Skip to main content
Glama
free-coding-agent
by office233

Free Coding Agent

Give frontier AI models real hands on a real developer workstation.

Free Coding Agent is an open-source, provider-neutral MCP execution layer that turns a capable model from a chat box into a hands-on software engineer. The model supplies the intelligence; Free Coding Agent supplies controlled access to files, terminals, Git, language servers, browsers, Windows UI, jobs, checkpoints, tests, and diagnostics.

LM Arena describes Code Arena as a place to build and compare with frontier AI models. Free Coding Agent is designed to be a compatible execution layer for any host that supports MCP or equivalent remote tools. It is independent software and is not an LM Arena product.

Core principle: no shared project infrastructure

Free Coding Agent does not require a relay, domain, account, API key, tunnel, or backend operated by this project.

Every installation is independent:

  • its own local configuration;

  • its own workspace allowlist;

  • its own MCP bearer token;

  • its own HTTP server;

  • its own HTTPS hostname/tunnel when remote access is enabled;

  • its own third-party account, if the user chooses a tunneling provider.

There is no common Free Coding Agent relay and no common remote credential.

Related MCP server: Workspace MCP

What it can do

  • transactional filesystem reads/writes;

  • atomic multi-file patches and rollback checkpoints;

  • optimistic SHA-256 concurrency protection;

  • shell commands and long-running processes;

  • real PTY / ConPTY for REPLs, debuggers, SSH and TUIs;

  • Git status, diff, history and repository operations;

  • headless LSP diagnostics, definitions, references, hover and symbols;

  • project inspection and project-local memory;

  • Playwright browser automation;

  • optional real-Chrome companion extension;

  • optional VS Code companion extension;

  • Windows UI automation;

  • FFmpeg/media workflows;

  • resource admission to avoid CPU/RAM stampedes;

  • MCP batching and capability discovery;

  • local stdio MCP;

  • authenticated local HTTP MCP;

  • optional personal public HTTPS MCP.

Durable Agent Mode

Free Coding Agent includes a provider-neutral task kernel for autonomous and multi-agent coding. It does not call or hardcode a model vendor: any MCP-capable model can act as a worker.

The durable loop is:

task_submit
    ↓
task_next / task_claim
    ↓
worker edits + targeted checks
    ↓
task_ready
    ↓
task_verify
   ↙       ↘
repairing  succeeded
   ↓
task_claim → repair → task_ready → task_verify

Important guarantees:

  • append-only task journal with fsync;

  • idempotency keys prevent duplicate submissions;

  • dependencies form explicit task DAGs;

  • exclusive leaseKey ownership prevents two workers from editing the same worktree at once;

  • cross-process journal locking prevents two MCP processes from racing the same task;

  • lease expiry and dead-owner recovery fail to interrupted, never fake success;

  • task_next atomically assigns the highest-priority runnable work;

  • verification commands are executed as real processes in the task workspace;

  • tasks can require an independent logical verifier identity distinct from every implementation worker;

  • failed gates create an evidence-backed repair loop;

  • configurable maximum repair rounds prevent infinite retry loops;

  • only task_verify can transition verified work to succeeded;

  • task events provide a durable audit trail.

Core tools:

task_submit
task_next
task_claim
task_heartbeat
task_ready
task_verify
task_update
task_reconcile
task_contract
task_status
task_list
task_events
task_stats
task_cancel

This is the portable agent-control layer: the model may come from OpenCode, an MCP desktop host, an IDE, a self-hosted model, or another compatible client. The task kernel only coordinates ownership, state, evidence and verification.

Worker/verifier IDs are logical identities supplied by the MCP host for coordination and audit; they are not authentication credentials.

Install on Windows

The normal installation flow is:

Download ZIP
→ extract
→ double-click install.cmd
→ choose the folder the agent may access
→ optionally configure YOUR personal HTTPS endpoint
→ Ready

The installer:

  1. verifies Node.js 20+;

  2. can install Node.js LTS when Windows Package Manager is available;

  3. installs free-coding-agent globally;

  4. configures the user's own workspace;

  5. runs free-coding-agent doctor;

  6. optionally guides the user through personal HTTPS setup.

The extracted installer folder can be deleted afterwards.

Local mode — no domain, no internet tunnel

For an MCP client running on the same machine, nothing public is needed:

{
  "mcpServers": {
    "free-coding-agent": {
      "command": "free-coding-agent",
      "args": ["stdio"]
    }
  }
}

No domain. No TLS. No exposed port. No external service.

For HTTP clients, Free Coding Agent uses the current MCP Streamable HTTP transport at POST /mcp. Deprecated legacy HTTP+SSE endpoints are intentionally not exposed in v3.

Personal HTTPS mode

When the model host is remote/cloud-based, it needs a public HTTPS URL that reaches the user's machine.

Free Coding Agent's official remote model is personal self-configuration, not a shared relay.

Run:

free-coding-agent remote setup

The setup uses the current user's own Tailscale account.

Tailscale Funnel gives that machine its own stable HTTPS hostname under the user's tailnet:

https://<device>.<tailnet>.ts.net/mcp

Free Coding Agent then:

  • generates a strong MCP bearer token locally;

  • keeps the HTTP origin bound to 127.0.0.1;

  • exposes it only through that user's Funnel;

  • stores the URL/token only in that user's application-data directory;

  • adds a current-user startup entry for the local HTTP server;

  • prints the exact MCP configuration.

Example output shape:

{
  "mcpServers": {
    "free-coding-agent": {
      "url": "https://YOUR-PERSONAL-HOST.ts.net/mcp",
      "headers": {
        "Authorization": "Bearer YOUR_LOCAL_TOKEN"
      }
    }
  }
}

Tailscale documents Funnel hostnames as predictable/stable, automatically TLS-protected, and publicly reachable while the user's machine is online.

Alternative: personal Cloudflare Tunnel

Users who own a domain on Cloudflare can use a locally managed named Cloudflare Tunnel instead.

The ownership model remains the same:

their Cloudflare account
+ their domain
+ their tunnel
+ their DNS record
+ their local MCP token

Cloudflare's documented flow is:

cloudflared tunnel login
cloudflared tunnel create <name>
cloudflared tunnel route dns <name-or-id> <hostname>
cloudflared tunnel run <name-or-id>

A named tunnel can also be installed as an OS service. Free Coding Agent does not own or operate it.

Why personal HTTPS instead of a project relay?

Because the open-source project should keep working independently of its author.

With personal endpoints:

  • no project-operated server can go offline and break everybody;

  • no project operator sees MCP traffic;

  • no shared credential exists;

  • no shared customer/device database exists;

  • no central billing requirement exists;

  • users can replace Tailscale/Cloudflare with another provider;

  • users can self-host everything indefinitely.

CLI

free-coding-agent
free-coding-agent stdio
free-coding-agent setup
free-coding-agent remote setup
free-coding-agent remote start
free-coding-agent remote status
free-coding-agent remote off
free-coding-agent doctor
free-coding-agent print-config

npm

The package is structured for public npm installation:

npm install -g free-coding-agent
free-coding-agent setup

The npm package must exist in the registry before those commands can be used from npm directly.

Security model

The agent can modify files and execute code, so remote exposure must fail closed.

The personal HTTPS setup enforces:

  • a random local MCP_API_KEY;

  • bearer authentication for every remote MCP request;

  • loopback-only local HTTP binding;

  • filesystem allowlisting via FCA_ALLOWED_ROOTS;

  • no anonymous proxy access;

  • no secret committed to Git;

  • no project-wide tunnel or account;

  • no remote credentials shared between users.

A remote URL without the user's bearer token cannot use the agent.

User configuration

Normal users should use the CLI instead of editing config manually.

Important variables:

Variable

Purpose

FCA_WORKSPACES

User's known workspaces

FCA_DEFAULT_WORKSPACE

Default workspace

FCA_ALLOWED_ROOTS

Filesystem sandbox

FCA_REMOTE_PROVIDER

Personal remote provider

FCA_REMOTE_URL

User's personal public MCP URL

FCA_TAILSCALE_DNS_NAME

User's personal Tailscale DNS name

MCP_API_KEY

User's own HTTP bearer token

MCP_HOST

Local HTTP bind address

PORT

Local HTTP port

TASKS_DIR

Durable task journal directory

TASK_LEASE_TTL_MS

Worker lease lifetime

TASK_MAX_ACTIVE

Maximum simultaneously running task workers

TASK_MAX_REPAIR_ROUNDS

Maximum evidence-backed repair rounds

TASK_VERIFY_TIMEOUT_MS

Per verification-command timeout

FCA_CHROME_BRIDGE_ENABLED

Enable real-Chrome integration

CHROME_BRIDGE_TOKEN

Local Chrome pairing secret

CHROME_EXTENSION_ID

Optional extension identity pin

VSCODE_BRIDGE_URL

Local VS Code companion endpoint

Configuration and runtime state live in standard per-user application-data directories, outside the repository.

OpenCode

OpenCode supports both local and remote MCP servers. A personal Free Coding Agent HTTPS endpoint can be configured as a remote MCP server with bearer authentication.

Conceptually:

{
  "type": "remote",
  "url": "https://YOUR-PERSONAL-HOST/mcp",
  "oauth": false,
  "headers": {
    "Authorization": "Bearer YOUR_LOCAL_TOKEN"
  }
}

Use OpenCode's current configuration schema/documentation for the surrounding config structure.

LM Arena / frontier models

Arena's public documentation describes Agent Mode and Code Arena as environments for agentic coding and frontier-model comparison.

Free Coding Agent does not scrape or automate Arena's private UI/API. If Arena exposes a supported MCP or compatible remote-tool integration, the user's personal HTTPS MCP endpoint is ready for it.

This distinction is intentional: the open-source agent remains standards-based and does not depend on undocumented consumer-site behavior.

References:

Chrome companion extension

The optional extension gives the local MCP server controlled access to the user's real Chrome.

  1. Load chrome-extension as an unpacked extension.

  2. Configure a local CHROME_BRIDGE_TOKEN.

  3. Enter the same token in the extension popup.

  4. Optionally pin the assigned extension ID.

No fixed extension identity key is stored in this repository.

VS Code companion extension

The optional extension exposes loopback-only editor state:

  • diagnostics;

  • references;

  • definitions;

  • open files;

  • debugger state.

Configuration key:

freeCodingAgent.port

Default port: 3005.

Development

npm install
npm run check
npm run privacy
npm run preflight
npm test

Privacy / publication hygiene

The public source tree intentionally excludes:

  • local .env files;

  • API keys;

  • tunnel credentials;

  • machine-specific paths;

  • user names and email addresses;

  • conversation archives;

  • browser profiles;

  • screenshots and clips;

  • logs, checkpoints and job state;

  • local memory;

  • fixed Chrome extension identity keys;

  • provider-account-specific orchestration.

npm run privacy fails if common secrets, email addresses, absolute Windows paths, or user-home paths appear in publishable source.

License

ISC. See LICENSE.

Available Tools

128 tools
apply_patchA
Destructive

Apply a multi-file patch atomically (nothing is written unless every hunk applies). Preferred way to change code. Format: *** Begin Patch *** Update File: src/app.ts @@ function main() { (optional anchor line to jump near the change) context line (space prefix) -removed line +added line *** Add File: src/new.ts +file content line *** Delete File: src/old.ts *** Update File: a.ts *** Move to: b.ts *** End Patch Include ~3 unchanged context lines around each change. The result reports compiler/linter problems in the changed files and a checkpoint id for undo.

Inputs: patch (required), cwd, check.

batchB
Destructive

Run several tool calls in one request. Parallel mode is allowed only when every called tool is read-only.

Inputs: calls (required), parallel, stopOnError, failOnAnyError.

browser_clickB
Destructive

Click an element by ref (preferred), selector or text. Returns the updated snapshot.

Inputs: ref, text, button, selector, +3 more.

browser_closeA
Destructive

Close the Playwright browser (the persistent profile stays on disk).

Inputs: no named parameters.

browser_consoleC
Read-onlyIdempotent

Console messages, page errors, failed requests and dialogs captured from the browser.

Inputs: clear, limit, onlyErrors.

browser_dialogB
Destructive

Inspect or answer a JavaScript dialog (alert/confirm/prompt) in the Playwright browser. Dialogs are never accepted automatically.

Inputs: action, promptText.

browser_evaluateB
Destructive

Run JavaScript in the page. Pass an expression ("document.title") or a function body using return.

Inputs: script (required).

browser_get_textC
Read-onlyIdempotent

Visible text of the page or of an element (CSS selector).

Inputs: maxChars, selector.

browser_hoverC
Destructive

Hover over an element.

Inputs: ref, text, selector.

browser_navigateB
Destructive

Open a URL in the Playwright-controlled Chrome (persistent profile: logins are remembered). Returns the page snapshot with element refs.

Inputs: url (required), newTab, snapshot.

browser_press_keyB
Destructive

Press a key or chord on the page, e.g. "Enter", "Escape", "Control+A", "ArrowDown".

Inputs: key (required), snapshot.

browser_record_startA
Destructive

Start recording a video of a browser session. Opens a dedicated recording tab (with your profile logins); every browser_* action afterwards is filmed until browser_record_stop.

Inputs: fps, url, name, width, +5 more.

browser_record_stopB
Destructive

Stop the recording and save the clip (mp4 via ffmpeg). Returns the file path.

Inputs: discard, trimStart.

browser_resizeC
Destructive

Set the viewport size.

Inputs: width (required), height (required).

browser_screenshotA
Read-onlyIdempotent

Screenshot of the page (or one element). The image is returned so you can see it, and saved to disk.

Inputs: ref, text, fullPage, selector.

browser_scrollC
Destructive

Scroll the page by deltaY/deltaX pixels, or scroll an element (ref/selector/text) into view.

Inputs: ref, text, deltaX, deltaY, +1 more.

browser_select_optionC
Destructive

Select option(s) in a .

Inputs: ref, text, value, values, +1 more.

browser_snapshotA
Read-onlyIdempotent

Accessibility snapshot of the current page with [ref=eN] handles. Use it before clicking/typing.

Inputs: no named parameters.

browser_tabsC
Destructive

List, open (new), select or close tabs by index.

Inputs: url, index, action.

browser_typeA
Destructive

Type into an input/textarea/contenteditable. Replaces its value unless slowly: true (types key by key). submit: true presses Enter.

Inputs: text (required), ref, slowly, submit, +1 more.

browser_upload_fileC
Destructive

Upload local file(s) through a file input or an upload button (ref/selector/text).

Inputs: ref, path, text, paths, +1 more.

browser_wait_forB
Destructive

Wait for a selector or text to appear (state visible/hidden/attached), or just wait timeoutMs.

Inputs: text, state, selector, timeoutMs.

capability_callC
Destructive

Fallback dispatcher for a capability present on the live server but missing from a cached client catalog.

Inputs: tool (required), args.

capability_listB
Read-onlyIdempotent

List the live MCP capability catalog. Use prefix to filter tool names.

Inputs: prefix, includeDescriptions.

check_filesB
Read-onlyIdempotent

Run the relevant compilers/linters (tsc, eslint, node --check, go vet, gofmt, py_compile, ruff, JSON) on specific files and report problems.

Inputs: path, paths.

checkpoint_listA
Read-onlyIdempotent

List recent checkpoints (one per file-changing tool call) with the files each one touched.

Inputs: limit.

checkpoint_rewindA
Destructive

Undo: restore files to their state before the given checkpoint (default: the latest), undoing it and every later checkpoint.

Inputs: id.

chrome_call_site_toolA
Destructive

Invoke a tool the web page itself declares (window.mcp / window.mcp_tools / meta[name=webmcp-tool]). Take a chrome_snapshot first to see the catalog.

Inputs: toolName (required), args, tabId, frameId, +1 more.

chrome_clickA
Destructive

Click an element by its [#N] ref using a real (trusted) mouse click via the Chrome debugger; falls back to a DOM click if the debugger cannot attach.

Inputs: ref (required), tabId, frameId, snapshotId, +1 more.

chrome_close_tabC
Destructive

Close a tab.

Inputs: tabId (required).

chrome_consoleC
Read-onlyIdempotent

Console messages and exceptions captured from a tab since the debugger attached to it.

Inputs: clear, tabId.

chrome_dialogA
Destructive

Inspect or answer a JavaScript dialog (alert/confirm/prompt/beforeunload) that is blocking a tab. Dialogs are never accepted automatically: read the message, then accept or dismiss (promptText for prompt()).

Inputs: tabId, action, promptText.

chrome_downloadsB
Read-onlyIdempotent

Recent Chrome downloads (file path, state, size, source URL, referrer).

Inputs: limit, since.

chrome_evaluateB
Destructive

Run JavaScript in a tab's page context (via the debugger). Pass an expression; the JSON-serializable result is returned.

Inputs: expression (required), tabId.

chrome_extension_reloadA
Destructive

Reload the Free Coding Agent Chrome extension from disk (after it was updated) and report the new version.

Inputs: no named parameters.

chrome_get_textB
Read-onlyIdempotent

Visible text of a tab (document.body.innerText, truncated).

Inputs: tabId, maxChars.

chrome_list_tabsA
Read-onlyIdempotent

List all tabs in the user's real Chrome.

Inputs: no named parameters.

chrome_navigateB
Destructive

Navigate a tab to an http(s) URL and wait for it to load.

Inputs: url (required), tabId.

chrome_new_tabC
Destructive

Open a new tab in the real Chrome.

Inputs: url, active.

chrome_pairing_setupA
Destructive

Securely configure or rotate the Chrome bridge pairing token in both the connected extension and .env. The secret is never returned. Restart the MCP worker afterwards to enforce it.

Inputs: rotate.

chrome_press_keyA
Destructive

Press a key or chord (e.g. "Enter", "Tab", "Escape", "Control+a") as a trusted key event in the tab.

Inputs: key (required), ref, tabId, frameId, +1 more.

chrome_screenshotA
Read-onlyIdempotent

Screenshot of a tab in the real Chrome (visible viewport). The image is returned so you can see it.

Inputs: tabId.

chrome_scrollB
Destructive

Scroll the inspected tab by y pixels (negative scrolls up).

Inputs: y, tabId, frameId, snapshotId.

chrome_snapshotA
Read-onlyIdempotent

Semantic snapshot of a tab: interactive elements with [#N] refs, plus page-declared site tools. Take one before clicking or typing.

Inputs: tabId, frameId, snapshotId, maxElements.

chrome_statusB
Read-onlyIdempotent

Connection status of the Chrome extension bridge (the user's real, logged-in Chrome).

Inputs: no named parameters.

chrome_switch_tabB
Destructive

Activate a tab and focus its window.

Inputs: tabId (required).

chrome_typeA
Destructive

Focus an element by ref and type text with trusted input (replaces the current value unless append: true). submit: true presses Enter afterwards.

Inputs: ref (required), text (required), tabId, append, +3 more.

copy_pathC
Destructive

Copy a file or directory.

Inputs: source (required), destination (required), overwrite, allowPartialUndo.

delete_pathA
Destructive

Delete a file, or a directory when recursive is true. Undoable with checkpoint_rewind.

Inputs: path (required), recursive, allowPartialUndo.

edit_fileA
Destructive

Replace exact text in one file. Either oldText/newText, or edits: [{oldText,newText,replaceAll}] applied atomically in order. oldText must match exactly once unless replaceAll. Reports diagnostics and a checkpoint id.

Inputs: path (required), check, edits, newText, +3 more.

fetch_urlA
Read-onlyIdempotent

Fetch a URL (follows redirects) and return readable text. raw: true returns the unprocessed body (useful for JSON/APIs).

Inputs: url (required), raw, maxChars.

file_infoB
Read-onlyIdempotent

Check whether a path exists and get its type, size and modification time.

Inputs: path (required).

find_filesB
Read-onlyIdempotent

Find files by glob pattern, e.g. "**/*.test.js" or "package.json".

Inputs: pattern (required), path, maxResults.

find_symbolB
Read-onlyIdempotent

Find where a function/class/type/method is defined (name or Container.name) and where it is used (whole-word references).

Inputs: name (required), kind, path, exact, +2 more.

get_system_infoA
Read-onlyIdempotent

Host info, configured workspaces, default workspace and available integrations. Call this first in a new conversation.

Inputs: no named parameters.

git_commitB
Destructive

Stage files (all changes by default) and create a commit.

Inputs: message (required), path, files.

git_diffA
Read-onlyIdempotent

Full unified diff of the working tree (or staged changes, or against a ref), optionally for one file.

Inputs: ref, file, path, staged.

git_logC
Read-onlyIdempotent

Recent commit history.

Inputs: path, limit.

git_statusB
Read-onlyIdempotent

git status (short) plus diff stat against HEAD.

Inputs: path.

job_cancelB
Destructive

Cancel a running job (kills its process tree).

Inputs: id (required).

job_listB
Read-onlyIdempotent

Recent background jobs with status.

Inputs: no named parameters.

job_outputB
Read-onlyIdempotent

Read a job log: tail (default 200 lines), a line range (fromLine/lines), or grep (regex with context lines).

Inputs: id (required), grep, tail, lines, +2 more.

job_startA
Destructive

Run a long command (test suite, build, install, benchmark) as a background job. Waits up to waitMs (default 25s): if it finishes you get a smart summary (pass/fail counts, failing tests with context, output tail) instead of the raw log; otherwise poll job_status.

Inputs: command (required), cwd, title, waitMs, +3 more.

job_statusA
Read-onlyIdempotent

Status of a job; waitMs (≤50s) waits for it to finish. Finished jobs return the failure summary.

Inputs: id (required), waitMs.

kill_processB
Destructive

Kill an OS process tree by PID.

Inputs: pid (required).

list_directoryB
Read-onlyIdempotent

Tree listing of a directory (skips node_modules, .git, build outputs unless includeIgnored).

Inputs: path, depth, includeIgnored.

list_processesA
Read-onlyIdempotent

List OS processes (optionally filtered by name substring).

Inputs: filter.

list_workspacesA
Read-onlyIdempotent

List configured project workspaces with git branch and number of changed files.

Inputs: no named parameters.

lsp_callsB
Read-onlyIdempotent

Call hierarchy of the function at file:line: incoming (who calls it) or outgoing (what it calls).

Inputs: file (required), line (required), symbol, character, +1 more.

lsp_code_actionsA
Read-onlyIdempotent

List language-server code actions/quick fixes/refactors for a source range without applying them.

Inputs: file (required), line (required), only, limit, +4 more.

lsp_definitionB
Read-onlyIdempotent

Go to definition (kind: definition | typeDefinition | implementation) of the symbol at file:line (give character or symbol name).

Inputs: file (required), line (required), kind, symbol, +1 more.

lsp_diagnosticsA
Read-onlyIdempotent

Compiler/type-checker diagnostics from the real language server (gopls, typescript-language-server, pyright) for files or a directory — no VS Code needed. all: true also returns diagnostics the server reported for other files of the project.

Inputs: all, path, paths, waitMs.

lsp_format_previewB
Read-onlyIdempotent

Preview language-server formatting edits for a file without applying them.

Inputs: file (required), limit, tabSize, insertSpaces.

lsp_hoverB
Read-onlyIdempotent

Type signature and documentation of the symbol at file:line.

Inputs: file (required), line (required), symbol, character.

lsp_referencesA
Read-onlyIdempotent

All references to the symbol at file:line, resolved by the language server (exact, not text search).

Inputs: file (required), line (required), limit, symbol, +2 more.

lsp_rename_previewA
Read-onlyIdempotent

Preview the exact workspace edits a semantic rename would make. Does not write files; apply reviewed changes through apply_patch/edit_file.

Inputs: file (required), line (required), newName (required), limit, +2 more.

lsp_statusA
Read-onlyIdempotent

Which language servers are installed and running (language, project root, pid).

Inputs: no named parameters.

lsp_symbolsB
Read-onlyIdempotent

Symbols: of one file (file), or matching a query across the project (query + path).

Inputs: file, path, limit, query.

move_pathC
Destructive

Move or rename a file or directory.

Inputs: source (required), destination (required), overwrite, allowPartialUndo.

outlineA
Read-onlyIdempotent

All symbols (functions, classes, methods, types) of a file with line numbers, so you can read_file just the part you need. A directory gives a repo map of it.

Inputs: path (required).

process_inputA
Destructive

Write text to stdin of a process started with process_start (REPLs, prompts, interactive CLIs). close: true writes the data and closes stdin.

Inputs: id (required), data (required), close.

process_listA
Read-onlyIdempotent

List background processes started by this bridge.

Inputs: no named parameters.

process_outputA
Read-onlyIdempotent

Read new output from a background process since the last read (or all buffered output with all: true).

Inputs: id (required), all.

process_startA
Destructive

Start a long-running background command (dev server, watcher, long build). Returns an id; read logs with process_output, stop with process_stop.

Inputs: command (required), cwd, name, waitMs, +1 more.

process_stopA
Destructive

Stop a background process started with process_start (kills its whole process tree).

Inputs: id (required).

project_contextA
Read-onlyIdempotent

Start here for any project: detected stack and build/test/lint commands, git state, top-level layout, project instruction files, README start and saved memory notes.

Inputs: path.

project_memoryA
Destructive

Durable per-project notes shown by project_context in future conversations. action: list | add (note) | remove (index). Save conventions, gotchas and verified commands — not temporary state.

Inputs: note, path, index, action.

pty_listB
Read-onlyIdempotent

List interactive PTY sessions.

Inputs: no named parameters.

pty_readA
Read-onlyIdempotent

Read new terminal output from a PTY session (or all buffered output with all: true). ANSI escapes are stripped by default.

Inputs: id (required), all, raw, maxChars.

pty_resizeC
Destructive

Resize a PTY terminal.

Inputs: id (required), cols, rows.

pty_startB
Destructive

Start a real interactive terminal backed by Windows ConPTY. Use for REPLs, debuggers, SSH/TUI programs and CLIs that require a terminal. By default starts the configured interactive shell; command runs inside it, or file+args starts an executable directly.

Inputs: cwd, args, cols, file, +5 more.

pty_stopC
Destructive

Stop and remove an interactive PTY session.

Inputs: id (required).

pty_writeB
Destructive

Write to an interactive PTY. enter: true appends the Enter key.

Inputs: id (required), data (required), enter.

read_fileA
Read-onlyIdempotent

Read a text file with line numbers. Relative paths resolve against the default workspace. Use startLine/endLine for large files.

Inputs: path (required), endLine, startLine.

read_many_filesA
Read-onlyIdempotent

Read up to 50 files in one call (strings, or {path,startLine,endLine}). Much faster than several read_file calls.

Inputs: files (required), maxTotalChars.

record_clipA
Destructive

Render a video clip from code: pass a complete HTML document (CSS/JS/canvas/SVG animation) or a URL; it is played headlessly at the given size for durationMs and saved as mp4/webm/gif. Default 1080x1920 (vertical, Shorts/TikTok/Reels). If the page defines window.startClip(), it is called when recording begins.

Inputs: fps, url, html, name, +7 more.

repo_mapB
Read-onlyIdempotent

Compact map of a codebase: the most-referenced files with their key functions/classes/types and line numbers. Understand a large project in one call. focus: file names or symbols to prioritise.

Inputs: path, focus, maxChars.

resource_statusA
Read-onlyIdempotent

Current workstation resource pressure and admission-controller slots for commands, builds/tests, LSP, diagnostics, background processes and video work.

Inputs: no named parameters.

run_commandA
Destructive

Run a shell command (/bin/bash) and wait for it to finish. Returns exitCode, stdout, stderr. Use for builds, tests, git, npm, python, ffmpeg, etc. For servers/watchers that never exit use process_start.

Inputs: command (required), cwd, stdin, timeoutMs, +2 more.

search_codeA
Read-onlyIdempotent

Search file contents with a regex (ripgrep when installed, Node fallback otherwise). Returns path:line: text; context adds surrounding lines.

Inputs: query (required), glob, path, context, +3 more.

task_cancelA
Destructive

Cancel a durable task. A running task requires its current lease; queued/verifying/repairing tasks can be cancelled by id.

Inputs: id (required), leaseId.

task_claimB
Destructive

Claim one queued/repairing task with an exclusive durable lease. Refuses unmet dependencies, lease conflicts, critical resource pressure, and worker-capacity overflow.

Inputs: id (required), workerId, workerRole.

task_contractB
Read-onlyIdempotent

Read the self-contained execution/verification contract for one durable task.

Inputs: id (required).

task_eventsB
Read-onlyIdempotent

Read the append-only task audit trail, optionally for one task.

Inputs: id, limit.

task_heartbeatA
Idempotent

Renew a running task lease. Long-lived workers should heartbeat before lease expiry.

Inputs: id (required), leaseId (required).

task_listB
Read-onlyIdempotent

List durable tasks filtered by state/project, ordered by priority then creation time.

Inputs: limit, states, project.

task_nextB
Destructive

Agent-loop primitive: atomically claim the highest-priority runnable task for this worker. Multiple model clients can call this concurrently; leases prevent two workers owning the same tree.

Inputs: cwd, project, workerId, workerRole.

task_readyA
Destructive

Worker handoff: mark implementation ready for verification and release the worker lease. The task keeps its tree reserved while verification runs.

Inputs: id (required), leaseId (required), result, evidence.

task_reconcileA
Destructive

Recover a task left interrupted after restart/lease loss. Requeue it, mark it failed, or explicitly reattach a known-live worker with a fresh lease.

Inputs: id (required), disposition (required), error, evidence, +2 more.

task_statsA
Read-onlyIdempotent

Read task counts, active workers, configured capacity, and current resource pressure.

Inputs: no named parameters.

task_statusB
Read-onlyIdempotent

Read the current durable state of one task.

Inputs: id (required).

task_submitB
Destructive

Create a durable provider-neutral agent task. Supports dependencies, exclusive tree leases, idempotency, repair limits, and authoritative verification commands.

Inputs: cwd (required), objective (required), title, project, +11 more.

task_updateA
Destructive

Report a worker failure or interruption while it owns the task. Successful work must go through task_ready then task_verify.

Inputs: id (required), action (required), leaseId (required), error, +1 more.

task_verifyB
Destructive

Run the task verification gates and apply the verdict durably. Passing gates transition to succeeded; failures transition to repairing until maxRepairRounds is exhausted.

Inputs: id (required), error, verdict, evidence, +4 more.

vscode_add_breakpointC
Destructive

Add a breakpoint (optionally conditional).

Inputs: file (required), line (required), condition.

vscode_debug_stateC
Read-onlyIdempotent

Active debug session and breakpoints.

Inputs: no named parameters.

vscode_diagnosticsA
Read-onlyIdempotent

Live compiler/linter errors and warnings from VS Code language servers (optionally filtered to one file).

Inputs: file.

vscode_find_referencesB
Read-onlyIdempotent

All references to the symbol at a position (via the language server).

Inputs: file (required), line (required), character (required).

vscode_go_to_definitionC
Read-onlyIdempotent

Definition location of the symbol at a position.

Inputs: file (required), line (required), character (required).

vscode_open_fileB
Destructive

Open a file in VS Code at a line so the user can see it.

Inputs: file (required), line.

vscode_open_filesC
Read-onlyIdempotent

Open editor tabs and the active file in VS Code.

Inputs: no named parameters.

windows_actionA
Destructive

Act on a native Windows UI Automation element from windows_snapshot: invoke, setValue, toggle, select, expand, collapse, focus or scrollIntoView. Re-snapshot after meaningful UI changes.

Inputs: ref (required), action (required), pid, title, +1 more.

windows_listB
Read-onlyIdempotent

List visible top-level native Windows application windows with process IDs and UI Automation refs.

Inputs: limit.

windows_screenshotA
Read-onlyIdempotent

Capture the visible bounds of a native Windows application window selected semantically by pid/title. Returns the PNG to the client and saves it under screenshots/.

Inputs: pid, title.

windows_snapshotB
Read-onlyIdempotent

Semantic Windows UI Automation snapshot of a native app window. Returns stable runtime refs, control names/types, supported patterns and bounds. Prefer this over coordinate clicking.

Inputs: pid, title, maxElements, includeOffscreen.

windows_waitB
Read-onlyIdempotent

Wait for a semantic native Windows control to appear, become enabled, or disappear. Matches by accessible name substring, AutomationId and/or control type.

Inputs: pid, name, state, title, +6 more.

write_fileA
Destructive

Create or fully overwrite a file (parent folders are created). Prefer apply_patch/edit_file for changes to existing files.

Inputs: path (required), content (required), check, expectedSha256.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

Loading tool schema changelog…

    TDQS

    C2.9/5.0

    Scored across 128 tools

    Disambiguation2/5

    Several large tool clusters overlap heavily: run_command/process_start/pty_start/job_start all run or manage commands, chrome_* and browser_* duplicate browser automation, and lsp_* and vscode_* duplicate language-server queries. Descriptions distinguish some contexts (real Chrome vs Playwright, background process vs PTY vs durable job), but an agent could easily misselect among them.

    Naming Consistency4/5

    The dominant convention is snake_case with consistent domain prefixes (browser_, chrome_, process_, task_, lsp_, vscode_), which makes the set mostly predictable. Minor deviations exist, such as list_processes vs process_list, get_system_info, file_info, record_clip, batch, and run_command, preventing a perfect consistency score.

    Tool Count1/5

    128 tools is an extreme over-provisioning for a single coding-agent server. Even with broad ambitions, the surface is far beyond the typical 3-15 well-scoped range and directly contributes to selection ambiguity and maintenance overhead.

    Completeness4/5

    The server covers a remarkably broad coding-agent lifecycle: file read/write/patch/edit, search, git status/diff/log/commit, shell, process/job/PTY control, LSP diagnostics and navigation, browser and real-Chrome automation, Windows UI automation, durable tasks, checkpoints, and web access. Some common operations are missing or only reachable via shell, such as advanced git workflows (push/pull/branch/PR) and project scaffolding, so it is strong but not fully complete.

    Maintenance

    ActivityNo data
    ResponsivenessOutdated data

    Related MCP Connectors

    Related MCP Servers

    • A
      license
      D
      quality
      D
      maintenance
      The intelligent execution layer for coding agents, exposed as an MCP server for high-stakes engineering projects. It enables AI agents to manage plans, tasks, and integrations via tool calls.
      25
      MIT
    • F
      license
      Not graded
      quality
      D
      maintenance
      Secure local development platform that exposes controlled developer capabilities (FS, Git, search, command execution) to AI assistants via MCP with deny-by-default security and audit logging.
      -
    • A
      license
      Not graded
      quality
      B
      maintenance
      Enables AI clients to securely control and interact with a local Windows machine through 218 configurable tools for files, Git, processes, Windows UI, browser automation, WSL, Office, recovery, skills, and child MCP servers.
      8 npm
      MIT