infrastructure-mcp
This server gives AI agents inventory-driven, auditable access to real infrastructure — Linux hosts, Docker, Kubernetes, Grafana, Proxmox, and Cisco devices — with read-only tooling by default and explicit confirmation for anything destructive.
Inventory discovery:
list_serverslists known targets (never credentials), optionally filtered by tag.Linux diagnostics: uptime/load averages, per-filesystem disk usage, memory usage, CPU utilization, failed systemd services, reboot-required detection, top processes, recent journal errors, and kernel version.
Docker management: list containers (running or all) and images, point-in-time CPU/memory/network/disk stats, container logs, and confirm-gated container restart.
Kubernetes operations: list pods, fetch pod/container logs, list events, get a structured pod description with events, and list nodes with readiness/roles/capacity.
Grafana observability: firing/resolved alerts, dashboard search by title/tag, annotations scoped by time/tags, and raw queries against a named datasource (PromQL/LogQL/SQL passthrough).
Proxmox virtualization: list cluster nodes, VMs/LXC containers, and recent tasks; plus confirm-gated start, force-stop, and snapshot actions (returning task UPIDs).
Cisco networking: fetch running config, software version/hostname/uptime, interface status, hardware inventory with serials, and buffered syslog lines.
Safety controls: named tools validate inputs, return structured JSON with severity/recommendations/timestamps, never interpolate unvalidated shell input, and gate mutations behind
confirm: true(withdry_runpreviews); an optional, off-by-defaultrun_commandescape hatch exists for unrestricted shell access.
Offers tools to retrieve Cisco device configuration, version, interfaces, inventory, and syslog messages.
Enables interaction with Docker containers and images, listing, stats, logs, and restarting containers.
Supports querying Grafana alerts, dashboards, annotations, and executing raw datasource queries (PromQL, LogQL, etc.).
Allows querying Kubernetes resources such as pods, nodes, events, and logs, with optional namespace scoping.
Provides tools for monitoring and managing Linux servers, including disk usage, CPU utilization, memory usage, failed services, kernel version, and journal errors.
Provides management of Proxmox cluster nodes, VMs, and containers, including starting, stopping, and taking snapshots.
Infrastructure MCP Server
Give Claude Code, Cursor, and other AI agents safe access to your real infrastructure — without giving them raw SSH access.
A self-hosted Model Context Protocol server that exposes high-level, auditable tools (disk_usage(), docker_restart(), grafana_alerts(), ...) instead of execute(command). Every call is inventory-driven, structured, and logged — the agent reasons about infrastructure; this server is the only thing that actually touches it.
Try it in two minutes, with no real infrastructure:
cd examples/demo && ./run-demo.sh— see the demo guide.
Status: early, actively developed. See Roadmap for what's implemented and what's coming.
Manage: ✓ Linux ✓ Docker ✓ Kubernetes ✓ Proxmox ✓ Grafana ✓ Cisco (MikroTik, UniFi, Prometheus/Loki, Home Assistant, and more are on the Roadmap — not shipped yet.)
Works with: ✓ Claude Code ✓ Cursor ✓ OpenAI Codex ✓ Gemini CLI ✓ Windsurf ✓ Hermes (MCP is an open, client-agnostic protocol — any spec-compliant client works; these are just the ones people actually use it with.)
Raw SSH access | Infrastructure MCP | |
Audit trail | ❌ | ✅ structured log per call ( |
Input validation | ❌ | ✅ named tools validate every parameter; no shell interpolation |
Structured output | ❌ free text | ✅ JSON, every response |
Inventory-aware | ❌ agent picks the host | ✅ targets resolved by name/tag only |
Blast-radius control | ❌ | ✅ read-only by default, mutations require |
Credential exposure | ❌ agent sees them | ✅ credentials never leave the adapter layer |
Quick Start
Prebuilt binary (Linux and macOS, amd64 and arm64): download the archive for your platform from the latest release, verify it against SHA256SUMS, and unpack it. Or use Docker: docker pull ghcr.io/radumalica/infrastructure-mcp:latest.
From source:
git clone https://github.com/radumalica/infrastructure-mcp.git
cd infrastructure-mcp
go build -o bin/infrastructure-mcp ./cmd/server
cp configs/inventory.example.yaml configs/inventory.yaml # fill in your own targetsPoint your MCP client at the binary — see Connecting an AI Agent for Docker and remote-HTTP setups too:
{
"mcpServers": {
"infrastructure": {
"command": "/path/to/bin/infrastructure-mcp",
"args": ["-inventory", "/path/to/configs/inventory.yaml"]
}
}
}Related MCP server: Shuttle
Example Conversation
You: My archive server feels slow, and I'm seeing errors in Grafana. Can you find out why?
Claude, using Infrastructure MCP:
1. cpu_usage(server: "archive") → 92% used, status: "warning"
2. docker_ps(server: "archive") → prometheus: "Restarting (1) 4 seconds ago"
3. docker_logs(server: "archive", container: "prometheus") → "panic: too many open files"
4. grafana_alerts(instance: "main") → firing: HighDiskUsage on archive:/
Claude: Root cause found — archive is at 91% disk usage, which is causing Prometheus
to crash-loop on startup ("too many open files" from a corrupted WAL it can't
compact into the remaining space). Free up space on `/` (or expand it), then run:
docker_restart(server: "archive", container: "prometheus", confirm: true)Four tool calls, one root cause, zero raw shell access. Every call above is inventory-driven, logged, and returns structured JSON — see Examples for the actual response shapes.
Current Features
Tools implemented and tested against the real MCP protocol so far:
Core (v0.1)
list_servers— list inventory targets, optionally filtered by tagcheck_inventory_health— validate the inventory file: parses, every${VAR}is set, every SSH key/kubeconfig file it references is readableuptime— uptime and load averagesdisk_usage— per-filesystem usage with warning/critical severitymemory_usage— memory utilization with warning/critical severity
Optional compatibility escape hatches: run_command, docker_exec and kubectl_exec execute arbitrary commands on an inventory target, in a container, or in a pod. They are disabled by default and registered only when the server starts with -enable-run-command. Prefer the named tools; enabling them grants connected agents unrestricted command execution.
Linux (v0.2)
failed_services— systemd units in the failed statecpu_usage— aggregate CPU utilization (Proxmox/KVM guest-time aware)reboot_required— pending-reboot detection (marker file + kernel comparison)running_processes— top processes by CPU usagejournal_errors— recent systemd journal entries at error priority+kernel_version— running kernel release
Docker (v0.3)
docker_ps— list containers (running or all)docker_images— list local imagesdocker_stats— point-in-time resource usage snapshotdocker_logs— recent combined stdout/stderr log linesdocker_restart— restart a container (destructive; requiresconfirm: true)docker_exec(opt-in,-enable-run-command) — run a command inside a running container, the container-scoped equivalent ofrun_command
Kubernetes (v0.4)
kubectl_get_pods— list pods, optionally scoped to a namespacekubectl_logs— fetch a pod/container's log lineskubectl_events— recent cluster events, most recent firstkubectl_describe— structured pod summary (spec/status highlights + recent events)kubectl_nodes— node list with readiness, roles, and capacitykubectl_exec(opt-in,-enable-run-command) — run a command inside a pod's container, the pod-scoped equivalent ofrun_command/docker_exec
Grafana (v0.5)
grafana_alerts— currently firing/resolved alert instances from the alerting APIgrafana_dashboards— search dashboards by title text and/or taggrafana_annotations— annotations, optionally scoped to a time range and/or tagsgrafana_query— raw query against one datasource (PromQL/LogQL/SQL/...); response is a datasource-specific passthrough, not normalized
Proxmox (v0.6)
proxmox_nodes— list cluster nodes with status and resource usageproxmox_vms— list QEMU VMs and LXC containers on a nodeproxmox_tasks— recent tasks on a node, most recent firstproxmox_start_vm— start a VM/container (state-changing; requiresconfirm: true)proxmox_stop_vm— force-stop a VM/container (destructive; requiresconfirm: true)proxmox_snapshot— take a VM/container snapshot (state-changing; requiresconfirm: true)
Networking — Cisco (v0.7, partial: MikroTik/UniFi remain on the Roadmap)
cisco_backup— fetch the running configuration, as-iscisco_version— software version, hostname, and uptimecisco_interfaces— interface list with IP address, admin/link status, and line protocolcisco_inventory— hardware components (chassis, modules, PSUs) with PID/VID/serial numbercisco_logs— buffered syslog messages, optionally capped to the most recent N linescisco_backup_diff— fetch the running config and diff it against the last snapshot taken by this tool, flagging config drift
Cross-cutting, since v0.1
audit://recentMCP resource — the most recent mutating tool invocations (docker_restart,proxmox_start_vm/proxmox_stop_vm/proxmox_snapshot), newest first, in-memory only (-audit-history-size, default 200)dry_run: trueon every confirm-gated mutating tool — reports the exact command/API call that would run without acting, taking priority overconfirmeven if both are setLegacy network device support: Telnet transport, SSH legacy-crypto negotiation, transparent per-target protocol dispatch, SSH public-key auth for routers/switches
Structured error contract on every tool (
message,recommendation,retryable,category)Structured per-execution logging (
tool,user,target,duration,result,error)Host-key verification fail-closed by default, with explicit opt-outs for lab use
Dual MCP transport: stdio (local subprocess clients) and Streamable HTTP (remote clients), from the same binary — HTTP is fail-closed by default, requiring a bearer token (
MCP_HTTP_TOKEN) unless explicitly opted out for lab useDocker image (multi-arch, GHCR) + Docker Compose, with a self-check
-healthcheckmode for shell-less containersCI/CD: PR-gated build/vet/lint/race-tested-CI, automatic semantic versioning + changelog + image publish + Trivy scan on merge to
main— see CI/CD
See Roadmap for what's next.
Table of Contents
Why
AI agents are increasingly asked to help operate infrastructure — check disk space, restart a container, look at recent errors. The naive way to enable this is to hand the agent raw SSH/shell access. That's fast to build and dangerous to run: no audit trail, no input validation, no blast-radius control, and every agent has to independently learn how to safely operate every kind of system.
Infrastructure MCP Server is the alternative: a single, self-hosted service that exposes meaningful, structured, inventory-driven tools (disk_usage(), docker_restart(), grafana_alerts()) instead of execute(command). Agents reason about infrastructure; this server is the only thing that actually touches it.
Goals
Self-hosted
Production-ready
Secure by default
Extensible
Vendor agnostic
Infrastructure as Code friendly
Stateless where possible
Structured outputs only
Human-auditable
Open Source
Non-Goals
The project is not intended to become:
another SSH wrapper
another Ansible replacement
another monitoring system
another Kubernetes operator
Instead, it provides AI-friendly infrastructure primitives built on top of those things.
Architecture
AI Agent
(Hermes / Claude / Cursor)
│
│ MCP
▼
Infrastructure MCP Server
│
┌───────────┴────────────┐
│ │
Infrastructure APIs SSH / Telnet Layer
│ │
▼ ▼
Proxmox Linux Servers
Grafana Cisco / MikroTik
Prometheus UniFi
Docker Home Assistant
Kubernetes Storage / Bare MetalThree layers, wired top-down:
MCP layer (
mcp/tools/,mcp/prompts/,mcp/resources/) — registers tools with the MCP SDK. Tools call adapters; they never talk to infrastructure directly.Adapter layer (
internal/linux/,internal/docker/,internal/proxmox/,internal/grafana/, ...) — one isolated package per integration, all implementing a common interface. Authentication (SSH keys, API tokens, kubeconfig) lives inside adapters and is never exposed to AI agents.Foundation —
internal/inventory/(YAML config, validated, env-var expansion for secrets) andinternal/ssh/internal/telnet(pooled connections to targets, including legacy devices with obsolete crypto or no SSH at all).
Everything is inventory-driven. No IP addresses, hostnames, or credentials appear in tool implementations — targets are resolved by name/tag from the inventory YAML.
Architectural decisions and the reasoning behind them are recorded as ADRs — see docs/adr/.
Technology Stack
Concern | Choice |
Language | Go 1.26+ |
MCP SDK | Official Model Context Protocol Go SDK |
Configuration | YAML ( |
Logging |
|
SSH |
|
HTTP |
|
Serialization |
|
Testing | Go testing, Testcontainers, Docker Compose |
CI | GitHub Actions |
Project Structure
infrastructure-mcp/
├── cmd/
│ └── server/ # entry point (stdio MCP transport)
├── internal/
│ ├── inventory/ # YAML config, validation, secret expansion
│ ├── ssh/ # pooled SSH connectivity
│ ├── telnet/ # legacy device transport
│ ├── remote/ # SSH/Telnet dispatch by target protocol
│ ├── linux/ # Linux diagnostics adapter
│ ├── docker/ # Docker CLI-over-SSH adapter
│ ├── toolerr/ # structured error contract
│ ├── kubernetes/
│ ├── grafana/
│ ├── proxmox/
│ ├── prometheus/, loki/ # planned
│ ├── cisco/
│ ├── mikrotik/, unifi/ # planned
│ └── homeassistant/ # planned
├── mcp/
│ ├── tools/ # one file per MCP tool
│ ├── prompts/
│ └── resources/
├── configs/ # example inventory
├── docs/
│ ├── adr/ # architecture decision records
│ ├── TOOL_REFERENCE.md # every tool's params + example output
│ └── ADDING_AN_ADAPTER.md # how to add a new integration
├── examples/
│ ├── mcp-client-config/ # ready-to-adapt client JSON snippets
│ ├── inventory-snippets/ # focused single-concept YAML fragments
│ └── sample-tool-outputs/ # example JSON responses
├── scripts/
└── tests/Installation
Prerequisites
Go 1.26 or newer (bumped from 1.24 in v0.4 — required by
k8s.io/client-go's current release train)SSH access (key- or password-based) to the servers/devices you want to manage
An MCP-capable client (Claude Desktop, Claude Code, Cursor, or any other MCP client)
Build from source
git clone https://github.com/radumalica/infrastructure-mcp.git
cd infrastructure-mcp
go build -o bin/infrastructure-mcp ./cmd/serverOr run via Docker
Pre-built multi-arch images (linux/amd64, linux/arm64) are published to GHCR on every merge to main (see CI/CD):
docker pull ghcr.io/radumalica/infrastructure-mcp:latestOr with Docker Compose, which wires up the inventory and SSH volume mounts for you — see docker-compose.yaml:
cp configs/inventory.example.yaml inventory.yaml # fill in your real targets
cp .env.example .env # fill in real secrets, never commit
docker compose up -dRun tests
go build ./... # build
go vet ./... # static checks
go test ./... -race -cover # all tests, race detector, coverage
go test ./internal/linux -run TestName # a single testConfiguration
The server is entirely inventory-driven — copy the example inventory and fill in your own targets:
cp configs/inventory.example.yaml configs/inventory.yamlservers:
archive:
hostname: 10.0.0.5
user: hermes
key: ~/.ssh/archive
tags:
- linux
- ethereum
pve01:
hostname: 10.0.0.2
user: hermes
proxyjump: jumpbox # reached only via another inventory target
tags:
- proxmox
routers:
core:
hostname: 10.0.0.10
vendor: cisco
user: admin
password: ${CORE_ROUTER_PASSWORD} # resolved from the environment at load time
legacy-edge: # no SSH server at all — Telnet only
hostname: 10.0.0.12
vendor: cisco
user: admin
password: ${LEGACY_EDGE_PASSWORD}
protocol: telnet
switches:
ancient-sw: # obsolete SSH key exchange/cipher/MAC only
hostname: 10.0.0.21
vendor: cisco
user: admin
password: ${ANCIENT_SW_PASSWORD}
legacy_crypto: true
# Every category, including single-instance-feeling ones like Grafana and
# Proxmox, is a map keyed by name — so a second Grafana or a second Proxmox
# cluster is just another key, not a schema change.
grafana:
main:
url: https://grafana.lab.local
token: ${GRAFANA_TOKEN}
proxmox:
# token is a Proxmox API token in "user@realm!tokenid=uuid" form
# (Datacenter > Permissions > API Tokens in the PVE UI). Ticket/cookie
# login is not supported.
lab:
url: https://pve.lab.local:8006
token: ${PROXMOX_TOKEN}
# insecure_skip_verify: true # only for a stock Proxmox's self-signed
# cert — lab/dev only, never production
# All auth (client cert, bearer token, exec plugin, ...) lives inside the
# kubeconfig file itself — nothing is inlined into the inventory.
kubernetes:
home:
kubeconfig: /etc/infrastructure-mcp/kubeconfig-home
context: home-adminSecrets are never written in plaintext. Any ${VAR} in the YAML is resolved from the process environment at load time, and load fails closed if the variable is unset — real credentials are never committed to the repo.
More focused, single-concept inventory fragments (key-authenticated network devices, multi-instance services, ...) live under examples/inventory-snippets/.
Server flags
./bin/infrastructure-mcp \
-inventory configs/inventory.yaml \
-known-hosts ~/.ssh/known_hosts \
-insecure-ignore-host-key=false \
-transport stdioFlag | Default | Description |
|
| Path to the inventory YAML file |
|
| Path used to verify target SSH host keys |
|
| Skip host key verification entirely — lab/dev only, never production |
|
|
|
|
| Address to listen on when |
|
| Instead of starting the server, GET |
|
| Allow |
|
| Register the unrestricted |
|
| Directory |
|
| Number of recent mutating tool invocations retained in-memory and exposed via the |
Host key verification is fail-closed by default: an unrecognized target's connection is refused unless it's in known_hosts or you explicitly opt into insecure mode. -transport=http is fail-closed the same way: it refuses to start unless the MCP_HTTP_TOKEN environment variable is set (see below) or -allow-anonymous-http is passed explicitly.
Connecting an AI Agent
Infrastructure MCP Server supports two transports from the same binary, so it works with both local-subprocess and remote-network MCP clients:
stdio (default) — the client spawns the binary itself and talks over its stdin/stdout. This is what most desktop IDEs and agent CLIs (Claude Desktop, Claude Code, Cursor) expect.
Streamable HTTP (
-transport http) — the server listens on the network (/mcpendpoint, plus/healthz) and any remote MCP client connects over HTTP. Use this when the server runs elsewhere (a container, a VM, behind a reverse proxy) rather than on the same machine as the client.
stdio (local)
{
"mcpServers": {
"infrastructure": {
"command": "/path/to/bin/infrastructure-mcp",
"args": ["-inventory", "/path/to/configs/inventory.yaml"]
}
}
}Remote HTTP
-transport=http requires a bearer token because /mcp exposes every registered tool. The server refuses to start without one (fail-closed, like host key verification above). Generate one and set it as MCP_HTTP_TOKEN:
export MCP_HTTP_TOKEN=$(openssl rand -hex 32)
./bin/infrastructure-mcp -inventory configs/inventory.yaml -transport http -http-addr :8080(or docker compose up -d, which does this by default once MCP_HTTP_TOKEN is set in .env — see Installation). Every request to /mcp must then send Authorization: Bearer $MCP_HTTP_TOKEN; /healthz stays open for container/load-balancer health checks. -allow-anonymous-http disables this requirement — lab/dev only, never expose an anonymous instance to anything but localhost.
Point any remote-MCP-capable client at http://<host>:8080/mcp with that header set. For clients that only support stdio, bridge with mcp-remote or an equivalent local proxy:
{
"mcpServers": {
"infrastructure": {
"command": "npx",
"args": ["-y", "mcp-remote", "http://<host>:8080/mcp", "--header", "Authorization: Bearer ${MCP_HTTP_TOKEN}"]
}
}
}Put the HTTP endpoint behind TLS and network-level access control (a reverse proxy, VPN, or private network) before exposing it beyond localhost — the server itself does not add its own transport-layer authentication.
Once connected, over either transport, the agent sees the named tools listed under Current Features. Adapter authentication credentials remain server-side, but tool output such as logs, raw queries, and device configurations may itself contain sensitive data. Raw shell access is absent unless the operator explicitly starts the server with -enable-run-command.
Ready-to-adapt client config files (stdio and remote-HTTP-via-mcp-remote) live under examples/mcp-client-config/.
Agent Skills
The repository includes the free, portable infrastructure-mcp-operator skill.
It teaches a connected agent how to select named infrastructure-mcp tools,
preserve safety boundaries, and separate observed evidence from interpretation.
The skill does not install or host this MCP server and never contains inventory
or credentials. Connect infrastructure-mcp first using one of the transports
above, then install the skill from
.github/skills/infrastructure-mcp-operator
or a GitHub release archive.
See the agent skills guide for installation and validation details.
Examples
Full request/response walkthroughs for a few representative tools, run
against the inventory shown in Configuration. Values are
synthetic — copy the shape, not the data. Every tool's shape is documented
in docs/TOOL_REFERENCE.md; runnable inventory
fragments and MCP client configs live under examples/.
Check disk space on a server:
disk_usage(server: "archive"){
"server": "archive",
"filesystems": [
{
"filesystem": "/dev/sda1",
"mount_point": "/",
"total_kb": 51475068,
"used_kb": 46853200,
"available_kb": 2003212,
"used_percent": 91,
"status": "critical",
"recommendation": "Free disk space immediately or expand capacity."
}
],
"timestamp": "2026-07-30T09:00:00Z"
}List containers on a Docker host:
docker_ps(server: "archive"){
"server": "archive",
"containers": [
{
"id": "a1b2c3d4e5f6",
"image": "grafana/grafana:11.2.0",
"status": "Up 3 weeks",
"state": "running",
"ports": "0.0.0.0:3000->3000/tcp",
"names": "grafana"
}
],
"timestamp": "2026-07-30T09:00:00Z"
}Restart a container — the confirm-gate pattern every mutating tool uses. The first call, without confirm, is a no-op that reports what would happen:
docker_restart(server: "archive", container: "grafana"){
"server": "archive",
"container": "grafana",
"status": "confirmation_required",
"message": "Set confirm: true to restart this container. No action was taken.",
"timestamp": "2026-07-30T09:00:00Z"
}Only the confirmed call actually restarts it:
docker_restart(server: "archive", container: "grafana", confirm: true){
"server": "archive",
"container": "grafana",
"status": "restarted",
"message": "Container restarted.",
"timestamp": "2026-07-30T09:00:05Z"
}Interfaces on a Cisco switch reached over legacy-crypto SSH (legacy_crypto: true in inventory — see ADR 0005):
cisco_interfaces(device: "old-core-sw"){
"device": "old-core-sw",
"interfaces": [
{ "interface": "Vlan100", "ip_address": "10.0.0.23", "ok": "YES", "method": "NVRAM", "status": "up", "protocol": "up" },
{ "interface": "GigabitEthernet1/0/1", "ip_address": "unassigned", "ok": "YES", "method": "unset", "status": "up", "protocol": "up" }
],
"timestamp": "2026-07-30T09:00:00Z"
}A firing alert from Grafana:
grafana_alerts(instance: "main"){
"instance": "main",
"alerts": [
{
"status": "firing",
"labels": { "alertname": "HighDiskUsage", "instance": "archive", "severity": "critical" },
"starts_at": "2026-07-30T08:00:00Z",
"fingerprint": "9f2a1c7e0b3d4e5f"
}
],
"timestamp": "2026-07-30T09:00:00Z"
}A tool call against an unreachable target — the structured error envelope, never a raw Go error:
uptime(server: "archive"){
"message": "dial tcp 10.0.0.5:22: connect: connection refused",
"recommendation": "Retry the request; if it persists, check network connectivity to the target.",
"retryable": true,
"category": "network"
}Tool Design Philosophy
Never expose raw infrastructure:
execute(command) # avoidPrefer meaningful, structured actions:
check_disk()
check_memory()
docker_list()
grafana_alerts()
backup_switch()Every tool:
validates its inputs
never panics
returns structured JSON
includes severity where relevant
includes a recommendation on warning/critical states
includes a timestamp
{
"status": "warning",
"server": "archive",
"disk_usage": 91,
"recommendation": "Free disk space or expand storage.",
"timestamp": "2026-07-23T19:10:00Z"
}Logging
Every tool execution produces a structured log line with:
tool, user, duration, target, result, error
Error Handling
Tools never return a raw Go error. Every failure is shaped as:
message, recommendation, retryable, category
(category is one of not_found, auth, network, timeout, invalid_input, internal.)
Security
No secrets in logs
No secrets in prompts
Named tools do not interpolate unvalidated user input into shell commands
The unrestricted
run_command,docker_execandkubectl_execescape hatches are disabled by default;-enable-run-commandmust be passed explicitly and grants connected agents arbitrary command executionValidate all inputs
Whitelist inventory — no target is reachable unless it's named in the inventory
Least privilege
Read-only by default
Dangerous actions require explicit confirmation (e.g.
docker_restartrequiresconfirm: trueand is a no-op otherwise)Those same mutating tools accept
dry_run: trueto preview the exact command/API call that would run without acting — and it takes priority overconfirmeven if both are set-transport=httpis fail-closed: it refuses to start without a bearer token (MCP_HTTP_TOKEN) unless-allow-anonymous-httpis explicitly passedTLS certificate verification is on by default for Grafana/Proxmox;
insecure_skip_verify: truedisables it per-instance — lab/dev only, same posture as-insecure-ignore-host-keyfor SSH
Found a security issue? Please report it privately rather than opening a public issue — see Contributing.
Development
Testing standards
Unit tests target ~100% coverage for inventory, adapters, parsing, and validation
Integration tests use Testcontainers / Docker Compose (Ubuntu, Alpine, Grafana, Prometheus, Loki)
Every tool is exercised through a real MCP protocol round-trip (
mcp.NewInMemoryTransports()), not just unit-tested in isolation
Performance goals
SSH/Telnet connection pooling
Parallel execution
Context cancellation everywhere
Streaming responses
Timeout and retry support
Code conventions
Small packages, dependency injection, no globals, prefer interfaces
context.Contexteverywherelog/slogfor loggingAvoid reflection when possible
Functions under ~50 lines when practical
Structured errors, never raw ones
Document exported functions
Never expose credentials to the MCP layer
Never hardcode infrastructure — always resolve through inventory
Adding a new integration? See docs/ADDING_AN_ADAPTER.md for the full walkthrough.
CI/CD
Two GitHub Actions workflows, both required for anyone contributing:
ci.yml — required for every PR into main
Runs on every pull request and on push to main:
test —
go build ./...,go vet ./..., agofmt -lformatting check, andgo test ./... -race -coverlint —
golangci-lintagainst.golangci.yml(errcheck, staticcheck, govet, gosec, and more)
Branch protection on main must be configured by a repo admin (this is a repository setting, not something a workflow file can enforce) to require both the test and lint jobs to pass, and to require a pull request before merging — that gate only takes effect once the setting is turned on.
The release pipeline is designed to work with protected main: it creates and pushes only the release tag, creates the GitHub release from that tag, and opens a separate PR for CHANGELOG.md updates.
release.yml — runs on every merge to main
Version + tag — Cocogitto reads Conventional Commits since the last tag (config:
cog.toml) and computes the next semver. The workflow then creates and pushes thevX.Y.Ztag (no direct commit push tomain). A merge with no releasable commits (e.g. docs/chore-only) skips the rest of the pipeline.Build & scan — builds the Docker image and scans it with Trivy before publishing; a CRITICAL/HIGH finding blocks the release. Results are uploaded to the repo's Security tab either way.
Publish — once the scan is clean, builds and pushes the multi-arch (
linux/amd64,linux/arm64) image toghcr.io/<org>/infrastructure-mcp, taggedlatestandvX.Y.Z.Changelog PR — the workflow regenerates
CHANGELOG.mdand opens an automated PR so changelog updates still go through normal branch protection and review.
Commit messages therefore need to follow Conventional Commits (feat:, fix:, docs:, chore:, ...) — see Contributing.
Roadmap
Shipped: Linux · Docker · Kubernetes · Grafana · Proxmox · Cisco Not started: MikroTik · UniFi · Prometheus/Loki/Tempo/Alertmanager · Home Assistant · AI-composite tools · AWS/Azure/GCP/VMware/...
Implemented versions are listed under Current Features and tracked feature-by-feature in PROGRESS.md. Everything below is not started.
v0.7 — Networking (in progress: Cisco shipped, MikroTik/UniFi remain)
MikroTik: backup, interfaces, routes, firewall, system resources
UniFi: devices, clients, AP status, firmware, statistics
Note: Telnet transport and SSH legacy-crypto support for these vendors already shipped ahead of schedule in v0.1 — only the vendor-specific tools above remain.
v0.8 — Monitoring
Prometheus, Loki, Tempo, Alertmanager
v0.9 — Home Assistant
entitiesdevicesautomationssensorscameras
v1.0 — AI-oriented composite tools
Instead of calling 15 low-level tools, the agent calls one expert tool that composes them:
diagnose_linux()diagnose_docker()diagnose_kubernetes()diagnose_network()diagnose_storage()morning_brief()incident_summary()root_cause_analysis()backup_everything()check_infrastructure()
Further out
AWS, Azure, GCP, VMware, TrueNAS, Ceph, Synology, IPMI, Redfish, OpenStack, Nomad, Consul.
Contributing
Contributions are welcome — see CONTRIBUTING.md. This is an early-stage project and there's a lot of surface area left on the roadmap above.
Fork the repo and create a feature branch.
Follow the existing package/adapter pattern: one isolated package per integration under
internal/, a matching set of tools undermcp/tools/, wired intocmd/server/main.go— seedocs/ADDING_AN_ADAPTER.mdfor the full walkthrough.Match the existing conventions: structured errors via
internal/toolerr, structured logging via thewithLoggingwrapper, inventory-driven targets, and no shell interpolation of user input in named tools.Add tests — unit tests for adapters/parsing, and at least one test that exercises new tools through the real MCP protocol.
Run
go build ./... && go vet ./... && gofmt -l . && go test ./... -race -coverand, if you have it installed,golangci-lint run ./...before opening a PR — this is exactly whatci.ymlruns, and it's a required, non-optional check on every PR intomain(see CI/CD).Use Conventional Commits for your commit messages (
feat:,fix:,docs:,chore:,refactor:,test:,ci:, ...) — the version bump,CHANGELOG.md, and release on merge are generated automatically from them.Open a pull request describing what changed and why. For an architectural decision (not just "add tool #N following the existing pattern"), add an ADR under
docs/adr/.
For larger changes (a new adapter, a new version's worth of tools), consider opening an issue first to discuss the approach.
License
Licensed under the MIT License — free to use, modify, and distribute, including commercially.
A Note on How This Project Is Built
This project is vibe-coded: the vast majority of the implementation — code, tests, commit-by-commit progress — is written by AI (Claude Code), iterating directly against this README as the specification.
The design and architecture are human-authored by the repository owner: the layering (MCP → adapters → foundation), the inventory-driven philosophy, the tool-design rules, the security posture, and the version roadmap were all decided by a person before any code was written. AI implements against that spec; it doesn't set the direction.
Available Tools
37 toolscheck_inventory_healthA
Validate the inventory file: it parses and passes structural validation, every referenced environment variable (${VAR}) is set, and every SSH key / kubeconfig file it references exists and is readable. Re-reads the inventory file from disk on every call, so it reflects the file's current state — including drift since the server started — not just what's currently loaded in memory. Read-only, takes no arguments.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| status | Yes | |
| grafana | Yes | |
| proxmox | Yes | |
| routers | Yes | |
| servers | Yes | |
| problems | No | |
| switches | Yes | |
| timestamp | Yes | |
| kubernetes | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations present, the description carries the full burden and does so: it declares read-only behavior, that it takes no arguments, and that it re-reads from disk on every call so results reflect drift since server start rather than cached state. That freshness guarantee is exactly the kind of behavioral trait structured fields cannot convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the validation scope, followed by the freshness guarantee and read-only statement. Every clause adds distinct information with no repetition of the name or schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-argument, read-only validation tool with an output schema covering return values, the description supplies everything an agent needs: what is validated, that it is safe to call freely, and why the result may differ from loaded state. Nothing material is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters, so the baseline is 4. The description confirms 'takes no arguments', which is consistent with the empty schema and removes any ambiguity about hidden inputs.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (validate) and resource (the inventory file), then enumerates exactly what is checked: parse/structural validation, ${VAR} environment variables being set, and SSH key/kubeconfig file existence and readability. This is clearly distinguishable from siblings like cisco_inventory or list_servers, which list rather than validate.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear context for use — validating the inventory file's on-disk state — and the drift note tells the agent when this result is more trustworthy than in-memory state. It stops short of naming an alternative tool or an explicit 'use this before doing X' rule, so it is clear context without exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cisco_backupA
Fetch a Cisco device's running configuration ("show running-config"), as-is. Telnet-connected devices get "terminal length 0" sent first automatically; SSH-connected devices do not (SSH runs one command per ephemeral session, so the setting wouldn't carry over) — if an SSH-connected device paginates output, only the first page is returned unless "terminal length 0" is already configured on the device.
| Name | Required | Description | Default |
|---|---|---|---|
| device | Yes | the inventory router/switch name |
Output Schema
| Name | Required | Description |
|---|---|---|
| config | Yes | |
| device | Yes | |
| timestamp | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does so well: it discloses that Telnet sessions auto-send 'terminal length 0', that SSH sessions do not because each command runs in an ephemeral session, and that SSH pagination can silently truncate output to the first page. It omits auth requirements and does not restate the read-only nature, but the pagination/transport behavior is genuinely valuable context beyond the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose is front-loaded in the first clause, with transport caveats following. The nested em-dash parenthetical is dense but each clause earns its place by preventing a wrong conclusion about output completeness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return-value explanation is not required, and the description supplies the one non-obvious operational risk (SSH truncation). For a single-parameter fetch tool this is close to complete; only credential/prerequisite context is absent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one parameter exists and schema description coverage is 100% ('the inventory router/switch name'), so the schema already does the work. The description adds no syntax, naming convention, or validation detail about the device argument. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Fetch a Cisco device's running configuration') and even names the underlying command ('show running-config') plus the 'as-is' scope. It does not, however, distinguish itself from the sibling cisco_backup_diff, which is the obvious adjacent tool an agent might confuse it with.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains condition-dependent behavior (Telnet vs SSH) and a truncation caveat, which implies when the output will be complete. But it never states when to choose this tool over cisco_backup_diff or any other sibling, and gives no prerequisites such as credential or reachability requirements.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cisco_backup_diffA
Fetch a Cisco device's running configuration and diff it against the last snapshot taken by this tool for the same device — flags unexpected config drift. The first call for a device has nothing to diff against and just establishes the baseline.
| Name | Required | Description | Default |
|---|---|---|---|
| device | Yes | the inventory router/switch name |
Output Schema
| Name | Required | Description |
|---|---|---|
| diff | No | |
| device | Yes | |
| changed | Yes | |
| timestamp | Yes | |
| first_snapshot | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does disclose the non-obvious stateful behavior — that the tool persists snapshots per device and behaves differently on first vs. subsequent calls. It omits auth requirements and rate/return details, but the baseline/diff disclosure is genuinely valuable.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences with the core action front-loaded and the baseline caveat following. No filler; every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return structure needn't be described. Between the schema (param) and the description (stateful behavior and drift semantics), an agent has everything needed to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the single 'device' parameter is already documented as the inventory router/switch name. The phrase 'for the same device' reinforces that identity matters, but adds no new syntax or format meaning. Baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States specific verbs (Fetch, diff) and resources (Cisco running configuration vs. last snapshot), plus the outcome ('flags unexpected config drift'). An agent can distinguish this from cisco_backup or cisco_interfaces without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explains the stateful call sequence clearly: the first call establishes a baseline, later calls diff against it. That is strong contextual guidance, but it never names when to prefer it over the sibling cisco_backup, so it stops short of explicit alternative routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cisco_interfacesA
List a Cisco device's interfaces with IP address, admin/link status, and line protocol state ("show ip interface brief").
| Name | Required | Description | Default |
|---|---|---|---|
| device | Yes | the inventory router/switch name |
Output Schema
| Name | Required | Description |
|---|---|---|
| device | Yes | |
| timestamp | Yes | |
| interfaces | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. The verb 'List' implies a non-destructive read and the CLI equivalent ('show ip interface brief') reinforces that, but nothing is said about device reachability, authentication requirements, or timeout behavior. It adds some value via the CLI mapping yet leaves operational caveats undisclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that front-loads the action and resource and appends the exact CLI command as a clarifying anchor. No filler and nothing redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be described, and the single parameter is documented in the schema. The remaining gap is the absence of any behavioral context (device reachability, auth, errors) for a tool with zero annotations, but for a simple read-only listing this is nearly complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is a single parameter ('device') with 100% schema description coverage ('the inventory router/switch name'), so the schema already does the heavy lifting. The description adds no further detail such as naming format or whether the name must match cisco_inventory entries.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource ('List a Cisco device's interfaces') and enumerates the returned attributes (IP address, admin/link status, line protocol state), which makes the tool's intent unambiguous. It does not explicitly differentiate itself from siblings like cisco_version or cisco_inventory, but the interface-listing scope is obvious enough to route correctly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: an agent can infer this is the tool for inspecting interface state on a Cisco device. There is no explicit guidance on when to prefer it over cisco_logs, cisco_version, or a generic run_command alternative, nor any stated prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cisco_inventoryA
List a Cisco device's hardware components — chassis, modules, PSUs — with PID/VID/serial number ("show inventory").
| Name | Required | Description | Default |
|---|---|---|---|
| device | Yes | the inventory router/switch name |
Output Schema
| Name | Required | Description |
|---|---|---|
| device | Yes | |
| entries | Yes | |
| timestamp | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It implies a read-only listing and discloses the shape of the data (component type plus PID/VID/serial), but says nothing about permissions, device-unreachable behavior, or whether it can be slow — reasonable gaps for a simple read, but not rich disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence: verb, resource, component examples, returned identifiers, and the underlying command. No filler and nothing buried.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter read tool with an output schema (so return values need no explanation), the description covers purpose, scope, and output fields adequately. Only the lack of explicit routing guidance against cisco_version/cisco_interfaces keeps it short of complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
One parameter with 100% schema description coverage ('the inventory router/switch name'), so the schema already does the work. The description adds only that the device is a Cisco device whose hardware is enumerated; no format or naming-convention detail beyond the schema. Baseline 3 per coverage rule.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (List) and resource (hardware components) with concrete examples — chassis, modules, PSUs — and explicitly names the fields returned (PID/VID/serial number). The parenthetical 'show inventory' anchors it against siblings like cisco_interfaces, cisco_version, and cisco_logs at a glance.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the domain command it mimics, but there is no explicit when-to-use or when-not guidance, and no sibling is named as an alternative. An agent can infer this is the hardware-inventory read versus a software-version or interface read, but must infer it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cisco_logsB
Fetch a Cisco device's buffered syslog messages ("show logging"), optionally capped to the most recent limit lines.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | maximum number of log lines to return — the most recent N messages, kept in their original oldest-to-newest order (default: all buffered lines) | |
| device | Yes | the inventory router/switch name |
Output Schema
| Name | Required | Description |
|---|---|---|
| lines | Yes | |
| device | Yes | |
| timestamp | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It usefully discloses that the messages come from the device's *buffered* log (not a live stream) and that `limit` returns the most recent lines in original order. It says nothing about permissions/credentials needed, buffer rotation, or output size — real gaps, though the operation is implicitly a safe read.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single tight sentence that front-loads the action and resource, then adds the optional cap. Every clause earns its place and nothing is padded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter read tool with an output schema present, the description need not explain return values and covers the core semantics. Only the absence of any access/prerequisite context keeps it from being fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both parameters are already documented in the schema, including the ordering behavior and the default of all buffered lines. The description restates the `limit` semantics without adding format or unit details beyond the schema, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb ("Fetch") and resource ("a Cisco device's buffered syslog messages") and anchors it to the underlying CLI command ("show logging"). The device scope implicitly separates it from docker_logs/kubectl_logs, but it never explicitly routes against those siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no statement of when to use this tool versus alternatives (e.g. kubectl_logs, docker_logs, journal_errors) or any prerequisite context. Usage is only inferable from the resource name; no exclusions or conditions are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cisco_versionB
Get a Cisco device's software version, hostname, and uptime ("show version").
| Name | Required | Description | Default |
|---|---|---|---|
| device | Yes | the inventory router/switch name |
Output Schema
| Name | Required | Description |
|---|---|---|
| device | Yes | |
| uptime | No | |
| hostname | No | |
| timestamp | Yes | |
| version_line | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. 'Get' and the 'show version' reference imply a safe read operation and the description discloses what is returned (version, hostname, uptime), but it says nothing about required credentials, target reachability, or failure behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that front-loads the verb and resource and appends the exact CLI command as a clarifying cue. Nothing is wasted or buried.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Output schema exists, so return values needn't be explained, and the description still names them helpfully. For a one-parameter read tool this is essentially complete; only the absence of any usage or behavioral context keeps it from a 5.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% – the single 'device' parameter is fully documented in the schema as the inventory router/switch name. The description adds no additional meaning about the parameter, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb 'Get' plus resource 'Cisco device's software version, hostname, and uptime', even quoting the underlying 'show version' command. It's clear what the tool returns, though it doesn't explicitly distinguish itself from siblings like cisco_inventory, uptime, or kernel_version.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use or when-not-to-use guidance, and no mention of alternatives such as cisco_interfaces or cisco_inventory that overlap on Cisco device introspection. Usage is only implied by the resource name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cpu_usageA
Report aggregate CPU utilization on a Linux server, sampled over a 1-second window, with a warning/critical severity and recommendation.
| Name | Required | Description | Default |
|---|---|---|---|
| server | Yes | the inventory server name to check |
Output Schema
| Name | Required | Description |
|---|---|---|
| server | Yes | |
| status | Yes | |
| timestamp | Yes | |
| used_percent | Yes | |
| recommendation | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations, so the description carries the full burden. It does add real behavioral detail the schema lacks: the metric is aggregate (not per-core) and sampled over a 1-second window, and it returns a severity and recommendation. However it is silent on access requirements, behavior when the server is unreachable, and whether repeat polling is safe.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single dense sentence, front-loaded with the verb and resource, with sampling scope and output characteristics appended. No filler and nothing repeated from the schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return contents need not be explained; the description correctly focuses on sampling semantics. For a one-parameter read tool this is nearly sufficient, with only the missing usage/alternative guidance keeping it from a 5.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the single 'server' parameter ('the inventory server name to check'), so the schema already does the work. The description adds no format or source-of-truth detail beyond it; baseline 3 applies for a 1-param tool with full schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb+resource: 'Report aggregate CPU utilization on a Linux server,' with the 1-second sampling window and severity/recommendation output named. An agent can distinguish it from disk_usage or memory_usage by resource, though the description never explicitly contrasts with those siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied (performance triage of a Linux host) but there is no explicit when-to-use instruction, no exclusions, and no routing to alternatives like running_processes or uptime. Adequate but leaves the agent to infer context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
disk_usageA
Report per-filesystem disk usage on a Linux server, with a warning/critical severity and recommendation for filesystems running low on space.
| Name | Required | Description | Default |
|---|---|---|---|
| server | Yes | the inventory server name to check |
Output Schema
| Name | Required | Description |
|---|---|---|
| server | Yes | |
| timestamp | Yes | |
| filesystems | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so the description carries the full behavioral burden. It mentions warning/critical severity and a recommendation, which adds some output-shape context, but it does not disclose permissions, whether it merely reads (implied, not stated), read-only nature, or any server-connectivity behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence states the action, scope, and output semantics (severity + recommendation) with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Output schema exists, so return-value detail is unnecessary. For a one-parameter read tool with no annotations, the description covering action, scope, and severity/recommendation output is nearly complete, though a brief read-only assurance and server-not-found behavior would round it out.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with the single 'server' parameter fully documented as 'the inventory server name to check'. The description adds no parameter detail, so the baseline of 3 would apply, but with only one well-documented required parameter the schema fully compensates, meriting a 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb+resource ('Report per-filesystem disk usage on a Linux server') with added scope describing severity outcome. Clearly distinguishable from siblings like cpu_usage and memory_usage by signaling disk-space focus and its warning/critical interpretation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies a monitoring/diagnostic context but never states when to use this vs cpu_usage, memory_usage, or run_command for disk checks, and offers no exclusions or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
docker_imagesC
List local Docker images on a Docker host.
| Name | Required | Description | Default |
|---|---|---|---|
| server | Yes | the inventory server name to check |
Output Schema
| Name | Required | Description |
|---|---|---|
| images | Yes | |
| server | Yes | |
| timestamp | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It hints at scope ('local', 'on a Docker host') but says nothing about permissions or Docker socket/API access requirements, whether the image list can be large or slow, or whether host state is touched. Listing is inherently read-only, but that is left implicit.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One short sentence with zero padding, and the essential scope qualifier ('local') is included up front. It is efficient but too sparse to earn a 5.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and a single well-documented parameter keeps the signature simple. What is missing is usage context (when to prefer this over docker_ps) and any behavioral note, leaving the definition minimal but functional.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is a single parameter ('server') and the schema already documents it at 100% coverage, so schema description coverage sets the baseline at 3. The description adds no syntax, format, or naming guidance for the server argument beyond what the schema states.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb and resource ('List local Docker images'), which is enough to distinguish it from docker_ps (containers), docker_logs, and docker_stats in the sibling set. It does not explicitly name any sibling or state how it differs from them, so it stops short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus docker_ps, docker_stats, or run_command, and no prerequisites or exclusions are stated. The agent must infer from the name alone that this is the way to enumerate images rather than containers.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
docker_logsB
Fetch the most recent combined stdout/stderr log lines from a container on a Docker host.
| Name | Required | Description | Default |
|---|---|---|---|
| tail | No | number of most recent log lines to return (default 100) | |
| server | Yes | the inventory server name to check | |
| container | Yes | container name or ID to fetch logs for |
Output Schema
| Name | Required | Description |
|---|---|---|
| logs | Yes | |
| server | Yes | |
| container | Yes | |
| timestamp | Yes | |
| line_count | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden but does deliver useful behavioral context: logs are 'combined stdout/stderr' and 'most recent', which sets expectations for the output. It does not disclose permission requirements, behavior on a missing container, or that it is a read-only operation, leaving gaps for a no-annotation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with zero filler, capturing the verb, resource, recency scope, and stream type efficiently.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values needn't be explained. The description adequately conveys source (container on Docker host), scope (most recent), and stream type; the only gap is the absence of any usage routing against kubectl_logs.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so server, container, and tail (including default) are already fully documented in the schema. The description adds no syntax or format detail beyond what the schema provides, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Fetch) and resource (combined stdout/stderr log lines) scoped to a container on a Docker host, which distinguishes it from kubectl_logs and cisco_logs/journall_errors. It does not explicitly name a sibling or clarify vs kubectl_logs, but the Docker/container anchoring is specific.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives such as kubectl_logs or journal_errors, and no prerequisites or conditions stated. Usage is only implied by the scope of the description.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
docker_psA
List containers on a Docker host (running only, unless all is set).
| Name | Required | Description | Default |
|---|---|---|---|
| all | No | include stopped containers too (default: running containers only) | |
| server | Yes | the inventory server name to check |
Output Schema
| Name | Required | Description |
|---|---|---|
| server | Yes | |
| timestamp | Yes | |
| containers | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It usefully discloses the default filtering behavior (running containers only unless `all` is set), and 'List' implies a non-mutating read, but it says nothing about permissions, host reachability, or result size/pagination.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence with zero filler, and the default-scope nuance is placed in the parenthetical right where the reader needs it.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter read-only listing tool with an output schema covering return values and 100% parameter documentation, the description covers the one non-obvious behavioral nuance (default scope). Only the absence of annotation-level safety signaling keeps it from being fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both `all` and `server` are already documented in the schema, giving a baseline of 3. The description restates the `all` toggle semantics but adds no ordering, format, or server-identification detail beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb+resource: 'List containers on a Docker host' immediately tells the agent this returns Docker containers, distinguishing it implicitly from docker_images, docker_logs, docker_stats and docker_restart. It stops short of explicitly naming a sibling or contrasting scope, so it is clear but not maximally differentiated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The parenthetical conveys the default scope (running only) and the condition that widens it (`all`), which is genuine usage guidance. However, there is no statement of when to reach for this tool versus docker_stats, docker_logs or docker_restart, so selection guidance is implied rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
docker_restartA
Restart a container on a Docker host. This is a dangerous, service-impacting action: it requires confirm: true, and returns without acting if confirmation is missing. Set dry_run: true to see the exact command that would run without needing confirm at all.
| Name | Required | Description | Default |
|---|---|---|---|
| server | Yes | the inventory server name to check | |
| confirm | No | must be true to actually restart the container; otherwise the tool reports what it would do without acting | |
| dry_run | No | if true, report the exact command that would be run and return without acting or requiring confirm | |
| container | Yes | container name or ID to restart |
Output Schema
| Name | Required | Description |
|---|---|---|
| server | Yes | |
| status | Yes | |
| message | Yes | |
| container | Yes | |
| timestamp | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does well: it flags the action as dangerous and service-impacting, explains the confirm gate and the no-op behavior when confirmation is missing, and clarifies that dry_run bypasses confirm. It omits permission/auth requirements and any cautions about container state loss, so it is not exhaustive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the core action before the danger warning and the dry_run escape hatch. Every clause carries behavioral information; nothing is padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and the description covers the operation's safety contract and confirmation semantics adequately. The only gap is the absence of any note on required permissions or the blast radius of restarting a container.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents server, container, confirm and dry_run. The description restates confirm and dry_run semantics in prose without adding format or syntax detail beyond the schema, making this the baseline case.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Restart a container on a Docker host'), which cleanly distinguishes it from read-only siblings like docker_ps, docker_logs and docker_stats. An agent can identify the operation without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states the precondition for acting ('requires confirm: true') and offers a safe alternative path ('Set dry_run: true to see the exact command... without needing confirm at all'). It does not name a sibling tool to use instead when a restart is the wrong choice, so it falls short of the 5-level routing guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
docker_statsA
Report a point-in-time CPU/memory/network/disk usage snapshot for containers on a Docker host.
| Name | Required | Description | Default |
|---|---|---|---|
| server | Yes | the inventory server name to check | |
| container | No | restrict to a single container name or ID (default: all containers) |
Output Schema
| Name | Required | Description |
|---|---|---|
| stats | Yes | |
| server | Yes | |
| timestamp | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It does disclose the key trait that this is a 'point-in-time snapshot' (not streaming or cumulative), but it omits whether the call is read-only, any auth/permission requirements, and any rate-limit or host-reachability caveats.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence that names the metric types and the object scope with no filler. It is appropriately sized, though it stops short of adding routing or behavioral detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need no explanation, and both parameters are fully documented in the schema. The description supplies the snapshot/semantics context an agent needs; only sibling routing and read-only/auth context are missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both 'server' and 'container' are already documented in the schema, including the default-all-containers behavior. The description adds no parameter syntax or format detail beyond that, making the baseline 3 appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (report) and resource (point-in-time CPU/memory/network/disk snapshot for containers), and the 'containers on a Docker host' scope differentiates it from host-level cpu_usage/memory_usage/disk_usage. It does not, however, explicitly name any sibling alternative to route the agent.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Use is only implied: an agent can infer you call this when you need per-container resource usage rather than host metrics or docker_ps listings. There is no explicit when-to-use, when-not-to-use, or alternative-tool guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
failed_servicesA
List systemd services currently in the failed state on a Linux server.
| Name | Required | Description | Default |
|---|---|---|---|
| server | Yes | the inventory server name to check |
Output Schema
| Name | Required | Description |
|---|---|---|
| server | Yes | |
| status | Yes | |
| services | Yes | |
| timestamp | Yes | |
| recommendation | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It implies a read-only, point-in-time listing, but never states that (no permissions/elevation requirement, no note that it is non-mutating, no rate or scope limits), leaving the safety profile to inference.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with zero filler. The scope-restricting phrase ('currently in the failed state') comes early, which is exactly where an agent needs it.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter read tool with an output schema that already defines the return shape, the description covers what is needed to select and call it correctly. It only omits operational niceties like privilege requirements, which keeps it short of a 5.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% — the single 'server' parameter is fully documented in the schema as 'the inventory server name to check'. The description adds no syntax, format, or sourcing detail beyond that, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb ('List') plus a tightly scoped resource ('systemd services currently in the failed state'), with the platform qualifier ('on a Linux server'). This is inherently distinguishable from every sibling (journal_errors, running_processes, uptime) without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the phrase 'currently in the failed state' — an agent infers this is for failure diagnosis on a host — but there is no explicit when-to-use, when-not-to-use, or pointer to an alternative such as journal_errors for the underlying cause.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
grafana_alertsB
List currently firing or resolved alert instances from a Grafana instance's alerting API.
| Name | Required | Description | Default |
|---|---|---|---|
| instance | Yes | the inventory grafana instance name |
Output Schema
| Name | Required | Description |
|---|---|---|
| alerts | Yes | |
| instance | Yes | |
| timestamp | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It notes the alert states covered (firing/resolved), which is mildly useful, but says nothing about read-only safety, authentication requirements, pagination, or result limits. For a list tool with zero annotation coverage this is a notable gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler; the action and resource lead and the scope qualifier follows. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return-value explanation is not required, and the lone parameter is fully documented. However, the absence of any usage guidance or behavioral caveats leaves the definition only minimally complete for an alert-retrieval tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the single 'instance' parameter, so the schema already documents it fully. The description adds no format, naming convention, or valid-value guidance beyond what the schema provides, making the baseline 3 appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('List') and resource ('alert instances') scoped to a Grafana instance's alerting API, with the additional qualifier 'firing or resolved'. This clearly distinguishes it from siblings like grafana_dashboards, grafana_query, and grafana_annotations, though it does not explicitly name an alternative.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no indication of when to reach for this tool versus grafana_annotations or grafana_query, nor any prerequisites or filtering options. Usage is only implied by the resource name, leaving the agent to infer the context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
grafana_annotationsA
List annotations on a Grafana instance, optionally scoped to a time range and/or tags.
| Name | Required | Description | Default |
|---|---|---|---|
| tags | No | only annotations carrying all of these tags | |
| to_ms | No | end of the time range, epoch milliseconds (default: unbounded) | |
| from_ms | No | start of the time range, epoch milliseconds (default: unbounded) | |
| instance | Yes | the inventory grafana instance name |
Output Schema
| Name | Required | Description |
|---|---|---|
| instance | Yes | |
| timestamp | Yes | |
| annotations | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. 'List' implies a read-only operation, which is useful, but it does not state permission requirements, pagination behavior, or result limits. The existence of an output schema relieves it of explaining return values, keeping this at a middling 3.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single tight sentence with the action front-loaded and the optional qualifiers clearly marked. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only listing tool with a full output schema and 100% parameter description coverage, the description covers what is needed to call it correctly. Only minor gaps remain around auth/prerequisites given the absence of annotations.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all four parameters (tags, to_ms, from_ms, instance) are already documented in the schema including defaults and tag semantics. The description only echoes time range and tags at a high level, adding no syntax or unit detail beyond the schema. Baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (List) and resource (annotations) plus optional scoping, which distinguishes it from Grafana siblings like grafana_alerts, grafana_dashboards, and grafana_query by resource. It does not explicitly name those siblings, but the resource noun is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'optionally scoped to a time range and/or tags' implies how the tool is used, but there is no explicit when-to-use vs when-not-to-use guidance or reference to alternatives. Adequate but leaves the agent to infer context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
grafana_dashboardsB
Search dashboards on a Grafana instance, optionally filtered by title text or tag.
| Name | Required | Description | Default |
|---|---|---|---|
| tag | No | filter to dashboards carrying this tag | |
| query | No | free-text search filter on dashboard title | |
| instance | Yes | the inventory grafana instance name |
Output Schema
| Name | Required | Description |
|---|---|---|
| instance | Yes | |
| timestamp | Yes | |
| dashboards | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. 'Search' weakly implies a read-only operation, but the description never states permission requirements, pagination, or whether results are scoped to a workspace. It adds little beyond the verb itself.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence that states the action, target, and optional filters with zero filler. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and the core search behavior is conveyed. However, for a no-annotation tool the description leaves behavioral gaps (auth, pagination, result scope) that an agent might need when invoking it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all three parameters (tag, query, instance). The description restates that filters exist (title text, tag) but adds no syntax, format, or matching semantics beyond what the schema provides, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb (Search) applied to a clear resource (dashboards) on a Grafana instance, which distinguishes it from siblings like grafana_alerts and grafana_annotations. It does not explicitly name those siblings, so it falls just short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Optionally filtered by title text or tag' implies the browsing use case and gives a sense of when the filters apply, but there is no explicit when-to-use, exclusion, or named alternative against grafana_query or grafana_alerts. Usage is only implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
grafana_queryA
Run a raw query against one datasource on a Grafana instance. The response shape is datasource-specific (Prometheus, Loki, SQL, ...); this is a passthrough, not a normalized result.
| Name | Required | Description | Default |
|---|---|---|---|
| to | No | end of the time range: a Grafana relative unit like now, or epoch milliseconds (default: now) | |
| from | No | start of the time range: a Grafana relative unit like now-1h, or epoch milliseconds (default: now-1h) | |
| query | Yes | raw query in the datasource's own language, e.g. a PromQL or LogQL expression | |
| instance | Yes | the inventory grafana instance name | |
| datasource_uid | Yes | UID of the datasource to query (see its dashboard/settings URL) |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes | |
| instance | Yes | |
| timestamp | Yes | |
| datasource_uid | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it does disclose a genuinely non-obvious trait: the response shape is datasource-specific and un-normalized, so callers cannot assume a uniform result. It omits other behavioral context such as read-only semantics, error behavior, or query timeouts/limits, so it falls short of fully covering a raw-query tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, zero filler. The core action is front-loaded and the caveat about response shape follows immediately, which is the right ordering for an agent skimming for intent.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists and the description still usefully warns that the payload is datasource-specific, and 100% parameter coverage means the schema handles inputs. For a tool spanning Prometheus/Loki/SQL it could say more about the datasource types it supports or whether the query is read-only, but what is present is adequate to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all five parameters including the from/to time defaults and the datasource UID. The description adds no parameter-level meaning beyond telling the agent the result varies by datasource type, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Run a raw query against one datasource') and clarifies the scope is a single datasource on a Grafana instance. It does not explicitly contrast itself with sibling tools like grafana_alerts or grafana_dashboards, so an agent must infer the boundary from the word 'raw'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: the agent can infer this is for datasource-native queries rather than the specialized Grafana siblings, but there is no explicit when-to-use/when-not statement or named alternative. The 'passthrough' framing hints at intent without spelling out the selection rule.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
journal_errorsB
Report the most recent systemd journal entries at error priority or higher on a Linux server.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | maximum number of journal entries to return, most recent first (default 20) | |
| server | Yes | the inventory server name to check |
Output Schema
| Name | Required | Description |
|---|---|---|
| server | Yes | |
| status | Yes | |
| entries | Yes | |
| timestamp | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It discloses the useful filtering behavior (error priority or higher) and recency ordering, but says nothing about read-only nature, permissions, or result volume beyond the schema's limit parameter.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no wasted words. The filtering constraint and target host type are stated immediately.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter read tool with an output schema covering the return values, the description is nearly sufficient. The main gap is the absence of when-to-use routing among the many log-related siblings.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both server and limit are already well documented in the schema. The description adds no syntax or format detail beyond what the schema provides, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb (report), resource (systemd journal entries), filter (error priority or higher), and scope (Linux server), so the agent knows exactly what this returns. It does not explicitly contrast itself with the log-oriented siblings like docker_logs, kubectl_logs, or cisco_logs, so it stops short of full sibling differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no statement of when to use this tool versus the other log-reading siblings (docker_logs, kubectl_logs, cisco_logs) or failed_services. Usage is only weakly implied by the 'error priority or higher' filter, and no exclusions or prerequisites are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
kernel_versionA
Report the running kernel release (uname -r) of a Linux server.
| Name | Required | Description | Default |
|---|---|---|---|
| server | Yes | the inventory server name to check |
Output Schema
| Name | Required | Description |
|---|---|---|
| server | Yes | |
| timestamp | Yes | |
| kernel_release | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. 'Report' implies a read-only, non-mutating call and the command is disclosed, but there is no mention of permission requirements or remote-execution caveats. Adequate for a trivial read, but thin.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One front-loaded sentence with no waste; the parenthetical command is the most useful token in the definition and is included without padding.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
A single-parameter, read-only tool with an output schema that carries the return values. The description covers the essential framing (Linux, kernel release), though it could note that the target must be a reachable inventory server.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the single parameter 'server' is documented in the schema, so the baseline is 3. The description adds only the framing that the server is Linux rather than any new parameter-level detail.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Report') and resource ('the running kernel release'), with the exact command (`uname -r`) as ground truth, which clearly distinguishes it from siblings like uptime or cisco_version. It doesn't explicitly name a sibling, so a 4 rather than 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the 'of a Linux server' qualifier, but there is no explicit when-to-use or when-to-prefer-an-alternative guidance (e.g., vs uptime or cisco_version). The agent can infer intent but must do so itself.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
kubectl_describeA
Describe a pod: its spec/status highlights plus recent events for it.
| Name | Required | Description | Default |
|---|---|---|---|
| pod | Yes | pod name to describe | |
| cluster | Yes | the inventory kubernetes cluster name | |
| namespace | Yes | namespace the pod is in |
Output Schema
| Name | Required | Description |
|---|---|---|
| pod | Yes | |
| node | No | |
| phase | Yes | |
| events | Yes | |
| pod_ip | No | |
| cluster | Yes | |
| namespace | Yes | |
| timestamp | Yes | |
| containers | Yes | |
| start_time | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses the return content (spec/status highlights plus recent events), which is genuine behavioral value, but says nothing about read-only nature, required permissions, or whether events retrieval is bounded/paginated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence that identifies the resource and its output with zero filler. Nothing is wasted and the key information comes first.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so the description need not explain return values, and all parameters are covered by the schema. What remains is the absence of annotation coverage for read-only/permission context, but for a describe-style inspection tool the definition is essentially complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all three parameters (cluster, namespace, pod) are already documented in the schema. The description adds no additional syntax, format, or defaulting guidance beyond what the schema provides, making the baseline 3 correct.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ("Describe a pod") and even previews the content it returns (spec/status highlights + recent events), so the agent knows this is a detail-oriented inspection tool rather than a listing tool. It never names or distinguishes itself from siblings like kubectl_get_pods or kubectl_events, whose scope partially overlaps with the events it mentions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: an agent can infer you call this to inspect a single pod, but there is no explicit when-to-use, when-not-to-use, or alternative routing (e.g., use kubectl_get_pods for listing, kubectl_logs for logs). Adequate but leaves selection to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
kubectl_eventsA
List recent Kubernetes events, most recent first, optionally scoped to one namespace.
| Name | Required | Description | Default |
|---|---|---|---|
| cluster | Yes | the inventory kubernetes cluster name | |
| namespace | No | namespace to list events in (default: all namespaces) |
Output Schema
| Name | Required | Description |
|---|---|---|
| events | Yes | |
| cluster | Yes | |
| namespace | No | |
| timestamp | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It usefully discloses sort order (most recent first) and that the default is all namespaces, but says nothing about how many events are returned, any time window, result caps/truncation, or required permissions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with the core action, ordering, and scope; no filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be described, and both parameters are fully documented in the schema. The remaining gap is behavioral (result volume, time window) rather than structural, leaving it nearly complete for a simple list tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both 'cluster' and 'namespace' are already documented, including the default of all namespaces. The description restates the namespace scoping without adding syntax, format, or behavior beyond the schema; baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (List) and resource (Kubernetes events) plus the ordering guarantee ('most recent first') and scope ('optionally scoped to one namespace'). It is clearly distinguishable from kubectl_logs or kubectl_describe by resource, though it never names a sibling or contrast case.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: 'recent events' suggests troubleshooting/cluster-health triage, and the namespace scoping hints at a filtering workflow. There is no explicit when-to-use, when-not-to-use, or pointer to alternatives like kubectl_describe or kubectl_logs for deeper diagnosis.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
kubectl_get_podsA
List pods in a Kubernetes cluster, optionally scoped to one namespace.
| Name | Required | Description | Default |
|---|---|---|---|
| cluster | Yes | the inventory kubernetes cluster name | |
| namespace | No | namespace to list pods in (default: all namespaces) |
Output Schema
| Name | Required | Description |
|---|---|---|
| pods | Yes | |
| cluster | Yes | |
| namespace | No | |
| timestamp | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full disclosure burden. 'List' implies a safe, non-mutating read, which is the key behavioral fact for this tool, but it says nothing about authentication/credential requirements, whether the query is cluster-wide by default affecting cost/latency, or pagination behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with the resource stated first and the scope qualifier second. Nothing is wasted, though the trailing clause largely echoes the namespace parameter's own schema description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and the tool is a simple two-parameter read with full schema coverage. The remaining gap is environmental context (which cluster/credential the agent must supply and default cluster-wide behavior), which is minor for a list operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and both parameters are already documented (cluster name, namespace with 'default: all namespaces'). The description only restates the namespace scoping and adds no format or syntax detail beyond the schema, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('List pods in a Kubernetes cluster') plus an explicit scope modifier (optional namespace). This clearly separates it from sibling kubectl tools like kubectl_nodes, kubectl_logs, and kubectl_describe, though it never names those siblings explicitly to sharpen the boundary.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The optional-namespace phrasing implies when to narrow the query, but there is no explicit guidance on when to use this versus kubectl_describe, kubectl_events, or kubectl_logs, nor any stated prerequisites (cluster credentials/context). Usage is inferable from the resource name rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
kubectl_logsB
Fetch log lines from a pod's container in a Kubernetes cluster.
| Name | Required | Description | Default |
|---|---|---|---|
| pod | Yes | pod name to fetch logs for | |
| tail | No | number of most recent log lines to return (default: all available) | |
| cluster | Yes | the inventory kubernetes cluster name | |
| container | No | container name (default: the pod's only/first container) | |
| namespace | Yes | namespace the pod is in |
Output Schema
| Name | Required | Description |
|---|---|---|
| pod | Yes | |
| logs | Yes | |
| cluster | Yes | |
| container | No | |
| namespace | Yes | |
| timestamp | Yes | |
| line_count | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It only says 'Fetch,' implying a read-only operation, but omits auth requirements, rate limits, behavior for multi-container pods, or whether the call is streaming versus snapshot.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with zero waste. It states the action and resource immediately and contains no redundant or filler content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be described, and schema coverage is full. However, with no annotations and no usage guidance, the description does not fully compensate for the missing behavioral and routing context an agent needs among multiple log-fetching siblings.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all five parameters including defaults for 'tail' and 'container'. The description adds no parameter semantics beyond what the schema provides, making the baseline 3 appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Fetch') and resource ('log lines from a pod's container in a Kubernetes cluster'). The resource scope naturally distinguishes it from sibling tools like docker_logs, cisco_logs, kubectl_describe, and kubectl_events.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance, prerequisites, or alternative tools are mentioned. The description implies usage context but provides no explicit routing information for an agent choosing among the many log-related siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
kubectl_nodesA
List nodes in a Kubernetes cluster with readiness, roles, and capacity.
| Name | Required | Description | Default |
|---|---|---|---|
| cluster | Yes | the inventory kubernetes cluster name |
Output Schema
| Name | Required | Description |
|---|---|---|
| nodes | Yes | |
| cluster | Yes | |
| timestamp | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. 'List' signals a read-only, non-destructive operation and the description discloses which node attributes come back, but it says nothing about cluster connectivity, credentials, failure modes, or pagination/scale limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with zero filler: verb, resource, scope, then value-add attributes. Nothing is wasted, though it is arguably a touch terse for a tool with no annotations to lean on.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and the single required parameter is fully covered by the schema. The description is complete enough for a simple read-only list tool; the only gap is behavioral context that annotations would normally supply.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one parameter and schema description coverage is 100%, so the schema already documents 'cluster' as the inventory cluster name. The description adds no extra meaning about that parameter, which is the expected baseline when the schema does the work.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb ('List') plus resource ('nodes') and scope ('in a Kubernetes cluster'), with the returned attributes (readiness, roles, capacity) enumerated. It is clearly separable from kubectl_get_pods and proxmox_nodes, though it never names a sibling to contrast against.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The listing intent implies when it is useful, but there is no explicit when/when-not guidance and no mention of alternatives such as kubectl_describe or kubectl_events for deeper per-node detail. Usage is only implied by the resource name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_serversA
List servers known to the inventory, optionally filtered by tag. Never returns credentials.
| Name | Required | Description | Default |
|---|---|---|---|
| tag | No | only return servers carrying this tag; omit to return all servers |
Output Schema
| Name | Required | Description |
|---|---|---|
| servers | Yes | servers matching the requested filter |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It does disclose one genuinely useful, non-obvious trait — "Never returns credentials" — but says nothing about whether the call is read-only, how large the result can get, or whether the inventory is queried live or cached.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, no filler, with the core action first and the security guarantee placed last where it reads as a guarantee rather than the main point. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need no explanation, and the parameter is fully documented in the schema. The description covers the action, the filter, and one behavioral caveat; only the read-only nature of the call is left implicit, which is minor for a list operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% for the single optional tag parameter, so the schema already documents its meaning fully. The description confirms the tag filter exists but adds no syntax, matching rules, or case-sensitivity detail beyond it. Baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb and resource ("List servers known to the inventory") and names the supported filter, so the operation is unambiguous. It does not, however, distinguish itself from the closest sibling, cisco_inventory, which an agent could plausibly confuse for a server listing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
"Optionally filtered by tag" implies the common usage pattern, and the schema's own description clarifies that omitting the tag returns everything. There is no explicit when-to-use guidance, no mention of when a different sibling (e.g. cisco_inventory) would be the better pick.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
memory_usageA
Report memory usage on a Linux server, with a warning/critical severity and recommendation when memory is running low.
| Name | Required | Description | Default |
|---|---|---|---|
| server | Yes | the inventory server name to check |
Output Schema
| Name | Required | Description |
|---|---|---|
| server | Yes | |
| status | Yes | |
| used_kb | Yes | |
| total_kb | Yes | |
| timestamp | Yes | |
| available_kb | Yes | |
| swap_free_kb | Yes | |
| used_percent | Yes | |
| swap_total_kb | Yes | |
| recommendation | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. It usefully discloses that output includes a warning/critical severity and a recommendation when memory is low, but it omits read-only confirmation, permission requirements, and whether it runs remotely or locally.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single compact sentence that front-loads the action and resource with no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter read-only diagnostic with an output schema, the description covers the essentials and even hints at return content (severity/recommendation). Minor gaps in host targeting and read-only confirmation keep it from a 5.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one parameter exists and the schema documents it fully (100% coverage), so the description is not required to add syntax. It adds no meaning beyond the schema's 'inventory server name', making the baseline 3 appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (report) and resource (memory usage) scoped to a Linux server, and mentions the warning/critical severity framing. This clearly distinguishes it from sibling diagnostics like cpu_usage and disk_usage.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the name and purpose (check memory on a host), but there is no explicit when-to-use/when-not guidance and no reference to alternative tools such as cpu_usage or disk_usage for other resource checks.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
proxmox_nodesB
List every node in a Proxmox VE cluster along with its resource usage summary.
| Name | Required | Description | Default |
|---|---|---|---|
| instance | Yes | the inventory proxmox instance name |
Output Schema
| Name | Required | Description |
|---|---|---|
| nodes | Yes | |
| instance | Yes | |
| timestamp | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. 'List' implies a read operation and it discloses the return content ('resource usage summary'), but it says nothing about authentication requirements, permissions, cluster-connectivity caveats, or output shape beyond that phrase. Adequate but thin for an unannotated tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single well-formed sentence that front-loads the action and resource and ends with the payload detail. No filler, no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple (one required param) and has an output schema, so return values need not be explained. The description covers the essential what-and-what-you-get, leaving only usage routing unaddressed, which is a minor completeness gap rather than a critical one.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is one parameter ('instance') and schema description coverage is 100%, so the schema already documents it. The description adds no syntax, format, or naming guidance for selecting the instance, which matches the baseline 3 for high-coverage schemas.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('List') and resource ('every node in a Proxmox VE cluster') plus the returned payload ('resource usage summary'). It is clearly distinct from siblings like proxmox_vms, but it never explicitly names or contrasts with those siblings, so it stops short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this versus alternatives. The agent must infer from the resource name that this lists cluster nodes, and the description never mentions exclusions, prerequisites, or related tools such as proxmox_vms or proxmox_tasks.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
proxmox_snapshotA
Take a snapshot of a QEMU VM or LXC container on a Proxmox node. This is a state-changing action: it requires confirm: true, and returns without acting if confirmation is missing. Snapshotting is asynchronous — the response carries a task UPID, not confirmation the snapshot has finished; check it with proxmox_tasks. Set dry_run: true to see the exact API call that would be made without needing confirm at all.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | name for the new snapshot | |
| node | Yes | the cluster node the guest lives on | |
| type | No | guest type: 'qemu' (default) or 'lxc' | |
| vmid | Yes | the guest's numeric VM/container ID | |
| confirm | No | must be true to actually take the snapshot; otherwise the tool reports what it would do without acting | |
| dry_run | No | if true, report the exact API call that would be made and return without acting or requiring confirm | |
| instance | Yes | the inventory proxmox instance name |
Output Schema
| Name | Required | Description |
|---|---|---|
| name | Yes | |
| node | Yes | |
| type | Yes | |
| upid | No | |
| vmid | Yes | |
| status | Yes | |
| message | Yes | |
| instance | Yes | |
| timestamp | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does so well: it discloses that this is state-changing, that it no-ops without confirm, that the success response is a UPID rather than completion, and that dry_run bypasses confirmation. This is exactly the context an agent needs to avoid assuming the snapshot finished.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four sentences, zero filler, and the most important constraint (state-changing, needs confirm) is front-loaded before the async and dry_run details. Each sentence delivers a distinct operational fact.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, yet the description goes further by interpreting the asynchronous UPID return and pointing to the tool that resolves it. Combined with the confirmation and dry_run semantics, nothing needed to invoke this correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all seven parameters, including confirm and dry_run. The description restates the confirm/dry_run contract in behavioral terms but adds no syntax, constraints, or default details beyond the schema, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Take a snapshot of a QEMU VM or LXC container on a Proxmox node') and scopes it to both guest types. No sibling tool performs snapshots, so the agent can distinguish it immediately from proxmox_start_vm, proxmox_stop_vm, or proxmox_tasks.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Clearly explains the gating condition (confirm: true required, otherwise it reports and returns) and names proxmox_tasks as the way to follow up on the async operation, plus dry_run as a no-confirm preview path. It lacks an explicit 'use this before making changes' framing, but the when/how conditions are concrete.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
proxmox_start_vmA
Start a QEMU VM or LXC container on a Proxmox node. This is a state-changing action: it requires confirm: true, and returns without acting if confirmation is missing. Starting is asynchronous — the response carries a task UPID, not confirmation the guest has finished starting; check it with proxmox_tasks. Set dry_run: true to see the exact API call that would be made without needing confirm at all.
| Name | Required | Description | Default |
|---|---|---|---|
| node | Yes | the cluster node the guest lives on | |
| type | No | guest type: 'qemu' (default) or 'lxc' | |
| vmid | Yes | the guest's numeric VM/container ID | |
| confirm | No | must be true to actually start the guest; otherwise the tool reports what it would do without acting | |
| dry_run | No | if true, report the exact API call that would be made and return without acting or requiring confirm | |
| instance | Yes | the inventory proxmox instance name |
Output Schema
| Name | Required | Description |
|---|---|---|
| node | Yes | |
| type | Yes | |
| upid | No | |
| vmid | Yes | |
| status | Yes | |
| message | Yes | |
| instance | Yes | |
| timestamp | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does so well: it declares the call state-changing, that it silently no-ops without confirm:true, that the operation is asynchronous returning a UPID rather than a completion signal, and that dry_run bypasses confirm entirely. These are exactly the traits an agent needs before firing a mutation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four tight sentences, purpose front-loaded, then preconditions, async caveat, and dry_run alternative in descending order of importance. No filler or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutating tool with an output schema, the description supplies everything the schema cannot: confirmation gating, the no-op-on-missing-confirm behavior, async/UPID semantics, and the follow-up tool. Return-value detail is legitimately left to the output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so confirm and dry_run semantics are already fully documented in the schema and the description largely restates them. It adds no format or value constraints beyond what the schema provides, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Start) and resource (QEMU VM or LXC container on a Proxmox node), and the scope is precise enough to separate it from sibling proxmox_stop_vm without opening any schema. Nothing tautological or vague.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explains the confirm-gating precondition, the dry_run escape hatch, and points to proxmox_tasks for follow-up, which is clear operational context. It does not explicitly contrast against proxmox_stop_vm or other lifecycle siblings, so it stops short of full when/when-not routing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
proxmox_stop_vmA
Force-stop (hard power-off, not a graceful shutdown) a QEMU VM or LXC container on a Proxmox node. This is a dangerous, service-impacting action: it requires confirm: true, and returns without acting if confirmation is missing. Stopping is asynchronous — the response carries a task UPID, not confirmation the guest has finished stopping; check it with proxmox_tasks. Set dry_run: true to see the exact API call that would be made without needing confirm at all.
| Name | Required | Description | Default |
|---|---|---|---|
| node | Yes | the cluster node the guest lives on | |
| type | No | guest type: 'qemu' (default) or 'lxc' | |
| vmid | Yes | the guest's numeric VM/container ID | |
| confirm | No | must be true to actually stop the guest; otherwise the tool reports what it would do without acting | |
| dry_run | No | if true, report the exact API call that would be made and return without acting or requiring confirm | |
| instance | Yes | the inventory proxmox instance name |
Output Schema
| Name | Required | Description |
|---|---|---|
| node | Yes | |
| type | Yes | |
| upid | No | |
| vmid | Yes | |
| status | Yes | |
| message | Yes | |
| instance | Yes | |
| timestamp | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden and does so well: it declares the action dangerous and service-impacting, states the confirm requirement and what happens without it, explains the asynchronous return (UPID, not confirmation), and points to proxmox_tasks for verification. It also explains dry_run's effect on the confirm requirement. This is more behavioral context than most mutation tools provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences, each front-loaded and purposeful: the action and its semantics, the danger/confirmation gating, then the async caveat and dry_run escape hatch. No filler, no repetition of schema fields.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive, no-annotation, async mutation tool, the description covers danger, confirmation gating, async result handling with a named sibling, and a dry-run alternative. An output schema exists, so return value details are not needed in the description. Nothing an agent needs to call this safely is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents node, type, vmid, confirm, dry_run, and instance. The description adds meaning for confirm and dry_run (what they gate and return), but doesn't elaborate on node/type/vmid beyond the schema. Baseline 3 is appropriate when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (force-stop) and resource (QEMU VM or LXC container on a Proxmox node), and immediately clarifies the semantics of 'stop' as hard power-off rather than graceful shutdown. This distinguishes it from the sibling proxmox_start_vm and from any graceful shutdown concept.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states the gating condition (requires confirm: true, otherwise it returns without acting) and mentions dry_run as a safe alternative for inspecting the call. It routes the agent to proxmox_tasks for checking the asynchronous result. However, it doesn't explicitly compare against a graceful shutdown sibling (none is listed), so the when-not guidance is implicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
proxmox_tasksA
List recent tasks (backups, migrations, VM actions, ...) recorded on a Proxmox node, most recent first.
| Name | Required | Description | Default |
|---|---|---|---|
| node | Yes | the cluster node to list tasks on, e.g. 'pve01' | |
| limit | No | maximum number of tasks to return, most recent first (default: Proxmox's server-side default) | |
| instance | Yes | the inventory proxmox instance name |
Output Schema
| Name | Required | Description |
|---|---|---|
| node | Yes | |
| tasks | Yes | |
| instance | Yes | |
| timestamp | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden, and it does disclose the 'most recent first' ordering, which is useful behavioral context. However, it does not state that this is a read-only listing, note any pagination or rate-limit behavior, or mention the default cap (`limit`) semantics beyond what the schema already says.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence, front-loaded with the verb and resource, with the ordering behavior appended and zero filler. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only listing tool with full schema coverage and an output schema, the description covers the essential purpose, scope, and ordering. Minor omissions (explicit read-only nature, pagination/limit interaction) keep it just short of complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so `node`, `limit`, and `instance` are already fully documented in the schema, and an output schema exists. The description adds no parameter-level meaning beyond the schema, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('List') with a clearly scoped resource ('recent tasks ... recorded on a Proxmox node') and even enumerates task types (backups, migrations, VM actions). This is readily distinguishable from siblings like proxmox_vms or proxmox_nodes, though it does not explicitly name them to reinforce the distinction.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: an agent can infer this is for inspecting node task history, but there is no statement of when to prefer this over alternatives or any exclusions/prerequisites. Adequate but with a clear gap.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
proxmox_vmsB
List every QEMU VM and LXC container on a Proxmox node.
| Name | Required | Description | Default |
|---|---|---|---|
| node | Yes | the cluster node to list guests on, e.g. 'pve01' | |
| instance | Yes | the inventory proxmox instance name |
Output Schema
| Name | Required | Description |
|---|---|---|
| vms | Yes | |
| node | Yes | |
| instance | Yes | |
| timestamp | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must carry behavioral disclosure; it does convey that this is a read-only enumeration scoped to a single node. It does not address pagination, result limits, permissions required, or what happens if the node name is invalid. For a low-risk list operation the scope statement is adequate but thin.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler; the resource and scope appear immediately. It is efficient, though almost too terse to stand alone without the schema.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and the tool is a simple two-parameter read. What is missing is the instance-to-node relationship and any usage routing against proxmox_nodes, leaving the definition minimally complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and both parameters (node, instance) are documented in the schema, so the baseline is 3. The description echoes the node scoping but adds nothing about the 'instance' parameter or the relationship between instance and node.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb ('List') plus both resources it covers (QEMU VMs and LXC containers) and the scope ('on a Proxmox node'). It is clearly distinct from siblings like proxmox_start_vm, proxmox_stop_vm, proxmox_snapshot, and proxmox_nodes, though it never explicitly contrasts itself with proxmox_nodes (which lists nodes rather than guests).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no statement of when to use this tool versus alternatives, no prerequisites (e.g. that the node must belong to the named instance), and no exclusions. The listing intent is only implied by the verb 'List'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
reboot_requiredA
Report whether a Linux server is pending a reboot (Debian/Ubuntu reboot-required marker, or a running kernel older than the newest installed one).
| Name | Required | Description | Default |
|---|---|---|---|
| server | Yes | the inventory server name to check |
Output Schema
| Name | Required | Description |
|---|---|---|
| reason | No | |
| server | Yes | |
| status | Yes | |
| required | Yes | |
| timestamp | Yes | |
| newest_kernel | No | |
| recommendation | No | |
| running_kernel | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It helpfully discloses the detection logic (Debian/Ubuntu reboot-required marker vs. running-kernel-older-than-newest), but does not state read-only safety, needed permissions, or whether the check is costly. Some genuine value, clear gaps remain.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence, front-loaded with the verb and outcome, with the clarifying detail parenthesized. Zero wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and the tool takes one simple parameter. The description covers the concept and detection method well; only minor gaps around permissions/behavior remain.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the single 'server' parameter is already fully documented in the schema. The description adds no format, naming, or resolution detail beyond it, matching the baseline when the schema does the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Report) and a precisely scoped resource: whether a Linux server is pending a reboot. The parenthetical even names the two detection mechanisms, making it easy to distinguish from siblings like kernel_version or uptime.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by the clear scope, but there is no explicit when-to-use or when-not-to-use guidance, and it never routes the agent away from the closely related kernel_version sibling. Adequate but leaves the choice to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
running_processesB
List the top processes on a Linux server, sorted by CPU usage descending.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | maximum number of processes to return, sorted by CPU usage descending (default 20) | |
| server | Yes | the inventory server name to check |
Output Schema
| Name | Required | Description |
|---|---|---|
| server | Yes | |
| processes | Yes | |
| timestamp | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It discloses the sort order and implicitly that this is a read operation, but says nothing about required server access/credentials, whether output is truncated beyond the limit, or any rate limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler; the ordering constraint is stated in the same breath as the purpose. Nothing is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return-value explanation is not needed, and the parameters are fully documented. However, for a tool that reaches out to a named inventory server, the description omits any note about connectivity, authentication, or failure modes, leaving it only minimally complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both 'server' and 'limit' are already documented in the schema, including the default of 20 and the CPU-descending sort. The description adds no parameter detail beyond what the schema provides, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clear verb+resource ('List the top processes') with the ordering stated explicitly, so an agent knows exactly what it returns. It does not, however, distinguish itself from nearby siblings such as cpu_usage or docker_ps, which an agent might otherwise confuse for process-level listing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use or when-not-to-use guidance is given, and no alternative tools are named. The agent must infer from the name alone that this is for per-process CPU analysis rather than aggregate CPU reporting.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
uptimeB
Report how long a Linux server has been running and its 1/5/15-minute load averages.
| Name | Required | Description | Default |
|---|---|---|---|
| server | Yes | the inventory server name to check |
Output Schema
| Name | Required | Description |
|---|---|---|
| load1 | Yes | |
| load5 | Yes | |
| load15 | Yes | |
| server | Yes | |
| timestamp | Yes | |
| uptime_seconds | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. 'Report' implies a non-mutating read, but the description does not state permissions, prerequisites, failure modes, or whether the target must be in inventory. It is adequate for a simple read-only diagnostic, but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no wasted words. It communicates the action and the exact metrics returned immediately.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only diagnostic with a fully documented single parameter and an output schema, the description is nearly complete. It explains what is measured but omits any prerequisite or error-handling context, leaving a minor gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents the single required 'server' parameter as an inventory server name. The description adds no further parameter meaning beyond reinforcing that the target is a Linux server, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific reporting action and two concrete outputs: server uptime and 1/5/15-minute load averages. It clearly distinguishes itself from sibling diagnostic tools like cpu_usage, memory_usage, and kernel_version, though it does not explicitly name alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit when-to-use or when-not-to-use guidance. The description does not tell the agent how this differs from or complements sibling tools such as cpu_usage or running_processes, leaving usage context to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
7 tool updates
v0.8.1- Added
check_inventory_health - Added
cisco_backup_diff - Changed
docker_restart1 field changed- added
Input schema / properties / dry_runAdded value: +{ + "description": "if true, report the exact command that would be run and return without acting or requiring confirm", + "type": "boolean" +}
- Changed
proxmox_snapshot1 field changed- added
Input schema / properties / dry_runAdded value: +{ + "description": "if true, report the exact API call that would be made and return without acting or requiring confirm", + "type": "boolean" +}
- Changed
proxmox_start_vm1 field changed- added
Input schema / properties / dry_runAdded value: +{ + "description": "if true, report the exact API call that would be made and return without acting or requiring confirm", + "type": "boolean" +}
- Changed
proxmox_stop_vm1 field changed- added
Input schema / properties / dry_runAdded value: +{ + "description": "if true, report the exact API call that would be made and return without acting or requiring confirm", + "type": "boolean" +}
- Removed
run_command
36 tool updates
v0.1.0- First observed
cisco_backup - First observed
cisco_interfaces - First observed
cisco_inventory - First observed
cisco_logs - First observed
cisco_version - First observed
cpu_usage - First observed
disk_usage - First observed
docker_images - First observed
docker_logs - First observed
docker_ps - First observed
docker_restart - First observed
docker_stats - First observed
failed_services - First observed
grafana_alerts - First observed
grafana_annotations - First observed
grafana_dashboards - First observed
grafana_query - First observed
journal_errors - First observed
kernel_version - First observed
kubectl_describe - First observed
kubectl_events - First observed
kubectl_get_pods - First observed
kubectl_logs - First observed
kubectl_nodes - First observed
list_servers - First observed
memory_usage - First observed
proxmox_nodes - First observed
proxmox_snapshot - First observed
proxmox_start_vm - First observed
proxmox_stop_vm - First observed
proxmox_tasks - First observed
proxmox_vms - First observed
reboot_required - First observed
run_command - First observed
running_processes - First observed
uptime
TDQS
Scored across 37 tools
Each tool targets a distinct resource/action within its platform (Linux, Docker, Cisco, Proxmox, Grafana, Kubernetes, inventory); overlaps like cisco_backup vs cisco_backup_diff are clearly differentiated by the diff/baseline semantics. No two tools appear to do the same thing.
All names use snake_case and largely follow a domain-prefix convention (docker_, cisco_, proxmox_, grafana_, kubectl_), which aids predictable grouping. Minor deviations exist: Linux and inventory tools lack a domain prefix, and action/noun phrasing varies (docker_images vs docker_restart), but the set remains readable and predictable.
37 tools across seven subsystems is heavy; while each subsystem is reasonably scoped, the total exceeds the 25-tool threshold and forces an agent to filter a large toolset. The breadth is plausible for a multi-platform infra server, but the count is a significant cognitive burden.
Diagnostic/read coverage is strong across Linux, Docker, Cisco, Proxmox, Grafana, and Kubernetes, with a few safe mutations (restart, start/stop, snapshot). However, no tool supports create/update/delete of core resources (containers, VMs, dashboards, Kubernetes objects, inventory entries) or config pushes, leaving significant lifecycle gaps for an infrastructure management server.
Maintenance
Related MCP Connectors
- emisarOAuthdev.emisar
Let AI operate servers without SSH. Choose actions, approve risky changes, and audit every step.
Operate Linux, macOS and Windows from your LLM. Every action runs through an auditable allowlist.
Your AI Agent's Infrastructure Layer. Connect Claude, Copilot, Codex, or ChatGPT to 200+ managed open source services. Start databases, pipelines, and applications through natural language.
Work on your own computers from Claude or ChatGPT: run commands, edit and search files.
Related MCP Servers
- AlicenseBqualityAmaintenanceProvides policy-driven, auditable SSH access to server fleets for AI assistants with zero-trust security controls, command whitelisting, and comprehensive audit logging to safely manage infrastructure.1328Apache 2.0
- AlicenseNot gradedqualityCmaintenanceEnables AI assistants to securely execute SSH commands on remote servers with connection pooling, session isolation, and a web audit panel.4MIT
- AlicenseNot gradedqualityDmaintenanceGive Claude direct access to your AWS account, SSH into your servers, run shell commands on your laptop, query your databases, and manage PM2 processes — all from a Claude chat. No Claude Code subscription needed. Your keys never leave your machine.2MIT
- AlicenseAqualityBmaintenanceStateful, structured, safe shell sessions for AI agents, on real infrastructure.712Apache 2.0