mcp-ssh-tool
mcp-ssh-tool
面向运维人员、开发人员和 AI 客户端的生产级 MCP SSH 自动化工具。mcp-ssh-tool 可开启持久化 SSH 会话,并提供安全、结构化的工具,用于命令执行、文件操作、传输、隧道、软件包/服务管理、指标监控、资源访问及引导式提示。
v2 版本默认安全:开启严格的主机密钥验证,禁用 root 登录,原始 sudo 受策略限制,除非策略允许,否则拒绝破坏性命令和文件系统变更;远程 HTTP 仅在回环地址上启动,除非配置了 bearer 令牌和允许的来源。
为什么选择此服务器
信任: 中心化策略引擎、结构化审计事件、脱敏日志、严格的主机密钥以及机器可读的错误信息。
MCP 质量: 本地客户端使用 stdio,远程客户端使用可流式传输的 HTTP,仅在显式兼容性标志下支持旧版 SSE。
AI 友好工具: 稳定的输出模式、
structuredContent、针对只读/破坏性/幂等行为的注解、资源以及精选提示词。运维: 会话 TTL/驱逐、命令超时、传输校验和验证、真实的 SSH 转发、Prometheus 指标以及 OpenTelemetry 钩子。
可移植性: 优先使用 SFTP,针对基本文件操作提供 POSIX/BusyBox 感知 shell 后备方案,并明确支持边界。
快速开始
无需安装直接运行:
npx -y mcp-ssh-tool --version或全局安装:
npm install -g mcp-ssh-tool将 stdio MCP 服务器添加到您的客户端:
{
"servers": {
"ssh-mcp": {
"type": "stdio",
"command": "mcp-ssh-tool",
"args": []
}
}
}在您的 MCP 客户端中使用它:
Open a safe SSH session to prod-1 as deploy, inspect host capabilities, then show disk usage.要求
Node.js
22.22.2+或24.14.1+(仅限 LTS 版本)对目标主机的 SSH 访问权限
包含已填充的
known_hosts文件以进行严格的主机验证,或显式的每会话主机密钥策略
传输方式
模式 | 命令 | 使用场景 |
stdio |
| 本地桌面客户端,如 ChatGPT、Claude Desktop、VS Code、Cursor 或 Codex。 |
Streamable HTTP |
| 远程 MCP 客户端、反向代理或 Inspector 会话。 |
legacy SSE |
| 仅用于临时 v1 兼容性。建议优先使用 Streamable HTTP。 |
除非同时配置了 --bearer-token-file 和允许的来源,否则拒绝非回环地址的 HTTP 启动。
安全默认设置
领域 | v2 默认值 |
主机密钥 |
|
Root SSH 登录 | 拒绝 |
原始 | 拒绝,除非 |
破坏性命令 | 拒绝,除非 |
破坏性文件系统操作 | 仅在策略前缀下允许,其他位置拒绝 |
HTTP 绑定 |
|
旧版 SSE | 禁用 |
文件读取 | 受 |
每会话的 policyMode: "explain" 会返回计划/判定而不执行。当 AI 客户端需要总结风险时,请在变更前使用此模式。
策略示例
设置 SSH_MCP_POLICY_FILE=/etc/mcp-ssh-tool/policy.json:
{
"mode": "enforce",
"allowRootLogin": false,
"allowRawSudo": false,
"allowDestructiveCommands": false,
"allowDestructiveFs": false,
"allowedHosts": ["^prod-[0-9]+\\.example\\.com$"],
"commandAllow": ["^(uname|df|uptime|systemctl status)\\b"],
"commandDeny": ["rm\\s+-rf\\s+/", "shutdown", "reboot"],
"pathAllowPrefixes": ["/tmp", "/var/tmp", "/home/deploy"],
"pathDenyPrefixes": ["/etc/shadow", "/etc/sudoers", "/boot", "/dev", "/proc"]
}简单的部署可以使用环境变量覆盖,例如 SSH_MCP_ALLOW_RAW_SUDO=true、SSH_MCP_ALLOWED_HOSTS=prod-1.example.com 或 SSH_MCP_PATH_ALLOW_PREFIXES=/tmp,/home/deploy。
核心工具
ssh_open_session,ssh_close_session,ssh_list_sessions,ssh_ping,ssh_list_configured_hosts,ssh_resolve_hostproc_exec,proc_sudo,proc_exec_streamfs_read,fs_write,fs_list,fs_stat,fs_mkdirp,fs_rmrf,fs_renamefile_upload,file_downloadensure_package,ensure_service,ensure_lines_in_file,patch_applyos_detect,get_metricstunnel_local_forward,tunnel_remote_forward,tunnel_list,tunnel_close
所有工具均返回文本及稳定的 structuredContent。工具元数据包含标题、输出模式以及披露只读、破坏性、幂等和外部副作用行为的注解。
资源与提示词
资源:
mcp-ssh-tool://sessions/activemcp-ssh-tool://metrics/jsonmcp-ssh-tool://metrics/prometheusmcp-ssh-tool://ssh-config/hostsmcp-ssh-tool://policy/effectivemcp-ssh-tool://audit/recentmcp-ssh-tool://capabilities/support-matrix
提示词:
safe-connectinspect-host-capabilitiesplan-mutationmanaged-config-change
支持矩阵
目标 | 状态 |
Linux | 完全支持。 |
macOS/BSD | 支持会话、进程、文件系统和传输;软件包/服务助手仅在已测试的环境中支持。 |
BusyBox/dropbear | 会话、进程和基本文件系统后备方案处于实验阶段。 |
Windows SSH 目标 | 会话、进程、文件系统和传输处于实验阶段;不支持 |
客户端示例
ChatGPT 或 Claude Desktop:
{
"mcpServers": {
"ssh-mcp": {
"command": "npx",
"args": ["-y", "mcp-ssh-tool"]
}
}
}VS Code 或 Cursor:
{
"servers": {
"ssh-mcp": {
"type": "stdio",
"command": "mcp-ssh-tool"
}
}
}通过 HTTP 使用 MCP Inspector:
printf '%s' 'super-secret-token' > .mcp-token
mcp-ssh-tool --transport=http --host 127.0.0.1 --port 3000 --bearer-token-file .mcp-token配置
高价值环境变量:
变量 | 默认值 | 用途 |
| 未设置 | 规范的 JSON 策略源。 |
|
|
|
|
| 用于严格验证的 known-hosts 文件。 |
|
|
|
|
| 默认命令超时时间。 |
|
| 可流式传输 HTTP 的绑定主机。 |
|
| 可流式传输 HTTP 的端口。 |
| 未设置 | 非回环地址 HTTP 必需。 |
| 回环来源 | 以逗号分隔的允许来源。 |
已弃用的别名 STRICT_HOST_KEY_CHECKING 和 SSH_MCP_STRICT_HOST_KEY 在 v2 兼容周期内仍被接受。建议优先使用 SSH_MCP_HOST_KEY_POLICY。
开发
使用 .nvmrc / .node-version 中的精确本地运行时,然后运行:
npm ci
npm run check实时 SSH 套件为可选:
RUN_SSH_INTEGRATION=1 npm run test:integration
RUN_SSH_E2E=1 npm run test:e2e本地质量门禁是分层的:
pre-commit:格式化暂存文件并仅对暂存的 TypeScript 进行 lint 检查pre-push:运行npm run check:pushtask hooks:在安装pre-commit时运行跟踪的 npm 钩子及.pre-commit-config.yaml钩子手动/完全对齐:
task ci或npm run check
CI/CD 所有权
个人仓库 https://github.com/oaslananka/mcp-ssh-tool 是规范的源仓库。自动 CI/CD、供应链安全检查、受信任的 npm 发布以及 MCP Registry 发布仅从 https://github.com/oaslananka-lab/mcp-ssh-tool 运行。组织仓库从规范源拉取;个人仓库的推送和发布工作流已禁用。
npm 包的 repository.url 特意指向组织仓库,以便 npm 来源验证可以确认发布的工件来自构建它的同一个 GitHub Actions 仓库。
参见 docs/ci-cd-topology.md 获取组织同步、发布流程和手动后备指南。
文档
许可证
MIT 许可证。参见 LICENSE。
Available Tools
33 toolsconnector_statusConnector StatusARead-onlyIdempotent
Use this when ChatGPT or Claude needs to understand the remote connector profile, authentication mode, and credential broker readiness without exposing secrets.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Description adds value beyond annotations by clarifying the tool does not expose secrets and listing specific data fields (profile, auth mode, credential broker readiness), though annotations already cover read-only and idempotent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single, front-loaded sentence with no wasted words efficiently communicates purpose and usage context.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given zero parameters, existing output schema, and no complex behaviors, the description sufficiently covers what the tool does and its key characteristics.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist, so schema coverage is trivially 100%. Baseline 4 is appropriate; description need not add parameter info.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description specifies the tool retrieves 'remote connector profile, authentication mode, and credential broker readiness' without exposing secrets, distinguishing it from action-oriented siblings like ssh commands or file operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description states 'Use this when... understanding the remote connector profile...' providing clear context, but does not explicitly contrast with alternatives like ssh_host_inspect or ssh_ping.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ensure_lines_in_fileEnsure Lines In FileADestructiveIdempotent
Ensures specific lines are present or absent in a file
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | SSH session ID | |
| path | Yes | File path | |
| lines | Yes | Lines to manage | |
| state | No | Desired state | |
| createIfMissing | No | Create file if it does not exist |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and idempotentHint=true. The description adds that it manages line presence/absence but does not elaborate on side effects, creation behavior, or required permissions. Most behavioral context is covered by annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Extremely concise single sentence with no wasted words. Front-loaded with purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the rich annotations and complete schema, the description is adequate. However, for a destructive tool, adding a note about backup or rollback would improve completeness. Output schema exists but is not visible.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema has 100% description coverage, so the schema already explains each parameter. The description does not add extra semantic meaning beyond what is in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool ensures specific lines are present or absent in a file, using a specific verb and resource. It distinguishes itself from sibling tools like fs_write (which writes full content) by focusing on line-level idempotent management.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives (e.g., fs_write, grep, sed). No mention of prerequisites like requiring an open SSH session, nor when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ensure_packageEnsure Package StateCDestructiveIdempotent
Ensures a package is installed or removed
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | SSH session ID | |
| name | Yes | Package name | |
| state | No | Desired state |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and idempotentHint=true, so the description does not add new behavioral context. It fails to mention that the tool modifies system state, which is implied but not explicit.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence with no superfluous words. It is front-loaded with the core action. However, it could be slightly expanded to include context like package manager without sacrificing conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (3 parameters, with output schema existing), the description is minimally adequate. It does not explain idempotency or edge cases (e.g., package not found), but the annotations and schema fill some gaps. A more complete description would mention the package manager or dependency handling.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema provides full descriptions (100% coverage) for all three parameters. The description adds no additional meaning beyond the schema; it merely restates 'installed or removed', which is already covered by the 'state' enum. Baseline score of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool manages package state (installed or removed), distinguishing it from sibling tools like ensure_lines_in_file and ensure_service. However, it lacks specificity about the package manager or platform, which could be ambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided about when to use this tool versus alternatives. The description does not mention prerequisites, such as requiring root privileges or a specific package manager, nor does it exclude contexts like unsupported distros.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ensure_serviceEnsure Service StateBDestructiveIdempotent
Ensures a service is in the desired state
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | SSH session ID | |
| name | Yes | Service name | |
| state | Yes | Desired state |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description is consistent with annotations (destructiveHint=true, idempotentHint=true), but adds no additional behavioral context beyond the annotations. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that front-loads the purpose. It is appropriately concise for a simple tool, though slightly generic.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the low complexity and rich annotations, the description is minimally adequate. It lacks details about authentication, permissions, or side effects, but the annotations fill some gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% coverage, so the description does not need to add parameter details. It adds no extra semantics beyond the schema, meeting the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: managing service state. It uses a specific verb ('ensures') and resource ('service'). While it distinguishes from sibling tools like ensure_package, it could be more precise about using SSH.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. It does not mention prerequisites like needing an active SSH session, nor does it exclude cases where it might not be appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
file_downloadDownload FileARead-only
Downloads a remote file to the local machine over SFTP
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | SSH session ID | |
| remotePath | Yes | Remote file path | |
| localPath | Yes | Local file path |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is clear. The description adds that the download uses SFTP, but does not elaborate on behavior like overwriting or error handling. It meets the baseline with minor additional context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, efficient sentence with no unnecessary words. Every word adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple, and the output schema exists but is not detailed. The description lacks mention of prerequisites (e.g., active SSH session) or return values, but for a straightforward download it is minimally adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema has 100% description coverage, so baseline is 3. The description does not add any additional meaning or constraints beyond the schema properties (sessionId, remotePath, localPath).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool downloads a remote file to the local machine over SFTP, providing a specific verb and resource. It distinguishes itself from sibling tools like 'file_upload' and other file operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool vs alternatives, nor any prerequisites or exclusions. Sibling tools like 'file_upload' or 'fs_read' exist but no differentiation is given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
file_uploadUpload FileBDestructive
Uploads a local file to the remote host over SFTP
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | SSH session ID | |
| localPath | Yes | Local file path | |
| remotePath | Yes | Remote file path |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and readOnlyHint=false. The description adds that it uses SFTP, providing some additional behavioral context beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence with no wasted words, clearly conveys the core action. Could potentially be more structured but is efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Description is adequate for a tool with complete annotations and output schema. It explains the purpose and protocol, but could mention requirements like active session or overwrite behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with descriptions for all three parameters. The description adds no further meaning beyond the schema, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the verb 'Uploads' and the resource 'local file to the remote host over SFTP', which is specific and distinguishes from siblings like file_download and fs_write.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives, no prerequisites or exclusions mentioned. The description only states what it does.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fs_listList Remote DirectoryCRead-onlyIdempotent
Lists directory contents
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | SSH session ID | |
| path | Yes | Directory path to list | |
| page | No | Page number for pagination | |
| limit | No | Maximum items per page (default: 100) |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide readOnlyHint, destructiveHint, idempotentHint, and openWorldHint. The description adds no behavioral details beyond the obvious. It does not mention pagination or the need for a session ID.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
At three words, it is extremely concise but not wasteful. However, it sacrifices informativeness for brevity. A slightly longer description would improve structure.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the presence of an output schema and well-documented input schema, the description is too minimal. It omits any mention of pagination, session requirements, or what the output contains.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage, so the baseline is 3. The description adds no extra meaning; it does not elaborate on parameters like pagination limits or the path format.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('lists') and the resource ('directory contents'). It is distinct from sibling tools like fs_read or fs_write. However, it could be more specific about the remote aspect, though the title already implies that.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool over others, or prerequisites like needing an active SSH session. The description is too terse to indicate context of use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fs_mkdirpCreate Remote DirectoriesAIdempotent
Creates directories recursively
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | SSH session ID | |
| path | Yes | Directory path to create |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare idempotentHint=true and destructiveHint=false, so the description's addition of 'recursively' adds valuable detail beyond annotations. However, it does not explain what happens if the path already exists or permissions required, which is partly covered by idempotency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Extremely concise (4 words) and front-loaded. Every word is meaningful with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the presence of an output schema and annotations covering idempotency, the description is fairly complete for a simple recursive directory creation tool. It covers the core functionality but could mention it resembles Unix mkdir -p.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with both parameters (sessionId, path) described. The description does not add any extra meaning beyond the schema, so baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Creates directories recursively' explicitly states the action (create) and resource (directories), with 'recursively' matching the mkdir -p behavior. It clearly distinguishes from sibling file tools like fs_write or fs_rmrf.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs alternatives. While it is the only directory creation tool among siblings, there is no mention of prerequisites, error conditions, or comparison to similar operations like using a shell command directly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fs_readRead Remote FileBRead-onlyIdempotent
Reads a file from the remote system
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | SSH session ID | |
| path | Yes | File path to read | |
| encoding | No | File encoding (default: utf8) | |
| maxBytes | No | Optional per-request read size limit in bytes |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide readOnlyHint=true, destructiveHint=false, and idempotentHint=true. The description adds no extra behavioral details, such as error handling or behavior with maxBytes. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that front-loads the core purpose. It is appropriately brief for a simple read operation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the low complexity and presence of output schema and annotations, the description is adequate. However, it does not mention that an SSH session is required (implied but not explicit) or the optional parameters' purpose.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the description does not need to add parameter meaning. The description does not explain how parameters interact or constraints beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'reads a file from the remote system', which identifies the action and resource. It distinguishes from sibling tools like fs_write or fs_rmrf, but could be more specific about relying on SSH sessions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like file_download or fs_list. The description does not mention exclusions or preferred contexts.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fs_renameRename Remote PathBDestructive
Renames or moves a file/directory
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | SSH session ID | |
| from | Yes | Source path | |
| to | Yes | Destination path |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate destructiveHint=true and readOnlyHint=false. Description adds that it performs rename/move, but does not disclose details like session dependency or behavior on existing destination.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence is concise, but could be restructured to front-load key details while remaining brief. Slightly under-informative.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Tool has 3 required parameters, destructive hint, and an output schema, yet description omits return values and side effects. Minimal extra context beyond annotations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema covers all three parameters with descriptions, so description adds no new meaning. Baseline 3 due to high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description uses specific verbs 'renames' or 'moves' and resource 'file/directory', clearly distinguishing it from sibling tools like fs_list or fs_rmrf.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives such as fs_mkdirp or fs_rmrf; lacks explicit use cases or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fs_rmrfRemove Remote Path RecursivelyADestructive
Removes files or directories recursively
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | SSH session ID | |
| path | Yes | Path to remove |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Description adds 'recursively' beyond annotations, but no details on irreversibility, permission requirements, or error handling. Annotations already signal destructive hint, so minimal added value.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, zero waste. Front-loaded with core action.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Output schema exists (not shown), but missing important cautions for a destructive tool (e.g., no undo, path format). Basic but adequate for a simple operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema covers both parameters with descriptions. Description adds no extra meaning beyond what schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states 'removes files or directories recursively' – specific verb and resource, and distinguishes from siblings like fs_read, fs_write, fs_list.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use vs alternatives (e.g., fs_rename for moving, fs_list for non-destructive operations). Lacks context about prerequisites or dangers.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fs_statStat Remote PathARead-onlyIdempotent
Gets file or directory statistics
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | SSH session ID | |
| path | Yes | Path to stat |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false, idempotentHint=true, and openWorldHint=true. The description adds 'statistics' but does not elaborate on what specific metadata is returned, which the output schema likely covers.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Extremely concise single sentence with no wasted words. Every element is necessary.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a stat tool, the description is adequate given that the output schema exists to explain return values. It could mention common statistics (size, permissions), but omissions are minor.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with clear descriptions for both parameters ('SSH session ID', 'Path to stat'). The description does not add additional meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Gets' and resource 'file or directory statistics', which distinguishes it from siblings like `fs_list` or `fs_read`.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs alternatives like `fs_list` or `fs_read`. The description does not provide context for appropriate usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fs_writeWrite Remote FileBDestructive
Writes data to a file on the remote system
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | SSH session ID | |
| path | Yes | File path to write | |
| data | Yes | Data to write to file | |
| mode | No | File permissions mode |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate destructiveHint=true and readOnlyHint=false. The description adds 'writes data to a file' but does not clarify whether it overwrites or appends, or specify permissions behavior beyond schema. Non-contradictory but relies on annotations for destructive nature.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence with no wasted words. Could be improved by front-loading key information, but it is efficiently communicated.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
While annotations and schema provide basic context, the description does not mention overwrite behavior, error handling, or return values. Output schema exists but is not visible; the description could clarify what is returned on success/failure.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema has 100% coverage with descriptions for all parameters (sessionId, path, data, mode). The description does not add any additional semantic meaning beyond what the schema already provides, meeting the baseline for high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it writes data to a file on the remote system, using specific verb 'writes' and resource. It distinguishes from sibling tools like fs_read (read), fs_rename (rename), and fs_rmrf (remove).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs alternatives like ensure_lines_in_file, which might also modify files. No when-not or alternative tool recommendations are provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_metricsGet Runtime MetricsARead-onlyIdempotent
Returns server metrics including session counts, command statistics, and uptime
| Name | Required | Description | Default |
|---|---|---|---|
| format | No | Output format (default: json) |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate read-only, non-destructive, idempotent. Description adds specific metric examples, enhancing behavioral context without contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, front-loaded with verb 'Returns', concise and efficient with no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Description covers the main purpose and output content. Output schema exists, so return values need not be detailed. Could mention format output options, but schema covers it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with one well-defined parameter ('format' with enums). Description doesn't mention the parameter, but schema fully covers it, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool returns server metrics with examples (session counts, command statistics, uptime). It distinguishes from sibling tools, which are mostly file/SSH/tunnel operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when to use (retrieve runtime metrics). No explicit when-not or alternatives, but siblings are unrelated, so no confusion.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
os_detectDetect Remote OSARead-onlyIdempotent
Detects operating system and environment information
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | SSH session ID |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false, idempotentHint=true, and openWorldHint=true, covering safety and idempotence. The description adds minimal behavioral context beyond the purpose; it does not contradict annotations but also does not enrich them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, clear sentence that efficiently conveys the tool's function. It is front-loaded and contains no extraneous words, though it could include slightly more detail without becoming verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the existence of an output schema and simple input, the description suffices for basic understanding. However, 'environment information' is vague, and the tool could benefit from specifying what OS and environment details are returned (e.g., kernel version, distro). The description is adequate but not rich.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The only parameter 'sessionId' has a schema description matching the tool's purpose. With 100% schema description coverage, the description adds no new semantic meaning beyond what the schema provides, meeting the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The tool name 'os_detect' and title 'Detect Remote OS' clearly indicate the purpose. The description 'Detects operating system and environment information' directly states the action and result, distinguishing it from sibling tools that handle file operations, process execution, or SSH session management.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives a general statement of what the tool does but lacks explicit guidance on when to use it versus alternatives. Context implies using after establishing an SSH session, but no prerequisites or exclusions are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
patch_applyApply PatchBDestructive
Applies a patch to a file
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | SSH session ID | |
| path | Yes | File path to patch | |
| diff | Yes | Patch content (unified diff format) |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide destructiveHint=true and readOnlyHint=false. The description adds no further behavioral details such as whether the patch is applied in-place, if rollback is possible, or what happens on failure. It does not contradict annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single short sentence, which is concise and front-loaded. However, for a destructive tool, it may be too terse; a bit more context would be beneficial without being wasteful.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's destructive nature and 3 required parameters, the description is too minimal. It does not mention the remote SSH context, file prerequisites, or output schema details. Siblings provide richer context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema has 100% description coverage, so the description does not need to add parameter meanings. However, it does not provide additional context like expected format of 'diff' or constraints on 'path'. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Applies a patch to a file' clearly states a specific verb and resource, and it distinguishes this tool from siblings like fs_write or ensure_lines_in_file which have different purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives (e.g., fs_write vs patch_apply), no mention of prerequisites like session or file existence, and no conditions for successful application.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
proc_execExecute Remote CommandA
Executes a non-interactive command on the remote system after policy and safety checks
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | SSH session ID | |
| command | Yes | Command to execute | |
| cwd | No | Working directory | |
| env | No | Environment variables | |
| timeoutMs | No | Command execution timeout in milliseconds |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate readOnlyHint=false and destructiveHint=false, but description adds 'after policy and safety checks'. Does not explain potential side effects or error handling beyond policy checks.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence with clear action and context. No filler or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Output schema exists, so return values are documented. Description covers core behavior but lacks information on failure modes (e.g., timeout, policy rejection) and timeoutMs parameter behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema covers all 5 parameters with descriptions. Description adds 'non-interactive' and 'safety checks' but no additional parameter-specific context beyond schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states it executes a non-interactive command on a remote system with policy and safety checks. Distinguishes from siblings like proc_exec_stream and proc_sudo.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives. Implies execution after checks but does not mention scenarios like needing interactive commands (use proc_exec_stream) or sudo (use proc_sudo).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
proc_exec_streamExecute Streaming CommandA
Executes a command and returns streaming output chunks
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | SSH session ID | |
| command | Yes | Command to execute | |
| cwd | No | Working directory | |
| env | No | Environment variables | |
| timeoutMs | No | Streaming command timeout in milliseconds |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Describes streaming output, but does not disclose side effects, permissions, or that it requires an active SSH session. Annotations provide readOnlyHint and destructiveHint, reducing burden, but description adds little beyond the name.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single clear sentence, no wasted words. Perfectly concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Description is minimal; lacks context about prerequisites (e.g., active SSH session from ssh_open_session), behavior on timeout, or output format. Output schema exists but description could elaborate on streaming semantics.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so parameter details are fully in the schema. Description adds no extra meaning or context to parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states it executes a command and returns streaming output chunks. Distinguishes from sibling proc_exec by specifying streaming nature.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit when-to-use or alternatives. The term 'streaming' implies use for long-running commands, but no mention of when not to use or comparison with proc_exec.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
proc_sudoExecute Sudo CommandADestructive
Executes a command with sudo privileges only when allowRawSudo policy permits it
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | SSH session ID | |
| command | Yes | Command to execute with sudo | |
| cwd | No | Working directory | |
| timeoutMs | No | Command execution timeout in milliseconds |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds the policy constraint beyond the annotations (destructiveHint true). It does not elaborate on specific behaviors like return values or potential side effects, but the output schema exists and annotations cover the destructive nature, so the description is adequate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that front-loads the action and key constraint, with no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive tool with 4 parameters and an output schema, the description covers the essential policy constraint but could be more complete with additional safety considerations or typical usage scenarios.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% coverage for parameter descriptions, so the description does not add additional meaning beyond what the schema already provides, yielding a baseline score of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (execute command with sudo) and the resource (command with sudo privileges), and it distinguishes from sibling tools like proc_exec (without sudo) by mentioning the policy constraint.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context by noting the policy requirement 'only when allowRawSudo policy permits it', implying when the tool should be used. However, it does not explicitly state when not to use or compare to alternatives like proc_exec_stream.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_close_sessionClose SSH SessionBIdempotent
Closes an SSH session
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | Session ID to close |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds no behavioral details beyond the action itself. Annotations indicate idempotent and non-destructive, but the description doesn't comment on side effects (e.g., terminating commands) or error handling. It fails to disclose traits not already in annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no wasted words, directly stating the tool's purpose. It is front-loaded and efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity of the tool (one required parameter) and presence of an output schema, the description is minimal. It lacks context on what happens upon successful close, error cases, or interaction with other SSH tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with 'sessionId' already described as 'Session ID to close'. The tool description adds no additional meaning, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb (Closes) and resource (an SSH session), directly matching the tool name and distinguishing it from sibling tools like ssh_open_session.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool, prerequisites (e.g., session must be open), or alternatives. It merely states the action without contextual advice.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_host_inspectInspect SSH HostARead-only
Use this when ChatGPT or Claude needs read-only host inspection through the server-side credential broker. The user supplies only a configured host alias and selected checks; no secret material or login details are accepted.
| Name | Required | Description | Default |
|---|---|---|---|
| hostAlias | Yes | Configured SSH host alias | |
| checks | No | Read-only checks to run |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false. The description adds useful context: it uses a server-side credential broker and does not accept secret material, enhancing safety transparency beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences: first states usage context, second adds security constraint. No filler, front-loaded, every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has an output schema and simple parameters, the description adequately covers purpose, usage, and constraints. It does not explain checks in detail but the schema covers that.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with descriptions for both parameters. The description adds 'selected checks' but does not elaborate beyond the schema's enum list, so the value added is marginal.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool is for read-only host inspection via a server-side credential broker, specifying the verb 'inspect' and resource 'SSH host'. It distinguishes from sibling tools like ssh_open_session or ssh_mutation_plan by emphasizing read-only access.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description indicates when to use (for read-only inspection) and provides a constraint (no secret material accepted). However, it does not explicitly mention when not to use or compare with alternatives like ssh_ping or ssh_resolve_host.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_hosts_listList Safe SSH Host AliasesARead-onlyIdempotent
Use this when ChatGPT or Claude needs a safe list of SSH host aliases that may be inspected through the remote connector. Sensitive login material is omitted.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint, destructiveHint, idempotentHint. The description adds that sensitive login material is omitted, providing additional behavioral context about the output's safety.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with usage guidance, no redundant information. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with zero parameters and an output schema, the description fully covers purpose, usage, and behavioral aspects. No gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist, so schema coverage is 100%. The description adds meaning by explaining the output is a safe list for SSH aliases inspected via the remote connector, which is adequate for zero-parameter tools.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The title and description clearly state the tool lists SSH host aliases, with the verb 'list'. It distinguishes from siblings like ssh_list_configured_hosts by emphasizing safety (sensitive material omitted) but does not explicitly name alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says 'Use this when...a safe list' is needed, providing clear context. It implies alternatives exist for full configurations but does not explicitly state when not to use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_list_configured_hostsList Configured HostsARead-onlyIdempotent
Lists all hosts configured in ~/.ssh/config
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false, idempotentHint=true. The description adds that it reads from ~/.ssh/config, which is minimal additional behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, no extraneous words, front-loaded with key information. Highly concise and structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameterless tool with an output schema, the description sufficiently covers its purpose and data source. Complete for its simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist, so schema coverage is 100% and the description adds no param info. Baseline 4 is appropriate for a zero-parameter tool.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Lists' and the resource 'all hosts configured in ~/.ssh/config', providing a specific source and distinguishing it from sibling tools that may list hosts from other sources.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool vs. siblings like ssh_hosts_list. The description implies usage for configured hosts, but lacks explicit context for agent decision-making.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_list_sessionsList SSH SessionsARead-onlyIdempotent
Lists all active SSH sessions with their details
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=true, destructiveHint=false, and idempotentHint=true. The description does not add new behavioral details beyond stating the tool lists sessions, which is consistent with the annotations. No extra context about details or side effects is provided.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is concise and front-loaded. Every word is useful, with no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has no parameters and an existing output schema (not shown). The description adequately states its purpose, but could hint at what 'details' means. However, with the output schema, the description is sufficiently complete for a simple list tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has no parameters, so schema description coverage is technically 100%. The description does not need to add parameter info; the baseline for no parameters is 4, and the description meets that.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool 'Lists all active SSH sessions with their details,' using a specific verb and resource. It distinguishes itself from sibling tools like ssh_list_configured_hosts, which lists configured hosts, not active sessions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
While the description implies when to use the tool (to view active sessions), it does not explicitly state when not to use it or name alternatives. The context from sibling tools provides some differentiation, but no direct guidance is given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_mutation_planPlan SSH MutationARead-onlyIdempotent
Use this when ChatGPT or Claude needs a non-executing plan for a remote SSH change. It never runs commands, writes files, uploads data, starts tunnels, or escalates privileges.
| Name | Required | Description | Default |
|---|---|---|---|
| hostAlias | Yes | Configured SSH host alias | |
| goal | Yes | Desired change to plan without executing | |
| category | No | Change category used for policy explanation |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark readOnlyHint=true, but the description adds specific prohibited actions (runs commands, writes files, uploads data, starts tunnels, escalates privileges), providing valuable context beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences that are each highly informative and free of redundancy, front-loading the action and usage context.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Covers purpose, usage, and behavioral limitations. Output schema exists (context signals show true), so return value details are unnecessary.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline applies. The description does not add parameter-specific information, which is acceptable.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the clear verb 'plan' with the resource 'SSH mutation' and explicitly states it never executes, distinguishing it from all sibling execution tools like ensure_package, file_upload, etc.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says 'Use this when ... needs a non-executing plan' and implicitly contrasts with execution by listing what it never does, but does not name specific sibling alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_open_sessionOpen SSH SessionB
Opens a new SSH session with authentication
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | SSH server hostname or IP | |
| username | Yes | SSH username | |
| port | No | SSH port (default: 22) | |
| auth | No | Authentication method (default: auto) | |
| password | No | Password for authentication | |
| privateKey | No | Inline private key content | |
| privateKeyPath | No | Path to private key file | |
| passphrase | No | Passphrase for encrypted private key | |
| useAgent | No | Use SSH agent for authentication | |
| readyTimeoutMs | No | Connection timeout in milliseconds (default: 20000) | |
| ttlMs | No | Session TTL in milliseconds (default: 900000) | |
| strictHostKeyChecking | No | Deprecated alias. Prefer hostKeyPolicy. | |
| hostKeyPolicy | No | SSH host key verification policy (default: strict) | |
| knownHostsPath | No | Path to known_hosts file | |
| expectedHostKeySha256 | No | Pinned SHA-256 host key fingerprint, with or without SHA256: prefix | |
| policyMode | No | Use explain to return the planned connection without opening SSH |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate non-readOnly and non-destructive. The description adds 'with authentication,' but does not disclose behavioral traits like connection timeout implications, session lifetime, or that the session must be explicitly closed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence with no waste. However, it could be slightly more structured to include key behavioral hints without losing brevity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having an output schema, the description omits important context like session management (e.g., returned session ID for use with other tools), and does not address the complexity arising from 16 parameters.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline is 3. The description adds no additional parameter meaning; it is a single sentence without details beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states 'Opens a new SSH session,' with a clear verb and resource. It distinguishes itself from sibling tools like ssh_close_session and ssh_list_sessions by focusing on opening a session.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives (e.g., ssh_mutation_plan for dry runs). No prerequisites or exclusions mentioned, leaving the agent to infer usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_pingPing SSH SessionARead-onlyIdempotent
Checks if an SSH session is still alive and responsive
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | SSH session ID to check |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false, idempotentHint=true, and openWorldHint=true. The description adds no new behavioral context (e.g., timeout behavior, response format, or side effects). With full annotation coverage, the description contributes minimal extra value.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that is front-loaded, clear, and contains no superfluous information. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an existing output schema and annotations, the description is reasonably complete for a simple check tool. It lacks mention of potential errors or return format, but these are likely covered by the output schema. Still, adding a note about session ID validity could improve completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% with sessionId described as 'SSH session ID to check'. The description does not add further details (e.g., format, validation). Baseline 3 is appropriate given high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'checks' and the resource 'SSH session', and is specific to checking aliveness/responsiveness. This distinguishes it from sibling tools like ssh_open_session, ssh_close_session, and ssh_list_sessions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is for checking liveliness but does not provide explicit guidance on when to use it over alternatives (e.g., ssh_host_inspect) or when not to use it. No prerequisites or exclusions are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_policy_explainExplain SSH PolicyARead-onlyIdempotent
Use this when ChatGPT or Claude needs to explain whether a requested SSH inspection or mutation would be allowed. This is explain-only and does not execute commands or open tunnels.
| Name | Required | Description | Default |
|---|---|---|---|
| hostAlias | No | Configured SSH host alias | |
| action | No | Requested action class to evaluate without executing it | |
| command | No | Optional command to evaluate in explain mode | |
| path | No | Optional remote path to evaluate in explain mode |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide readOnlyHint=true, destructiveHint=false, idempotentHint=true. The description adds 'explain-only and does not execute commands or open tunnels', reinforcing and adding context beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with use case, no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool is for explanation (simple) and has an output schema, the description adequately covers its purpose and behavior without needing to detail output.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Parameter schema coverage is 100%, so baseline is 3. The description does not add significant detail about specific parameters beyond what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'explain' and resource 'policy allowability' and distinguishes it from sibling tools that execute commands or open tunnels.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly specifies when to use ('when needs to explain whether... would be allowed') and what not to do ('does not execute commands or open tunnels'), implying alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_resolve_hostResolve SSH HostARead-onlyIdempotent
Resolves a host alias from ~/.ssh/config to connection parameters
| Name | Required | Description | Default |
|---|---|---|---|
| hostAlias | Yes | Host alias from SSH config |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false, and idempotentHint=true. The description adds context that it reads from ~/.ssh/config, which is consistent and slightly enriches the behavioral model. No contradictions or missing critical behaviors.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence of 10 words with no superfluous information. It is front-loaded with the action and resource, making it easy for an agent to quickly understand the tool's core function.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the existence of an output schema (not shown here), the description does not need to detail return values. It fully covers the tool's purpose and input requirements, and the annotations cover safety. No gaps are apparent for this simple resolver operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with a clear description for the single parameter 'hostAlias'. The tool description does not add extra meaning beyond the schema, but baseline is adequate since schema handles semantics well.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('resolves') and clearly identifies the resource ('host alias from ~/.ssh/config') and output ('connection parameters'). It distinguishes itself from sibling tools like ssh_hosts_inspect or ssh_list_configured_hosts by focusing on resolution of a single alias.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives (e.g., ssh_host_inspect, ssh_list_configured_hosts). It does not mention prerequisites, typical use cases, or exclusions. An agent would have to infer context from the name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tunnel_closeClose SSH TunnelBIdempotent
Closes an active tunnel
| Name | Required | Description | Default |
|---|---|---|---|
| tunnelId | Yes | Tunnel identifier |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate non-read-only, non-destructive, idempotent, and open-world hints. The description adds 'closes' which is consistent with mutation, but doesn't disclose additional behavioral traits beyond what annotations provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single four-word sentence with no redundant information. It is appropriately sized for the tool's simplicity, though slightly too minimal.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one required parameter, no nested objects, and an existing output schema), the description is sufficient for an agent to invoke it correctly. However, it could mention that the tunnelId comes from tunnel_list.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage for the single parameter 'tunnelId'. The description does not add any extra meaning or context beyond 'Tunnel identifier', so it provides no added value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Closes an active tunnel' uses a specific verb and resource, clearly indicating the tool's purpose. It distinguishes from sibling tools like 'tunnel_list' and 'tunnel_local_forward', but doesn't explicitly differentiate from 'ssh_close_session'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. Sibling tools like 'ssh_close_session' close SSH sessions, not tunnels, but the description doesn't clarify this distinction or mention prerequisites like needing a valid tunnel ID.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tunnel_listList SSH TunnelsARead-onlyIdempotent
Lists active tunnels, optionally filtered by session
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | No | Optional SSH session ID filter |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, so the description adds no extra behavioral context (e.g., pagination, performance). It's adequate but doesn't enrich beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence with no extraneous words; every part is necessary.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only list tool with one optional param and an output schema, the description is sufficient. Could hint at output structure but not required.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% for the single parameter, description reiterates the filter capability but adds no new semantics beyond the schema's description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb-resource pair ('Lists active tunnels') and includes an optional filter, clearly distinguishing it from sibling tools like tunnel_close or tunnel_local_forward.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives (e.g., ssh_list_sessions, tunnel_close). No explicit when-not-to or context for selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tunnel_local_forwardCreate Local SSH TunnelC
Creates a local SSH port forward
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | SSH session ID | |
| localPort | Yes | Local TCP port | |
| remoteHost | Yes | Remote host | |
| remotePort | Yes | Remote TCP port |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate readOnlyHint=false, consistent with mutation, but the description adds no behavioral details beyond the schema. Missing info on port conflicts, permissions, or binding behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single efficient sentence, but it is somewhat terse. It earns a 4 for being concise yet functional.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With only 4 required parameters and an output schema (present but not shown), the description is minimally adequate. However, it lacks behavioral context and success indicators, limiting completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, providing clear parameter descriptions. The tool description adds no additional meaning or examples, earning a baseline score of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Creates a local SSH port forward' clearly states the verb 'Creates' and the resource 'local SSH port forward', distinguishing it from siblings like 'tunnel_remote_forward'. However, it is minimal and could be more descriptive.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs. alternatives like 'tunnel_remote_forward' or prerequisites such as having an open SSH session (via 'ssh_open_session'). The description lacks context for appropriate use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
tunnel_remote_forwardCreate Remote SSH TunnelC
Creates a remote SSH port forward
| Name | Required | Description | Default |
|---|---|---|---|
| sessionId | Yes | SSH session ID | |
| remotePort | Yes | Remote TCP port | |
| localHost | Yes | Local host | |
| localPort | Yes | Local TCP port |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotation indicates readOnlyHint=false, which aligns with creating a tunnel, but the description adds no behavioral details beyond that. It does not disclose potential side effects (e.g., port binding, required permissions, impact on existing tunnels). The description does not complement the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is one short sentence, concise and to the point. It avoids unnecessary words. No structural issues, though it could be slightly expanded with usage context without becoming verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having an output schema, the description lacks important context: it does not mention the need for an already established SSH session, potential conflicts with existing port forwards, or what happens on failure. For a non-idempotent, state-changing tool, this is insufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Input schema has 100% description coverage, so each parameter is already documented in the schema. The description does not add any additional meaning or context, but since schema coverage is high, a baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action: creates a remote SSH port forward. The verb 'creates' and resource 'remote SSH port forward' are specific. It is distinguishable from sibling tools like tunnel_local_forward due to the word 'remote', though no explicit comparison is made.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool vs alternatives (e.g., tunnel_local_forward). No mention of prerequisites like an active SSH session, which is implicitly required by the sessionId parameter. No when-not-to-use or exclusion criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
5 tool updates
v1.2.11- Changed
ensure_lines_in_file1 field changed- removed
Input schema / properties / sudoPasswordRemoved value: -{ - "description": "Optional sudo password", - "type": "string" -}
- Changed
ensure_package1 field changed- removed
Input schema / properties / sudoPasswordRemoved value: -{ - "description": "Optional sudo password", - "type": "string" -}
- Changed
ensure_service1 field changed- removed
Input schema / properties / sudoPasswordRemoved value: -{ - "description": "Optional sudo password", - "type": "string" -}
- Changed
patch_apply1 field changed- removed
Input schema / properties / sudoPasswordRemoved value: -{ - "description": "Optional sudo password", - "type": "string" -}
- Changed
proc_sudo1 field changed- removed
Input schema / properties / passwordRemoved value: -{ - "description": "Sudo password", - "type": "string" -}
33 tool updates
v1.2.9- Added
connector_status - Changed
ensure_lines_in_file4 fields changed- added
Input schema / properties / createIfMissingAdded value: +{ + "description": "Create file if it does not exist", + "type": "boolean" +} - added
Input schema / properties / sudoPasswordAdded value: +{ + "description": "Optional sudo password", + "type": "string" +} - changed
Input schema / requiredPrevious value: -[ - "sessionId", - "path", - "lines", - "state" -]New value: +[ + "sessionId", + "path", + "lines" +] - changed
Output schema / (root)Previous value: -nullNew value: +{ + "additionalProperties": true, + "description": "Line management result", + "type": "object" +}
- Changed
ensure_package3 fields changed- added
Input schema / properties / sudoPasswordAdded value: +{ + "description": "Optional sudo password", + "type": "string" +} - changed
Input schema / requiredPrevious value: -[ - "sessionId", - "name", - "state" -]New value: +[ + "sessionId", + "name" +] - changed
Output schema / (root)Previous value: -nullNew value: +{ + "additionalProperties": true, + "description": "Package state result", + "type": "object" +}
- Changed
ensure_service3 fields changed- changed
Input schema / properties / state / enumPrevious value: -[ - "started", - "stopped", - "enabled", - "disabled" -]New value: +[ + "started", + "stopped", + "restarted", + "enabled", + "disabled" +] - added
Input schema / properties / sudoPasswordAdded value: +{ + "description": "Optional sudo password", + "type": "string" +} - changed
Output schema / (root)Previous value: -nullNew value: +{ + "additionalProperties": true, + "description": "Service state result", + "type": "object" +}
- Added
file_download - Added
file_upload - Changed
fs_list1 field changed- changed
Output schema / (root)Previous value: -nullNew value: +{ + "additionalProperties": true, + "description": "Remote directory entries", + "type": "object" +}
- Changed
fs_mkdirp2 fields changed- removed
Input schema / properties / modeRemoved value: -{ - "description": "Directory permissions mode", - "type": "number" -} - changed
Output schema / (root)Previous value: -nullNew value: +{ + "additionalProperties": true, + "description": "Directory creation result", + "type": "object" +}
- Changed
fs_read2 fields changed- added
Input schema / properties / maxBytesAdded value: +{ + "description": "Optional per-request read size limit in bytes", + "type": "number" +} - changed
Output schema / (root)Previous value: -nullNew value: +{ + "additionalProperties": true, + "description": "Remote file content wrapped as structured content", + "type": "object" +}
- Changed
fs_rename1 field changed- changed
Output schema / (root)Previous value: -nullNew value: +{ + "additionalProperties": true, + "description": "Rename result", + "type": "object" +}
- Changed
fs_rmrf1 field changed- changed
Output schema / (root)Previous value: -nullNew value: +{ + "additionalProperties": true, + "description": "Recursive remove result", + "type": "object" +}
- Changed
fs_stat1 field changed- changed
Output schema / (root)Previous value: -nullNew value: +{ + "additionalProperties": true, + "description": "Remote path stat result", + "type": "object" +}
- Changed
fs_write1 field changed- changed
Output schema / (root)Previous value: -nullNew value: +{ + "additionalProperties": true, + "description": "File write result", + "type": "object" +}
- Added
get_metrics - Changed
os_detect1 field changed- changed
Output schema / (root)Previous value: -nullNew value: +{ + "additionalProperties": true, + "description": "Remote operating system information", + "type": "object" +}
- Changed
patch_apply5 fields changed- added
Input schema / properties / diffAdded value: +{ + "description": "Patch content (unified diff format)", + "type": "string" +} - removed
Input schema / properties / patchRemoved value: -{ - "description": "Patch content (unified diff format)", - "type": "string" -} - added
Input schema / properties / sudoPasswordAdded value: +{ + "description": "Optional sudo password", + "type": "string" +} - changed
Input schema / requiredPrevious value: -[ - "sessionId", - "path", - "patch" -]New value: +[ + "sessionId", + "path", + "diff" +] - changed
Output schema / (root)Previous value: -nullNew value: +{ + "additionalProperties": true, + "description": "Patch application result", + "type": "object" +}
- Changed
proc_exec2 fields changed- added
Input schema / properties / timeoutMsAdded value: +{ + "description": "Command execution timeout in milliseconds", + "type": "number" +} - changed
Output schema / (root)Previous value: -nullNew value: +{ + "additionalProperties": true, + "description": "Remote command result", + "type": "object" +}
- Added
proc_exec_stream - Changed
proc_sudo2 fields changed- added
Input schema / properties / timeoutMsAdded value: +{ + "description": "Command execution timeout in milliseconds", + "type": "number" +} - changed
Output schema / (root)Previous value: -nullNew value: +{ + "additionalProperties": true, + "description": "Remote sudo command result", + "type": "object" +}
- Changed
ssh_close_session1 field changed- changed
Output schema / (root)Previous value: -nullNew value: +{ + "additionalProperties": true, + "description": "Boolean close result wrapped as structured content", + "type": "object" +}
- Added
ssh_host_inspect - Added
ssh_hosts_list - Changed
ssh_list_configured_hosts1 field changed- changed
Output schema / (root)Previous value: -nullNew value: +{ + "additionalProperties": true, + "description": "Configured SSH host aliases", + "type": "object" +}
- Changed
ssh_list_sessions1 field changed- changed
Output schema / (root)Previous value: -nullNew value: +{ + "additionalProperties": true, + "description": "Active SSH sessions", + "type": "object" +}
- Added
ssh_mutation_plan - Changed
ssh_open_session6 fields changed- added
Input schema / properties / expectedHostKeySha256Added value: +{ + "description": "Pinned SHA-256 host key fingerprint, with or without SHA256: prefix", + "type": "string" +} - added
Input schema / properties / hostKeyPolicyAdded value: +{ + "description": "SSH host key verification policy (default: strict)", + "enum": [ + "strict", + "accept-new", + "insecure" + ], + "type": "string" +} - added
Input schema / properties / knownHostsPathAdded value: +{ + "description": "Path to known_hosts file", + "type": "string" +} - added
Input schema / properties / policyModeAdded value: +{ + "description": "Use explain to return the planned connection without opening SSH", + "enum": [ + "enforce", + "explain" + ], + "type": "string" +} - added
Input schema / properties / strictHostKeyCheckingAdded value: +{ + "description": "Deprecated alias. Prefer hostKeyPolicy.", + "type": "boolean" +} - changed
Output schema / (root)Previous value: -nullNew value: +{ + "additionalProperties": true, + "description": "Session creation result or explain-mode connection plan", + "type": "object" +}
- Changed
ssh_ping1 field changed- changed
Output schema / (root)Previous value: -nullNew value: +{ + "additionalProperties": true, + "description": "Session health check result", + "type": "object" +}
- Added
ssh_policy_explain - Changed
ssh_resolve_host1 field changed- changed
Output schema / (root)Previous value: -nullNew value: +{ + "additionalProperties": true, + "description": "Resolved SSH connection parameters", + "type": "object" +}
- Added
tunnel_close - Added
tunnel_list - Added
tunnel_local_forward - Added
tunnel_remote_forward
20 tool updates
v1.2.8- First observed
ensure_lines_in_file - First observed
ensure_package - First observed
ensure_service - First observed
fs_list - First observed
fs_mkdirp - First observed
fs_read - First observed
fs_rename - First observed
fs_rmrf - First observed
fs_stat - First observed
fs_write - First observed
os_detect - First observed
patch_apply - First observed
proc_exec - First observed
proc_sudo - First observed
ssh_close_session - First observed
ssh_list_configured_hosts - First observed
ssh_list_sessions - First observed
ssh_open_session - First observed
ssh_ping - First observed
ssh_resolve_host
TDQS
Scored across 33 tools
Each tool targets a distinct operation or resource type (file, command, session, tunnel, package, service, inspection). There is no significant overlap; even similar tools like proc_exec and proc_exec_stream are differentiated by execution mode.
Tools are grouped by domain (fs_, proc_, tunnel_, ssh_, ensure_) with consistent patterns within groups. However, the overall naming convention mixes prefixes (fs_list vs file_download) and some tools use long phrasal names (ensure_lines_in_file).
At 33 tools, the server is heavily featured. While most tools serve a clear purpose, the count is above the typical sweet spot and includes several niche utilities (get_metrics, os_detect, ssh_mutation_plan) that could be consolidated.
The tool surface covers the full lifecycle of SSH interactions: session management, file operations, command execution, package/service management, tunneling, and safety/planning. No obvious gaps exist for a generic SSH administration server.
Maintenance
Related MCP Connectors
Remote MCP server for supportsheep: run AI interviews and manage support content for your blog.
Personal assistant MCP server with search, execute, packages, jobs, secrets, and integrations.
Hosted MCP server connecting claude.ai, ChatGPT and other AI apps to your own computer
Nifty's MCP server — exposes tasks, projects, messages, and files as tools for AI agents.