Skip to main content
Glama

Relay Shell

v0.4.0 · Python 3.12 / 3.13 / 3.14 · transports stdio and streamable-http · MCP SDK mcp>=2,<3 · Apache-2.0

relay-shell is a Model Context Protocol server that gives an MCP client the full reach of a shell: run commands on the local host, hold interactive PTY sessions, run scripts, operate a fleet over SSH, move files with SFTP and open port forwards.

It is operator infrastructure for hosts you own and administer. It runs with the privileges of its service account, with no sandbox, and it is open by default: no command is refused for what it does. What it adds is a record and a warning:

  • Every call is audited: one JSON line with the redacted arguments, the output's hash and length (never its body), the exit code, the client and the assessed tier.

  • Every risky call says so: a call classified Tier 2 (changes state) or Tier 3 (irreversible), or an SSH call with host-key checking off, ends with a [NOTICE ...] line. server_info lists the standing unsafe settings.

  • Refusal is opt-in: guarded and readonly modes, a deny list and a Tier-3 confirmation step are available and all off by default.

Tools

Local shell

Purpose

shell_exec

Run a command with timeout and output caps, cwd, env overlay and stdin.

shell_script

Run a multi-line bash, sh or python script, optionally under set -euo pipefail.

shell_spawn

Start a persistent PTY session (REPLs, TUIs, prompts, long jobs).

SSH

Purpose

ssh_exec

Run a command on a remote host (jump host, key or agent, known-hosts policy).

ssh_spawn

Start an interactive remote PTY session.

ssh_upload / ssh_download

SFTP transfer, recursive supported.

ssh_forward

Local (L), remote (R) or dynamic SOCKS (D) forward; L/D listen on loopback only.

ssh_forward_list / ssh_forward_close

List or close active forwards.

ssh_check

Probe connectivity across the inventory or a host list.

ssh_fanout

Run one command on many hosts in parallel; per-host exit codes in one JSON.

ssh_keyscan

Fetch host keys with ssh-keyscan to pre-populate known_hosts.

ssh_hosts

Show the resolved inventory (~/.ssh/config plus the inventory file).

Sessions (local and SSH PTY)

Purpose

session_send

Send input, optionally followed by Enter.

session_recv

Read buffered and new output, with a short wait.

session_resize

Resize the PTY.

session_kill

Signal or terminate a session.

session_list

List active sessions.

Diagnostics

Purpose

server_info

Version, effective limits, policy mode, audit path, unsafe-setting warnings.

audit_tail

Read recent audit records, filterable by tool, tier and denied.

operation_confirm

Arm a Tier-3 confirmation token when that opt-in step is enabled.

The server also exposes three read-only MCP resources (relay-shell://inventory, relay-shell://inventory/{host}, relay-shell://ssh-config) and one prompt, operating_guide, with guidance on which tool to use when; resource reads and prompt fetches are audited too. Full reference: docs/tools.md. Over HTTP, GET /metrics serves Prometheus counters and gauges (docs/deployment.md §9a).

Related MCP server: SSH MCP Server

Quickstart

Requires CPython 3.12 or later; tested on Ubuntu 24.04.

git clone https://github.com/rmednitzer/relay-shell.git && cd relay-shell
python3 -m venv .venv && . .venv/bin/activate
pip install -e ".[dev]"

relay-shell                              # stdio transport
RELAY_SHELL_TRANSPORT=http relay-shell   # streamable-http on 127.0.0.1:8080
relay-shell --check-config               # validate config, print unsafe-setting notes
relay-shell --verify-deploy              # compare installed templates with the shipped ones

Register with an MCP client (stdio):

{ "mcpServers": { "relay-shell": { "command": "relay-shell" } } }

Configuration comes from RELAY_SHELL_* environment variables, optionally via a .env file; see .env.example and docs/deployment.md.

Default behaviour

With the default configuration every command on every tool is admitted, including rm -rf /, mkfs, dd to a block device, shutdown, curl | sh and sudo (pinned by tests/test_notices.py). The call is classified and audited, and a risky one ends with a notice:

[exit 0]
...command output...
[NOTICE tier 3 (IRREVERSIBLE), matched an irreversible-operation pattern. It may not be
undoable and ran with no confirmation step; verify the target and take a backup or snapshot
first. Classification is a heuristic, not a boundary]

The classifier is a regex heuristic over the command text, not a parse of the shell language. A call without a notice is not thereby safe, and a notice does not block anything.

Only resource bounds and one startup check refuse a call, none of them based on what the command does:

Bound

Setting (default)

Behaviour

Input size (command, stdin, script, env)

RELAY_SHELL_MAX_INPUT (2 MiB)

refused, because the policy scan is synchronous

Wall-clock per call

RELAY_SHELL_MAX_TIMEOUT (900 s)

killed; use shell_spawn / ssh_spawn for longer work

Live sessions / forwards

RELAY_SHELL_MAX_SESSIONS (64), RELAY_SHELL_MAX_FORWARDS (64)

a new one is refused at the cap

Output returned

RELAY_SHELL_MAX_OUTPUT (64 KiB)

truncated, not refused

HTTP without OAuth on a non-loopback address

RELAY_SHELL_ALLOW_UNAUTH_NETWORK

refused at startup unless set

Session output buffers are also bounded, and idle sessions (RELAY_SHELL_SESSION_IDLE_TIMEOUT, 1800 s) and exited, drained sessions are reaped.

Making it stricter

Every option below is opt-in and they combine:

Want

Setting

Refuse state-changing calls unless allow-listed

RELAY_SHELL_POLICY_MODE=guarded + RELAY_SHELL_POLICY_ALLOW

Observe only

RELAY_SHELL_POLICY_MODE=readonly

Refuse specific text (checked first, in every mode)

RELAY_SHELL_POLICY_DENY

Two-step confirmation for Tier-3 calls

RELAY_SHELL_CONFIRM_TIER3=true

Verified SSH host keys, no per-call downgrade

RELAY_SHELL_SSH_KNOWN_HOSTS=strict, RELAY_SHELL_SSH_ALLOW_WEAKER_KNOWN_HOSTS=false

Tamper-evident audit

RELAY_SHELL_AUDIT_CHAIN=true, plus the off-host sync in deploy/evidence/

Authenticated HTTP transport

RELAY_SHELL_AUTH_ENABLED=true (OAuth 2.1) behind the Caddy edge

Silence the [NOTICE] lines

RELAY_SHELL_UNSAFE_NOTICES=false

Security

The server grants real administrative power. Run it as a scoped service account, only on hosts you are authorized to administer, behind the network controls in docs/deployment.md. A privileged (root or sudo) deployment is supported for isolated administrative hosts with strict network controls and full audit shipping. SECURITY.md has the threat model and how to report a vulnerability.

Besides the audit record, notices and bounds above:

  • Audit integrity: the log is append-only on disk with a rotation-safe handler. The optional hash chain makes edits, insertions, reorders and interior deletions detectable with relay-shell --verify-audit (fail-closed); detecting tail truncation needs the off-host copy.

  • Redaction: audited arguments are scrubbed of tokens, keys and Authorization material. Heuristic; tested with synthetic secrets.

  • Syscall visibility (optional): RELAY_SHELL_SECCOMP_NOTIFY records a spawned child's execve, privilege, namespace, mount, write-open and privilege-relevant prctl syscalls. It never blocks a syscall and installs only with CAP_SYS_ADMIN.

  • OAuth 2.1 (optional, off by default): dynamic client registration behind an operator approval gate, PKCE, rotating refresh tokens with reuse detection. See docs/auth.md.

  • Edge: the Caddy config from deploy/install-edge.sh restricts the MCP endpoint to known CIDRs, adds security headers, caps public OAuth request bodies, keeps authorization codes out of the access log and automates TLS via ACME. The systemd unit applies resource caps.

Compatibility

Surface

Supported

Notes

Python

3.12 / 3.13 / 3.14

CI runs the full matrix.

Host OS

Ubuntu 24.04 LTS

Tested; the systemd and Caddy installers assume it. macOS works for development only.

Windows

SSH target only

Over OpenSSH with PowerShell 7; not supported as a host (no PTY contract, no systemd).

Transports

stdio, streamable-http

stdio is the default; HTTP binds loopback and needs a TLS edge.

MCP SDK

mcp>=2,<3

Pinned in requirements.txt; a bump triggers a fresh validation pass.

SSH library

asyncssh>=2.23.0,<3 (tested 2.24.1)

Native async; no shell-out to the system ssh (only ssh_keyscan runs ssh-keyscan).

Development

ruff check . && ruff format --check .
mypy
pytest

Layout: src/relay_shell/ (server and modules), deploy/ (systemd unit, Caddyfile, logrotate, installers, off-host audit sync, monitoring), docs/ (start at docs/index.md), tests/ (unit and integration; an in-process SSH server, no network).

CONTRIBUTING.md covers scope, branch naming, the local loop and review of security-sensitive changes; docs/runbook.md holds the audit, review and validation procedures and the backlog. AI agents follow AGENTS.md (with CLAUDE.md for Claude). Participation is governed by the Code of Conduct.

License

Apache-2.0. See LICENSE and NOTICE.

Available Tools

18 tools
server_infoA

Report version, effective limits, policy mode, and audit status.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. It states it reports information (non-destructive), but doesn't disclose any behavioral traits like rate limits or auth requirements. Adequate for a simple read tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence with no wasted words. Every part is meaningful and front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given that there is an output schema (not shown), description doesn't need to explain return values. For a parameterless info tool, the description is complete and sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

No parameters exist, so schema coverage is 100%. The description adds meaning by detailing what information is reported. Baseline is 4 due to zero params.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description uses specific verb 'report' and resource 'server' with concrete items (version, effective limits, policy mode, audit status). It clearly distinguishes from sibling tools which are all action-oriented (session, shell, ssh).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool vs alternatives. The description implies it's for checking server status, but doesn't provide context or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

session_killA

Signal a session and (by default) close and reap it.

ParametersJSON Schema
NameRequiredDescriptionDefault
session_idYes
signal_nameNoTERM
closeNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description bears the full burden of transparency. It discloses that a signal is sent and the session is closed and reaped by default, but lacks details on side effects, permissions, or what 'reap' entails. The description provides a basic overview but is not comprehensive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence that is front-loaded with the action. No extraneous words or redundant information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 3 parameters, an output schema, and multiple siblings, the description is too sparse. It lacks guidance on return values, valid signal names, and what happens to the session's state. More detail is needed for complete understanding.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. However, it only mentions 'session' and 'signal' without explaining any parameters: session_id, signal_name (default TERM), or close. The description adds no value beyond the schema fields, leaving the agent uninformed about parameter usage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action 'Signal a session' and includes the default behavior 'close and reap it'. This distinguishes it from siblings like session_list or session_send, which have different purposes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for sending signals to terminate or manage a session, but it does not explicitly state when to use this tool over related siblings like session_send (which sends input) or session_resize. No exclusions or alternatives are mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

session_listA

List active sessions with size, age, idle, and byte counters.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations exist, so the description must convey behavior. It indicates a read-only operation ('List active sessions') with no side effects, but does not mention permissions, limits, or sorting. For a listing tool, this is minimally sufficient.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, well-structured sentence with no extraneous words. Every word contributes to clarity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no parameters and an output schema present, the description fully covers the tool's purpose and outputs. It satisfies the needs for effective selection and invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0 parameters with 100% coverage, so the description adds value by specifying the exact counters included (size, age, idle, byte). This meaningfully supplements the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('List'), identifies the resource ('active sessions'), and enumerates the output fields (size, age, idle, byte counters). This clearly distinguishes the tool from siblings like session_kill or session_send.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool is for viewing session details but lacks explicit guidance on when to use it versus alternatives. No exclusions or prerequisites are provided, making it adequate but not strong.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

session_recvA

Read buffered/new output from a session, waiting up to timeout seconds.

ParametersJSON Schema
NameRequiredDescriptionDefault
session_idYes
timeoutNo
max_bytesNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses the timeout behavior and that it reads buffered/new output, which is transparent for a read operation. However, it does not mention any side effects or blocking nature beyond timeout.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with 12 words, front-loaded with the main action. Every word earns its place, making it concise and efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity and the presence of an output schema, the description adequately covers the core behavior (reading output with timeout). It could mention that the tool is non-destructive or clarify the meaning of 'buffered/new', but overall it is complete enough.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It only explains the timeout parameter, while session_id and max_bytes are not described. Although parameter names are somewhat self-explanatory, the description does not add sufficient meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action: 'Read buffered/new output from a session'. It uses a specific verb and resource, and distinguishes from sibling tools like session_send or session_kill.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not explicitly state when to use this tool or when not to, nor does it mention alternatives. The usage is implied from the action, but lacks explicit guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

session_resizeC

Resize a session's PTY.

ParametersJSON Schema
NameRequiredDescriptionDefault
session_idYes
colsYes
rowsYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

C2.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided; description only states the basic operation. Lacks details on side effects (e.g., content clipping), error conditions, or required permissions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, no wasted words. It is appropriately sized for the simple operation, though could benefit from additional context without becoming verbose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simple operation and presence of an output schema, the description is too sparse. It omits prerequisites, error handling, and behavioral details that would aid an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, yet the description adds no meaning to the parameters. It does not clarify what cols and rows represent (e.g., character columns vs pixels) or any constraints.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (resize) and the resource (session's PTY). It is specific and distinguishes from sibling tools like session_kill or session_list.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool, prerequisites (e.g., session must be active), or when not to use. No mention of alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

session_sendC

Send input to a session (local or SSH). enter appends a newline.

ParametersJSON Schema
NameRequiredDescriptionDefault
session_idYes
dataYes
enterNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

C2.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must disclose all behavioral traits. It only mentions that the `enter` option appends a newline, leaving out important details like whether the call is blocking, what happens if the session is inactive, or any side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is very short with two sentences, no unnecessary words. However, the brevity sacrifices completeness, and a more structured layout could improve clarity without adding length.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 3 parameters (2 required) and no schema descriptions, the description should be more comprehensive. It does not explain how to obtain a session_id, what constitutes valid data, or how the output behaves (though an output schema exists). The context is incomplete for effective use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description should explain all parameters. It only partially explains the `enter` parameter by noting it appends a newline. The `session_id` and `data` parameters are implied by the overall purpose but lack explicit definition or constraints.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it sends input to a session (local or SSH), specifying the verb and resource. However, it does not explicitly differentiate from sibling tools like shell_exec or ssh_exec, which also deal with input.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives. There is no mention of prerequisites, such as ensuring the session exists, or when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

shell_execB

Run a shell command on the local host and return its combined output.

Timeout and output size are clamped to the server limits. Set use_shell=false to exec an argv without a shell.

ParametersJSON Schema
NameRequiredDescriptionDefault
commandYes
timeoutNo
max_outputNo
cwdNo
stdinNo
merge_stderrNo
use_shellNo
env_jsonNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

B3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations are absent, so the description must cover behavior. It notes clamping and the use_shell option, but omits security implications, blocking behavior, error handling, and other safety concerns for running shell commands.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is short (three sentences) and front-loaded with the main purpose. However, it could be more structured to cover parameters better without becoming verbose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity (8 params, no schema descriptions), the description is too minimal. It only addresses the core use case and one parameter, leaving the agent to guess about others. Output schema exists but doesn't compensate for missing param docs.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage and 8 parameters, only 'use_shell' is mentioned. The meaning of parameters like cwd, stdin, merge_stderr, env_json, and how they affect execution is not explained.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool runs a shell command locally and returns combined output. It distinguishes from sibling tools like shell_spawn (interactive) and ssh_* (remote execution).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description mentions timeout/output clamping and the use_shell flag, but does not explicitly state when to use this tool vs alternatives like shell_script or shell_spawn. Some guidance is present but incomplete.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

shell_scriptA

Run a multi-line script (bash/sh/python) fed on stdin.

With strict and a shell interpreter, set -euo pipefail is prepended so failures abort early.

ParametersJSON Schema
NameRequiredDescriptionDefault
scriptYes
interpreterNobash
strictNo
timeoutNo
cwdNo
env_jsonNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description partially covers behavior by noting the strict mode and error handling with set -euo pipefail. However, it omits important details like output capture, error propagation, security implications, or side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise with two sentences, front-loading the core purpose. Every sentence adds value, though additional parameter details might be needed.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (6 parameters, script execution), the description lacks coverage of return values, logging, error handling specifics, and environmental setup. An output schema exists but is not described, limiting completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, so the description must compensate. It only clarifies the 'strict' parameter's effect, leaving script, interpreter, timeout, cwd, and env_json unexplained. This adds minimal value beyond the schema defaults.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool runs multi-line scripts via stdin, specifying interpreters like bash/sh/python. This distinguishes it from sibling tools such as shell_exec and shell_spawn.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for script execution and mentions strict mode behavior, but does not explicitly state when to use this tool over alternatives like shell_exec or ssh_exec, nor when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

shell_spawnB

Start a persistent local PTY session; returns a session id.

Drive it with session_send / session_recv.

ParametersJSON Schema
NameRequiredDescriptionDefault
commandNo
colsNo
rowsNo
cwdNo
env_jsonNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

B3.3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided, so description carries full burden. It mentions 'persistent' and 'local PTY session', but lacks details on resource cleanup, auth requirements, or state management. Minimal behavioral disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Extremely concise with two sentences. First sentence states the primary action; second sentence directs usage. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having 5 parameters and no output schema details, the description ignores parameter semantics and return format. It mentions session_id but not its type or structure. Incomplete for effective tool selection and invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%. The description adds no information about any of the 5 parameters (command, cols, rows, cwd, env_json) beyond what the schema provides (defaults and types).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool starts a persistent local PTY session and returns a session id. It distinguishes from siblings by specifying that it is driven by session_send/session_recv, implying persistence.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says to drive the session with session_send/session_recv, providing clear workflow context. However, no mention of when not to use this tool versus alternatives like shell_exec.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_checkC

Probe connectivity to the given hosts (or the whole inventory).

ParametersJSON Schema
NameRequiredDescriptionDefault
hostsNo
timeoutNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

C2.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, and the description does not disclose behavioral details such as what the probe entails (e.g., ping, SSH handshake), how errors are reported, or the effect of the timeout parameter. It lacks transparency beyond the basic purpose.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise (one sentence) with no fluff. It is front-loaded with the core action. It could be more structured but is appropriately sized for a simple tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 2 parameters, no annotations, and an output schema, the description is incomplete. It does not explain the effect of leaving hosts empty (probing all inventory) or the role of timeout. An output schema exists but the description does not hint at the return format.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has 0% description coverage, and the description does not mention or explain any parameters (hosts, timeout). The description adds no meaning beyond the parameter names and types already in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool probes connectivity to hosts or the whole inventory, using a specific verb and resource. However, it does not differentiate from sibling tools like ssh_exec or ssh_hosts, though the purpose is distinct enough.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for checking SSH connectivity but provides no explicit guidance on when to use this tool versus alternatives like ssh_hosts or ssh_exec. No when-not-to-use or prerequisites are mentioned.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_downloadC

Download a file or tree from a remote host via SFTP.

ParametersJSON Schema
NameRequiredDescriptionDefault
hostYes
remote_pathYes
local_pathYes
recursiveNo
userNo
portNo
key_pathNo
known_hostsNo
jumpNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

C2.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must disclose behavior. It only mentions downloading via SFTP, missing details on authentication, overwrite behavior, error handling, or return value. Minimal additional context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single short sentence, front-loaded with the action. It is concise but lacks essential details, resulting in under-specification rather than efficient conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 9 parameters, no annotations, and no parameter descriptions, the one-line description is severely incomplete. It fails to explain required vs optional parameters, protocol details, or output schema content.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, meaning parameters have no descriptions. The tool description adds no meaning to the 9 parameters; it only restates the general purpose.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it downloads a file or tree from a remote host via SFTP, using a specific verb and resource. It distinguishes from sibling tools like ssh_upload and ssh_exec.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives, nor any prerequisites or exclusions. It only states the action.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_execA

Run a command on a remote host over SSH and return its output.

host may be an inventory/ssh_config alias or user@host. known_hosts is strict | accept-new | ignore.

ParametersJSON Schema
NameRequiredDescriptionDefault
hostYes
commandYes
timeoutNo
userNo
portNo
key_pathNo
known_hostsNo
jumpNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must disclose behavior. It mentions output return and gives parameter constraints (host format, known_hosts policy), but does not cover authentication, connection lifecycle, side effects of command execution, or error handling. This is adequate but not comprehensive.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise: two short sentences conveying core usage and key parameter details. No redundant information, and critical points are front-loaded. Every sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 8 parameters, no annotations, and an output schema (not shown), the description is somewhat incomplete. It fails to explain the return format, error behavior, authentication requirements, or how the timeout and jump host work. It covers the most essential parts but leaves gaps for a complex SSH execution tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description adds crucial meaning for two of eight parameters (host and known_hosts). It explains host can be an alias or user@host, and known_hosts accepts specific values. However, six parameters (command, timeout, user, port, key_path, jump) lack any description, limiting overall semantic clarity.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Run a command on a remote host over SSH and return its output,' which is a specific verb and resource. It distinguishes from siblings like ssh_check (connectivity check) and ssh_download (file transfer), making its purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives (e.g., shell_exec for local commands, ssh_spawn for interactive sessions). The description does not mention prerequisites, limitations, or exclusions, leaving the agent without decision support.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_forwardC

Create a port forward.

Spec: L:lport:dhost:dport (local), R:rport:dhost:dport (remote), or D:lport (dynamic SOCKS).

ParametersJSON Schema
NameRequiredDescriptionDefault
hostYes
specYes
userNo
portNo
key_pathNo
known_hostsNo
jumpNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It mentions creation but does not disclose behavioral traits like what happens on invalid spec, if it blocks, how to close, or any side effects. Only 'create' is indicated, leaving many aspects ambiguous.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is brief (two sentences plus a code block) and front-loaded with the purpose. The spec format is well-structured. However, it could be improved by listing or summarizing parameters instead of leaving them to the schema alone.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex SSH port forwarding tool with 7 parameters and an output schema, the description is too minimal. It omits error conditions, default values, return value explanation, and usage scenarios. Significant gaps remain for an agent to use it reliably.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%. The description only explains the 'spec' parameter via format examples. Other parameters (host, user, port, key_path, known_hosts, jump) are not described, failing to compensate for the lack of structured definitions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Create a port forward' with a verb and resource. It also explains the spec format for local, remote, and dynamic forwarding, distinguishing it from sibling tools like ssh_forward_close (close) and ssh_forward_list (list).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool vs alternatives, prerequisites (e.g., need an active SSH connection), or context such as whether the forward is persistent or how to manage it. The spec format is shown but usage conditions are omitted.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_forward_closeB

Close an SSH port forward by id.

ParametersJSON Schema
NameRequiredDescriptionDefault
forward_idYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

B3.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description should disclose behavioral details like effects on SSH connections, required permissions, or error behavior. It only states the action without any such context, leaving ambiguity.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence that is front-loaded with the verb and resource. Every word is necessary, and there is no extraneous information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simplicity of the tool and the existence of an output schema, the description is minimally adequate. However, it could benefit from mentioning that the forward must be active or that the id comes from ssh_forward_list.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has no parameter descriptions, and the tool description only mentions 'by id', which adds little beyond the parameter name. It does not explain how to obtain a valid forward_id or its format.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (close), the resource (SSH port forward), and the method (by id). It effectively distinguishes from siblings like ssh_forward (create) and ssh_forward_list (list).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies that the user needs to know the forward_id, likely from listing, but does not provide explicit guidance on when to use this tool versus other operations or prerequisites. The context of sibling tools partially compensates.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_forward_listB

List active SSH port forwards.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

B3.2/5.0
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided; description only states purpose without any behavioral traits (e.g., read-only, authentication needs, side effects).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single, clear sentence with no waste. Could be slightly more informative, but efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Output schema exists, so return values are not required in description. However, no extra context beyond purpose; minimal for a simple tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

No parameters defined in schema; schema coverage is 100%. Description adds no additional param info, but baseline for 0 params is 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description uses a specific verb 'list' and resource 'active SSH port forwards', clearly distinguishing it from sibling tools like ssh_forward (create) and ssh_forward_close (close).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use vs. alternatives. Implicit from name, but no explicit context or exclusions provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_hostsA

Show the resolved host inventory (ssh_config + inventory file).

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations provided; description only says 'Show' implying read-only, but lacks details on resolution behavior, caching, or performance implications. Minimal disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Single sentence, front-loaded with action and resource, no wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given zero parameters and presence of output schema (not shown), description adequately conveys purpose and data sources. Could mention output format but not required.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

No parameters exist (schema coverage 100%), so description does not need to add parameter info. Baseline score of 4 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description uses specific verb 'Show' and resource 'resolved host inventory' with clear indication of combining ssh_config and inventory file, distinguishing it from sibling tools like ssh_exec or ssh_check.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool versus alternatives (e.g., checking specific hosts) or when not to use it. The description provides no context for selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_spawnB

Open a persistent interactive PTY on a remote host; returns a session id.

ParametersJSON Schema
NameRequiredDescriptionDefault
hostYes
commandNo
colsNo
rowsNo
userNo
portNo
key_pathNo
known_hostsNo
jumpNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

B3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must disclose behavioral traits. It mentions 'persistent interactive' but omits key details like authentication requirements, error handling, timeout behavior, and how to manage the session (e.g., session_kill).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with no wasted words. It is front-loaded with the core purpose. Could potentially be expanded to include parameter details without losing conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the complexity (9 parameters, 1 required) and no annotations, the description is insufficient. It does not cover parameter semantics, prerequisites, or session lifecycle, though the output schema likely documents the returned session id.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It provides no explanation for any of the 9 parameters (host, command, cols, etc.), leaving their purpose and valid values entirely undefined.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Open', the resource 'persistent interactive PTY', and the output 'returns a session id'. It effectively distinguishes from sibling tools like ssh_exec (non-interactive) and shell_spawn (local PTY).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for interactive remote sessions but does not provide explicit when-to-use or alternatives. No exclusions or prerequisites are mentioned, leaving the agent to infer from context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

ssh_uploadB

Upload a file or tree to a remote host via SFTP.

ParametersJSON Schema
NameRequiredDescriptionDefault
hostYes
local_pathYes
remote_pathYes
recursiveNo
userNo
portNo
key_pathNo
known_hostsNo
jumpNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

B3.1/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations provided, the description carries the full burden of behavioral disclosure. It states 'Upload' (a write operation) but does not mention destructive potential (overwriting files), authentication requirements, error handling, or other behaviors beyond the basic action.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, front-loaded sentence with no wasted words. It efficiently conveys the core purpose, earning its place without any fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (9 parameters, no annotations, 0% schema coverage), the description is too sparse. It does not cover authentication, prerequisites, or parameter relationships, leaving significant gaps for the agent to handle properly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds minimal meaning beyond the schema: 'file or tree' hints at the recursive parameter, but it does not explain any other parameters (host, user, key_path, etc.). With 0% schema description coverage, the description fails to compensate adequately.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Upload' and the resource 'a file or tree to a remote host via SFTP'. It distinguishes this tool from siblings like ssh_download (download) and ssh_exec (execute command) by specifying the action and protocol.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives like ssh_download or ssh_exec. It does not mention prerequisites (e.g., SSH access) or scenario-specific advice, leaving the agent without context for decision-making.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 18 tool updatesv0.1.0
    • First observedserver_info
    • First observedsession_kill
    • First observedsession_list
    • First observedsession_recv
    • First observedsession_resize
    • First observedsession_send
    • First observedshell_exec
    • First observedshell_script
    • First observedshell_spawn
    • First observedssh_check
    • First observedssh_download
    • First observedssh_exec
    • First observedssh_forward
    • First observedssh_forward_close
    • First observedssh_forward_list
    • First observedssh_hosts
    • First observedssh_spawn
    • First observedssh_upload

TDQS

B3.4/5.0

Scored across 18 tools

Disambiguation4/5

Most tools target distinct operations (e.g., session vs shell vs SSH), but shell_exec and shell_script overlap in running commands, and session_send/recv are closely tied to shells. Overall, an agent can distinguish them with careful reading.

Naming Consistency4/5

Naming is predominantly <domain>_<action> with underscores, e.g., ssh_upload, session_kill. A few exceptions like server_info (reverse order) and ssh_hosts (noun) break the pattern slightly, but consistency is high overall.

Tool Count5/5

18 tools cover a well-scoped domain of remote execution and session management without being excessive. Each tool serves a clear purpose, and the count feels appropriate for the functionality offered.

Completeness4/5

The set covers local and remote execution, interactive sessions, file transfer, port forwarding, and server info. Minor gaps exist (e.g., no remote file listing, no SSH key management), but core workflows are supported.

Maintenance

ActivityActive
ResponsivenessUnresponsive

Related MCP Connectors

Related MCP Servers

  • A
    license
    B
    quality
    D
    maintenance
    A server that enables remote command execution over SSH through the Model Context Protocol (MCP), supporting both password and private key authentication.
    1
    5 npm
    2
    MIT
  • F
    license
    A
    quality
    D
    maintenance
    A local Model Context Protocol server that allows LLMs to securely execute shell commands on remote Linux and Windows systems via SSH connections.
    6
    9 npm
    2
    -
  • A
    license
    A
    quality
    A
    maintenance
    A Model Context Protocol server that allows LLMs to securely execute shell commands on remote Linux and Windows systems via SSH. It supports password and key-based authentication, command timeouts, and sudo elevation for administrative tasks.
    14
    5,023 npm
    805
    MIT