Model Worker MCP
Integrates with OpenAI-compatible /chat/completions endpoints to delegate coding tasks to language models and retrieve validated unified diffs.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Model Worker MCPfix the bug in src/utils.js in C:\dev\app and run npm test"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Model Worker MCP
本機、受限範圍的 coding worker MCP。它只接受明確的 cwd、read_paths、write_paths,將 provider 回傳的 unified diff 在套用前驗證,並可執行指定驗證命令。
設定
在使用者環境變數設定
MODEL_WORKER_API_KEY,或執行npm run credentials:set -- worker-primary(Windows DPAPI 加密儲存)。設定
MODEL_WORKER_BASE_URL(任何 OpenAI-compatible/chat/completionsendpoint,預設為阿里雲百煉https://dashscope.aliyuncs.com/compatible-mode/v1;若使用百煉專屬 workspace,改成自己的 workspace endpoint)與MODEL_WORKER_MODEL。預設主力是qwen3.7-plus;單檔小修改可切換為qwen3.6-flash。deepseek-flash-0731會自動用於中低風險程式邏輯、bug 修復、測試與後端小功能,也支援手動指定。模型名稱與價格表在worker/router.js、worker/usage-store.js,換 provider 時一併調整。.mcp.json以相對路徑啟動server/server.js;若你的 MCP client 不支援cwd,把args改成此目錄的絕對路徑。
需求:Node.js 18 以上、Git(diff 以 git apply 套用,cwd 必須是 Git repository);驗證命令與 credential 加密目前透過 Windows PowerShell 執行。
Related MCP server: ForgeGuard MCP
本機測試
node server/server.jsMCP 工具:route_code_task、delegate_code_task、get_task_status、cancel_task、get_usage_summary。優先呼叫 route_code_task:CSS/文案/文件等低複雜度任務走 qwen3.6-flash;中低風險程式邏輯、bug 修復、測試與後端小功能走 deepseek-flash-0731;一般或跨檔 coding 走 qwen3.7-plus;審查走 glm-5.2。涉及 auth、payment、secret、migration、database、部署或正式環境時只回傳 guarded,不會自動委派。每個任務的 token、估算費用與失敗錯誤摘要會持久化到 %LOCALAPPDATA%\CodexModelWorker\usage.json,可用 get_usage_summary 查詢。DeepSeek 價格尚未填入,因此其費用會標為未知,不會猜算。錯誤內容會遮罩 Bearer 與 sk- 字串,API key 不會出現在設定檔、任務參數、diff 或 log 中。
License
Available Tools
5 toolscancel_taskC
Cancel a running delegated task.
| Name | Required | Description | Default |
|---|---|---|---|
| task_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It does not disclose idempotency, what happens to already-completed/failed tasks, whether partial work or results are destroyed, permission requirements, or the response on success versus failure. The single word "running" is the only behavioral signal.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single short, front-loaded sentence with no filler and the verb and scope immediately visible. It is efficient, though its brevity is under-specification rather than deliberate compression.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with no annotations, no output schema, and a parameter it never explains, the description is too thin. An agent learns what it does but not how to obtain task_id, what state the task must be in, or what the outcome of the call is.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% and task_id has no schema description, yet the description never explains the parameter — notably not where task_id comes from (presumably delegate_code_task or get_task_status). The description adds no meaning beyond the bare parameter name.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ("Cancel a running delegated task") that an agent can distinguish from delegate_code_task and get_task_status by name alone. It stops short of naming siblings explicitly, so it is clear but not differentiated in-text.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance and no reference to alternatives such as get_task_status (to check a task first) or delegate_code_task. The word "running" implies only in-flight tasks are cancellable, but that is inference, not instruction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
delegate_code_taskC
Run a bounded coding task through the configured provider.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | Yes | ||
| task | Yes | ||
| model | No | ||
| forbidden | No | ||
| read_paths | Yes | ||
| validation | No | ||
| write_paths | Yes | ||
| timeout_seconds | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden and mostly fails. It says nothing about whether this is asynchronous (the existence of get_task_status and cancel_task strongly implies it), what write_paths actually modifies, sandboxing, cost, or what the timeout bounds mean. 'Bounded' gestures at a constraint without disclosing it.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler, so structurally it is efficient. But the brevity reflects under-specification rather than discipline; it omits information the agent needs.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a high-complexity tool: 8 parameters (4 required), no annotations, no output schema, and an implied async/external-provider execution model. The one-sentence description covers none of the parameters, lifecycle, or side effects, leaving the definition far short of what an agent needs to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across 8 parameters, and the description adds no meaning for any of them. Critical fields like read_paths, write_paths, forbidden, validation, and timeout_seconds are completely unexplained in both the schema and the description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Names a specific verb and resource ('Run a bounded coding task') and hints at an execution model ('through the configured provider'). However, 'bounded' and 'configured provider' are undefined jargon, and the description does nothing to distinguish it from the sibling route_code_task, which by name alone seems closely related.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance is given at all. The most pressing question an agent faces — delegate vs. route (route_code_task) — is left entirely unaddressed, and there is no mention of prerequisites or how this interacts with get_task_status/cancel_task.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_task_statusB
Get status, diff and validation output for a delegated task.
| Name | Required | Description | Default |
|---|---|---|---|
| task_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries the full burden. It helpfully discloses the return payload (status, diff, validation output), which is the main behavioral fact an agent needs, but it omits whether the call is read-only, whether it blocks until task completion, and any rate-limit or auth requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler; the resource and the returned fields come first and nothing redundant is included.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter read tool with no output schema, the description covers what comes back but leaves the input side unexplained (task_id origin) and says nothing about polling/blocking behavior. Adequate but with visible gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% for the single required parameter task_id, so the description must compensate and does not. It never says what a task_id is, where it comes from (presumably delegate_code_task's response), or its expected format.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Get') and names the exact payload (status, diff, validation output) scoped to 'a delegated task', which implicitly links it to delegate_code_task and distinguishes it from cancel_task/route_code_task. It is clear what the tool returns, though it never explicitly contrasts itself with any sibling.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit when-to-use, when-not-to-use, or alternative named. The phrase 'for a delegated task' hints that it follows delegate_code_task, but nothing tells the agent when to poll, how often, or why to prefer this over another status mechanism.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_usage_summaryA
Get persisted token usage and estimated CNY cost, optionally filtered by model or time range.
| Name | Required | Description | Default |
|---|---|---|---|
| model | No | ||
| since | No | ISO-8601 timestamp | |
| until | No | ISO-8601 timestamp |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. 'Get' implies a read, 'persisted' signals stored (not live) data, and 'estimated' discloses that the CNY cost is approximate — meaningful behavioral nuance. It does not state scope (per-user/session/global), aggregation granularity, or permissions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler; the core action, return content, and optional filters all appear before any padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple three-optional-param read tool with no output schema, the description names what is returned (token usage plus estimated cost) and how it can be narrowed. Minor gaps remain around result scope and aggregation granularity, but nothing blocks correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 67% ('model' is undocumented; 'since'/'until' carry ISO-8601 notes). The description maps the three params to 'filtered by model or time range', adding a semantic grouping but no format or default details beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Get') and a precise resource ('persisted token usage and estimated CNY cost'), which is unambiguous. The sibling tools are all task-routing/status operations, so no explicit differentiation is needed, though none is offered.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'optionally filtered by model or time range' implies the filtering use case but gives no when-to-use or when-not-to-use guidance. Because no sibling covers usage reporting, the lack of alternatives is less costly, but the description still leaves invocation conditions implicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
route_code_taskC
Classify a coding task by risk and automatically delegate safe work to the discounted model tier.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | Yes | ||
| task | Yes | ||
| model | No | ||
| forbidden | No | ||
| read_paths | Yes | ||
| validation | No | ||
| write_paths | Yes | ||
| timeout_seconds | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden and falls short. It implies file reads and writes (mirrored by read_paths/write_paths) and mentions a 'discounted model tier' cost angle, but discloses nothing about permissions required, what happens to rejected/unsafe tasks, whether file changes are reversible, or any timeout/rate behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no padding, which is structurally clean. It is arguably too terse for an 8-parameter tool, but that shortfall is better attributed to completeness than to verbosity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a complex tool with 8 parameters (4 required), 0% schema coverage, no annotations, and no output schema, and the description supplies almost none of the missing context. An agent cannot determine how the risk classifier behaves, what the safety boundary is, or what any parameter should contain.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across 8 parameters, so the description must compensate and largely does not. Only the 'discounted model tier' phrasing loosely gestures at the model parameter, while cwd, read_paths, write_paths, forbidden, validation, and timeout_seconds receive no explanation, and it is unclear whether the model enum is auto-selected or must be supplied.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb phrase ('classify a coding task by risk') and a concrete outcome ('automatically delegate safe work to the discounted model tier'), so the agent understands this is an auto-routing wrapper. It does not, however, explicitly contrast itself with the sibling delegate_code_task, leaving the manual-vs-automatic distinction to inference.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use or when-not-to-use guidance is given, and the nearest alternative (delegate_code_task) is never named. The description implies this tool handles routing decisions automatically, but the agent is not told what qualifies as 'safe' or what it should do when the risk classification rejects the task.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
5 tool updates
v0.1.0- First observed
cancel_task - First observed
delegate_code_task - First observed
get_task_status - First observed
get_usage_summary - First observed
route_code_task
TDQS
Scored across 5 tools
route_code_task and delegate_code_task both initiate delegated coding work, which could cause some initial confusion, but the descriptions clarify that one performs risk classification and auto-routing while the other directly runs a bounded task. The remaining tools (status, cancel, usage) are clearly distinct.
Most tools follow a verb_noun pattern (route_code_task, delegate_code_task, get_task_status, get_usage_summary), but cancel_task breaks the pattern by omitting the 'code' qualifier used by the delegation tools. The set is still readable and predictable overall.
Five tools is well-scoped for a task delegation worker: routing, execution, status, cancellation, and usage reporting. Each tool clearly earns its place with no redundancy.
The core lifecycle is covered: initiate/route, run, check status, cancel, and inspect usage. Minor gaps exist, such as no list/history operation to enumerate past tasks or a retry/resume capability, but these are workable around.
Maintenance
Related MCP Connectors
Security reviews for coding agents: diffs checked against your org policy and live infrastructure.
Supervised API-write gateway for AI agents with policy, human approval and execution receipts.
Lets coding agents check their own code for leaked secrets, risky dependencies and AI-code mistakes
Guardian agent for AI coding: four frontier models review risky diffs and commits before they ship.
Related MCP Servers
- FlicenseAqualityAmaintenanceEnables coding agents to perform workspace-confined file operations, read-only Git inspection, and structured shell commands, while requiring out-of-band human approval for mutations and external executions and maintaining an audit trail.143-
- AlicenseAqualityBmaintenanceEnables coding agents to safely inspect and modify project files within explicitly allowed workspace roots, with controls for file operations, git status/diff, and optionally allowlisted command execution.11Apache 2.0
- AlicenseNot gradedqualityBmaintenanceEnables delegating coding tasks to sandboxed agents, returning changes as auditable diffs for human review before applying or discarding them.1MIT
- AlicenseNot gradedqualityCmaintenanceTurns bounded coding tasks into reviewable Git diffs using isolated worktrees, configurable worker models, and test execution.MIT