcpServers": {
"ssh-mcp": {
"command": "pnpm",
"args": ["dlx", "mcp-ssh-tool"]
}
}
}VS Code or Cursor:
{
"servers": {
"ssh-mcp": {
"type": "stdio",
"command": "mcp-ssh-tool"
}
}
}MCP Inspector over HTTP:
printf '%s' 'super-secret-token' > .mcp-token
mcp-ssh-tool --transport=http --host 127.0.0.1 --port 3000 --bearer-token-file .mcp-tokenConfiguration
High-value environment variables:
Variable | Default | Purpose |
| unset | Canonical JSON policy source. |
|
|
|
|
| Known-hosts file for strict verification. |
|
| Max bytes for |
|
| Max text payload bytes accepted by |
|
| Max retained stdout/stderr bytes per command or stream. |
|
| Max retained streaming chunks before truncation metadata is returned. |
|
| Max bytes for |
|
| Default command timeout. |
|
| Streamable HTTP bind host. |
|
| Streamable HTTP port. |
|
| Max JSON request bytes accepted by Streamable HTTP. |
|
| Max concurrent Streamable HTTP/SSE MCP sessions. |
|
| Idle TTL before abandoned HTTP sessions are closed. |
| unset | Required for non-loopback HTTP to publish stable protected-resource metadata. |
|
| Trust |
| OS temp directory | Local transfer allow-list for |
|
| Tunnel bind-host allow-list. |
|
| Tunnel bind-host deny-list. |
| unset | Optional tunnel destination host allow-list. |
| unset | Tunnel destination host deny-list. |
| unset | Optional tunnel port allow-list, including ranges such as |
| unset | Tunnel port deny-list. |
| unset | Required for non-loopback HTTP. |
| loopback origins | Comma-separated allowed origins. |
Deprecated aliases STRICT_HOST_KEY_CHECKING and SSH_MCP_STRICT_HOST_KEY are still accepted for one v2 compatibility cycle. Prefer SSH_MCP_HOST_KEY_POLICY.
Development
Use the exact local runtime from .nvmrc / .node-version, then run:
pnpm install --frozen-lockfile
pnpm run checkLive SSH suites are opt-in:
RUN_SSH_INTEGRATION=1 pnpm run test:integration
RUN_SSH_E2E=1 pnpm run test:e2eLocal quality gates are layered:
pre-commit: formats staged files and lints staged TypeScript onlypre-push: runspnpm run check:pushtask hooks: runs tracked pnpm hooks plus.pre-commit-config.yamlhooks whenpre-commitis installedmanual/full parity:
task ciorpnpm run check
CI/CD Ownership
The personal repository https://github.com/oaslananka/mcp-ssh-tool is the source repository. The organization repository https://github.com/oaslananka-lab/mcp-ssh-tool is the GitHub Actions, CI/CD, release, security, and provenance boundary.
Automatic CI/CD, supply-chain security checks, trusted npm publishing, MCP Registry publishing, GitHub Releases, Docker image validation, SBOMs, attestations, and release decisions run only from the org repository. Personal-repo Actions are intentionally not required gates.
The two repositories must stay content-identical for main, release tags, releases, labels, milestones, and active collaboration state. Org release-generated refs are backfilled to the personal source repository.
The npm package repository.url intentionally points at the org automation repository so npm provenance can verify that the published artifact came from the same GitHub Actions repository that built it. The MCP Registry server name remains io.github.oaslananka/mcp-ssh-tool because it is already published and changing it would break existing users.
See docs/ci-cd-topology.md for mirror, release, dry-run, and manual fallback guidance.
Documentation
License
MIT License. See LICENSE.
Available Tools
33 toolsconnector_statusConnector StatusARead-onlyIdempotent
Use this when ChatGPT or Claude needs to understand the remote connector profile, authentication mode, and credential broker readiness without exposing secrets.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Description adds value beyond annotations by clarifying the tool does not expose secrets and listing specific data fields (profile, auth mode, credential broker readiness), though annotations already cover read-only and idempotent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single, front-loaded sentence with no wasted words efficiently communicates purpose and usage context.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given zero parameters, existing output schema, and no complex behaviors, the description sufficiently covers what the tool does and its key characteristics.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist, so schema coverage is trivially 100%. Baseline 4 is appropriate; description need not add parameter info.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description specifies the tool retrieves 'remote connector profile, authentication mode, and credential broker readiness' without exposing secrets, distinguishing it from action-oriented siblings like ssh commands or file operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description states 'Use this when... understanding the remote connector profile...' providing clear context, but does not explicitly contrast with alternatives like ssh_host_inspect or ssh_ping.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ensure_lines_in_fileEnsure Lines In FileADestructiveIdempotent
Ensures specific lines are present or absent in a file
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | SSH session ID | |
| path | Yes | File path | |
| lines | Yes | Lines to manage | |
| state | No | Desired state | |
| createIfMissing | No | Create file if it does not exist |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and idempotentHint=true. The description adds that it manages line presence/absence but does not elaborate on side effects, creation behavior, or required permissions. Most behavioral context is covered by annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Extremely concise single sentence with no wasted words. Front-loaded with purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the rich annotations and complete schema, the description is adequate. However, for a destructive tool, adding a note about backup or rollback would improve completeness. Output schema exists but is not visible.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema has 100% description coverage, so the schema already explains each parameter. The description does not add extra semantic meaning beyond what is in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool ensures specific lines are present or absent in a file, using a specific verb and resource. It distinguishes itself from sibling tools like fs_write (which writes full content) by focusing on line-level idempotent management.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives (e.g., fs_write, grep, sed). No mention of prerequisites like requiring an open SSH session, nor when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ensure_packageEnsure Package StateCDestructiveIdempotent
Ensures a package is installed or removed
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | SSH session ID | |
| name | Yes | Package name | |
| state | No | Desired state |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and idempotentHint=true, so the description does not add new behavioral context. It fails to mention that the tool modifies system state, which is implied but not explicit.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence with no superfluous words. It is front-loaded with the core action. However, it could be slightly expanded to include context like package manager without sacrificing conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (3 parameters, with output schema existing), the description is minimally adequate. It does not explain idempotency or edge cases (e.g., package not found), but the annotations and schema fill some gaps. A more complete description would mention the package manager or dependency handling.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema provides full descriptions (100% coverage) for all three parameters. The description adds no additional meaning beyond the schema; it merely restates 'installed or removed', which is already covered by the 'state' enum. Baseline score of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool manages package state (installed or removed), distinguishing it from sibling tools like ensure_lines_in_file and ensure_service. However, it lacks specificity about the package manager or platform, which could be ambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided about when to use this tool versus alternatives. The description does not mention prerequisites, such as requiring root privileges or a specific package manager, nor does it exclude contexts like unsupported distros.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ensure_serviceEnsure Service StateBDestructiveIdempotent
Ensures a service is in the desired state
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | SSH session ID | |
| name | Yes | Service name | |
| state | Yes | Desired state |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description is consistent with annotations (destructiveHint=true, idempotentHint=true), but adds no additional behavioral context beyond the annotations. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that front-loads the purpose. It is appropriately concise for a simple tool, though slightly generic.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the low complexity and rich annotations, the description is minimally adequate. It lacks details about authentication, permissions, or side effects, but the annotations fill some gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% coverage, so the description does not need to add parameter details. It adds no extra semantics beyond the schema, meeting the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: managing service state. It uses a specific verb ('ensures') and resource ('service'). While it distinguishes from sibling tools like ensure_package, it could be more precise about using SSH.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. It does not mention prerequisites like needing an active SSH session, nor does it exclude cases where it might not be appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
file_downloadDownload FileARead-only
Downloads a remote file to the local machine over SFTP
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | SSH session ID | |
| remotePath | Yes | Remote file path | |
| localPath | Yes | Local file path |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is clear. The description adds that the download uses SFTP, but does not elaborate on behavior like overwriting or error handling. It meets the baseline with minor additional context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, efficient sentence with no unnecessary words. Every word adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple, and the output schema exists but is not detailed. The description lacks mention of prerequisites (e.g., active SSH session) or return values, but for a straightforward download it is minimally adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema has 100% description coverage, so baseline is 3. The description does not add any additional meaning or constraints beyond the schema properties (sessionId, remotePath, localPath).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool downloads a remote file to the local machine over SFTP, providing a specific verb and resource. It distinguishes itself from sibling tools like 'file_upload' and other file operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool vs alternatives, nor any prerequisites or exclusions. Sibling tools like 'file_upload' or 'fs_read' exist but no differentiation is given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
file_uploadUpload FileBDestructive
Uploads a local file to the remote host over SFTP
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | SSH session ID | |
| localPath | Yes | Local file path | |
| remotePath | Yes | Remote file path |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and readOnlyHint=false. The description adds that it uses SFTP, providing some additional behavioral context beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence with no wasted words, clearly conveys the core action. Could potentially be more structured but is efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Description is adequate for a tool with complete annotations and output schema. It explains the purpose and protocol, but could mention requirements like active session or overwrite behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with descriptions for all three parameters. The description adds no further meaning beyond the schema, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the verb 'Uploads' and the resource 'local file to the remote host over SFTP', which is specific and distinguishes from siblings like file_download and fs_write.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives, no prerequisites or exclusions mentioned. The description only states what it does.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fs_listList Remote DirectoryCRead-onlyIdempotent
Lists directory contents
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | SSH session ID | |
| path | Yes | Directory path to list | |
| page | No | Page number for pagination | |
| limit | No | Maximum items per page (default: 100) |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide readOnlyHint, destructiveHint, idempotentHint, and openWorldHint. The description adds no behavioral details beyond the obvious. It does not mention pagination or the need for a session ID.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
At three words, it is extremely concise but not wasteful. However, it sacrifices informativeness for brevity. A slightly longer description would improve structure.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the presence of an output schema and well-documented input schema, the description is too minimal. It omits any mention of pagination, session requirements, or what the output contains.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage, so the baseline is 3. The description adds no extra meaning; it does not elaborate on parameters like pagination limits or the path format.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('lists') and the resource ('directory contents'). It is distinct from sibling tools like fs_read or fs_write. However, it could be more specific about the remote aspect, though the title already implies that.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool over others, or prerequisites like needing an active SSH session. The description is too terse to indicate context of use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fs_mkdirpCreate Remote DirectoriesAIdempotent
Creates directories recursively
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | SSH session ID | |
| path | Yes | Directory path to create |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare idempotentHint=true and destructiveHint=false, so the description's addition of 'recursively' adds valuable detail beyond annotations. However, it does not explain what happens if the path already exists or permissions required, which is partly covered by idempotency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Extremely concise (4 words) and front-loaded. Every word is meaningful with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the presence of an output schema and annotations covering idempotency, the description is fairly complete for a simple recursive directory creation tool. It covers the core functionality but could mention it resembles Unix mkdir -p.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with both parameters (sessionId, path) described. The description does not add any extra meaning beyond the schema, so baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Creates directories recursively' explicitly states the action (create) and resource (directories), with 'recursively' matching the mkdir -p behavior. It clearly distinguishes from sibling file tools like fs_write or fs_rmrf.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs alternatives. While it is the only directory creation tool among siblings, there is no mention of prerequisites, error conditions, or comparison to similar operations like using a shell command directly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fs_readRead Remote FileBRead-onlyIdempotent
Reads a file from the remote system
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | SSH session ID | |
| path | Yes | File path to read | |
| encoding | No | File encoding (default: utf8) | |
| maxBytes | No | Optional per-request read size limit in bytes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide readOnlyHint=true, destructiveHint=false, and idempotentHint=true. The description adds no extra behavioral details, such as error handling or behavior with maxBytes. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that front-loads the core purpose. It is appropriately brief for a simple read operation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the low complexity and presence of output schema and annotations, the description is adequate. However, it does not mention that an SSH session is required (implied but not explicit) or the optional parameters' purpose.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the description does not need to add parameter meaning. The description does not explain how parameters interact or constraints beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'reads a file from the remote system', which identifies the action and resource. It distinguishes from sibling tools like fs_write or fs_rmrf, but could be more specific about relying on SSH sessions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like file_download or fs_list. The description does not mention exclusions or preferred contexts.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fs_renameRename Remote PathBDestructive
Renames or moves a file/directory
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | SSH session ID | |
| from | Yes | Source path | |
| to | Yes | Destination path |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate destructiveHint=true and readOnlyHint=false. Description adds that it performs rename/move, but does not disclose details like session dependency or behavior on existing destination.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence is concise, but could be restructured to front-load key details while remaining brief. Slightly under-informative.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool has 3 required parameters, destructive hint, and an output schema, yet description omits return values and side effects. Minimal extra context beyond annotations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema covers all three parameters with descriptions, so description adds no new meaning. Baseline 3 due to high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description uses specific verbs 'renames' or 'moves' and resource 'file/directory', clearly distinguishing it from sibling tools like fs_list or fs_rmrf.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives such as fs_mkdirp or fs_rmrf; lacks explicit use cases or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fs_rmrfRemove Remote Path RecursivelyADestructive
Removes files or directories recursively
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | SSH session ID | |
| path | Yes | Path to remove |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Description adds 'recursively' beyond annotations, but no details on irreversibility, permission requirements, or error handling. Annotations already signal destructive hint, so minimal added value.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, zero waste. Front-loaded with core action.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Output schema exists (not shown), but missing important cautions for a destructive tool (e.g., no undo, path format). Basic but adequate for a simple operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema covers both parameters with descriptions. Description adds no extra meaning beyond what schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states 'removes files or directories recursively' – specific verb and resource, and distinguishes from siblings like fs_read, fs_write, fs_list.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use vs alternatives (e.g., fs_rename for moving, fs_list for non-destructive operations). Lacks context about prerequisites or dangers.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fs_statStat Remote PathARead-onlyIdempotent
Gets file or directory statistics
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | SSH session ID | |
| path | Yes | Path to stat |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false, idempotentHint=true, and openWorldHint=true. The description adds 'statistics' but does not elaborate on what specific metadata is returned, which the output schema likely covers.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Extremely concise single sentence with no wasted words. Every element is necessary.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a stat tool, the description is adequate given that the output schema exists to explain return values. It could mention common statistics (size, permissions), but omissions are minor.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with clear descriptions for both parameters ('SSH session ID', 'Path to stat'). The description does not add additional meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Gets' and resource 'file or directory statistics', which distinguishes it from siblings like `fs_list` or `fs_read`.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs alternatives like `fs_list` or `fs_read`. The description does not provide context for appropriate usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fs_writeWrite Remote FileBDestructive
Writes data to a file on the remote system
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | SSH session ID | |
| path | Yes | File path to write | |
| data | Yes | Data to write to file | |
| mode | No | File permissions mode |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate destructiveHint=true and readOnlyHint=false. The description adds 'writes data to a file' but does not clarify whether it overwrites or appends, or specify permissions behavior beyond schema. Non-contradictory but relies on annotations for destructive nature.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence with no wasted words. Could be improved by front-loading key information, but it is efficiently communicated.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
While annotations and schema provide basic context, the description does not mention overwrite behavior, error handling, or return values. Output schema exists but is not visible; the description could clarify what is returned on success/failure.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 100% coverage with descriptions for all parameters (sessionId, path, data, mode). The description does not add any additional semantic meaning beyond what the schema already provides, meeting the baseline for high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it writes data to a file on the remote system, using specific verb 'writes' and resource. It distinguishes from sibling tools like fs_read (read), fs_rename (rename), and fs_rmrf (remove).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs alternatives like ensure_lines_in_file, which might also modify files. No when-not or alternative tool recommendations are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_metricsGet Runtime MetricsARead-onlyIdempotent
Returns server metrics including session counts, command statistics, and uptime
| Name | Required | Description | Default |
|---|---|---|---|
| format | No | Output format (default: json) |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate read-only, non-destructive, idempotent. Description adds specific metric examples, enhancing behavioral context without contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, front-loaded with verb 'Returns', concise and efficient with no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Description covers the main purpose and output content. Output schema exists, so return values need not be detailed. Could mention format output options, but schema covers it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with one well-defined parameter ('format' with enums). Description doesn't mention the parameter, but schema fully covers it, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool returns server metrics with examples (session counts, command statistics, uptime). It distinguishes from sibling tools, which are mostly file/SSH/tunnel operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when to use (retrieve runtime metrics). No explicit when-not or alternatives, but siblings are unrelated, so no confusion.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
os_detectDetect Remote OSARead-onlyIdempotent
Detects operating system and environment information
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | SSH session ID |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false, idempotentHint=true, and openWorldHint=true, covering safety and idempotence. The description adds minimal behavioral context beyond the purpose; it does not contradict annotations but also does not enrich them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, clear sentence that efficiently conveys the tool's function. It is front-loaded and contains no extraneous words, though it could include slightly more detail without becoming verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the existence of an output schema and simple input, the description suffices for basic understanding. However, 'environment information' is vague, and the tool could benefit from specifying what OS and environment details are returned (e.g., kernel version, distro). The description is adequate but not rich.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The only parameter 'sessionId' has a schema description matching the tool's purpose. With 100% schema description coverage, the description adds no new semantic meaning beyond what the schema provides, meeting the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The tool name 'os_detect' and title 'Detect Remote OS' clearly indicate the purpose. The description 'Detects operating system and environment information' directly states the action and result, distinguishing it from sibling tools that handle file operations, process execution, or SSH session management.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives a general statement of what the tool does but lacks explicit guidance on when to use it versus alternatives. Context implies using after establishing an SSH session, but no prerequisites or exclusions are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
patch_applyApply PatchBDestructive
Applies a patch to a file
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | SSH session ID | |
| path | Yes | File path to patch | |
| diff | Yes | Patch content (unified diff format) |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide destructiveHint=true and readOnlyHint=false. The description adds no further behavioral details such as whether the patch is applied in-place, if rollback is possible, or what happens on failure. It does not contradict annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single short sentence, which is concise and front-loaded. However, for a destructive tool, it may be too terse; a bit more context would be beneficial without being wasteful.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's destructive nature and 3 required parameters, the description is too minimal. It does not mention the remote SSH context, file prerequisites, or output schema details. Siblings provide richer context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema has 100% description coverage, so the description does not need to add parameter meanings. However, it does not provide additional context like expected format of 'diff' or constraints on 'path'. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Applies a patch to a file' clearly states a specific verb and resource, and it distinguishes this tool from siblings like fs_write or ensure_lines_in_file which have different purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives (e.g., fs_write vs patch_apply), no mention of prerequisites like session or file existence, and no conditions for successful application.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
proc_execExecute Remote CommandA
Executes a non-interactive command on the remote system after policy and safety checks
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | SSH session ID | |
| command | Yes | Command to execute | |
| cwd | No | Working directory | |
| env | No | Environment variables | |
| timeoutMs | No | Command execution timeout in milliseconds |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate readOnlyHint=false and destructiveHint=false, but description adds 'after policy and safety checks'. Does not explain potential side effects or error handling beyond policy checks.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence with clear action and context. No filler or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Output schema exists, so return values are documented. Description covers core behavior but lacks information on failure modes (e.g., timeout, policy rejection) and timeoutMs parameter behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema covers all 5 parameters with descriptions. Description adds 'non-interactive' and 'safety checks' but no additional parameter-specific context beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states it executes a non-interactive command on a remote system with policy and safety checks. Distinguishes from siblings like proc_exec_stream and proc_sudo.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives. Implies execution after checks but does not mention scenarios like needing interactive commands (use proc_exec_stream) or sudo (use proc_sudo).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
proc_exec_streamExecute Streaming CommandA
Executes a command and returns streaming output chunks
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | SSH session ID | |
| command | Yes | Command to execute | |
| cwd | No | Working directory | |
| env | No | Environment variables | |
| timeoutMs | No | Streaming command timeout in milliseconds |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Describes streaming output, but does not disclose side effects, permissions, or that it requires an active SSH session. Annotations provide readOnlyHint and destructiveHint, reducing burden, but description adds little beyond the name.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single clear sentence, no wasted words. Perfectly concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Description is minimal; lacks context about prerequisites (e.g., active SSH session from ssh_open_session), behavior on timeout, or output format. Output schema exists but description could elaborate on streaming semantics.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so parameter details are fully in the schema. Description adds no extra meaning or context to parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states it executes a command and returns streaming output chunks. Distinguishes from sibling proc_exec by specifying streaming nature.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit when-to-use or alternatives. The term 'streaming' implies use for long-running commands, but no mention of when not to use or comparison with proc_exec.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
proc_sudoExecute Sudo CommandADestructive
Executes a command with sudo privileges only when allowRawSudo policy permits it
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | SSH session ID | |
| command | Yes | Command to execute with sudo | |
| cwd | No | Working directory | |
| timeoutMs | No | Command execution timeout in milliseconds |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds the policy constraint beyond the annotations (destructiveHint true). It does not elaborate on specific behaviors like return values or potential side effects, but the output schema exists and annotations cover the destructive nature, so the description is adequate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that front-loads the action and key constraint, with no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive tool with 4 parameters and an output schema, the description covers the essential policy constraint but could be more complete with additional safety considerations or typical usage scenarios.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% coverage for parameter descriptions, so the description does not add additional meaning beyond what the schema already provides, yielding a baseline score of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (execute command with sudo) and the resource (command with sudo privileges), and it distinguishes from sibling tools like proc_exec (without sudo) by mentioning the policy constraint.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context by noting the policy requirement 'only when allowRawSudo policy permits it', implying when the tool should be used. However, it does not explicitly state when not to use or compare to alternatives like proc_exec_stream.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_close_sessionClose SSH SessionBIdempotent
Closes an SSH session
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | Session ID to close |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds no behavioral details beyond the action itself. Annotations indicate idempotent and non-destructive, but the description doesn't comment on side effects (e.g., terminating commands) or error handling. It fails to disclose traits not already in annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no wasted words, directly stating the tool's purpose. It is front-loaded and efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity of the tool (one required parameter) and presence of an output schema, the description is minimal. It lacks context on what happens upon successful close, error cases, or interaction with other SSH tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with 'sessionId' already described as 'Session ID to close'. The tool description adds no additional meaning, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb (Closes) and resource (an SSH session), directly matching the tool name and distinguishing it from sibling tools like ssh_open_session.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool, prerequisites (e.g., session must be open), or alternatives. It merely states the action without contextual advice.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_host_inspectInspect SSH HostARead-only
Use this when ChatGPT or Claude needs read-only host inspection through the server-side credential broker. The user supplies only a configured host alias and selected checks; no secret material or login details are accepted.
| Name | Required | Description | Default |
|---|---|---|---|
| hostAlias | Yes | Configured SSH host alias | |
| checks | No | Read-only checks to run |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false. The description adds useful context: it uses a server-side credential broker and does not accept secret material, enhancing safety transparency beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences: first states usage context, second adds security constraint. No filler, front-loaded, every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has an output schema and simple parameters, the description adequately covers purpose, usage, and constraints. It does not explain checks in detail but the schema covers that.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with descriptions for both parameters. The description adds 'selected checks' but does not elaborate beyond the schema's enum list, so the value added is marginal.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool is for read-only host inspection via a server-side credential broker, specifying the verb 'inspect' and resource 'SSH host'. It distinguishes from sibling tools like ssh_open_session or ssh_mutation_plan by emphasizing read-only access.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description indicates when to use (for read-only inspection) and provides a constraint (no secret material accepted). However, it does not explicitly mention when not to use or compare with alternatives like ssh_ping or ssh_resolve_host.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_hosts_listList Safe SSH Host AliasesARead-onlyIdempotent
Use this when ChatGPT or Claude needs a safe list of SSH host aliases that may be inspected through the remote connector. Sensitive login material is omitted.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint, destructiveHint, idempotentHint. The description adds that sensitive login material is omitted, providing additional behavioral context about the output's safety.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with usage guidance, no redundant information. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with zero parameters and an output schema, the description fully covers purpose, usage, and behavioral aspects. No gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist, so schema coverage is 100%. The description adds meaning by explaining the output is a safe list for SSH aliases inspected via the remote connector, which is adequate for zero-parameter tools.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The title and description clearly state the tool lists SSH host aliases, with the verb 'list'. It distinguishes from siblings like ssh_list_configured_hosts by emphasizing safety (sensitive material omitted) but does not explicitly name alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says 'Use this when...a safe list' is needed, providing clear context. It implies alternatives exist for full configurations but does not explicitly state when not to use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_list_configured_hostsList Configured HostsARead-onlyIdempotent
Lists all hosts configured in ~/.ssh/config
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false, idempotentHint=true. The description adds that it reads from ~/.ssh/config, which is minimal additional behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, no extraneous words, front-loaded with key information. Highly concise and structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameterless tool with an output schema, the description sufficiently covers its purpose and data source. Complete for its simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist, so schema coverage is 100% and the description adds no param info. Baseline 4 is appropriate for a zero-parameter tool.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Lists' and the resource 'all hosts configured in ~/.ssh/config', providing a specific source and distinguishing it from sibling tools that may list hosts from other sources.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool vs. siblings like ssh_hosts_list. The description implies usage for configured hosts, but lacks explicit context for agent decision-making.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_list_sessionsList SSH SessionsARead-onlyIdempotent
Lists all active SSH sessions with their details
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=true, destructiveHint=false, and idempotentHint=true. The description does not add new behavioral details beyond stating the tool lists sessions, which is consistent with the annotations. No extra context about details or side effects is provided.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is concise and front-loaded. Every word is useful, with no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has no parameters and an existing output schema (not shown). The description adequately states its purpose, but could hint at what 'details' means. However, with the output schema, the description is sufficiently complete for a simple list tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has no parameters, so schema description coverage is technically 100%. The description does not need to add parameter info; the baseline for no parameters is 4, and the description meets that.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool 'Lists all active SSH sessions with their details,' using a specific verb and resource. It distinguishes itself from sibling tools like ssh_list_configured_hosts, which lists configured hosts, not active sessions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
While the description implies when to use the tool (to view active sessions), it does not explicitly state when not to use it or name alternatives. The context from sibling tools provides some differentiation, but no direct guidance is given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_mutation_planPlan SSH MutationARead-onlyIdempotent
Use this when ChatGPT or Claude needs a non-executing plan for a remote SSH change. It never runs commands, writes files, uploads data, starts tunnels, or escalates privileges.
| Name | Required | Description | Default |
|---|---|---|---|
| hostAlias | Yes | Configured SSH host alias | |
| goal | Yes | Desired change to plan without executing | |
| category | No | Change category used for policy explanation |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark readOnlyHint=true, but the description adds specific prohibited actions (runs commands, writes files, uploads data, starts tunnels, escalates privileges), providing valuable context beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences that are each highly informative and free of redundancy, front-loading the action and usage context.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers purpose, usage, and behavioral limitations. Output schema exists (context signals show true), so return value details are unnecessary.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline applies. The description does not add parameter-specific information, which is acceptable.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the clear verb 'plan' with the resource 'SSH mutation' and explicitly states it never executes, distinguishing it from all sibling execution tools like ensure_package, file_upload, etc.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says 'Use this when ... needs a non-executing plan' and implicitly contrasts with execution by listing what it never does, but does not name specific sibling alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_open_sessionOpen SSH SessionB
Opens a new SSH session with authentication
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | SSH server hostname or IP | |
| username | Yes | SSH username | |
| port | No | SSH port (default: 22) | |
| auth | No | Authentication method (default: auto) | |
| password | No | Password for authentication | |
| privateKey | No | Inline private key content | |
| privateKeyPath | No | Path to private key file | |
| passphrase | No | Passphrase for encrypted private key | |
| useAgent | No | Use SSH agent for authentication | |
| readyTimeoutMs | No | Connection timeout in milliseconds (default: 20000) | |
| ttlMs | No | Session TTL in milliseconds (default: 900000) | |
| strictHostKeyChecking | No | Deprecated alias. Prefer hostKeyPolicy. | |
| hostKeyPolicy | No | SSH host key verification policy (default: strict) | |
| knownHostsPath | No | Path to known_hosts file | |
| expectedHostKeySha256 | No | Pinned SHA-256 host key fingerprint, with or without SHA256: prefix | |
| policyMode | No | Use explain to return the planned connection without opening SSH |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate non-readOnly and non-destructive. The description adds 'with authentication,' but does not disclose behavioral traits like connection timeout implications, session lifetime, or that the session must be explicitly closed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence with no waste. However, it could be slightly more structured to include key behavioral hints without losing brevity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having an output schema, the description omits important context like session management (e.g., returned session ID for use with other tools), and does not address the complexity arising from 16 parameters.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline is 3. The description adds no additional parameter meaning; it is a single sentence without details beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states 'Opens a new SSH session,' with a clear verb and resource. It distinguishes itself from sibling tools like ssh_close_session and ssh_list_sessions by focusing on opening a session.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives (e.g., ssh_mutation_plan for dry runs). No prerequisites or exclusions mentioned, leaving the agent to infer usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_pingPing SSH SessionARead-onlyIdempotent
Checks if an SSH session is still alive and responsive
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | SSH session ID to check |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false, idempotentHint=true, and openWorldHint=true. The description adds no new behavioral context (e.g., timeout behavior, response format, or side effects). With full annotation coverage, the description contributes minimal extra value.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that is front-loaded, clear, and contains no superfluous information. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an existing output schema and annotations, the description is reasonably complete for a simple check tool. It lacks mention of potential errors or return format, but these are likely covered by the output schema. Still, adding a note about session ID validity could improve completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% with sessionId described as 'SSH session ID to check'. The description does not add further details (e.g., format, validation). Baseline 3 is appropriate given high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'checks' and the resource 'SSH session', and is specific to checking aliveness/responsiveness. This distinguishes it from sibling tools like ssh_open_session, ssh_close_session, and ssh_list_sessions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is for checking liveliness but does not provide explicit guidance on when to use it over alternatives (e.g., ssh_host_inspect) or when not to use it. No prerequisites or exclusions are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_policy_explainExplain SSH PolicyARead-onlyIdempotent
Use this when ChatGPT or Claude needs to explain whether a requested SSH inspection or mutation would be allowed. This is explain-only and does not execute commands or open tunnels.
| Name | Required | Description | Default |
|---|---|---|---|
| hostAlias | No | Configured SSH host alias | |
| action | No | Requested action class to evaluate without executing it | |
| command | No | Optional command to evaluate in explain mode | |
| path | No | Optional remote path to evaluate in explain mode |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide readOnlyHint=true, destructiveHint=false, idempotentHint=true. The description adds 'explain-only and does not execute commands or open tunnels', reinforcing and adding context beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with use case, no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool is for explanation (simple) and has an output schema, the description adequately covers its purpose and behavior without needing to detail output.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Parameter schema coverage is 100%, so baseline is 3. The description does not add significant detail about specific parameters beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'explain' and resource 'policy allowability' and distinguishes it from sibling tools that execute commands or open tunnels.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly specifies when to use ('when needs to explain whether... would be allowed') and what not to do ('does not execute commands or open tunnels'), implying alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_resolve_hostResolve SSH HostARead-onlyIdempotent
Resolves a host alias from ~/.ssh/config to connection parameters
| Name | Required | Description | Default |
|---|---|---|---|
| hostAlias | Yes | Host alias from SSH config |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false, and idempotentHint=true. The description adds context that it reads from ~/.ssh/config, which is consistent and slightly enriches the behavioral model. No contradictions or missing critical behaviors.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence of 10 words with no superfluous information. It is front-loaded with the action and resource, making it easy for an agent to quickly understand the tool's core function.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the existence of an output schema (not shown here), the description does not need to detail return values. It fully covers the tool's purpose and input requirements, and the annotations cover safety. No gaps are apparent for this simple resolver operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with a clear description for the single parameter 'hostAlias'. The tool description does not add extra meaning beyond the schema, but baseline is adequate since schema handles semantics well.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('resolves') and clearly identifies the resource ('host alias from ~/.ssh/config') and output ('connection parameters'). It distinguishes itself from sibling tools like ssh_hosts_inspect or ssh_list_configured_hosts by focusing on resolution of a single alias.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives (e.g., ssh_host_inspect, ssh_list_configured_hosts). It does not mention prerequisites, typical use cases, or exclusions. An agent would have to infer context from the name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tunnel_closeClose SSH TunnelBIdempotent
Closes an active tunnel
| Name | Required | Description | Default |
|---|---|---|---|
| tunnelId | Yes | Tunnel identifier |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate non-read-only, non-destructive, idempotent, and open-world hints. The description adds 'closes' which is consistent with mutation, but doesn't disclose additional behavioral traits beyond what annotations provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single four-word sentence with no redundant information. It is appropriately sized for the tool's simplicity, though slightly too minimal.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one required parameter, no nested objects, and an existing output schema), the description is sufficient for an agent to invoke it correctly. However, it could mention that the tunnelId comes from tunnel_list.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage for the single parameter 'tunnelId'. The description does not add any extra meaning or context beyond 'Tunnel identifier', so it provides no added value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Closes an active tunnel' uses a specific verb and resource, clearly indicating the tool's purpose. It distinguishes from sibling tools like 'tunnel_list' and 'tunnel_local_forward', but doesn't explicitly differentiate from 'ssh_close_session'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. Sibling tools like 'ssh_close_session' close SSH sessions, not tunnels, but the description doesn't clarify this distinction or mention prerequisites like needing a valid tunnel ID.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tunnel_listList SSH TunnelsARead-onlyIdempotent
Lists active tunnels, optionally filtered by session
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | No | Optional SSH session ID filter |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, so the description adds no extra behavioral context (e.g., pagination, performance). It's adequate but doesn't enrich beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence with no extraneous words; every part is necessary.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only list tool with one optional param and an output schema, the description is sufficient. Could hint at output structure but not required.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% for the single parameter, description reiterates the filter capability but adds no new semantics beyond the schema's description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb-resource pair ('Lists active tunnels') and includes an optional filter, clearly distinguishing it from sibling tools like tunnel_close or tunnel_local_forward.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives (e.g., ssh_list_sessions, tunnel_close). No explicit when-not-to or context for selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tunnel_local_forwardCreate Local SSH TunnelC
Creates a local SSH port forward
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | SSH session ID | |
| localPort | Yes | Local TCP port | |
| remoteHost | Yes | Remote host | |
| remotePort | Yes | Remote TCP port |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate readOnlyHint=false, consistent with mutation, but the description adds no behavioral details beyond the schema. Missing info on port conflicts, permissions, or binding behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single efficient sentence, but it is somewhat terse. It earns a 4 for being concise yet functional.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With only 4 required parameters and an output schema (present but not shown), the description is minimally adequate. However, it lacks behavioral context and success indicators, limiting completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, providing clear parameter descriptions. The tool description adds no additional meaning or examples, earning a baseline score of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Creates a local SSH port forward' clearly states the verb 'Creates' and the resource 'local SSH port forward', distinguishing it from siblings like 'tunnel_remote_forward'. However, it is minimal and could be more descriptive.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs. alternatives like 'tunnel_remote_forward' or prerequisites such as having an open SSH session (via 'ssh_open_session'). The description lacks context for appropriate use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tunnel_remote_forwardCreate Remote SSH TunnelC
Creates a remote SSH port forward
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | SSH session ID | |
| remotePort | Yes | Remote TCP port | |
| localHost | Yes | Local host | |
| localPort | Yes | Local TCP port |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotation indicates readOnlyHint=false, which aligns with creating a tunnel, but the description adds no behavioral details beyond that. It does not disclose potential side effects (e.g., port binding, required permissions, impact on existing tunnels). The description does not complement the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is one short sentence, concise and to the point. It avoids unnecessary words. No structural issues, though it could be slightly expanded with usage context without becoming verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having an output schema, the description lacks important context: it does not mention the need for an already established SSH session, potential conflicts with existing port forwards, or what happens on failure. For a non-idempotent, state-changing tool, this is insufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema has 100% description coverage, so each parameter is already documented in the schema. The description does not add any additional meaning or context, but since schema coverage is high, a baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action: creates a remote SSH port forward. The verb 'creates' and resource 'remote SSH port forward' are specific. It is distinguishable from sibling tools like tunnel_local_forward due to the word 'remote', though no explicit comparison is made.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs alternatives (e.g., tunnel_local_forward). No mention of prerequisites like an active SSH session, which is implicitly required by the sessionId parameter. No when-not-to-use or exclusion criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
TDQS
Each tool targets a distinct operation or resource type (file, command, session, tunnel, package, service, inspection). There is no significant overlap; even similar tools like proc_exec and proc_exec_stream are differentiated by execution mode.
Tools are grouped by domain (fs_, proc_, tunnel_, ssh_, ensure_) with consistent patterns within groups. However, the overall naming convention mixes prefixes (fs_list vs file_download) and some tools use long phrasal names (ensure_lines_in_file).
At 33 tools, the server is heavily featured. While most tools serve a clear purpose, the count is above the typical sweet spot and includes several niche utilities (get_metrics, os_detect, ssh_mutation_plan) that could be consolidated.
The tool surface covers the full lifecycle of SSH interactions: session management, file operations, command execution, package/service management, tunneling, and safety/planning. No obvious gaps exist for a generic SSH administration server.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Remote MCP server for supportsheep: run AI interviews and manage support content for your blog.
Personal assistant MCP server with search, execute, packages, jobs, secrets, and integrations.
Hosted MCP server connecting claude.ai, ChatGPT and other AI apps to your own computer
Nifty's MCP server — exposes tasks, projects, messages, and files as tools for AI agents.
Appeared in Searches
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/oaslananka/mcp-ssh-tool'
If you have feedback or need assistance with the MCP directory API, please join our Discord server