Skip to main content
Glama

LocalBridge MCP

CI CodeQL Release License: Apache-2.0

LocalBridge MCP is a self-hosted bridge between an online AI assistant and your own computer.

Most online assistants can reason, write code, and plan work, but they normally cannot touch the local files, terminals, repos, logs, and scripts that make real work happen. LocalBridge MCP gives a trusted assistant a controlled doorway into a machine you own, so it can inspect files, edit text, search a project, run tests, use Git, and operate a shell inside the boundaries you choose.

Think of it as a local workbench for an online AI assistant:

online AI assistant
  -> your connector or tunnel
  -> LocalBridge MCP on your computer
  -> allowed files, search, edits, shell, Git, SSH, tests, scripts

It is not a cloud agent. It is not a hosted relay. It is not a sandbox. It is your computer, your credentials, your allowlist, and your risk boundary.

LocalBridge MCP is intentionally powerful. Treat it like giving an assistant access to a terminal, not like installing a harmless browser bookmark.

Why I built it

For the engineering story behind LocalBridge MCP, including the cost motivation, ChatGPT-to-macOS architecture, runtime reliability work, and how it fits alongside Codex and API usage, see AI Engineering Field Notes Part 02: Codex Quota Wasn’t Enough, So I Gave ChatGPT a Way Into My Mac.

In one minute

Use LocalBridge MCP when you want an online AI assistant to help with local computer work, for example:

  • look through a repo and explain what changed;

  • edit files and run the test suite;

  • search a project faster than copying snippets into chat;

  • execute small shell commands and return exact output;

  • drive Git, SSH, package managers, Docker, build scripts, or deployment commands;

  • keep a persistent macOS runtime online through OpenAI Secure MCP Tunnel.

The currently qualified happy path is:

ChatGPT
  -> developer-mode MCP app
  -> OpenAI Secure MCP Tunnel
  -> LocalBridge MCP Runtime.app on macOS
  -> local filesystem and shell tools

That path has been end-to-end tested for listing files, reading files, writing a smoke-test file, and running a shell command.

Related MCP server: remote-desktop-commander

Can I use it on Windows?

Not as a supported path yet.

Parts of the TypeScript core are written with portability in mind, but this repository does not currently claim Windows qualification. The Windows path still needs dedicated testing for path handling, line endings, shell behavior, process management, service startup, tunnel-client, permissions, and ChatGPT end-to-end tool calls.

Practical guidance:

  • macOS: use this repo's qualified ChatGPT/OpenAI Secure MCP Tunnel path.

  • Linux: the portable stdio core is tested in CI, but no production service manager is advertised here yet.

  • Windows: treat as future work or an experiment, not a documented install target.

  • WSL: may be useful for experimentation, but it should be treated as an unqualified Linux-like environment until someone runs a focused WSL/Windows qualification pass.

See docs/PORTABILITY.md for the current portability contract.

AI-assisted install prompt

You can give this repository to ChatGPT or another online AI assistant and ask it to install LocalBridge MCP on your machine. Use a prompt like this:

Install LocalBridge MCP from https://github.com/danielcanfly/localbridge-mcp on this computer.

Read README.md, docs/ONLINE_PLATFORMS.md, docs/platforms/protocol-compatible-guides.md, docs/platforms/platform-flow-reference.md, and docs/INSTALL_MACOS.md first. Do not invent credentials. Do not print secrets.

Start by asking me which online platform I want to connect:
- ChatGPT / OpenAI
- Claude.ai / Claude custom connector
- Claude MCP tunnels
- Grok
- Perplexity
- Gemini Apps or Gemini Enterprise
- Mistral Le Chat / Work / Studio
- GitHub Copilot cloud/app
- Kimi web
- Other

The qualified path is ChatGPT through OpenAI Secure MCP Tunnel on macOS. Other online platforms may support custom remote MCP servers, but they need a platform-specific connector URL, tunnel, gateway, or adapter path. Do not run the OpenAI-specific setup unless I choose ChatGPT / OpenAI.

After I choose a platform, show me exactly where to create or find the platform-specific tunnel, key, connector URL, OAuth/client setting, or gateway requirement before asking me to provide or confirm anything. Give the official setup URLs in the answer.

If I choose ChatGPT / OpenAI, show these links before asking for Tunnel ID or Runtime API key readiness:
- OpenAI Tunnels management: https://platform.openai.com/settings/organization/tunnels
- OpenAI Runtime API keys: https://platform.openai.com/settings/organization/api-keys
- ChatGPT developer-mode plugin page: https://chatgpt.com/plugins
- OpenAI tunnel-client guide: https://github.com/openai/tunnel-client/blob/master/docs/end-user-guide.md
- OpenAI tunnel-client permissions: https://github.com/openai/tunnel-client/blob/master/docs/permissions.md

For the ChatGPT / OpenAI path, I will provide or confirm separately:
- my OpenAI Secure MCP Tunnel ID;
- my own OpenAI Runtime API key with Tunnels permission only, stored locally and not pasted into chat;
- the local directories I want LocalBridge MCP to access;
- whether tunnel-client is already installed;
- macOS privacy approvals when LocalBridge MCP Runtime.app asks for access.

Use the repository scripts instead of hand-writing a service:
1. clone the repo;
2. run npm ci;
3. run npm test;
4. create ~/.config/localbridge-mcp/tunnel-runtime-key with chmod 600, but never display the key;
5. run scripts/setup-macos.sh with my allowlist, tunnel id, and file: key reference;
6. run tunnel-client doctor for the generated profile;
7. verify scripts/macos-service.sh status returns HEALTH=ok and READY=ok.

If you do not have a local shell/filesystem tool for this Mac, do not stop after only saying you cannot operate the machine. Instead, switch to manual Terminal bootstrap mode:
- give me one complete macOS Terminal script I can copy and paste;
- the script must ask for tunnel ID and allowlist interactively;
- the script must ask for the Tunnels-only API key with hidden input;
- the script must write the key to ~/.config/localbridge-mcp/tunnel-runtime-key with chmod 600;
- the script must not print the key;
- the script must clone or update LocalBridge MCP, run npm ci, run npm test, run setup-macos.sh, run tunnel-client doctor, and run macos-service.sh status;
- the script must not require me to edit placeholders before pasting;
- after the script runs, ask me to paste the terminal output back here for review.

Stop and ask me if any credential, connector/tunnel, tunnel-client installation, macOS permission, or allowlist is missing.

The assistant can perform local setup work when it has a local execution tool. Without one, it should provide the manual bootstrap script from docs/INSTALL_MACOS.md rather than asking the user to paste secrets into chat.

Every user must provide their own platform configuration, key, and filesystem boundaries.

Status

Item

Status

Latest release

v0.2.1

Distribution

Source release only

npm package

Disabled intentionally (private: true)

Qualified online platform path

ChatGPT through OpenAI Secure MCP Tunnel

Other online platforms

Researched in docs/ONLINE_PLATFORMS.md; protocol-compatible guides exist, but not yet qualified here

macOS local core

Qualified

Linux local core

Qualified in CI

macOS persistent runtime

Qualified with launchd and Runtime.app

Windows

Not yet qualified; do not advertise as supported

Hosted relay

Not provided

Release: LocalBridge MCP v0.2.1

What this repo is and is not

This repo is

This repo is not

A self-hosted MCP server for local files, search, editing, and shell work

A hosted SaaS relay

A bridge from online assistants to a user-owned runtime

A shared public endpoint

A macOS-qualified ChatGPT/OpenAI Secure MCP Tunnel setup

A universal all-platform installer

A controlled local automation surface

A security sandbox

Source release only

An npm-published package

LocalBridge MCP does not provide a hosted relay. It also does not provide shared credentials, a shared tunnel, a cloud agent, a web dashboard, model hosting, or billing infrastructure.

Each user brings their own computer, platform account, connector or tunnel, API key if required, filesystem allowlist, and security boundary.

Start here: choose the online platform

Every guided install should start by asking:

Which online platform are you connecting LocalBridge MCP to?

Choose one if possible:
- ChatGPT / OpenAI
- Claude.ai / Claude custom connector
- Claude MCP tunnels
- Grok
- Perplexity
- Gemini Apps or Gemini Enterprise
- Mistral Le Chat / Work / Studio
- GitHub Copilot cloud/app
- Kimi web
- Other

Do not assume ChatGPT. Tunnel IDs, API keys, connector URLs, OAuth settings, and remote MCP requirements are platform-specific.

The only currently qualified online path in this repository is ChatGPT / OpenAI Secure MCP Tunnel on macOS. Other online platforms may support custom remote MCP servers, but LocalBridge MCP still needs a platform-compatible remote transport path before they are claimed as supported.

See:

Before you install

LocalBridge MCP cannot be installed completely from this repository alone. The repository provides the server, scripts, and documentation. The user provides the local authority boundary.

Required user inputs for the qualified ChatGPT path

Required input

What it means

Who provides it

Safe handling

Target online platform

ChatGPT/OpenAI, Claude, Grok, Perplexity, Gemini, Mistral, GitHub Copilot cloud/app, Kimi web, or other

User

Ask before choosing commands

OpenAI Secure MCP Tunnel ID

The OpenAI tunnel identifier, usually starting with tunnel_

User

Required only for the OpenAI path; show the OpenAI Tunnels link before asking for it; do not invent it

Tunnels-only Runtime API key

An OpenAI API key restricted to the Tunnels permission

User

Required only for the OpenAI path; show the Runtime API key link before asking whether it is prepared; do not paste it into chat

Filesystem allowlist

Local directories LocalBridge MCP may read/write through filesystem tools

User

Start narrow, for example one project folder; avoid $HOME unless intentional

macOS privacy approval

Permission for LocalBridge MCP Runtime.app to access protected folders such as Desktop or Documents

User through macOS prompts

Approve only folders you intend the assistant to use

tunnel-client installation

The OpenAI tunnel client binary available on the local machine

User or installer

Required only for the OpenAI tunnel path

For other online platforms, see docs/ONLINE_PLATFORMS.md first. Most non-OpenAI platforms expect a remote HTTPS MCP server URL, not an OpenAI Secure MCP Tunnel ID.

Installer behavior for AI assistants

If you are an AI assistant installing LocalBridge MCP:

  1. Read this README, docs/ONLINE_PLATFORMS.md, docs/platforms/protocol-compatible-guides.md, docs/platforms/platform-flow-reference.md, and docs/INSTALL_MACOS.md before running commands.

  2. Ask which online platform the user wants to connect before choosing an install path.

  3. After the user chooses a platform, show that platform's setup links and credential instructions before asking for missing values.

  4. If the user chooses ChatGPT/OpenAI, show the OpenAI Tunnels, Runtime API key, ChatGPT plugin creation page, and tunnel-client docs links before asking for tunnel ID, runtime key readiness, or tunnel-client status.

  5. If the user chooses Claude, Grok, Perplexity, Gemini, Mistral, GitHub Copilot cloud/app, or Kimi web, show the platform's setup links first, explain that the platform may support custom remote MCP servers, and stop if the user does not have a reachable LocalBridge remote MCP URL or gateway.

  6. If the user chooses an unverified platform such as Poe, MiniMax chat/web, DeepSeek web, You.com chat, or another platform, ask for official custom MCP connector documentation before claiming support.

  7. Check that Node.js and npm are installed. For the ChatGPT tunnel path, also check tunnel-client.

  8. Ask the user to create any secret API key locally, or to provide a local file path containing it. Do not ask them to paste secrets into chat.

  9. Ask which directories should be allowlisted. Do not choose broad directories on behalf of the user.

  10. Stop before installing the persistent macOS service if the required platform credential, connector/tunnel identifier, key file, allowlist, or required macOS permission is missing.

  11. Never generate fake credentials, tunnel IDs, connector URLs, SSH keys, or API keys.

  12. Never store credentials in the repository.

  13. Never print API keys, SSH keys, or tunnel secrets.

  14. If you do not have a local shell or filesystem tool for the user's Mac, do not merely stop after explaining that limitation. Switch to manual Terminal bootstrap mode and provide one complete copy-paste script that prompts interactively for tunnel ID, allowlist, and hidden API key input.

  15. The manual bootstrap script must not require the user to edit placeholders. It should use read prompts, read -s or an equivalent hidden-input method for the API key, write the key to a local file with mode 600, run the repository setup scripts, verify service health, and ask the user to paste terminal output back into the chat.

ChatGPT setup, in plain English

For the qualified ChatGPT/OpenAI path, the user supplies three things:

  1. A tunnel: the private route between ChatGPT and the user's local machine.

  2. A restricted Runtime API key: used by tunnel-client to keep that route alive. Do not paste it into chat.

  3. An allowlist: the local directories LocalBridge is allowed to touch.

The local runtime then runs behind launchd and LocalBridge MCP Runtime.app on macOS.

After the local install is healthy, the ChatGPT-side app is created from:

https://chatgpt.com/plugins

With Developer Mode enabled, a + button appears next to the plugin search box. Click it and fill the new plugin form:

Name:
LocalBridge MCP

Description:
Self-hosted MCP bridge for local files, search, editing, shell sessions, Git, and SSH.

Connection:
Tunnel / 通道

Available tunnel:
Select localbridge-mcp (tunnel_...)

Authentication:
None / No authentication / 無

Advanced OAuth settings:
Leave unset for the current stdio-over-tunnel path.

Start with read-only smoke tests before write or shell tests.

When an AI assistant is guiding setup, it must not only ask for a missing tunnel ID, API key, connector URL, or allowlist. It must first show the platform-specific setup links and explain where the user creates or finds each value.

For ChatGPT / OpenAI, show this block before asking whether the user already has a tunnel ID or runtime key:

Create or find your OpenAI Secure MCP Tunnel:
https://platform.openai.com/settings/organization/tunnels

Create a Runtime API key for tunnel-client:
https://platform.openai.com/settings/organization/api-keys

Use a restricted runtime key with Tunnels permission for the long-running daemon.
Do not paste the key into chat. The bootstrap script will read it with hidden input and store it locally at:
~/.config/localbridge-mcp/tunnel-runtime-key

Do not use an Admin API key as the long-running runtime key. Admin keys are for tunnel management, not the daemon.

Create the ChatGPT developer-mode MCP app:
https://chatgpt.com/plugins

OpenAI tunnel-client installation and permission docs:
https://github.com/openai/tunnel-client/blob/master/docs/end-user-guide.md
https://github.com/openai/tunnel-client/blob/master/docs/permissions.md

For non-OpenAI platforms, show the platform setup links from docs/ONLINE_PLATFORMS.md, docs/platforms/protocol-compatible-guides.md, or docs/platforms/platform-flow-reference.md before asking for a connector URL, OAuth/client configuration, vendor key, bearer token, tunnel token, or enterprise data-store settings.

Do not promise that any vendor key, tunnel, connector, or tool call is free. Safe wording is: use the narrowest platform key or auth method available, keep budgets or alerts enabled where available, and check the vendor's current billing policy.

macOS persistent ChatGPT runtime

The qualified macOS production path is:

ChatGPT
  -> your MCP app
  -> your OpenAI Secure MCP Tunnel
  -> launchd
  -> LocalBridge MCP Runtime.app
  -> tunnel-client
  -> Node.js
  -> LocalBridge MCP

Additional requirements:

  • macOS;

  • Xcode Command Line Tools;

  • tunnel-client installed;

  • your own OpenAI Secure MCP Tunnel ID;

  • your own Runtime API key restricted to the Tunnels permission;

  • a local filesystem allowlist.

See docs/INSTALL_MACOS.md for the full installation, OpenAI setup links, update, profile-only validation, uninstall flow, and copy-paste bootstrap script for AI sessions that cannot operate the local terminal directly.

Quick start: local stdio MCP server

The local stdio path is still available for development and testing, but this repository's public installation guide targets online platforms first.

git clone https://github.com/danielcanfly/localbridge-mcp.git
cd localbridge-mcp
npm ci
npm test
./scripts/setup-core.sh --allow "$HOME/Projects"
./scripts/doctor.sh

What LocalBridge MCP does

LocalBridge MCP gives an AI assistant a tool surface for practical local work:

  • read, list, and inspect allowed local files;

  • write, move, create, and patch text files;

  • run fast text search with session-based pagination;

  • start and manage persistent shell sessions;

  • drive Git, SSH, test runners, package managers, Docker, and other CLI workflows through the shell;

  • on macOS, run persistently behind OpenAI Secure MCP Tunnel through a local Runtime.app and launchd.

MCP tool surface

LocalBridge MCP exposes 17 tools using a product-owned lb_* namespace:

Area

Tools

Filesystem read

lb_read_text, lb_read_many_texts, lb_list_entries, lb_stat_path

Filesystem write

lb_write_text, lb_make_directory, lb_move_path, lb_patch_text_block

Search

lb_search_start, lb_search_read, lb_search_cancel, lb_search_sessions

Shell

lb_run_shell, lb_shell_output, lb_shell_input, lb_shell_sessions, lb_shell_kill

Git, SSH, package managers, test runners, and deployment workflows use the general shell surface instead of product-specific wrappers.

Security model

LocalBridge MCP is a local control plane. Treat it like giving an assistant access to your terminal.

Filesystem allowlists and command blocklists are guardrails, not an operating-system sandbox. Shells, interpreters, scripts, SSH commands, and package managers can reach resources available to the OS user that runs LocalBridge MCP.

Recommended practices:

  • use a dedicated OS account, VM, container, or disposable workspace for higher-risk work;

  • keep credentials outside the repository;

  • restrict OpenAI API keys to the minimum required permission, normally Tunnels only for the OpenAI path;

  • avoid broad filesystem allowlists such as $HOME unless you intentionally want that scope;

  • do not expose an unauthenticated shell-capable MCP endpoint to the public Internet;

  • review SECURITY.md before enabling remote access.

macOS service commands

./scripts/macos-service.sh status
./scripts/macos-service.sh update
./scripts/macos-service.sh restart
./scripts/macos-service.sh stop
./scripts/macos-service.sh start
./scripts/macos-service.sh uninstall

Configuration

Default configuration is fail-closed:

{
  "allowedDirectories": []
}

See config.example.json.

User-specific paths, tunnel IDs, connector URLs, API keys, SSH aliases, private keys, and runtime secrets belong in external configuration, never in this repository.

fileWriteLineLimit is an advisory chunking threshold for lb_write_text. It warns about large writes; it is not a security boundary or hard size cap.

Repository layout

src/                 MCP server and local execution core
scripts/             setup, doctor, release, and macOS service scripts
runtime-app/         macOS Runtime.app Swift entrypoint
test/                integration qualification suites
docs/                architecture, installation, portability, online-platform, and release docs
docs/qualification/ historical qualification evidence

Development

npm ci
npm test
npm run release:preflight

Documentation

Provenance and license

LocalBridge MCP is released under the Apache License 2.0.

Selected execution-core code is derived from Desktop Commander MCP under the MIT license. Required third-party license and provenance notices are preserved in THIRD_PARTY_NOTICES.md.

Available Tools

17 tools
lb_list_entriesA
Read-only

List files and directories inside an allowed directory.

ParametersJSON Schema
NameRequiredDescriptionDefault
directory_pathYes

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, and the description adds the scope limit of 'an allowed directory.' It does not disclose recursive behavior, hidden-file handling, or behavior for disallowed paths, but the safety profile is covered by annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One sentence with no wasted words; the verb and resource are front-loaded. The description is optimally concise for its scope.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple, with one required parameter and no output schema, so the description plus annotations provide a workable baseline. It still omits details like returned entry format and the precise meaning of 'allowed directory,' leaving some ambiguity for an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must carry parameter meaning. It does clarify that directory_path points to a directory and that the result is the entries inside it, but it does not specify path format or allowed-path constraints beyond the word 'allowed.' This is adequate for one self-explanatory parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'List files and directories inside an allowed directory,' making the core function clear and distinguishable from read/stat siblings. It does not explicitly name an alternative, so it stops short of a perfect score.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The use case is implied by the verb 'List files and directories,' so an agent can infer when to use it. However, there is no explicit guidance on when to prefer this over siblings or how to interpret 'allowed directory.'

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

lb_make_directoryA

Create a directory, including missing parent directories, inside configured allowed directories.

ParametersJSON Schema
NameRequiredDescriptionDefault
directory_pathYes

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already signal a non-read-only, non-destructive mutation; the description adds useful behavioral detail beyond that: missing parent directories are created and only configured allowed directories are targets. It does not mention failure behavior or what happens if the directory already exists, but no contradiction with annotations exists.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, front-loaded sentence puts the verb first and tucks modifiers after it, with no filler. Every phrase ('including missing parent directories', 'inside configured allowed directories') earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter filesystem mutation tool with no output schema and annotations covering read-only/destructive signals, the description is mostly complete: it reveals recursion and scope. Minor omissions such as existing-directory behavior and path resolution rules keep it from a perfect score.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage and a single directory_path parameter, the description partially compensates by explaining that nested paths are accepted and that the path is constrained to configured allowed directories. It does not clarify path format, absolute/relative interpretation, or how allowed directories are determined, leaving some burden still on the parameter name.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear action ('Create a directory') and a specific resource, and adds two defining constraints: recursive parent creation and restriction to configured allowed directories. This distinguishes it from sibling tools like lb_write_text or lb_move_path, which operate on files rather than create directories.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use it (when a directory, including parents, needs to be created) and names the allowed-directory boundary, but it provides no explicit when-not-to-use guidance or comparison with alternatives. Usage context is present but not fully spelled out.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

lb_move_pathA
Destructive

Move or rename a file or directory within configured allowed directories.

ParametersJSON Schema
NameRequiredDescriptionDefault
to_pathYes
from_pathYes

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already mark this as destructive and non-read-only. The description adds the useful constraint that operations are limited to configured allowed directories. It does not disclose overwrite behavior, error cases, or path resolution, but the annotation coverage reduces the burden.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is one focused sentence with no filler. The operation and the key boundary are front-loaded, making it easy for an agent to parse quickly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive move operation with no output schema, the description lacks important safety and behavior details: destination-conflict handling, behavior when the source does not exist, and directory-versus-file semantics. The allowed-directory boundary is helpful but does not fully specify a safe invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the schema only provides names and minLength. The description implies from_path is the source and to_path is the destination through 'move or rename', but it does not explain path formats, absolute versus relative paths, or whether to_path can be an existing directory.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses an explicit verb phrase, 'Move or rename a file or directory', and adds the boundary 'within configured allowed directories'. This clearly identifies the operation and resource, and it is distinct from sibling tools like lb_read_text, lb_write_text, and lb_stat_path.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies this tool is for relocation or renaming, but it does not explicitly name alternatives or state when not to use it. It lacks exclusions such as 'for content edits use lb_write_text' or 'for inspection use lb_stat_path', so routing relies on inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

lb_patch_text_blockA
Destructive

Replace a text block in a UTF-8 file. Uses exact replacement first and a bounded fuzzy fallback when one replacement is expected.

ParametersJSON Schema
NameRequiredDescriptionDefault
file_pathYes
find_textYes
replace_textYes
expected_matchesNo

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint=true and readOnlyHint=false, so the destructive nature is known. The description adds valuable behavior beyond that: 'Uses exact replacement first and a bounded fuzzy fallback when one replacement is expected' reveals the matching strategy and the role of expected_matches. However, it does not explain edge cases like zero matches or multiple matches, but the provided detail is meaningful.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences, front-loading the action and then adding behavioral detail. No wasted words; it is appropriately sized for the tool's complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the core purpose and matching behavior but omits details about error handling, what happens if no match is found, or if expected_matches is greater than 1. For a destructive operation with no output schema, more guidance on failure modes would improve completeness. However, the essential calling information is present.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must compensate. It indirectly explains expected_matches via 'when one replacement is expected', and implies find_text and replace_text are the texts involved. However, it does not explicitly describe each parameter or provide format details, leaving some interpretation to the agent. The parameter names are self-explanatory, so it partially compensates.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action: 'Replace a text block in a UTF-8 file', identifying the verb and resource. It also distinguishes itself from siblings like lb_write_text (which writes whole files) and lb_read_text (which reads) by focusing on targeted block replacement. The mention of exact replacement and fuzzy fallback adds further specificity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies its use case (targeted block replacement) but does not explicitly state when to choose it over alternatives like lb_write_text or when not to use it. It does not mention exclusions or alternative tools. The behavior described (exact then fuzzy) offers some guidance but lacks explicit comparison.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

lb_read_many_textsA
Read-only

Read multiple UTF-8 text files inside configured allowed directories in one call.

ParametersJSON Schema
NameRequiredDescriptionDefault
file_pathsYes
line_countNo
line_offsetNo

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already convey readOnlyHint=true and destructiveHint=false, and the description adds useful behavioral context: UTF-8 encoding, allowed-directory restrictions, and batched single-call reading. However, it does not disclose what happens if a path is missing, whether line_count/line_offset apply per file or across all files, or any error behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single front-loaded sentence with no filler or repetition. Every phrase adds meaningful information: what is read, the encoding, the directory restriction, and the batching behavior.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a multi-file read tool with no output schema and 0% parameter descriptions, so the description needed to explain return shape, error handling for invalid paths or paths outside allowed directories, and how line_count/line_offset apply. The annotations cover the safety profile, but the operational details an agent needs for reliable invocation are missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With schema description coverage at 0%, the description needed to explain file_paths, line_count, and line_offset. It only indirectly contextualizes file_paths as multiple UTF-8 text files; line_count and line_offset are left entirely to inference from their names, and their exact relationship to the batch read is unclear.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action (Read), resource (multiple UTF-8 text files), and constraints (inside configured allowed directories, in one call). This clearly distinguishes it from the singular lb_read_text sibling and leaves no ambiguity about the tool's core function.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description establishes a clear use case: reading multiple UTF-8 text files in a single batch call, restricted to configured allowed directories. It does not explicitly name alternatives or say 'use this instead of lb_read_text', but the 'multiple' and 'in one call' phrasing gives an agent sufficient context to select it over the singular sibling.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

lb_read_textA
Read-only

Read a UTF-8 text file inside configured allowed directories. Supports line offset and line count.

ParametersJSON Schema
NameRequiredDescriptionDefault
file_pathYes
line_countNo
line_offsetNo

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish read-only and non-destructive behavior, so the description adds value by disclosing the allowed-directory restriction and the UTF-8 requirement. It does not describe output or error behavior, but for a read-only operation with annotations present this is acceptable.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences with no filler, with the core purpose and scope front-loaded and the optional parameters stated second. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only tool, the core behavior is covered, but there is no return-value description or explanation of line_offset/line_count semantics, and no output schema to compensate. An agent can call it correctly in basic cases but may misread partial-read behavior without more detail.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema descriptions cover 0% of parameters, so the description must supply meaning. It identifies 'line offset' and 'line count' as supported parameters, but it leaves file_path semantics to the name and does not clarify whether offsets are zero-based, defaults, or how line_count behaves when omitted.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names the action (read), the resource (a UTF-8 text file), and a precise scope (inside configured allowed directories). This makes it easy to distinguish from siblings like lb_read_many_texts and lb_write_text.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It clearly communicates that the tool applies only to files inside allowed directories and that line offset and line count are supported for partial reads. It does not explicitly name alternative tools or state when not to use it, but the context is sufficiently clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

lb_run_shellA
Destructive

Start a shell command in a persistent local terminal session. The session can later receive stdin and expose paginated output. Commands are checked against the configured blocklist.

ParametersJSON Schema
NameRequiredDescriptionDefault
wait_msNo
shell_pathNo
command_lineYes

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate destructiveHint=true and readOnlyHint=false, so the mutation risk is covered. The description adds useful context beyond annotations: commands are checked against a blocklist, sessions are persistent, output is paginated, and stdin can be provided later.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences with the action front-loaded. The first sentence states the verb and resource; the second adds lifecycle and safety context. No filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description sketches the full workflow—start, later stdin, paginated output, blocklist—but omits practical integration details such as how the session is identified after creation, how output is retrieved via lb_shell_output, and how to terminate the session. Since there is no output schema, these missing return-value and follow-up details leave an agent partially guessing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description does not compensate. It only implies command_line's role via 'shell command', while wait_ms and shell_path are left entirely unexplained. The parameter names are somewhat self-evident, but no real semantic guidance is provided.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a precise action and resource: start a shell command in a persistent local terminal session. It also distinguishes this tool from siblings like lb_shell_output, lb_shell_input, and lb_shell_kill by emphasizing session creation and later stdin/output capabilities.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use the tool: when a command should run in a persistent session that can later receive stdin and expose paginated output. However, it does not explicitly name alternatives or state when not to use it, leaving usage guidance mostly inferred.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

lb_search_cancelA

Cancel an active search session.

ParametersJSON Schema
NameRequiredDescriptionDefault
search_idYes

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate this is not read-only and not destructive, so the description's 'Cancel' action is consistent. The word 'active' adds a useful scoping hint that cancelling an inactive session may not be valid, but the description provides no further behavioral details such as side effects, idempotency, or error behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no redundant words. Every part contributes to stating the tool's core action.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter tool, a one-sentence description can almost suffice, but there is no output schema and no guidance on error cases like invalid or already-finished sessions. The description is minimally viable but leaves minor gaps that an agent might need filled for reliable invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description carries the burden of explaining search_id but does not explain what it is, where it comes from, or how it relates to search sessions. The parameter name is somewhat self-explanatory, but the description adds no meaning beyond the bare schema definition.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Cancel') and resource ('an active search session'), making the tool's purpose immediately clear. It is easily distinguishable from sibling tools like lb_search_start, lb_search_read, and lb_search_sessions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'active search session' gives an implicit condition for use: the session must exist and be active. However, there is no explicit comparison with alternatives, no when-not guidance, and no mention of how to obtain a valid search_id.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

lb_search_readA
Read-only

Read a page of results from an existing search session.

ParametersJSON Schema
NameRequiredDescriptionDefault
search_idYes
result_countNo
result_offsetNo

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is known. The description adds the pagination concept ('a page of results') but does not detail behavior like offset handling or session validity, which is expected for a read operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence with a clear verb and object, no fluff. Front-loaded with the core purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Description is minimal; it does not explain how pagination works (e.g., using result_offset to get subsequent pages), what the response contains, or error conditions. With no output schema, the agent lacks guidance on return format. However, the tool is simple and the schema provides basic parameter constraints, so a 3 is appropriate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description provides no information about search_id, result_count, or result_offset beyond their names. The schema includes defaults and constraints, but the description does not add meaning to parameters or explain how they interact for pagination.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Read) and resource (results from an existing search session). Clearly distinguishes from siblings like lb_search_start and lb_search_sessions, which are about starting or listing sessions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Implies it must be used after a search session exists, but does not explicitly state when to use this over alternatives or any exclusions. No mention of alternative tools or when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

lb_search_sessionsA
Read-only

List search sessions and their status.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The wording is consistent with the readOnlyHint=true and destructiveHint=false annotations, and it adds the small behavioral detail that status is included in the result. Since annotations already cover the read-only and non-destructive traits, the description adds only minimal behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single clean sentence with no filler, front-loading the core purpose and the key output detail. Every word contributes meaning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a parameterless, read-only listing tool, the description provides the essential information: what is listed and what aspect is reported. It could add more detail about what 'status' values or session scope look like, but this is a minor gap given the tool's simplicity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and 100% schema description coverage, so the description bears no real burden for parameter semantics. The baseline of 4 applies here because nothing about parameters needs clarification.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb, resource, and focus: 'List search sessions and their status.' It clearly separates this from sibling tools like lb_search_start, lb_search_read, and lb_search_cancel because this one is about listing sessions rather than performing an operation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The intended use is implied: use this tool when you need an overview of search sessions and their statuses. However, it does not explicitly contrast itself with sibling search tools or state when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

lb_search_startA
Read-only

Start an asynchronous ripgrep-backed filename or content search inside allowed directories.

ParametersJSON Schema
NameRequiredDescriptionDefault
file_globNo
query_kindYes
query_textYes
deadline_msNo
search_rootYes
fixed_stringNo
result_limitNo
case_insensitiveNo
include_dotfilesNo
context_line_countNo

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish read-only and non-destructive behavior. The description adds that the operation is asynchronous and ripgrep-backed, which is useful. Still, it does not disclose how results are delivered, whether a session handle is returned, or how 'allowed directories' are enforced. These are meaningful behavioral gaps given the async lifecycle.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, information-dense sentence with no filler. The core action, engine, scope, and asynchronous nature are front-loaded, and every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 10-parameter asynchronous tool with no output schema, this description is incomplete. It does not explain what the tool returns, how to retrieve results, how cancel/read sessions work, or important parameter semantics. An agent would need substantial external inference to call this correctly and consume its outcome.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, but it explains almost none of the 10 parameters. The phrase 'filename or content' maps faintly to query_kind, and 'allowed directories' hints at search_root, but query_text, file_glob, deadline_ms, result_limit, fixed_string, case_insensitive, include_dotfiles, and context_line_count are left entirely undocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Start') and resource ('search'), and adds meaningful qualifiers: 'asynchronous', 'ripgrep-backed', 'filename or content', and 'inside allowed directories'. This clearly separates it from siblings like lb_search_read, lb_search_cancel, and lb_search_sessions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied rather than explicit: starting an asynchronous search suggests that results are retrieved separately, likely via lb_search_read. However, the description never states when to prefer this over siblings, what to do after starting, or any exclusions. The role is evident from naming, but no direct guidance is given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

lb_shell_inputC
Destructive

Send a line of stdin to an active persistent terminal session.

ParametersJSON Schema
NameRequiredDescriptionDefault
process_idYes
stdin_textYes

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare destructiveHint=true and readOnlyHint=false, so the description's job is to add behavioral context beyond that. The description does not disclose what happens to the session after input, whether the input is echoed, whether it blocks, or any side effects. It also does not mention that sending input to a persistent session may have irreversible effects, which is important given the destructive hint.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with no wasted words, and the core action is front-loaded. It is appropriately concise, though it could have used the available space to add parameter or usage context.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool that sends input to a persistent shell session, the description is incomplete. It does not explain how to identify the session (process_id), what happens if the session is inactive, or how this relates to lb_shell_output and lb_shell_sessions. With no output schema and no parameter documentation, an agent has limited guidance for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate for the two parameters. It does not explain what process_id refers to (e.g., how to obtain it from lb_shell_sessions) or what format stdin_text should take (e.g., whether newlines are appended). The description adds no meaning beyond the parameter names.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Send') and resource ('a line of stdin to an active persistent terminal session'), which clearly distinguishes it from sibling tools like lb_run_shell or lb_shell_output. It lacks a title but the description is unambiguous about the tool's core function.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage context ('active persistent terminal session') but does not explicitly state when to use this tool versus alternatives like lb_run_shell or lb_shell_kill. It gives no exclusions or conditions, so an agent must infer that this is for interacting with an already-running session rather than starting a new one.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

lb_shell_killA
Destructive

Terminate an active terminal session by PID, escalating from SIGINT to SIGKILL if necessary.

ParametersJSON Schema
NameRequiredDescriptionDefault
process_idYes

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint=true, so the destructive nature is known. The description adds the escalation behavior (SIGINT to SIGKILL) and the constraint that it targets an 'active' session, providing extra context beyond annotations. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One sentence that front-loads the action and escalation behavior. No filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple kill operation with one parameter and no output schema, the description covers the core behavior. It does not mention return values, failure handling, or prerequisites like needing to list sessions first, but given the tool's simplicity and annotations covering safety, it is reasonably complete. However, it could note that the session must be active and that the PID comes from a session list.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has a single parameter process_id with type integer and bounds. The description only says 'by PID' which reiterates the property name without adding new meaning. With 0% schema coverage, the description does not compensate for the lack of documentation in the schema, but the property name is self-explanatory.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool terminates a terminal session by PID, using the verb 'terminate' and resource 'active terminal session'. It distinguishes itself from siblings like lb_run_shell or lb_shell_output by its destructive action.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not explicitly mention when to use this tool versus alternatives. It implies it is for ending a session, but does not reference sibling tools like lb_shell_sessions or lb_shell_input, nor does it provide exclusions. The context of being a kill operation is clear, but no guidance on prerequisites or alternative scenarios is given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

lb_shell_outputA
Read-only

Read paginated stdout/stderr captured for an active or recently completed terminal session.

ParametersJSON Schema
NameRequiredDescriptionDefault
line_countNo
process_idYes
line_offsetNo

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, lowering the burden on the description. The description adds meaningful extras: output is paginated, captures stdout/stderr, and is available only for active or recently completed sessions, implying a session-lifetime limitation. This is useful beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, front-loaded sentence with no wasted words. It states the action, the data, and the temporal scope compactly while remaining readable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the core purpose and session-scope constraint, which is adequate for a simple read tool. However, it leaves important context unstated, such as how the pagination parameters map to output and how process_id relates to a shell session, and there is no output schema to fill those gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate, but it only says 'paginated' and does not explain process_id, line_count, or line_offset. The parameter names and default values are somewhat self-explanatory, but the meaning of process_id as the terminal session identifier is not clarified.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Read') and names a concrete resource ('paginated stdout/stderr captured for an active or recently completed terminal session'). It clearly differentiates this from sibling tools like lb_shell_input, lb_shell_sessions, and lb_shell_kill without needing to open the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'active or recently completed terminal session' gives useful context about when the tool applies, but it does not explicitly state when to use this tool versus alternatives such as lb_shell_sessions or lb_run_shell. No exclusions or alternative-selection guidance are provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

lb_shell_sessionsA
Read-only

List active and recently completed persistent terminal sessions.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds the detail about including 'recently completed' sessions, which is useful context beyond the annotations. However, it does not disclose what 'recently' means or any potential limits on the list size, though these are minor for a simple read-only list operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with no wasted words. It is front-loaded with the action and resource, and completely appropriate for the tool's simplicity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is adequate for a basic list tool, but it does not specify the return format (e.g., whether it returns session IDs, names, or other metadata). Since there is no output schema, the agent must infer what the list contains to use the results with sibling tools. A brief mention of the returned fields would improve completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the schema fully covers everything. According to the rubric, a baseline of 4 is appropriate for 0-parameter tools since nothing is needed to clarify parameter usage. The description correctly contains no parameter information.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear verb ('List') and resource ('persistent terminal sessions'), and specifies the scope ('active and recently completed'). It distinguishes from siblings like lb_shell_output or lb_shell_kill, which operate on individual sessions rather than enumerate them.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance is given about when to use this tool versus alternatives. While it's implied that this is the enumeration tool before using session-specific tools (lb_shell_output, lb_shell_input, etc.), the description does not state that or any usage context. This is a gap for an agent that needs to decide between multiple session-related tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

lb_stat_pathA
Read-only

Return size, type, canonical path, and modification time for a file or directory.

ParametersJSON Schema
NameRequiredDescriptionDefault
target_pathYes

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already provide readOnlyHint=true and destructiveHint=false, so the safety profile is clear. The description adds that it returns metadata (size, type, canonical path, modification time) but does not disclose behavior around non-existent paths, permission errors, or whether symlinks are resolved. With annotations covering the main behavioral aspects, a 3 is appropriate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is one clear sentence with zero wasted words. It front-loads the action and lists the return fields compactly. Every part earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple, read-only, single-parameter tool with annotations declaring reading safety, the description is nearly complete. However, it lacks details on error behavior (missing path, permissions) and path resolution specifics (canonical path implies symlink resolution), which would help an agent handle failures. Given the simplicity and annotation coverage, a 3 is fair.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. The description clarifies that target_path refers to a file or directory path, which is the core meaning beyond the raw schema. However, it does not specify path format (relative/absolute), whether it must be an existing path, or anything about handling of directories vs files. Since the description adds some semantic meaning but not complete parameter documentation, a 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Return') and names the resource ('a file or directory') plus the specific data fields (size, type, canonical path, modification time). This clearly distinguishes it from siblings like lb_list_entries or lb_read_text, though it does not explicitly name any sibling.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The tool's purpose and the 'file or directory' scope imply when to use it, especially compared to lb_list_entries or lb_read_text, but there is no explicit guidance about when not to use it, such as when a listing or reading content is needed. The description gives context but no explicit exclusions or alternative selection guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

lb_write_textA
Destructive

Write or append UTF-8 text inside configured allowed directories. Rewrite mode replaces existing content.

ParametersJSON Schema
NameRequiredDescriptionDefault
textYes
file_pathYes
write_modeNorewrite

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate destructiveHint=true and readOnlyHint=false, so the description adds value by specifying that rewrite mode replaces existing content and that operations are confined to configured allowed directories. This goes beyond the annotations but does not cover other behaviors like file creation or error handling. With annotations covering the safety profile, a 3 is appropriate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two concise sentences, with the primary action front-loaded in the first sentence and the mode detail in the second. There is no waste, and every word contributes meaning.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a write tool with no output schema, the description covers the core action and mode but omits details such as whether files are created if absent, path formats (absolute/relative), or success/error responses. Given the tool's simplicity and the annotations, it is adequate but not fully comprehensive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It explains the write_mode parameter via 'Rewrite mode replaces existing content' and implies text is the content and file_path is the target, but it does not provide syntax, format, or constraint details for file_path and text. The description adds some meaning but leaves gaps, warranting a 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description explicitly states the tool writes or appends UTF-8 text to files within allowed directories, and clarifies rewrite mode replaces content. This clearly distinguishes it from sibling tools like lb_read_text (reading) and lb_patch_text_block (patching), so an agent can identify its purpose immediately.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context: it is for writing or appending text, not for reading or other operations. However, it does not explicitly name alternative tools or state when-not-to-use scenarios. The verb 'write' makes the usage obvious, but explicit guidance against using it for reads is absent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 17 tool updatesv0.1.0
    • First observedlb_list_entries
    • First observedlb_make_directory
    • First observedlb_move_path
    • First observedlb_patch_text_block
    • First observedlb_read_many_texts
    • First observedlb_read_text
    • First observedlb_run_shell
    • First observedlb_search_cancel
    • First observedlb_search_read
    • First observedlb_search_sessions
    • First observedlb_search_start
    • First observedlb_shell_input
    • First observedlb_shell_kill
    • First observedlb_shell_output
    • First observedlb_shell_sessions
    • First observedlb_stat_path
    • First observedlb_write_text

TDQS

A3.6/5.0

Scored across 17 tools

Disambiguation4/5

The tools are clearly grouped by domain (file, search, shell) and each has a distinct action and object. The only potential overlap is lb_read_text vs. lb_read_many_texts, but the single vs. batch distinction is explicit. Overall, misselection is unlikely.

Naming Consistency4/5

All tools share the 'lb_' prefix and follow an action-object pattern, though some use verb_noun (e.g., read_text, write_text) and others noun_verb (e.g., search_start, shell_kill). This minor inconsistency is offset by the predictable structure and domain grouping.

Tool Count5/5

With 17 tools covering file operations, search, and shell sessions, the count is well-scoped for the server's purpose. Each tool serves a specific function without redundancy, and the number is neither too thin nor overwhelming.

Completeness3/5

File operations cover create, read, update, move, and listing, but there is no delete/remove tool. Search and shell lifecycles are well covered. The missing delete operation is a notable gap, though agents might work around it via shell commands.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • F
    license
    B
    quality
    C
    maintenance
    Enables remote command execution, scripting, file operations, and persistent tmux sessions on a VPS via MCP protocol.
    17
    28 npm
    -
  • F
    license
    Not graded
    quality
    C
    maintenance
    Enables secure remote access to your computer's filesystem and terminal through MCP, allowing AI assistants to manage files, run commands, and automate tasks from anywhere via a hosted relay.
    105
    -
  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables ChatGPT and other MCP clients to browse, search, edit and upload files, run commands and interactive terminals, inspect Git history and worktrees, dispatch coding agents, and install composable plugins within locally registered workspaces. Requests execute under the user's own machine with per-request approval or auto-approval, keeping files, tasks and results local unless explicitly returned.
    1
    MIT