free-coding-agent
Supports using a user-owned Cloudflare Tunnel and domain as an alternative personal HTTPS endpoint for remote MCP access.
Enables FFmpeg/media workflows through the agent.
Provides Git status, diff, history, and repository operations through the agent.
Supports personal HTTPS remote MCP access via Tailscale Funnel using the user's own Tailscale account and stable ts.net hostname.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@free-coding-agent fix the failing tests in this repo and show me the git diff"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Free Coding Agent
Give frontier AI models real hands on a real developer workstation.
Free Coding Agent is an open-source, provider-neutral MCP execution layer that turns a capable model from a chat box into a hands-on software engineer. The model supplies the intelligence; Free Coding Agent supplies controlled access to files, terminals, Git, language servers, browsers, Windows UI, jobs, checkpoints, tests, and diagnostics.
LM Arena describes Code Arena as a place to build and compare with frontier AI models. Free Coding Agent is designed to be a compatible execution layer for any host that supports MCP or equivalent remote tools. It is independent software and is not an LM Arena product.
Core principle: no shared project infrastructure
Free Coding Agent does not require a relay, domain, account, API key, tunnel, or backend operated by this project.
Every installation is independent:
its own local configuration;
its own workspace allowlist;
its own MCP bearer token;
its own HTTP server;
its own HTTPS hostname/tunnel when remote access is enabled;
its own third-party account, if the user chooses a tunneling provider.
There is no common Free Coding Agent relay and no common remote credential.
Related MCP server: Workspace MCP
What it can do
transactional filesystem reads/writes;
atomic multi-file patches and rollback checkpoints;
optimistic SHA-256 concurrency protection;
shell commands and long-running processes;
real PTY / ConPTY for REPLs, debuggers, SSH and TUIs;
Git status, diff, history and repository operations;
headless LSP diagnostics, definitions, references, hover and symbols;
project inspection and project-local memory;
Playwright browser automation;
optional real-Chrome companion extension;
optional VS Code companion extension;
Windows UI automation;
FFmpeg/media workflows;
resource admission to avoid CPU/RAM stampedes;
MCP batching and capability discovery;
local stdio MCP;
authenticated local HTTP MCP;
optional personal public HTTPS MCP.
Durable Agent Mode
Free Coding Agent includes a provider-neutral task kernel for autonomous and multi-agent coding. It does not call or hardcode a model vendor: any MCP-capable model can act as a worker.
The durable loop is:
task_submit
↓
task_next / task_claim
↓
worker edits + targeted checks
↓
task_ready
↓
task_verify
↙ ↘
repairing succeeded
↓
task_claim → repair → task_ready → task_verifyImportant guarantees:
append-only task journal with fsync;
idempotency keys prevent duplicate submissions;
dependencies form explicit task DAGs;
exclusive
leaseKeyownership prevents two workers from editing the same worktree at once;cross-process journal locking prevents two MCP processes from racing the same task;
lease expiry and dead-owner recovery fail to
interrupted, never fake success;task_nextatomically assigns the highest-priority runnable work;verification commands are executed as real processes in the task workspace;
tasks can require an independent logical verifier identity distinct from every implementation worker;
failed gates create an evidence-backed repair loop;
configurable maximum repair rounds prevent infinite retry loops;
only
task_verifycan transition verified work tosucceeded;task events provide a durable audit trail.
Core tools:
task_submit
task_next
task_claim
task_heartbeat
task_ready
task_verify
task_update
task_reconcile
task_contract
task_status
task_list
task_events
task_stats
task_cancelThis is the portable agent-control layer: the model may come from OpenCode, an MCP desktop host, an IDE, a self-hosted model, or another compatible client. The task kernel only coordinates ownership, state, evidence and verification.
Worker/verifier IDs are logical identities supplied by the MCP host for coordination and audit; they are not authentication credentials.
Install on Windows
The normal installation flow is:
Download ZIP
→ extract
→ double-click install.cmd
→ choose the folder the agent may access
→ optionally configure YOUR personal HTTPS endpoint
→ ReadyThe installer:
verifies Node.js 20+;
can install Node.js LTS when Windows Package Manager is available;
installs
free-coding-agentglobally;configures the user's own workspace;
runs
free-coding-agent doctor;optionally guides the user through personal HTTPS setup.
The extracted installer folder can be deleted afterwards.
Local mode — no domain, no internet tunnel
For an MCP client running on the same machine, nothing public is needed:
{
"mcpServers": {
"free-coding-agent": {
"command": "free-coding-agent",
"args": ["stdio"]
}
}
}No domain. No TLS. No exposed port. No external service.
For HTTP clients, Free Coding Agent uses the current MCP Streamable HTTP transport at POST /mcp. Deprecated legacy HTTP+SSE endpoints are intentionally not exposed in v3.
Personal HTTPS mode
When the model host is remote/cloud-based, it needs a public HTTPS URL that reaches the user's machine.
Free Coding Agent's official remote model is personal self-configuration, not a shared relay.
Recommended: Tailscale Funnel
Run:
free-coding-agent remote setupThe setup uses the current user's own Tailscale account.
Tailscale Funnel gives that machine its own stable HTTPS hostname under the user's tailnet:
https://<device>.<tailnet>.ts.net/mcpFree Coding Agent then:
generates a strong MCP bearer token locally;
keeps the HTTP origin bound to
127.0.0.1;exposes it only through that user's Funnel;
stores the URL/token only in that user's application-data directory;
adds a current-user startup entry for the local HTTP server;
prints the exact MCP configuration.
Example output shape:
{
"mcpServers": {
"free-coding-agent": {
"url": "https://YOUR-PERSONAL-HOST.ts.net/mcp",
"headers": {
"Authorization": "Bearer YOUR_LOCAL_TOKEN"
}
}
}
}Tailscale documents Funnel hostnames as predictable/stable, automatically TLS-protected, and publicly reachable while the user's machine is online.
Alternative: personal Cloudflare Tunnel
Users who own a domain on Cloudflare can use a locally managed named Cloudflare Tunnel instead.
The ownership model remains the same:
their Cloudflare account
+ their domain
+ their tunnel
+ their DNS record
+ their local MCP tokenCloudflare's documented flow is:
cloudflared tunnel login
cloudflared tunnel create <name>
cloudflared tunnel route dns <name-or-id> <hostname>
cloudflared tunnel run <name-or-id>A named tunnel can also be installed as an OS service. Free Coding Agent does not own or operate it.
Why personal HTTPS instead of a project relay?
Because the open-source project should keep working independently of its author.
With personal endpoints:
no project-operated server can go offline and break everybody;
no project operator sees MCP traffic;
no shared credential exists;
no shared customer/device database exists;
no central billing requirement exists;
users can replace Tailscale/Cloudflare with another provider;
users can self-host everything indefinitely.
CLI
free-coding-agent
free-coding-agent stdio
free-coding-agent setup
free-coding-agent remote setup
free-coding-agent remote start
free-coding-agent remote status
free-coding-agent remote off
free-coding-agent doctor
free-coding-agent print-confignpm
The package is structured for public npm installation:
npm install -g free-coding-agent
free-coding-agent setupThe npm package must exist in the registry before those commands can be used from npm directly.
Security model
The agent can modify files and execute code, so remote exposure must fail closed.
The personal HTTPS setup enforces:
a random local
MCP_API_KEY;bearer authentication for every remote MCP request;
loopback-only local HTTP binding;
filesystem allowlisting via
FCA_ALLOWED_ROOTS;no anonymous proxy access;
no secret committed to Git;
no project-wide tunnel or account;
no remote credentials shared between users.
A remote URL without the user's bearer token cannot use the agent.
User configuration
Normal users should use the CLI instead of editing config manually.
Important variables:
Variable | Purpose |
| User's known workspaces |
| Default workspace |
| Filesystem sandbox |
| Personal remote provider |
| User's personal public MCP URL |
| User's personal Tailscale DNS name |
| User's own HTTP bearer token |
| Local HTTP bind address |
| Local HTTP port |
| Durable task journal directory |
| Worker lease lifetime |
| Maximum simultaneously running task workers |
| Maximum evidence-backed repair rounds |
| Per verification-command timeout |
| Enable real-Chrome integration |
| Local Chrome pairing secret |
| Optional extension identity pin |
| Local VS Code companion endpoint |
Configuration and runtime state live in standard per-user application-data directories, outside the repository.
OpenCode
OpenCode supports both local and remote MCP servers. A personal Free Coding Agent HTTPS endpoint can be configured as a remote MCP server with bearer authentication.
Conceptually:
{
"type": "remote",
"url": "https://YOUR-PERSONAL-HOST/mcp",
"oauth": false,
"headers": {
"Authorization": "Bearer YOUR_LOCAL_TOKEN"
}
}Use OpenCode's current configuration schema/documentation for the surrounding config structure.
LM Arena / frontier models
Arena's public documentation describes Agent Mode and Code Arena as environments for agentic coding and frontier-model comparison.
Free Coding Agent does not scrape or automate Arena's private UI/API. If Arena exposes a supported MCP or compatible remote-tool integration, the user's personal HTTPS MCP endpoint is ready for it.
This distinction is intentional: the open-source agent remains standards-based and does not depend on undocumented consumer-site behavior.
References:
https://help.arena.ai/articles/5432423882-how-to-use-agent-mode
https://help.arena.ai/articles/5701270322-lmarena-how-to-code-arena
https://developers.cloudflare.com/tunnel/features/locally-managed-tunnels/create-local-tunnel/
Chrome companion extension
The optional extension gives the local MCP server controlled access to the user's real Chrome.
Load
chrome-extensionas an unpacked extension.Configure a local
CHROME_BRIDGE_TOKEN.Enter the same token in the extension popup.
Optionally pin the assigned extension ID.
No fixed extension identity key is stored in this repository.
VS Code companion extension
The optional extension exposes loopback-only editor state:
diagnostics;
references;
definitions;
open files;
debugger state.
Configuration key:
freeCodingAgent.portDefault port: 3005.
Development
npm install
npm run check
npm run privacy
npm run preflight
npm testPrivacy / publication hygiene
The public source tree intentionally excludes:
local
.envfiles;API keys;
tunnel credentials;
machine-specific paths;
user names and email addresses;
conversation archives;
browser profiles;
screenshots and clips;
logs, checkpoints and job state;
local memory;
fixed Chrome extension identity keys;
provider-account-specific orchestration.
npm run privacy fails if common secrets, email addresses, absolute Windows paths, or user-home paths appear in publishable source.
License
ISC. See LICENSE.
Available Tools
128 toolsapply_patchADestructive
Apply a multi-file patch atomically (nothing is written unless every hunk applies). Preferred way to change code. Format: *** Begin Patch *** Update File: src/app.ts @@ function main() { (optional anchor line to jump near the change) context line (space prefix) -removed line +added line *** Add File: src/new.ts +file content line *** Delete File: src/old.ts *** Update File: a.ts *** Move to: b.ts *** End Patch Include ~3 unchanged context lines around each change. The result reports compiler/linter problems in the changed files and a checkpoint id for undo.
Inputs: patch (required), cwd, check.
batchBDestructive
Run several tool calls in one request. Parallel mode is allowed only when every called tool is read-only.
Inputs: calls (required), parallel, stopOnError, failOnAnyError.
browser_clickBDestructive
Click an element by ref (preferred), selector or text. Returns the updated snapshot.
Inputs: ref, text, button, selector, +3 more.
browser_closeADestructive
Close the Playwright browser (the persistent profile stays on disk).
Inputs: no named parameters.
browser_consoleCRead-onlyIdempotent
Console messages, page errors, failed requests and dialogs captured from the browser.
Inputs: clear, limit, onlyErrors.
browser_dialogBDestructive
Inspect or answer a JavaScript dialog (alert/confirm/prompt) in the Playwright browser. Dialogs are never accepted automatically.
Inputs: action, promptText.
browser_evaluateBDestructive
Run JavaScript in the page. Pass an expression ("document.title") or a function body using return.
Inputs: script (required).
browser_get_textCRead-onlyIdempotent
Visible text of the page or of an element (CSS selector).
Inputs: maxChars, selector.
browser_hoverCDestructive
Hover over an element.
Inputs: ref, text, selector.
browser_press_keyBDestructive
Press a key or chord on the page, e.g. "Enter", "Escape", "Control+A", "ArrowDown".
Inputs: key (required), snapshot.
browser_record_startADestructive
Start recording a video of a browser session. Opens a dedicated recording tab (with your profile logins); every browser_* action afterwards is filmed until browser_record_stop.
Inputs: fps, url, name, width, +5 more.
browser_record_stopBDestructive
Stop the recording and save the clip (mp4 via ffmpeg). Returns the file path.
Inputs: discard, trimStart.
browser_resizeCDestructive
Set the viewport size.
Inputs: width (required), height (required).
browser_screenshotARead-onlyIdempotent
Screenshot of the page (or one element). The image is returned so you can see it, and saved to disk.
Inputs: ref, text, fullPage, selector.
browser_scrollCDestructive
Scroll the page by deltaY/deltaX pixels, or scroll an element (ref/selector/text) into view.
Inputs: ref, text, deltaX, deltaY, +1 more.
browser_select_optionCDestructive
Select option(s) in a .
Inputs: ref, text, value, values, +1 more.
browser_snapshotARead-onlyIdempotent
Accessibility snapshot of the current page with [ref=eN] handles. Use it before clicking/typing.
Inputs: no named parameters.
browser_tabsCDestructive
List, open (new), select or close tabs by index.
Inputs: url, index, action.
browser_typeADestructive
Type into an input/textarea/contenteditable. Replaces its value unless slowly: true (types key by key). submit: true presses Enter.
Inputs: text (required), ref, slowly, submit, +1 more.
browser_upload_fileCDestructive
Upload local file(s) through a file input or an upload button (ref/selector/text).
Inputs: ref, path, text, paths, +1 more.
browser_wait_forBDestructive
Wait for a selector or text to appear (state visible/hidden/attached), or just wait timeoutMs.
Inputs: text, state, selector, timeoutMs.
capability_callCDestructive
Fallback dispatcher for a capability present on the live server but missing from a cached client catalog.
Inputs: tool (required), args.
capability_listBRead-onlyIdempotent
List the live MCP capability catalog. Use prefix to filter tool names.
Inputs: prefix, includeDescriptions.
check_filesBRead-onlyIdempotent
Run the relevant compilers/linters (tsc, eslint, node --check, go vet, gofmt, py_compile, ruff, JSON) on specific files and report problems.
Inputs: path, paths.
checkpoint_listARead-onlyIdempotent
List recent checkpoints (one per file-changing tool call) with the files each one touched.
Inputs: limit.
checkpoint_rewindADestructive
Undo: restore files to their state before the given checkpoint (default: the latest), undoing it and every later checkpoint.
Inputs: id.
chrome_call_site_toolADestructive
Invoke a tool the web page itself declares (window.mcp / window.mcp_tools / meta[name=webmcp-tool]). Take a chrome_snapshot first to see the catalog.
Inputs: toolName (required), args, tabId, frameId, +1 more.
chrome_clickADestructive
Click an element by its [#N] ref using a real (trusted) mouse click via the Chrome debugger; falls back to a DOM click if the debugger cannot attach.
Inputs: ref (required), tabId, frameId, snapshotId, +1 more.
chrome_close_tabCDestructive
Close a tab.
Inputs: tabId (required).
chrome_consoleCRead-onlyIdempotent
Console messages and exceptions captured from a tab since the debugger attached to it.
Inputs: clear, tabId.
chrome_dialogADestructive
Inspect or answer a JavaScript dialog (alert/confirm/prompt/beforeunload) that is blocking a tab. Dialogs are never accepted automatically: read the message, then accept or dismiss (promptText for prompt()).
Inputs: tabId, action, promptText.
chrome_downloadsBRead-onlyIdempotent
Recent Chrome downloads (file path, state, size, source URL, referrer).
Inputs: limit, since.
chrome_evaluateBDestructive
Run JavaScript in a tab's page context (via the debugger). Pass an expression; the JSON-serializable result is returned.
Inputs: expression (required), tabId.
chrome_extension_reloadADestructive
Reload the Free Coding Agent Chrome extension from disk (after it was updated) and report the new version.
Inputs: no named parameters.
chrome_get_textBRead-onlyIdempotent
Visible text of a tab (document.body.innerText, truncated).
Inputs: tabId, maxChars.
chrome_list_tabsARead-onlyIdempotent
List all tabs in the user's real Chrome.
Inputs: no named parameters.
chrome_new_tabCDestructive
Open a new tab in the real Chrome.
Inputs: url, active.
chrome_pairing_setupADestructive
Securely configure or rotate the Chrome bridge pairing token in both the connected extension and .env. The secret is never returned. Restart the MCP worker afterwards to enforce it.
Inputs: rotate.
chrome_press_keyADestructive
Press a key or chord (e.g. "Enter", "Tab", "Escape", "Control+a") as a trusted key event in the tab.
Inputs: key (required), ref, tabId, frameId, +1 more.
chrome_screenshotARead-onlyIdempotent
Screenshot of a tab in the real Chrome (visible viewport). The image is returned so you can see it.
Inputs: tabId.
chrome_scrollBDestructive
Scroll the inspected tab by y pixels (negative scrolls up).
Inputs: y, tabId, frameId, snapshotId.
chrome_snapshotARead-onlyIdempotent
Semantic snapshot of a tab: interactive elements with [#N] refs, plus page-declared site tools. Take one before clicking or typing.
Inputs: tabId, frameId, snapshotId, maxElements.
chrome_statusBRead-onlyIdempotent
Connection status of the Chrome extension bridge (the user's real, logged-in Chrome).
Inputs: no named parameters.
chrome_switch_tabBDestructive
Activate a tab and focus its window.
Inputs: tabId (required).
chrome_typeADestructive
Focus an element by ref and type text with trusted input (replaces the current value unless append: true). submit: true presses Enter afterwards.
Inputs: ref (required), text (required), tabId, append, +3 more.
copy_pathCDestructive
Copy a file or directory.
Inputs: source (required), destination (required), overwrite, allowPartialUndo.
delete_pathADestructive
Delete a file, or a directory when recursive is true. Undoable with checkpoint_rewind.
Inputs: path (required), recursive, allowPartialUndo.
edit_fileADestructive
Replace exact text in one file. Either oldText/newText, or edits: [{oldText,newText,replaceAll}] applied atomically in order. oldText must match exactly once unless replaceAll. Reports diagnostics and a checkpoint id.
Inputs: path (required), check, edits, newText, +3 more.
fetch_urlARead-onlyIdempotent
Fetch a URL (follows redirects) and return readable text. raw: true returns the unprocessed body (useful for JSON/APIs).
Inputs: url (required), raw, maxChars.
file_infoBRead-onlyIdempotent
Check whether a path exists and get its type, size and modification time.
Inputs: path (required).
find_filesBRead-onlyIdempotent
Find files by glob pattern, e.g. "**/*.test.js" or "package.json".
Inputs: pattern (required), path, maxResults.
find_symbolBRead-onlyIdempotent
Find where a function/class/type/method is defined (name or Container.name) and where it is used (whole-word references).
Inputs: name (required), kind, path, exact, +2 more.
get_system_infoARead-onlyIdempotent
Host info, configured workspaces, default workspace and available integrations. Call this first in a new conversation.
Inputs: no named parameters.
git_commitBDestructive
Stage files (all changes by default) and create a commit.
Inputs: message (required), path, files.
git_diffARead-onlyIdempotent
Full unified diff of the working tree (or staged changes, or against a ref), optionally for one file.
Inputs: ref, file, path, staged.
git_logCRead-onlyIdempotent
Recent commit history.
Inputs: path, limit.
git_statusBRead-onlyIdempotent
git status (short) plus diff stat against HEAD.
Inputs: path.
job_cancelBDestructive
Cancel a running job (kills its process tree).
Inputs: id (required).
job_listBRead-onlyIdempotent
Recent background jobs with status.
Inputs: no named parameters.
job_outputBRead-onlyIdempotent
Read a job log: tail (default 200 lines), a line range (fromLine/lines), or grep (regex with context lines).
Inputs: id (required), grep, tail, lines, +2 more.
job_startADestructive
Run a long command (test suite, build, install, benchmark) as a background job. Waits up to waitMs (default 25s): if it finishes you get a smart summary (pass/fail counts, failing tests with context, output tail) instead of the raw log; otherwise poll job_status.
Inputs: command (required), cwd, title, waitMs, +3 more.
job_statusARead-onlyIdempotent
Status of a job; waitMs (≤50s) waits for it to finish. Finished jobs return the failure summary.
Inputs: id (required), waitMs.
kill_processBDestructive
Kill an OS process tree by PID.
Inputs: pid (required).
list_directoryBRead-onlyIdempotent
Tree listing of a directory (skips node_modules, .git, build outputs unless includeIgnored).
Inputs: path, depth, includeIgnored.
list_processesARead-onlyIdempotent
List OS processes (optionally filtered by name substring).
Inputs: filter.
list_workspacesARead-onlyIdempotent
List configured project workspaces with git branch and number of changed files.
Inputs: no named parameters.
lsp_callsBRead-onlyIdempotent
Call hierarchy of the function at file:line: incoming (who calls it) or outgoing (what it calls).
Inputs: file (required), line (required), symbol, character, +1 more.
lsp_code_actionsARead-onlyIdempotent
List language-server code actions/quick fixes/refactors for a source range without applying them.
Inputs: file (required), line (required), only, limit, +4 more.
lsp_definitionBRead-onlyIdempotent
Go to definition (kind: definition | typeDefinition | implementation) of the symbol at file:line (give character or symbol name).
Inputs: file (required), line (required), kind, symbol, +1 more.
lsp_diagnosticsARead-onlyIdempotent
Compiler/type-checker diagnostics from the real language server (gopls, typescript-language-server, pyright) for files or a directory — no VS Code needed. all: true also returns diagnostics the server reported for other files of the project.
Inputs: all, path, paths, waitMs.
lsp_format_previewBRead-onlyIdempotent
Preview language-server formatting edits for a file without applying them.
Inputs: file (required), limit, tabSize, insertSpaces.
lsp_hoverBRead-onlyIdempotent
Type signature and documentation of the symbol at file:line.
Inputs: file (required), line (required), symbol, character.
lsp_referencesARead-onlyIdempotent
All references to the symbol at file:line, resolved by the language server (exact, not text search).
Inputs: file (required), line (required), limit, symbol, +2 more.
lsp_rename_previewARead-onlyIdempotent
Preview the exact workspace edits a semantic rename would make. Does not write files; apply reviewed changes through apply_patch/edit_file.
Inputs: file (required), line (required), newName (required), limit, +2 more.
lsp_statusARead-onlyIdempotent
Which language servers are installed and running (language, project root, pid).
Inputs: no named parameters.
lsp_symbolsBRead-onlyIdempotent
Symbols: of one file (file), or matching a query across the project (query + path).
Inputs: file, path, limit, query.
move_pathCDestructive
Move or rename a file or directory.
Inputs: source (required), destination (required), overwrite, allowPartialUndo.
outlineARead-onlyIdempotent
All symbols (functions, classes, methods, types) of a file with line numbers, so you can read_file just the part you need. A directory gives a repo map of it.
Inputs: path (required).
process_inputADestructive
Write text to stdin of a process started with process_start (REPLs, prompts, interactive CLIs). close: true writes the data and closes stdin.
Inputs: id (required), data (required), close.
process_listARead-onlyIdempotent
List background processes started by this bridge.
Inputs: no named parameters.
process_outputARead-onlyIdempotent
Read new output from a background process since the last read (or all buffered output with all: true).
Inputs: id (required), all.
process_startADestructive
Start a long-running background command (dev server, watcher, long build). Returns an id; read logs with process_output, stop with process_stop.
Inputs: command (required), cwd, name, waitMs, +1 more.
process_stopADestructive
Stop a background process started with process_start (kills its whole process tree).
Inputs: id (required).
project_contextARead-onlyIdempotent
Start here for any project: detected stack and build/test/lint commands, git state, top-level layout, project instruction files, README start and saved memory notes.
Inputs: path.
project_memoryADestructive
Durable per-project notes shown by project_context in future conversations. action: list | add (note) | remove (index). Save conventions, gotchas and verified commands — not temporary state.
Inputs: note, path, index, action.
pty_listBRead-onlyIdempotent
List interactive PTY sessions.
Inputs: no named parameters.
pty_readARead-onlyIdempotent
Read new terminal output from a PTY session (or all buffered output with all: true). ANSI escapes are stripped by default.
Inputs: id (required), all, raw, maxChars.
pty_resizeCDestructive
Resize a PTY terminal.
Inputs: id (required), cols, rows.
pty_startBDestructive
Start a real interactive terminal backed by Windows ConPTY. Use for REPLs, debuggers, SSH/TUI programs and CLIs that require a terminal. By default starts the configured interactive shell; command runs inside it, or file+args starts an executable directly.
Inputs: cwd, args, cols, file, +5 more.
pty_stopCDestructive
Stop and remove an interactive PTY session.
Inputs: id (required).
pty_writeBDestructive
Write to an interactive PTY. enter: true appends the Enter key.
Inputs: id (required), data (required), enter.
read_fileARead-onlyIdempotent
Read a text file with line numbers. Relative paths resolve against the default workspace. Use startLine/endLine for large files.
Inputs: path (required), endLine, startLine.
read_many_filesARead-onlyIdempotent
Read up to 50 files in one call (strings, or {path,startLine,endLine}). Much faster than several read_file calls.
Inputs: files (required), maxTotalChars.
record_clipADestructive
Render a video clip from code: pass a complete HTML document (CSS/JS/canvas/SVG animation) or a URL; it is played headlessly at the given size for durationMs and saved as mp4/webm/gif. Default 1080x1920 (vertical, Shorts/TikTok/Reels). If the page defines window.startClip(), it is called when recording begins.
Inputs: fps, url, html, name, +7 more.
repo_mapBRead-onlyIdempotent
Compact map of a codebase: the most-referenced files with their key functions/classes/types and line numbers. Understand a large project in one call. focus: file names or symbols to prioritise.
Inputs: path, focus, maxChars.
resource_statusARead-onlyIdempotent
Current workstation resource pressure and admission-controller slots for commands, builds/tests, LSP, diagnostics, background processes and video work.
Inputs: no named parameters.
run_commandADestructive
Run a shell command (/bin/bash) and wait for it to finish. Returns exitCode, stdout, stderr. Use for builds, tests, git, npm, python, ffmpeg, etc. For servers/watchers that never exit use process_start.
Inputs: command (required), cwd, stdin, timeoutMs, +2 more.
search_codeARead-onlyIdempotent
Search file contents with a regex (ripgrep when installed, Node fallback otherwise). Returns path:line: text; context adds surrounding lines.
Inputs: query (required), glob, path, context, +3 more.
task_cancelADestructive
Cancel a durable task. A running task requires its current lease; queued/verifying/repairing tasks can be cancelled by id.
Inputs: id (required), leaseId.
task_claimBDestructive
Claim one queued/repairing task with an exclusive durable lease. Refuses unmet dependencies, lease conflicts, critical resource pressure, and worker-capacity overflow.
Inputs: id (required), workerId, workerRole.
task_contractBRead-onlyIdempotent
Read the self-contained execution/verification contract for one durable task.
Inputs: id (required).
task_eventsBRead-onlyIdempotent
Read the append-only task audit trail, optionally for one task.
Inputs: id, limit.
task_heartbeatAIdempotent
Renew a running task lease. Long-lived workers should heartbeat before lease expiry.
Inputs: id (required), leaseId (required).
task_listBRead-onlyIdempotent
List durable tasks filtered by state/project, ordered by priority then creation time.
Inputs: limit, states, project.
task_nextBDestructive
Agent-loop primitive: atomically claim the highest-priority runnable task for this worker. Multiple model clients can call this concurrently; leases prevent two workers owning the same tree.
Inputs: cwd, project, workerId, workerRole.
task_readyADestructive
Worker handoff: mark implementation ready for verification and release the worker lease. The task keeps its tree reserved while verification runs.
Inputs: id (required), leaseId (required), result, evidence.
task_reconcileADestructive
Recover a task left interrupted after restart/lease loss. Requeue it, mark it failed, or explicitly reattach a known-live worker with a fresh lease.
Inputs: id (required), disposition (required), error, evidence, +2 more.
task_statsARead-onlyIdempotent
Read task counts, active workers, configured capacity, and current resource pressure.
Inputs: no named parameters.
task_statusBRead-onlyIdempotent
Read the current durable state of one task.
Inputs: id (required).
task_submitBDestructive
Create a durable provider-neutral agent task. Supports dependencies, exclusive tree leases, idempotency, repair limits, and authoritative verification commands.
Inputs: cwd (required), objective (required), title, project, +11 more.
task_updateADestructive
Report a worker failure or interruption while it owns the task. Successful work must go through task_ready then task_verify.
Inputs: id (required), action (required), leaseId (required), error, +1 more.
task_verifyBDestructive
Run the task verification gates and apply the verdict durably. Passing gates transition to succeeded; failures transition to repairing until maxRepairRounds is exhausted.
Inputs: id (required), error, verdict, evidence, +4 more.
vscode_add_breakpointCDestructive
Add a breakpoint (optionally conditional).
Inputs: file (required), line (required), condition.
vscode_debug_stateCRead-onlyIdempotent
Active debug session and breakpoints.
Inputs: no named parameters.
vscode_diagnosticsARead-onlyIdempotent
Live compiler/linter errors and warnings from VS Code language servers (optionally filtered to one file).
Inputs: file.
vscode_find_referencesBRead-onlyIdempotent
All references to the symbol at a position (via the language server).
Inputs: file (required), line (required), character (required).
vscode_go_to_definitionCRead-onlyIdempotent
Definition location of the symbol at a position.
Inputs: file (required), line (required), character (required).
vscode_open_fileBDestructive
Open a file in VS Code at a line so the user can see it.
Inputs: file (required), line.
vscode_open_filesCRead-onlyIdempotent
Open editor tabs and the active file in VS Code.
Inputs: no named parameters.
web_searchBRead-onlyIdempotent
Search the web (DuckDuckGo). Returns title, url, snippet for the top results.
Inputs: query (required).
windows_actionADestructive
Act on a native Windows UI Automation element from windows_snapshot: invoke, setValue, toggle, select, expand, collapse, focus or scrollIntoView. Re-snapshot after meaningful UI changes.
Inputs: ref (required), action (required), pid, title, +1 more.
windows_listBRead-onlyIdempotent
List visible top-level native Windows application windows with process IDs and UI Automation refs.
Inputs: limit.
windows_screenshotARead-onlyIdempotent
Capture the visible bounds of a native Windows application window selected semantically by pid/title. Returns the PNG to the client and saves it under screenshots/.
Inputs: pid, title.
windows_snapshotBRead-onlyIdempotent
Semantic Windows UI Automation snapshot of a native app window. Returns stable runtime refs, control names/types, supported patterns and bounds. Prefer this over coordinate clicking.
Inputs: pid, title, maxElements, includeOffscreen.
windows_waitBRead-onlyIdempotent
Wait for a semantic native Windows control to appear, become enabled, or disappear. Matches by accessible name substring, AutomationId and/or control type.
Inputs: pid, name, state, title, +6 more.
write_fileADestructive
Create or fully overwrite a file (parent folders are created). Prefer apply_patch/edit_file for changes to existing files.
Inputs: path (required), content (required), check, expectedSha256.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
Loading tool schema changelog…
TDQS
Scored across 128 tools
Several large tool clusters overlap heavily: run_command/process_start/pty_start/job_start all run or manage commands, chrome_* and browser_* duplicate browser automation, and lsp_* and vscode_* duplicate language-server queries. Descriptions distinguish some contexts (real Chrome vs Playwright, background process vs PTY vs durable job), but an agent could easily misselect among them.
The dominant convention is snake_case with consistent domain prefixes (browser_, chrome_, process_, task_, lsp_, vscode_), which makes the set mostly predictable. Minor deviations exist, such as list_processes vs process_list, get_system_info, file_info, record_clip, batch, and run_command, preventing a perfect consistency score.
128 tools is an extreme over-provisioning for a single coding-agent server. Even with broad ambitions, the surface is far beyond the typical 3-15 well-scoped range and directly contributes to selection ambiguity and maintenance overhead.
The server covers a remarkably broad coding-agent lifecycle: file read/write/patch/edit, search, git status/diff/log/commit, shell, process/job/PTY control, LSP diagnostics and navigation, browser and real-Chrome automation, Windows UI automation, durable tasks, checkpoints, and web access. Some common operations are missing or only reachable via shell, such as advanced git workflows (push/pull/branch/PR) and project scaffolding, so it is strong but not fully complete.
Maintenance
Related MCP Connectors
Control plane for autonomous software labor. Agents claim objectives over MCP with audit trail.
MCP server for your apps' tools and custom tools, plus hosted AI agents and approval-gated workflows
Work management where AI agents are first-class members: tasks, projects, memory over hosted MCP
Task management your AI agents can actually run. One line becomes a context-ready task over MCP.
Related MCP Servers
- AlicenseDqualityDmaintenanceThe intelligent execution layer for coding agents, exposed as an MCP server for high-stakes engineering projects. It enables AI agents to manage plans, tasks, and integrations via tool calls.25MIT
- FlicenseNot gradedqualityDmaintenanceSecure local development platform that exposes controlled developer capabilities (FS, Git, search, command execution) to AI assistants via MCP with deny-by-default security and audit logging.-
- AlicenseNot gradedqualityBmaintenanceRemote-first, model-independent Windows execution MCP for ChatGPT, Claude, Gemini, and other MCP-compatible AI clients.MIT
- AlicenseNot gradedqualityBmaintenanceEnables AI clients to securely control and interact with a local Windows machine through 218 configurable tools for files, Git, processes, Windows UI, browser automation, WSL, Office, recovery, skills, and child MCP servers.8 npmMIT