Skip to main content
Glama

pty-mcp

pty-mcp MCP server

AIエージェントにインタラクティブなターミナルセッション(ローカルシェル、SSH、シリアルポート、切断後も維持される永続的なリモートセッション)を提供するMCP(Model Context Protocol)サーバーです。

単なるコード生成ではなく、実際のサーバーやデバイス管理をAIに支援させたいシステム管理者やネットワークエンジニアのために構築されました。

pty-mcpを介してTelehack BBSと対話するAIエージェント

なぜ必要なのか

AIエージェントは非インタラクティブなシェルでコマンドを実行します。そのため、以下のようなことができません。

  • サーバーにSSH接続し、実行中のプロセスと対話する

  • シリアルコンソール経由でルーターやスイッチに接続する

  • ログを監視し、特定のイベントが発生したときに反応する

  • 複数のコマンド間でセッション状態を保持する

  • サーバーの再起動を待ち、復旧したことを検知する

pty-mcpは、MCP上で実際のPTYセッションを提供することで、これらすべてを解決します。

pty-mcpがない場合、AIエージェントは sleep 30 && check_status のようなループに頼ることになり、CPUサイクルとAPI呼び出しを浪費してしまいます。wait_for を使用すれば、エージェントはイベントが発生するまでサーバー側で待機します。ポーリングが減り、エネルギー消費も抑えられ、シロクマにも優しい設計です。🐻❄️

Related MCP server: interactive-cli

ユースケース

サーバー管理

# Reboot a server and wait until it's back online
create_local_session("ping myserver")
read_output(wait_for: "bytes from", timeout: 300)
→ blocks until server responds after reboot (~80s, one tool call)

ネットワークデバイス管理

# Connect to a router via serial console
create_serial_session(port: "/dev/ttyUSB0", baud: 9600)
send_input("show interfaces status")
read_output(wait_for: "\\$")

ログ監視とアラート

# Watch logs and act when something happens
create_ssh_session(host: "prod", user: "admin")
send_input("tail -f /var/log/app.log")
read_output(wait_for: "ERROR|CRITICAL", timeout: 3600)
→ returns the error line + context when it appears

切断後も継続する長時間タスク

create_ssh_session(host: "server", user: "admin", persistent: true)
send_input("apt upgrade -y")
detach_session()          → close Claude Code, task continues
# Reconnect later to check result

機能

機能

説明

ローカルターミナル

ローカルマシン上でのインタラクティブなbash/python/nodeセッション

SSHセッション

鍵/パスワード認証、SSH設定サポートを使用してリモートホストに接続

シリアルポート

シリアル経由でデバイス(IoT、組み込み、ネットワーク機器)に接続

永続セッション

ai-tmux デーモンにより、SSH切断後もセッションを維持

アタッチ/デタッチ

実行中のセッションからデタッチし、後で再接続

制御キー

ctrl+c、ctrl+d、矢印キー、tab、escapeの送信

安定検知

出力が安定するまで待機してから戻る(スマートタイムアウト)

パターンマッチング

wait_for は出力に正規表現パターンが現れるまでブロック(v0.2.0)

メモリ制限

リングバッファにより、長時間実行セッションでのOOMを防止(v0.2.0)

監査ログ

オプションの任意操作ログ — send_input コマンドをコレクターに記録し、レビューと追跡が可能(v0.8.0)

アーキテクチャ

┌─────────────────────────────────────────────────────┐
│ AI Agent (Claude Code, etc.)                        │
│                                                     │
│  MCP Tools: create_local_session, send_input,       │
│             send_control, read_output, close_session │
└──────────────────────┬──────────────────────────────┘
                       │ JSON-RPC stdio
┌──────────────────────┴──────────────────────────────┐
│ pty-mcp (MCP Server)                                │
│                                                     │
│  Session Manager                                    │
│  ├── LocalSession  (local PTY via creack/pty)       │
│  ├── SSHSession    (remote PTY via x/crypto/ssh)    │
│  ├── SerialSession (serial port via go.bug.st)      │
│  └── RemoteSession (persistent via ai-tmux)         │
└─────────────────────────────────────────────────────┘

Persistent mode (ai-tmux):

  pty-mcp ──SSH──▶ ai-tmux client ──Unix socket──▶ ai-tmux server (daemon)
                                                     ├── PTY: bash
                                                     ├── PTY: ssh admin@router
                                                     └── PTY: tail -f /var/log/syslog

クイックスタート

Claude Codeプラグイン(推奨)

バイナリを自動的にインストールし、MCPサーバーを登録します:

claude plugin marketplace add raychao-oao/pty-mcp
claude plugin install pty-mcp@pty-mcp

Claude Codeを再起動してください。セッション開始時にバイナリが自動ダウンロードされます。その後、もう一度再起動して有効化してください。手動での claude mcp add は不要です。

アップデート:

claude plugin marketplace update pty-mcp
claude plugin update pty-mcp@pty-mcp

Claude Codeを再起動してください。新しいバイナリがセッション開始時に自動ダウンロードされます。その後、もう一度再起動してアップデートを適用してください。

手動インストール

ワンライナーでのインストール + 登録(macOS / Linux / WSL2):

curl -fsSL https://raw.githubusercontent.com/raychao-oao/pty-mcp/main/install.sh | sh
claude mcp add pty-mcp -- /usr/local/bin/pty-mcp

Claude Codeを再起動すれば、ツールが利用可能になります。

GitHub Releasesからダウンロード:

Releases にアクセスし、プラットフォーム用のバイナリをダウンロードして実行権限を付与してください:

プラットフォーム

バイナリ

macOS (Apple Silicon)

pty-mcp-darwin-arm64

macOS (Intel)

pty-mcp-darwin-amd64

Linux (x86_64) / WSL2

pty-mcp-linux-amd64

Linux (ARM64)

pty-mcp-linux-arm64

chmod +x pty-mcp-*
sudo mv pty-mcp-* /usr/local/bin/pty-mcp
claude mcp add pty-mcp -- /usr/local/bin/pty-mcp

ソースからビルド(Go 1.25+が必要):

go install github.com/raychao-oao/pty-mcp@latest
claude mcp add pty-mcp -- $(go env GOPATH)/bin/pty-mcp

WSL2に関する注意点

pty-mcpはWSL2でそのまま動作します。Linuxバイナリを使用してください:

# Inside WSL2
curl -fsSL https://raw.githubusercontent.com/raychao-oao/pty-mcp/main/install.sh | sh
claude mcp add pty-mcp -- /usr/local/bin/pty-mcp

オプション:リモートサーバーへのai-tmuxのインストール

SSH切断後も維持される永続セッションを利用するには、リモートサーバーに ai-tmux をインストールしてください:

# Download for your server's architecture
curl -fsSL https://raw.githubusercontent.com/raychao-oao/pty-mcp/main/install.sh | sh
# Or just copy the binary:
scp /usr/local/bin/ai-tmux your-server:/usr/local/bin/ai-tmux

使用例

登録が完了すると、AIエージェントは以下のMCPツールを使用できます:

ローカルインタラクティブシェル:

create_local_session()                    → {session_id, type: "local"}
send_input(session_id, "cd /tmp && ls")   → {output: "...", is_complete: true}
send_input(session_id, "python3")         → start Python REPL
send_input(session_id, "print('hello')")  → {output: "hello\n>>>"}
send_control(session_id, "ctrl+d")        → exit Python
close_session(session_id)

リモートサーバーへのSSH接続:

create_ssh_session(host: "myserver", user: "admin")
send_input(session_id, "top")
send_control(session_id, "ctrl+c")        → stop top

パターン待機(v0.2.0):

create_local_session("ping myserver")
read_output(session_id, wait_for: "bytes from", timeout: 300)
→ blocks until server responds or 5 min timeout

send_input(session_id, "docker-compose up")
read_output(session_id, wait_for: "ready|error", timeout: 60, context_lines: 3)
→ returns matched line + 3 lines of context

シークレット/パスワードの送信(v0.3.0):

# AI detects a password prompt, calls send_secret instead of handling the password itself
create_ssh_session(host: "router", user: "admin")
read_output(session_id, wait_for: "Password:")   → session is waiting for input

send_secret(session_id, prompt: "Router admin password:")
→ native GUI dialog appears on the operator's screen (macOS: system dialog,
   WSL2: Windows Get-Credential, Linux: zenity/kdialog)
→ operator types password — it is sent directly to the PTY session
→ AI only sees: {success: true, length: 12}
→ password never appears in AI context or logs

永続セッション(SSH切断後も維持):

create_ssh_session(host: "server", user: "admin", persistent: true)
send_input(session_id, "make build")      → start long build
detach_session(session_id)                → disconnect, build continues

# Later (even after restart):
list_remote_sessions(host: "server", user: "admin")  → see running sessions
create_ssh_session(host: "server", user: "admin", session_id: "abc123")  → reattach
send_input(session_id, "echo $?")         → check build result

MCPツール

ツール

説明

create_local_session

ローカルインタラクティブターミナル(bash, python3, node等)を開始

create_ssh_session

リモートホストへSSH接続(SSH設定のエイリアスをサポート)

create_serial_session

シリアルポートデバイスへ接続

send_input

コマンドを送信し、出力が安定するまで待機

read_output

出力を読み取る。オプションでパターン待機が可能(wait_for, timeout, context_lines, tail_lines)

send_control

制御キーを送信(ctrl+c, ctrl+d, 矢印, tab等)

send_secret

GUIダイアログを通じてオペレーターにシークレットの入力を促す。AIコンテキストやログにさらすことなくPTYセッションへ送信 ¹

list_sessions

アクティブなセッションを一覧表示

close_session

セッションを閉じる(リモートPTYを終了)

detach_session

切断するが、リモートPTYは実行し続ける

list_remote_sessions

リモートホスト上の永続セッションを一覧表示

¹ send_secret のプラットフォームサポート: macOSはネイティブのパスワードダイアログ(osascript)を使用します。WSL2は powershell.exe Get-Credential(Windows GUIダイアログ)を使用します。ディスプレイサーバーを備えたLinuxは zenity または kdialog を使用します。ヘッドレスLinuxは /dev/tty にフォールバックします。

監査ログ

pty-mcpには、すべての send_input コマンドを中央コレクターに記録するオプションの監査ログ機能が含まれています。これにより、チームはセッション中にAIエージェントが何を行ったかをレビューおよび追跡できます。

重要: これは任意かつ自己申告型の操作ログです。オペレーターが有効化し、コレクターを実行することを選択する必要があります。pty-mcpはオペレーター自身のマシン上で動作するため、ログを強制する技術的なメカニズムはありません。準拠していないオペレーターは、監査を有効にせずにpty-mcpを実行できてしまいます。この機能は、それを望むチームに追跡可能性を提供しますが、監査コンプライアンスが求められる環境において、システムレベルの監査ツール(auditd、syslog転送、SSHセッション記録など)の代わりにはなりません。

記録される内容

  • タイムスタンプ、オペレーターID、セッションID、セッションタイプ(ローカル/ssh/シリアル)、ターゲットホスト

  • send_input を介して送信された正確な入力(メニュー選択などの raw=true 入力を含む)

  • 各コマンド後の出力スニペット(最初の2 KB)

  • コマンドと出力を紐付ける cmd_id

send_secret は決してログに記録されません。GUIダイアログ経由で入力されたシークレットは監査ログには表示されません。

セットアップ

各オペレーターが一度だけ実行して設定を作成し、トークンを生成します:

pty-mcp audit init

これにより、ランダムに生成されたトークンを含む ~/.config/pty-mcp/config(chmod 600)が作成され、コレクター管理者に共有するためのトークンが表示されます。

コレクター管理者はサーバーを起動します(init出力のトークンを使用):

PTY_MCP_AUDIT_TOKEN=<token-from-init> \
  pty-mcp audit serve --port 9099 --log /var/log/pty-mcp-audit.jsonl

設定でコレクターURLを設定した後、監査を有効化します:

# Edit config and set: audit-url=http://your-collector:9099
pty-mcp audit enable
# Restart Claude Code to apply

設定を失わずに一時的にログ記録を停止するには:

pty-mcp audit disable

設定ファイルを持たないオペレーターには影響ありません。監査はデフォルトでオフになっています。

監査モード

モード

動作

best-effort (デフォルト)

ログが書き込まれたかどうかにかかわらずコマンドは実行されます。エントリはキューに入れられ、バックグラウンドで再試行されます

strict

監査エントリが配信できない場合、send_input は拒否されます。ログ記録がチームのポリシー要件である場合に使用してください

ログのレビュー

ログはJSONL(1行につき1つのJSONオブジェクト)として保存され、標準ツールで読み取り可能です:

# All commands by operator ray
grep '"user":"ray"' /var/log/pty-mcp-audit.jsonl | jq .

# Commands sent to a specific host
jq 'select(.target == "root@prod01")' /var/log/pty-mcp-audit.jsonl

ai-tmux: 永続ターミナルデーモン

ai-tmux はリモートサーバー上で動作する軽量なデーモンで、SSH切断後もPTYセッションを維持します。AIエージェントのために設計されたtmuxと考えてください。

リモートサーバーへのインストール

# Cross-compile for Linux
GOOS=linux GOARCH=amd64 go build -o ai-tmux-linux ./cmd/ai-tmux/

# Copy to server
scp ai-tmux-linux server:~/ai-tmux
ssh server "chmod +x ~/ai-tmux && sudo mv ~/ai-tmux /usr/local/bin/ai-tmux"

仕組み

  • ai-tmux server — デーモンモード。Unixソケットをリッスンし、PTYセッションを管理します

  • ai-tmux client — ブリッジモード。stdin/stdout経由でJSONプロトコルを転送します(SSH経由でpty-mcpが使用)

  • ai-tmux list — アクティブなセッションを一覧表示

pty-mcpが persistent: true で接続すると、デーモンが自動起動します。セッションは30分間非アクティブになると終了します。

SSH設定のサポート

pty-mcpは ~/.ssh/config を読み取ってホストエイリアスを解決します:

# ~/.ssh/config
Host myserver
    HostName 192.168.1.100
    User admin
    Port 2222
    IdentityFile ~/.ssh/id_ed25519
create_ssh_session(host: "myserver", user: "admin")
# Automatically resolves hostname, port, and identity file

要件

  • Go 1.25+

  • シリアル接続の場合:適切なデバイス権限

  • 永続セッションの場合:リモートサーバー上の ai-tmux バイナリ

変更履歴

バージョン履歴については CHANGELOG.md を参照してください。

ライセンス

MIT

Available Tools

16 tools
close_sessionB

Close a session (also terminates remote PTY)

ParametersJSON Schema
NameRequiredDescriptionDefault
session_idYes

TDQS

B3.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Discloses termination of remote PTY, a key behavioral effect. However, no annotations provided, and description lacks details on destructive nature, permissions, or reversibility.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Extremely concise with no wasted words. Two clauses efficiently convey the core action and an important side effect.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Sufficient for a simple close operation, but misses parameter explanation and lacks return value info (no output schema). Barely adequate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Single parameter 'session_id' has no schema description (0% coverage). Tool description does not explain the parameter's meaning or format beyond the obvious.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clear verb 'close' and resource 'session'. Parenthetical clarifies termination of remote PTY, but does not distinguish from sibling 'detach_session'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool vs alternatives like detach_session or send_control. With 15 sibling tools, this is a significant gap.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

create_local_sessionA

Open a local interactive terminal session (bash, python3, node, etc.). WARNING: Executes as the current user with full local system access — this is by design for legitimate sysadmin automation. Only use on trusted systems.

ParametersJSON Schema
NameRequiredDescriptionDefault
commandNoCommand to run (default: /bin/bash). Examples: /bin/bash, python3, node
log_fileNoFile path to append all session output. Useful when output may exceed buffer size. File is created if it doesn't exist.
log_max_sizeNoMax log file size in MB before rotation (0 = no rotation, default: 0)
log_max_filesNoMax number of rotated log files to keep (default: 3)

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Without annotations, the description carries the burden. It warns of 'full local system access' and identifies intended use for 'legitimate sysadmin automation'. This adds crucial behavioral context. Additional details on session lifecycle (e.g., how it blocks) would improve transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no fluff. The warning is front-loaded. Every word serves a purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers core purpose, warning, and log parameters. However, it doesn't mention how to interact with the session (e.g., use send_input), which would be helpful given the sibling tools. Still adequate for a creation tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, baseline 3. The description adds value by noting the default command ('default: /bin/bash') and explaining log_file purpose ('append all session output'), which enhances understanding beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Open a local interactive terminal session' with examples like bash, python3, node. This distinguishes it from siblings like create_ssh_session and create_serial_session by specifying 'local'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The warning 'Only use on trusted systems' provides a clear when-not-to-use condition. However, it does not explicitly name alternatives like create_ssh_session for remote access, which would strengthen guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

create_serial_sessionB

Open a serial port session. Device path must start with /dev/tty or /dev/cu. (e.g. /dev/ttyUSB0, /dev/cu.usbserial-XXXX)

ParametersJSON Schema
NameRequiredDescriptionDefault
deviceYesSerial device path (must start with /dev/tty or /dev/cu.)
log_fileNoFile path to append all session output. File is created if it doesn't exist.
baud_rateNoBaud rate (default: 9600)
log_max_sizeNoMax log file size in MB before rotation (0 = no rotation, default: 0)
log_max_filesNoMax number of rotated log files to keep (default: 3)

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It explains how to open a session but does not disclose what happens afterward (e.g., how to interact, session lifecycle, error conditions). It lacks critical behavioral context like whether authentication is needed or if multiple sessions can coexist.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences: one states the purpose, the second provides a constraint and examples. Front-loaded, no unnecessary words, highly efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 5 parameters, no output schema, and no annotations, the description is adequate for initial use but lacks guidance on session interactions and prerequisites. It tells how to open but not what to expect.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with descriptions for all 5 parameters. The description adds value by providing concrete examples of device paths and reiterating the constraint, which is more helpful than the schema alone.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action 'Open a serial port session' and specifies the device path constraint. The name 'create_serial_session' aligns with the purpose. However, it does not distinguish itself from sibling tools like 'create_ssh_session' or 'create_local_session'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides a clear constraint (device path must start with /dev/tty or /dev/cu) and examples. However, it does not specify when to use this tool versus alternatives (e.g., SSH, local sessions).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

create_ssh_sessionB

Open an interactive SSH session (supports key/password auth and SSH config aliases)

ParametersJSON Schema
NameRequiredDescriptionDefault
hostYesSSH host IP or hostname
portNoSSH port (default: 22)
userYes
commandNoInitial command for persistent session (default: /bin/bash)
key_pathNoSSH private key path (default: ~/.ssh/id_ed25519, id_rsa)
log_fileNoFile path to append all session output. Useful when output may exceed buffer size (e.g. long-running scripts). File is created if it doesn't exist.
passwordNoOptional if using key auth
persistentNoUse ai-tmux for persistent session (survives SSH disconnect)
session_idNoAttach to existing ai-tmux session by ID (use list_remote_sessions to find IDs)
log_max_sizeNoMax log file size in MB before rotation (0 = no rotation, default: 0)
log_max_filesNoMax number of rotated log files to keep (default: 3)
ignore_host_keyNoSkip known_hosts check (not recommended)

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full weight. It only mentions 'interactive' and indicates support for persistent sessions via parameters, but fails to disclose session lifecycle, blocking behavior, or how to terminate the session.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence that conveys the core purpose and key features. It is appropriately sized but lacks structural elements like bullet points or front-loading of critical information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 12 parameters and no output schema, the description is too brief. It does not explain return values, session handling, or integration with sibling tools (e.g., list_remote_sessions, send_input), leaving gaps for an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 92%, so the baseline is 3. The description does not add meaning beyond what parameter descriptions provide; it only repeats auth methods already covered.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it opens an interactive SSH session and lists supported authentication methods. However, it does not explicitly differentiate from sibling tools like create_local_session or create_serial_session, though the SSH specificity provides implicit distinction.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides context on auth methods (key, password, SSH config aliases) but does not specify when to use this tool versus alternatives, nor does it mention prerequisites or typical use cases.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

detach_sessionA

Detach from a persistent session but keep the remote PTY running (reattach via list_remote_sessions + session_id)

ParametersJSON Schema
NameRequiredDescriptionDefault
session_idYes

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so the description must disclose behavior. It explicitly states that the remote PTY keeps running after detachment, which is the key behavioral trait. However, it omits details like error handling or required permissions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, clear sentence with a parenthetical hint. It is front-loaded with the primary action and contains no redundant information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with one parameter, the description covers the main action and reattachment path. However, it does not specify return values, error conditions, or prerequisites, leaving some gaps in completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must explain parameters. It references 'session_id' implicitly in the reattachment hint, but does not describe its purpose, format, or constraints beyond its name.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Detach'), the resource ('persistent session'), and the effect ('keep the remote PTY running'). It also distinguishes from siblings like 'close_session' by noting the session remains active.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage when you want to leave a session running but disconnect, and mentions reattachment via 'list_remote_sessions + session_id'. However, it does not explicitly contrast with alternatives like 'close_session' or state prerequisites.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_credential_bundleA

Generate a signed ConsumerBundle for use with cred-mcp's vault_seal tool. The bundle contains only public keys and is safe to pass to the AI. The session private key is held in memory for a matching inject_secret call. Call this before request_authorization + vault_seal on cred-mcp.

ParametersJSON Schema
NameRequiredDescriptionDefault
consumer_idNoConsumer identity (default: "pty-mcp")
ttl_secondsNoBundle validity in seconds (default: 300, max: 3600)

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden. It discloses that the bundle contains only public keys, that the session private key is held in memory for a matching inject_secret call, and that the bundle is safe to pass to the AI. This is good behavioral context, though it omits error conditions or idempotency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences long, front-loaded with the core purpose, and every sentence adds valuable context. There is no redundancy or fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 2 parameters, no output schema, and no annotations, the description covers the essential aspects: purpose, usage sequence, safety, and the relationship to inject_secret. It could mention the output bundle format or error conditions, but for a simple generation tool it is fairly complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 100% coverage with descriptions for both parameters (consumer_id and ttl_seconds). The description does not add new semantic details beyond the schema; it mentions the default for consumer_id and max for ttl_seconds but the schema already includes those. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool generates a signed ConsumerBundle for use with cred-mcp's vault_seal tool. It specifies the verb 'Generate' and the resource 'signed ConsumerBundle', and the purpose is distinct from sibling tools which all deal with session management.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit sequencing: 'Call this before request_authorization + vault_seal on cred-mcp.' It also explains the bundle contains only public keys so it's safe to pass to the AI. While it does not explicitly say when not to use it, the context is clear enough.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_session_stateB

Get detailed state of a session: type, target, is_alive, cursor, and classified state (at_prompt/password_prompt/confirmation/pager/running/unknown), awaiting_secret, last_prompt. Use cursor with read_output(since_cursor=...) for incremental reads.

ParametersJSON Schema
NameRequiredDescriptionDefault
session_idYes

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full responsibility for behavioral disclosure. It reveals that the tool returns a cursor usable with read_output, but omits critical behavioral traits such as whether it is read-only, permissions required, error handling for invalid session IDs, or response format. The listed fields provide some transparency but insufficient depth.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, consisting of only two sentences that front-load the primary purpose and then provide a usage hint. It avoids unnecessary words, though the structure could be improved by separating output fields and usage guidance more explicitly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's low complexity (single parameter, no output schema), the description covers the main returned fields and a key usage pattern. However, it lacks explanation of the return value structure, potential error states, and how classified state is determined, leaving some ambiguity for an AI agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has one parameter (session_id) with 0% description coverage, yet the description adds no additional meaning beyond the name itself. It does not specify format, origin, or constraints of session_id, relying on implicit understanding. The description focuses on output rather than clarifying the input parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it retrieves detailed session state and lists specific fields (type, target, is_alive, cursor, classified state, etc.), making the purpose unambiguous. It implicitly distinguishes from siblings like list_sessions (which returns summary) and read_output (which reads output) by focusing on state retrieval, but does not explicitly differentiate.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides usage guidance by mentioning that the returned cursor can be used with read_output for incremental reads, indicating a related workflow. However, it does not explicitly state when to use this tool versus alternatives like list_sessions or when not to use it, leaving gaps in decision-making.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

inject_secretA

Decrypt a SealedBox from cred-mcp and write the plaintext directly into a PTY session. The plaintext never appears in AI context or tool results — only {success:true} is returned. Call after vault_seal on cred-mcp.

ParametersJSON Schema
NameRequiredDescriptionDefault
sealed_boxYesSealedBox JSON object returned by cred-mcp's vault_seal tool
pty_session_idYesID of the PTY session to inject the secret into

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Despite no annotations, the description discloses that plaintext never appears in AI context or results. However, it lacks details on side effects, failure modes, or prerequisites beyond vault_seal.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences covering purpose, behavior, and usage, with no unnecessary words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description provides essential flow but omits possible errors, session state requirements, and return value details. Given security-critical nature, more completeness would help.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so baseline is 3. The description adds minimal nuance beyond the schema, merely attributing sealed_box to vault_seal.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool decrypts a SealedBox and writes plaintext into a PTY session, specifying that plaintext never appears in AI context or tool results. This distinguishes it from sibling tools like send_secret.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly says 'Call after vault_seal on cred-mcp,' providing a clear precondition. However, it does not mention when not to use this tool or alternative scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_remote_sessionsB

List persistent sessions on a remote ai-tmux server (use session_id to reattach). Optionally filter by status.

ParametersJSON Schema
NameRequiredDescriptionDefault
hostYesSSH host IP or hostname
portNoSSH port (default: 22)
userYes
statusNoFilter by session status (e.g. 'running', 'idle')
key_pathNoSSH private key path
passwordNoOptional if using key auth
ignore_host_keyNo

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must fully disclose behavior. It states a read operation (list) with no side effects, but fails to mention authentication prerequisites (SSH credentials), potential connection errors, or that the tool requires a working SSH connection. The behavioral traits are under-specified.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with a parenthetical clarification, no wasted words. It is front-loaded with the primary action and resource, making it immediately clear to the agent.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (7 parameters, no output schema, no annotations), the description is far too brief. It omits critical context such as what information is returned (e.g., list of session objects with IDs), how authentication works (requires valid SSH credentials), and how to handle common errors. The agent would be left guessing about return format and prerequisites.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema covers 71% of parameters with descriptions, so the bar for additional value is lower. The tool description only adds context for the 'status' parameter (optionally filter), but does not enhance understanding of other parameters beyond what the schema already provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly specifies the action (List) and the resource (persistent sessions on a remote ai-tmux server). The parenthetical mention of session_id for reattachment adds context that distinguishes this tool from sibling 'list_sessions', which likely handles local sessions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for listing remote sessions and filtering by status, but it does not explicitly state when to choose this tool over siblings like 'list_sessions' or when not to use it. No alternatives or exclusions are mentioned, leaving the agent with inferred guidelines.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_sessionsB

List all active sessions

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

B3.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure. It only states 'list all active sessions' without indicating side effects (likely none), permissions needed, or what the tool returns. This is insufficient for a tool with no output schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, clear sentence with no unnecessary words. It is appropriately sized for a parameterless tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description should explain what 'active sessions' means and what data is returned (e.g., session IDs, type, status). It lacks these details, making it incomplete for an agent to understand the tool's output.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has no parameters, and the input schema is an empty object with 100% coverage. The description adds no parameter information, but no further details are needed since there are no parameters to describe.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (list) and resource (active sessions), distinguishing it from sibling tools like close_session or create_* by being a read-only listing operation. However, it is vague about what exactly is listed (e.g., session IDs, names) and does not clarify if it lists only active sessions or all sessions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage when an agent needs to see active sessions, but it provides no explicit guidance on when to use this tool versus alternatives like list_remote_sessions. No exclusions or prerequisites are mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

prepare_secretA

Pre-stage a secret (password/passphrase) for a session. Shows a GUI dialog NOW so the operator can enter the secret before a password prompt appears. The secret is stored in a buffer and automatically sent when a password prompt is detected — no further agent action needed. Use this before connecting to devices with short password timeouts (e.g. serial console). The buffered secret is never logged.

ParametersJSON Schema
NameRequiredDescriptionDefault
promptNoPrompt shown to the user (default: "Enter secret: ")
session_idYes
line_endingNoLine ending appended after the secret (default: "\r"). Use "\r\n" for serial consoles that require CR+LF, "\n" for Linux terminals.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description discloses key behaviors: it shows a dialog, buffers the secret, auto-sends on password prompt, and never logs it. It doesn't cover cancellation or buffer expiration, but given the absence of annotations, it provides sufficient transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three concise sentences with no redundancy. Each sentence adds value: first states purpose, second explains the core mechanism, third gives a concrete use case. Perfectly front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 3 parameters, no output schema, and no annotations, the description covers the essential behavioral and usage aspects. It could mention what happens if multiple secrets are pre-staged or the buffer timeout, but it is largely complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 67%, and the description adds meaningful context for 'prompt' and 'line_ending' (defaults, usage examples). It does not add to 'session_id', but overall it enhances understanding beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool pre-stages a secret for a session, shows a GUI dialog, and automatically sends it when a password prompt appears. It distinguishes itself from siblings like send_secret or inject_secret by emphasizing proactive pre-staging and automatic handling.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly recommends using this tool before connecting to devices with short password timeouts (e.g., serial console). It could be improved by also stating when not to use it, but the provided guidance is clear and actionable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

read_outputA

Read output from a session. Three modes: (1) default: wait for output to settle, (2) since_cursor: incremental read from a cursor position (returns only new output), (3) wait_for: block until a regex pattern matches. Mode 2 response includes has_more (true = more unread data, call again with new cursor) and is_truncated (true = data was overwritten before you read it).

ParametersJSON Schema
NameRequiredDescriptionDefault
timeoutNoMax wait time in seconds (default: 5, max: 600)
wait_forNoRegex pattern to wait for. Falls back to plain text match if regex is invalid.
max_bytesNoMaximum bytes to return in a single read (mode 2 only). If output exceeds this, has_more=true and you should call again with the returned cursor. Recommended: 32768 (32KB) to avoid large context usage.
session_idYesSession ID to read from
tail_linesNoOn timeout, include last N lines of output (default: 0, max: 100). Only with wait_for.
since_cursorNoRead only output written after this cursor position. Get cursor from previous read_output/send_input/get_session_state responses.
context_linesNoLines before/after matched line to include (default: 0, max: 50). Only with wait_for.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description fully discloses behaviors: blocking vs non-blocking, response fields, and truncation. However, it does not mention side effects, auth, or prerequisites.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single efficient paragraph with clear mode enumeration and no redundant sentences. Key information is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 7 parameters and no output schema, the description adequately covers modes, response behavior, and parameter usage. Lacks error handling details but is sufficient for selecting and invoking the tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, but the description adds context on how parameters interact (e.g., tail_lines only with wait_for) and provides usage recommendations like max_bytes=32KB, adding value beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Read output from a session' and enumerates three distinct modes with specific behaviors, distinguishing it from sibling tools like send_input or get_session_state.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains when to use each mode (default, since_cursor, wait_for) and describes response fields like has_more, but does not explicitly state when not to use the tool or compare with alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

resize_sessionA

Resize the terminal window (rows x cols) for a session. Affects how TUI tools (top, less, vim, etc.) lay out output. Serial sessions are not supported.

ParametersJSON Schema
NameRequiredDescriptionDefault
colsYesTerminal width in columns (e.g. 220)
rowsYesTerminal height in rows (e.g. 40)
session_idYes

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries full burden. It transparently describes the effect (changes terminal size, affects TUI output layout) and the limitation (serial sessions unsupported). No side effects are mentioned, but the behavior is straightforward.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three well-structured sentences with no unnecessary words. The main purpose is front-loaded, followed by effect and limitation, making it efficient and easy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has three required parameters, no output schema, and no annotations, the description covers the core purpose, effect, and key limitation. It could mention what happens with invalid dimensions, but overall it is sufficiently complete for an agent to use correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 67% (two of three parameters have descriptions). The description adds helpful examples (e.g., 'e.g. 220') for rows and cols, clarifying their meaning beyond the schema. session_id lacks description, but it is a common identifier.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action 'resize the terminal window' and the resource 'for a session', distinguishing it from sibling tools like close_session or create_local_session. It also specifies that serial sessions are not supported, clarifying scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains when to use it (affects TUI tool layout) and explicitly notes that serial sessions are not supported, indicating a when-not-to-use. It lacks mention of prerequisites like requiring an active session but provides sufficient context for typical use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

send_controlB

Send a control key (ctrl+c, ctrl+d, enter, tab, up, down, etc.)

ParametersJSON Schema
NameRequiredDescriptionDefault
keyYes
session_idYes

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description should disclose behavioral traits. It only says 'send a control key' but does not explain effects, prerequisites, or response behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence is concise and front-loaded, containing all essential purpose information without wordiness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with 2 parameters, the description minimally covers purpose and examples but lacks detail on parameter format and usage context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so description must compensate. It lists example keys but does not specify the exact format for the 'key' parameter, leaving ambiguity.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool sends control keys and provides concrete examples (ctrl+c, enter, tab, etc.), distinguishing it from send_input which likely handles text input.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool vs siblings like send_input. The context implies differentiation, but the description does not state it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

send_inputA

Send input and wait for output to settle. Returns cursor_start/cursor_end for command boundary tracking, and is_complete (false = timeout, use read_output for remaining output). If wait_for is set, blocks until the pattern matches (combines send_input + read_output wait_for in one call).

ParametersJSON Schema
NameRequiredDescriptionDefault
rawNoIf true, send input exactly as-is without appending a newline. Use for interactive menus and single-character inputs (e.g. menu selections, y/n prompts). Follow with send_control('enter') when ready to submit.
inputYes
wait_forNoRegex pattern to wait for after sending input. Combines send_input + read_output(wait_for=...) into one tool call.
session_idYes
timeout_msNoMax wait time in ms (default: 5000, max: 30000)
wait_for_timeoutNoTimeout in seconds for wait_for (default: 10, max: 600)

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description fully discloses blocking behavior, return values (cursor, is_complete), timeout handling, and raw input mode. No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with no redundancy. First sentence states core action and return fields; second sentence explains wait_for option. Efficient and to the point.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers main use case, critical return values, and primary behavioral nuance (wait_for). Could mention default timeout values (present in schema but not description) but overall sufficient for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Adds meaning beyond schema: explains return values (cursor_start, cursor_end, is_complete) and clarifies raw parameter behavior ('no newline, for interactive menus') and wait_for combination. Schema covers 67% of parameters; description compensates for remaining coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clear verb+resource: 'send input' with specific outcome 'wait for output to settle'. Distinguishes from siblings by mentioning combination with read_output and contrasting with send_control for raw input.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Describes when to use wait_for parameter and behavior of is_complete. Implies using read_output when is_complete is false. Could explicitly mention when not to use this tool in favor of send_control or send_secret, but provides adequate guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

send_secretA

Prompt the human user to type a secret (password/passphrase) directly into a GUI dialog. The value is sent to the PTY session without ever appearing in AI context or logs. IMPORTANT: only call this when the session is actively waiting for a password input (echo is off) — e.g. an SSH/sudo/getpass prompt. Do NOT call this on an idle shell prompt. If prepare_secret was called earlier for this session, uses the buffered secret without showing a dialog.

ParametersJSON Schema
NameRequiredDescriptionDefault
promptNoPrompt shown to the user (default: "Enter secret: ")
session_idYes

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description discloses that the secret never appears in AI context or logs, and covers buffered secret behavior. Misses error scenarios (invalid session) but sufficiently transparent for core use.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Very concise (approx. 60 words), front-loaded with action, each sentence adds value. No fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 2 parameters and no output schema, the description covers key aspects: purpose, usage condition, data privacy. Could mention permissions or that return is void, but sufficient for an experienced agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 50% (prompt described only). Description adds meaning for prompt (default value, dialog) but does not elaborate on session_id. Overall adds some value beyond schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool prompts the human to type a secret into a GUI dialog and sends it to the PTY, distinguishing it from siblings like prepare_secret. It specifies the exact verb (prompt) and resource (PTY session).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use (session actively waiting for password with echo off) and when not to (idle shell prompt). Mentions alternative behavior if prepare_secret was called earlier.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 2 tool updatesv0.11.2
    • Addedget_credential_bundle
    • Addedinject_secret
  2. 1 tool updatev0.10.0
    • Addedresize_session
  3. 9 tool updatesv0.9.0
    • Changedcreate_local_session3 fields changed
      • addedInput schema / properties / log_file
        Added value: +{
        +  "description": "File path to append all session output. Useful when output may exceed buffer size. File is created if it doesn't exist.",
        +  "type": "string"
        +}
      • addedInput schema / properties / log_max_files
        Added value: +{
        +  "description": "Max number of rotated log files to keep (default: 3)",
        +  "type": "integer"
        +}
      • addedInput schema / properties / log_max_size
        Added value: +{
        +  "description": "Max log file size in MB before rotation (0 = no rotation, default: 0)",
        +  "type": "integer"
        +}
    • Changedcreate_serial_session4 fields changed
      • changedInput schema / properties / device / description
        Previous value: -"Serial device path, e.g. /dev/tty.usbserial-XXXX"New value: +"Serial device path (must start with /dev/tty or /dev/cu.)"
      • addedInput schema / properties / log_file
        Added value: +{
        +  "description": "File path to append all session output. File is created if it doesn't exist.",
        +  "type": "string"
        +}
      • addedInput schema / properties / log_max_files
        Added value: +{
        +  "description": "Max number of rotated log files to keep (default: 3)",
        +  "type": "integer"
        +}
      • addedInput schema / properties / log_max_size
        Added value: +{
        +  "description": "Max log file size in MB before rotation (0 = no rotation, default: 0)",
        +  "type": "integer"
        +}
    • Changedcreate_ssh_session3 fields changed
      • addedInput schema / properties / log_file
        Added value: +{
        +  "description": "File path to append all session output. Useful when output may exceed buffer size (e.g. long-running scripts). File is created if it doesn't exist.",
        +  "type": "string"
        +}
      • addedInput schema / properties / log_max_files
        Added value: +{
        +  "description": "Max number of rotated log files to keep (default: 3)",
        +  "type": "integer"
        +}
      • addedInput schema / properties / log_max_size
        Added value: +{
        +  "description": "Max log file size in MB before rotation (0 = no rotation, default: 0)",
        +  "type": "integer"
        +}
    • Addedget_session_state
    • Changedlist_remote_sessions1 field changed
      • addedInput schema / properties / status
        Added value: +{
        +  "description": "Filter by session status (e.g. 'running', 'idle')",
        +  "type": "string"
        +}
    • Addedprepare_secret
    • Changedread_output7 fields changed
      • addedInput schema / properties / context_lines
        Added value: +{
        +  "description": "Lines before/after matched line to include (default: 0, max: 50). Only with wait_for.",
        +  "type": "integer"
        +}
      • addedInput schema / properties / max_bytes
        Added value: +{
        +  "description": "Maximum bytes to return in a single read (mode 2 only). If output exceeds this, has_more=true and you should call again with the returned cursor. Recommended: 32768 (32KB) to avoid large context usage.",
        +  "type": "integer"
        +}
      • addedInput schema / properties / session_id / description
        Added value: +"Session ID to read from"
      • addedInput schema / properties / since_cursor
        Added value: +{
        +  "description": "Read only output written after this cursor position. Get cursor from previous read_output/send_input/get_session_state responses.",
        +  "type": "integer"
        +}
      • addedInput schema / properties / tail_lines
        Added value: +{
        +  "description": "On timeout, include last N lines of output (default: 0, max: 100). Only with wait_for.",
        +  "type": "integer"
        +}
      • addedInput schema / properties / timeout
        Added value: +{
        +  "description": "Max wait time in seconds (default: 5, max: 600)",
        +  "type": "number"
        +}
      • addedInput schema / properties / wait_for
        Added value: +{
        +  "description": "Regex pattern to wait for. Falls back to plain text match if regex is invalid.",
        +  "type": "string"
        +}
    • Changedsend_input3 fields changed
      • addedInput schema / properties / raw
        Added value: +{
        +  "description": "If true, send input exactly as-is without appending a newline. Use for interactive menus and single-character inputs (e.g. menu selections, y/n prompts). Follow with send_control('enter') when ready to submit.",
        +  "type": "boolean"
        +}
      • addedInput schema / properties / wait_for
        Added value: +{
        +  "description": "Regex pattern to wait for after sending input. Combines send_input + read_output(wait_for=...) into one tool call.",
        +  "type": "string"
        +}
      • addedInput schema / properties / wait_for_timeout
        Added value: +{
        +  "description": "Timeout in seconds for wait_for (default: 10, max: 600)",
        +  "type": "number"
        +}
    • Addedsend_secret
  4. 10 tool updates
    • First observedclose_session
    • First observedcreate_local_session
    • First observedcreate_serial_session
    • First observedcreate_ssh_session
    • First observeddetach_session
    • First observedlist_remote_sessions
    • First observedlist_sessions
    • First observedread_output
    • First observedsend_control
    • First observedsend_input

TDQS

A4/5.0

Scored across 16 tools

Disambiguation5/5

Each tool has a clearly distinct purpose: session creation (local, SSH, serial), management (list, close, detach, resize), interaction (send_input, send_control, read_output), and secret handling (prepare, inject, send, get credentials). No ambiguity between tools.

Naming Consistency5/5

All tools follow a consistent verb_noun pattern in snake_case (e.g., create_local_session, send_input, get_session_state). No mixing of conventions, and verbs are uniform.

Tool Count5/5

16 tools is well-scoped for a PTY management server. It covers session creation, lifecycle, input/output, secrets, and state inspection without being excessive or sparse.

Completeness5/5

The tool surface is comprehensive for the domain: all major session types (local, SSH, serial), full lifecycle (create, close, detach, resize), input/output (send, read with cursors), secret management (prepare, inject, send, credential bundles), and state inspection.

Maintenance

ActivityMaintained
ResponsivenessUnresponsive

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    C
    maintenance
    Provides AI agents with fully interactive terminal sessions, including TUI support, keyboard control, and screen capture across Windows, Linux, and Mac.
    MIT
  • A
    license
    Not graded
    quality
    C
    maintenance
    Enables AI agents to interact with interactive CLI processes via a real PTY, allowing them to send keystrokes, read screen output, and handle interactive prompts.
    0
    1
    MIT
  • A
    license
    A
    quality
    A
    maintenance
    Give AI agents a persistent, interactive terminal with support for SSH, REPLs, database CLIs, TUI apps, and long-running processes.
    9
    64 PyPI
    12
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables AI agents to drive real interactive terminal sessions—PTYs, TUIs, REPLs, SSH, even another agent's CLI—with a live web view where humans can watch and type in.
    5 npm
    2
    MIT