mcpx
This server gives an MCP client full shell and SSH operator access to local and remote hosts — running commands and scripts, driving interactive PTY sessions, transferring files, forwarding ports, and inspecting its own configuration and audit state.
Local shell: run arbitrary shell commands (
shell_exec) with cwd, env overlay, stdin, timeout, output caps, stderr merging, or argv-exec without a shell.Scripting: run multi-line bash/sh/python scripts via stdin (
shell_script), optionally withset -euo pipefail.Local PTY sessions: start persistent interactive sessions (
shell_spawn) for REPLs, TUIs, prompts, and long jobs.Remote command execution: run commands on SSH hosts (
ssh_exec), with jump hosts, ports, keys/agent, and known-hosts policy (strict / accept-new / ignore).Remote PTY sessions: open interactive remote sessions (
ssh_spawn).Session control: send input (
session_send), read output (session_recv), resize the PTY (session_resize), signal or kill and reap (session_kill), and list active sessions (session_list).File transfer: upload and download files or whole trees over SFTP (
ssh_upload,ssh_download, recursive supported).Port forwarding: create local, remote, or dynamic SOCKS forwards (
ssh_forward), list them (ssh_forward_list), and close them (ssh_forward_close).Inventory and connectivity: probe reachability across hosts or the whole inventory (
ssh_check) and show the resolved inventory from ssh_config plus the inventory file (ssh_hosts).Diagnostics: inspect version, effective limits, policy mode, and audit status (
server_info); the README also describesaudit_tail,operation_confirm,ssh_fanout,ssh_keyscan, read-only inventory resources, and theoperating_guideprompt.Policy posture: by default nothing is refused for what it does — every call is audited (redacted args, output hash/length, exit code, client, tier) and risky Tier 2/3 calls end with a
[NOTICE]; stricterguarded/readonlymodes, deny lists, and Tier-3 confirmation are opt-in.
Operates a local Linux host through the MCP server: run one-shot commands, multi-line bash/sh/python scripts with strict error handling, and persistent local PTY sessions (REPLs, TUIs, prompts, long-running jobs) with send/recv/resize/kill control, all bounded by timeouts, output caps, and an audited append-only trail.
Exposes server metrics over the HTTP transport at GET /metrics in Prometheus text format, including per-tool/per-tier call counters, syscall-notify counters and overflow counts, plus gauges for active sessions, active port forwards, and audit degradation, so a Prometheus instance can scrape tool usage, session load, and security-signal health.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@mcpxcheck disk usage on db01 via ssh"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Relay Shell
v0.4.0 · Python 3.12 / 3.13 / 3.14 · transports stdio and streamable-http · MCP SDK
mcp>=2,<3 · Apache-2.0
relay-shell is a Model Context Protocol server that gives
an MCP client the full reach of a shell: run commands on the local host, hold interactive PTY
sessions, run scripts, operate a fleet over SSH, move files with SFTP and open port forwards.
It is operator infrastructure for hosts you own and administer. It runs with the privileges of its service account, with no sandbox, and it is open by default: no command is refused for what it does. What it adds is a record and a warning:
Every call is audited: one JSON line with the redacted arguments, the output's hash and length (never its body), the exit code, the client and the assessed tier.
Every risky call says so: a call classified Tier 2 (changes state) or Tier 3 (irreversible), or an SSH call with host-key checking off, ends with a
[NOTICE ...]line.server_infolists the standing unsafe settings.Refusal is opt-in:
guardedandreadonlymodes, a deny list and a Tier-3 confirmation step are available and all off by default.
Tools
Local shell | Purpose |
| Run a command with timeout and output caps, cwd, env overlay and stdin. |
| Run a multi-line bash, sh or python script, optionally under |
| Start a persistent PTY session (REPLs, TUIs, prompts, long jobs). |
SSH | Purpose |
| Run a command on a remote host (jump host, key or agent, known-hosts policy). |
| Start an interactive remote PTY session. |
| SFTP transfer, recursive supported. |
| Local ( |
| List or close active forwards. |
| Probe connectivity across the inventory or a host list. |
| Run one command on many hosts in parallel; per-host exit codes in one JSON. |
| Fetch host keys with |
| Show the resolved inventory ( |
Sessions (local and SSH PTY) | Purpose |
| Send input, optionally followed by Enter. |
| Read buffered and new output, with a short wait. |
| Resize the PTY. |
| Signal or terminate a session. |
| List active sessions. |
Diagnostics | Purpose |
| Version, effective limits, policy mode, audit path, unsafe-setting warnings. |
| Read recent audit records, filterable by |
| Arm a Tier-3 confirmation token when that opt-in step is enabled. |
The server also exposes three read-only MCP resources (relay-shell://inventory,
relay-shell://inventory/{host}, relay-shell://ssh-config) and one prompt,
operating_guide, with guidance on which tool to use when; resource reads and prompt fetches
are audited too. Full reference: docs/tools.md. Over HTTP, GET /metrics
serves Prometheus counters and gauges (docs/deployment.md §9a).
Related MCP server: SSH MCP Server
Quickstart
Requires CPython 3.12 or later; tested on Ubuntu 24.04.
git clone https://github.com/rmednitzer/relay-shell.git && cd relay-shell
python3 -m venv .venv && . .venv/bin/activate
pip install -e ".[dev]"
relay-shell # stdio transport
RELAY_SHELL_TRANSPORT=http relay-shell # streamable-http on 127.0.0.1:8080
relay-shell --check-config # validate config, print unsafe-setting notes
relay-shell --verify-deploy # compare installed templates with the shipped onesRegister with an MCP client (stdio):
{ "mcpServers": { "relay-shell": { "command": "relay-shell" } } }Configuration comes from RELAY_SHELL_* environment variables, optionally via a .env file;
see .env.example and docs/deployment.md.
Default behaviour
With the default configuration every command on every tool is admitted, including rm -rf /,
mkfs, dd to a block device, shutdown, curl | sh and sudo (pinned by
tests/test_notices.py). The call is classified and audited, and a risky one ends with a
notice:
[exit 0]
...command output...
[NOTICE tier 3 (IRREVERSIBLE), matched an irreversible-operation pattern. It may not be
undoable and ran with no confirmation step; verify the target and take a backup or snapshot
first. Classification is a heuristic, not a boundary]The classifier is a regex heuristic over the command text, not a parse of the shell language. A call without a notice is not thereby safe, and a notice does not block anything.
Only resource bounds and one startup check refuse a call, none of them based on what the command does:
Bound | Setting (default) | Behaviour |
Input size (command, stdin, script, env) |
| refused, because the policy scan is synchronous |
Wall-clock per call |
| killed; use |
Live sessions / forwards |
| a new one is refused at the cap |
Output returned |
| truncated, not refused |
HTTP without OAuth on a non-loopback address |
| refused at startup unless set |
Session output buffers are also bounded, and idle sessions (RELAY_SHELL_SESSION_IDLE_TIMEOUT,
1800 s) and exited, drained sessions are reaped.
Making it stricter
Every option below is opt-in and they combine:
Want | Setting |
Refuse state-changing calls unless allow-listed |
|
Observe only |
|
Refuse specific text (checked first, in every mode) |
|
Two-step confirmation for Tier-3 calls |
|
Verified SSH host keys, no per-call downgrade |
|
Tamper-evident audit |
|
Authenticated HTTP transport |
|
Silence the |
|
Security
The server grants real administrative power. Run it as a scoped service account, only on hosts
you are authorized to administer, behind the network controls in
docs/deployment.md. A privileged (root or sudo) deployment is supported
for isolated administrative hosts with strict network controls and full audit shipping.
SECURITY.md has the threat model and how to report a vulnerability.
Besides the audit record, notices and bounds above:
Audit integrity: the log is append-only on disk with a rotation-safe handler. The optional hash chain makes edits, insertions, reorders and interior deletions detectable with
relay-shell --verify-audit(fail-closed); detecting tail truncation needs the off-host copy.Redaction: audited arguments are scrubbed of tokens, keys and
Authorizationmaterial. Heuristic; tested with synthetic secrets.Syscall visibility (optional):
RELAY_SHELL_SECCOMP_NOTIFYrecords a spawned child'sexecve, privilege, namespace, mount, write-openand privilege-relevantprctlsyscalls. It never blocks a syscall and installs only withCAP_SYS_ADMIN.OAuth 2.1 (optional, off by default): dynamic client registration behind an operator approval gate, PKCE, rotating refresh tokens with reuse detection. See
docs/auth.md.Edge: the Caddy config from
deploy/install-edge.shrestricts the MCP endpoint to known CIDRs, adds security headers, caps public OAuth request bodies, keeps authorization codes out of the access log and automates TLS via ACME. The systemd unit applies resource caps.
Compatibility
Surface | Supported | Notes |
Python | 3.12 / 3.13 / 3.14 | CI runs the full matrix. |
Host OS | Ubuntu 24.04 LTS | Tested; the systemd and Caddy installers assume it. macOS works for development only. |
Windows | SSH target only | Over OpenSSH with PowerShell 7; not supported as a host (no PTY contract, no systemd). |
Transports |
| stdio is the default; HTTP binds loopback and needs a TLS edge. |
MCP SDK |
| Pinned in |
SSH library |
| Native async; no shell-out to the system |
Development
ruff check . && ruff format --check .
mypy
pytestLayout: src/relay_shell/ (server and modules), deploy/ (systemd unit, Caddyfile, logrotate,
installers, off-host audit sync, monitoring), docs/ (start at
docs/index.md), tests/ (unit and integration; an in-process SSH server,
no network).
CONTRIBUTING.md covers scope, branch naming, the local loop and review of
security-sensitive changes; docs/runbook.md holds the audit, review and
validation procedures and the backlog. AI agents follow AGENTS.md (with
CLAUDE.md for Claude). Participation is governed by the
Code of Conduct.
License
Available Tools
18 toolsserver_infoA
Report version, effective limits, policy mode, and audit status.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. It states it reports information (non-destructive), but doesn't disclose any behavioral traits like rate limits or auth requirements. Adequate for a simple read tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence with no wasted words. Every part is meaningful and front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given that there is an output schema (not shown), description doesn't need to explain return values. For a parameterless info tool, the description is complete and sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist, so schema coverage is 100%. The description adds meaning by detailing what information is reported. Baseline is 4 due to zero params.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description uses specific verb 'report' and resource 'server' with concrete items (version, effective limits, policy mode, audit status). It clearly distinguishes from sibling tools which are all action-oriented (session, shell, ssh).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool vs alternatives. The description implies it's for checking server status, but doesn't provide context or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
session_killA
Signal a session and (by default) close and reap it.
| Name | Required | Description | Default |
|---|---|---|---|
| session_id | Yes | ||
| signal_name | No | TERM | |
| close | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description bears the full burden of transparency. It discloses that a signal is sent and the session is closed and reaped by default, but lacks details on side effects, permissions, or what 'reap' entails. The description provides a basic overview but is not comprehensive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that is front-loaded with the action. No extraneous words or redundant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 3 parameters, an output schema, and multiple siblings, the description is too sparse. It lacks guidance on return values, valid signal names, and what happens to the session's state. More detail is needed for complete understanding.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. However, it only mentions 'session' and 'signal' without explaining any parameters: session_id, signal_name (default TERM), or close. The description adds no value beyond the schema fields, leaving the agent uninformed about parameter usage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action 'Signal a session' and includes the default behavior 'close and reap it'. This distinguishes it from siblings like session_list or session_send, which have different purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for sending signals to terminate or manage a session, but it does not explicitly state when to use this tool over related siblings like session_send (which sends input) or session_resize. No exclusions or alternatives are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
session_listA
List active sessions with size, age, idle, and byte counters.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description must convey behavior. It indicates a read-only operation ('List active sessions') with no side effects, but does not mention permissions, limits, or sorting. For a listing tool, this is minimally sufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence with no extraneous words. Every word contributes to clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no parameters and an output schema present, the description fully covers the tool's purpose and outputs. It satisfies the needs for effective selection and invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0 parameters with 100% coverage, so the description adds value by specifying the exact counters included (size, age, idle, byte). This meaningfully supplements the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('List'), identifies the resource ('active sessions'), and enumerates the output fields (size, age, idle, byte counters). This clearly distinguishes the tool from siblings like session_kill or session_send.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is for viewing session details but lacks explicit guidance on when to use it versus alternatives. No exclusions or prerequisites are provided, making it adequate but not strong.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
session_recvA
Read buffered/new output from a session, waiting up to timeout seconds.
| Name | Required | Description | Default |
|---|---|---|---|
| session_id | Yes | ||
| timeout | No | ||
| max_bytes | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses the timeout behavior and that it reads buffered/new output, which is transparent for a read operation. However, it does not mention any side effects or blocking nature beyond timeout.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with 12 words, front-loaded with the main action. Every word earns its place, making it concise and efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity and the presence of an output schema, the description adequately covers the core behavior (reading output with timeout). It could mention that the tool is non-destructive or clarify the meaning of 'buffered/new', but overall it is complete enough.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It only explains the timeout parameter, while session_id and max_bytes are not described. Although parameter names are somewhat self-explanatory, the description does not add sufficient meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action: 'Read buffered/new output from a session'. It uses a specific verb and resource, and distinguishes from sibling tools like session_send or session_kill.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not explicitly state when to use this tool or when not to, nor does it mention alternatives. The usage is implied from the action, but lacks explicit guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
session_resizeC
Resize a session's PTY.
| Name | Required | Description | Default |
|---|---|---|---|
| session_id | Yes | ||
| cols | Yes | ||
| rows | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided; description only states the basic operation. Lacks details on side effects (e.g., content clipping), error conditions, or required permissions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, no wasted words. It is appropriately sized for the simple operation, though could benefit from additional context without becoming verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple operation and presence of an output schema, the description is too sparse. It omits prerequisites, error handling, and behavioral details that would aid an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, yet the description adds no meaning to the parameters. It does not clarify what cols and rows represent (e.g., character columns vs pixels) or any constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (resize) and the resource (session's PTY). It is specific and distinguishes from sibling tools like session_kill or session_list.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool, prerequisites (e.g., session must be active), or when not to use. No mention of alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
session_sendC
Send input to a session (local or SSH). enter appends a newline.
| Name | Required | Description | Default |
|---|---|---|---|
| session_id | Yes | ||
| data | Yes | ||
| enter | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must disclose all behavioral traits. It only mentions that the `enter` option appends a newline, leaving out important details like whether the call is blocking, what happens if the session is inactive, or any side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very short with two sentences, no unnecessary words. However, the brevity sacrifices completeness, and a more structured layout could improve clarity without adding length.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 3 parameters (2 required) and no schema descriptions, the description should be more comprehensive. It does not explain how to obtain a session_id, what constitutes valid data, or how the output behaves (though an output schema exists). The context is incomplete for effective use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description should explain all parameters. It only partially explains the `enter` parameter by noting it appends a newline. The `session_id` and `data` parameters are implied by the overall purpose but lack explicit definition or constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it sends input to a session (local or SSH), specifying the verb and resource. However, it does not explicitly differentiate from sibling tools like shell_exec or ssh_exec, which also deal with input.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. There is no mention of prerequisites, such as ensuring the session exists, or when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
shell_execB
Run a shell command on the local host and return its combined output.
Timeout and output size are clamped to the server limits. Set
use_shell=false to exec an argv without a shell.
| Name | Required | Description | Default |
|---|---|---|---|
| command | Yes | ||
| timeout | No | ||
| max_output | No | ||
| cwd | No | ||
| stdin | No | ||
| merge_stderr | No | ||
| use_shell | No | ||
| env_json | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations are absent, so the description must cover behavior. It notes clamping and the use_shell option, but omits security implications, blocking behavior, error handling, and other safety concerns for running shell commands.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short (three sentences) and front-loaded with the main purpose. However, it could be more structured to cover parameters better without becoming verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (8 params, no schema descriptions), the description is too minimal. It only addresses the core use case and one parameter, leaving the agent to guess about others. Output schema exists but doesn't compensate for missing param docs.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage and 8 parameters, only 'use_shell' is mentioned. The meaning of parameters like cwd, stdin, merge_stderr, env_json, and how they affect execution is not explained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool runs a shell command locally and returns combined output. It distinguishes from sibling tools like shell_spawn (interactive) and ssh_* (remote execution).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions timeout/output clamping and the use_shell flag, but does not explicitly state when to use this tool vs alternatives like shell_script or shell_spawn. Some guidance is present but incomplete.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
shell_scriptA
Run a multi-line script (bash/sh/python) fed on stdin.
With strict and a shell interpreter, set -euo pipefail is
prepended so failures abort early.
| Name | Required | Description | Default |
|---|---|---|---|
| script | Yes | ||
| interpreter | No | bash | |
| strict | No | ||
| timeout | No | ||
| cwd | No | ||
| env_json | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description partially covers behavior by noting the strict mode and error handling with set -euo pipefail. However, it omits important details like output capture, error propagation, security implications, or side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with two sentences, front-loading the core purpose. Every sentence adds value, though additional parameter details might be needed.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (6 parameters, script execution), the description lacks coverage of return values, logging, error handling specifics, and environmental setup. An output schema exists but is not described, limiting completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage, so the description must compensate. It only clarifies the 'strict' parameter's effect, leaving script, interpreter, timeout, cwd, and env_json unexplained. This adds minimal value beyond the schema defaults.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool runs multi-line scripts via stdin, specifying interpreters like bash/sh/python. This distinguishes it from sibling tools such as shell_exec and shell_spawn.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for script execution and mentions strict mode behavior, but does not explicitly state when to use this tool over alternatives like shell_exec or ssh_exec, nor when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
shell_spawnB
Start a persistent local PTY session; returns a session id.
Drive it with session_send / session_recv.
| Name | Required | Description | Default |
|---|---|---|---|
| command | No | ||
| cols | No | ||
| rows | No | ||
| cwd | No | ||
| env_json | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. It mentions 'persistent' and 'local PTY session', but lacks details on resource cleanup, auth requirements, or state management. Minimal behavioral disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Extremely concise with two sentences. First sentence states the primary action; second sentence directs usage. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having 5 parameters and no output schema details, the description ignores parameter semantics and return format. It mentions session_id but not its type or structure. Incomplete for effective tool selection and invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%. The description adds no information about any of the 5 parameters (command, cols, rows, cwd, env_json) beyond what the schema provides (defaults and types).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool starts a persistent local PTY session and returns a session id. It distinguishes from siblings by specifying that it is driven by session_send/session_recv, implying persistence.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says to drive the session with session_send/session_recv, providing clear workflow context. However, no mention of when not to use this tool versus alternatives like shell_exec.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_checkC
Probe connectivity to the given hosts (or the whole inventory).
| Name | Required | Description | Default |
|---|---|---|---|
| hosts | No | ||
| timeout | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, and the description does not disclose behavioral details such as what the probe entails (e.g., ping, SSH handshake), how errors are reported, or the effect of the timeout parameter. It lacks transparency beyond the basic purpose.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise (one sentence) with no fluff. It is front-loaded with the core action. It could be more structured but is appropriately sized for a simple tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 2 parameters, no annotations, and an output schema, the description is incomplete. It does not explain the effect of leaving hosts empty (probing all inventory) or the role of timeout. An output schema exists but the description does not hint at the return format.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 0% description coverage, and the description does not mention or explain any parameters (hosts, timeout). The description adds no meaning beyond the parameter names and types already in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool probes connectivity to hosts or the whole inventory, using a specific verb and resource. However, it does not differentiate from sibling tools like ssh_exec or ssh_hosts, though the purpose is distinct enough.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for checking SSH connectivity but provides no explicit guidance on when to use this tool versus alternatives like ssh_hosts or ssh_exec. No when-not-to-use or prerequisites are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_downloadC
Download a file or tree from a remote host via SFTP.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | ||
| remote_path | Yes | ||
| local_path | Yes | ||
| recursive | No | ||
| user | No | ||
| port | No | ||
| key_path | No | ||
| known_hosts | No | ||
| jump | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must disclose behavior. It only mentions downloading via SFTP, missing details on authentication, overwrite behavior, error handling, or return value. Minimal additional context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single short sentence, front-loaded with the action. It is concise but lacks essential details, resulting in under-specification rather than efficient conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 9 parameters, no annotations, and no parameter descriptions, the one-line description is severely incomplete. It fails to explain required vs optional parameters, protocol details, or output schema content.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, meaning parameters have no descriptions. The tool description adds no meaning to the 9 parameters; it only restates the general purpose.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it downloads a file or tree from a remote host via SFTP, using a specific verb and resource. It distinguishes from sibling tools like ssh_upload and ssh_exec.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives, nor any prerequisites or exclusions. It only states the action.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_execA
Run a command on a remote host over SSH and return its output.
host may be an inventory/ssh_config alias or user@host.
known_hosts is strict | accept-new | ignore.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | ||
| command | Yes | ||
| timeout | No | ||
| user | No | ||
| port | No | ||
| key_path | No | ||
| known_hosts | No | ||
| jump | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must disclose behavior. It mentions output return and gives parameter constraints (host format, known_hosts policy), but does not cover authentication, connection lifecycle, side effects of command execution, or error handling. This is adequate but not comprehensive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise: two short sentences conveying core usage and key parameter details. No redundant information, and critical points are front-loaded. Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 8 parameters, no annotations, and an output schema (not shown), the description is somewhat incomplete. It fails to explain the return format, error behavior, authentication requirements, or how the timeout and jump host work. It covers the most essential parts but leaves gaps for a complex SSH execution tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description adds crucial meaning for two of eight parameters (host and known_hosts). It explains host can be an alias or user@host, and known_hosts accepts specific values. However, six parameters (command, timeout, user, port, key_path, jump) lack any description, limiting overall semantic clarity.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Run a command on a remote host over SSH and return its output,' which is a specific verb and resource. It distinguishes from siblings like ssh_check (connectivity check) and ssh_download (file transfer), making its purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives (e.g., shell_exec for local commands, ssh_spawn for interactive sessions). The description does not mention prerequisites, limitations, or exclusions, leaving the agent without decision support.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_forwardC
Create a port forward.
Spec: L:lport:dhost:dport (local), R:rport:dhost:dport
(remote), or D:lport (dynamic SOCKS).
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | ||
| spec | Yes | ||
| user | No | ||
| port | No | ||
| key_path | No | ||
| known_hosts | No | ||
| jump | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It mentions creation but does not disclose behavioral traits like what happens on invalid spec, if it blocks, how to close, or any side effects. Only 'create' is indicated, leaving many aspects ambiguous.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is brief (two sentences plus a code block) and front-loaded with the purpose. The spec format is well-structured. However, it could be improved by listing or summarizing parameters instead of leaving them to the schema alone.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex SSH port forwarding tool with 7 parameters and an output schema, the description is too minimal. It omits error conditions, default values, return value explanation, and usage scenarios. Significant gaps remain for an agent to use it reliably.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%. The description only explains the 'spec' parameter via format examples. Other parameters (host, user, port, key_path, known_hosts, jump) are not described, failing to compensate for the lack of structured definitions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Create a port forward' with a verb and resource. It also explains the spec format for local, remote, and dynamic forwarding, distinguishing it from sibling tools like ssh_forward_close (close) and ssh_forward_list (list).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool vs alternatives, prerequisites (e.g., need an active SSH connection), or context such as whether the forward is persistent or how to manage it. The spec format is shown but usage conditions are omitted.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_forward_closeB
Close an SSH port forward by id.
| Name | Required | Description | Default |
|---|---|---|---|
| forward_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description should disclose behavioral details like effects on SSH connections, required permissions, or error behavior. It only states the action without any such context, leaving ambiguity.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is front-loaded with the verb and resource. Every word is necessary, and there is no extraneous information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity of the tool and the existence of an output schema, the description is minimally adequate. However, it could benefit from mentioning that the forward must be active or that the id comes from ssh_forward_list.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has no parameter descriptions, and the tool description only mentions 'by id', which adds little beyond the parameter name. It does not explain how to obtain a valid forward_id or its format.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (close), the resource (SSH port forward), and the method (by id). It effectively distinguishes from siblings like ssh_forward (create) and ssh_forward_list (list).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies that the user needs to know the forward_id, likely from listing, but does not provide explicit guidance on when to use this tool versus other operations or prerequisites. The context of sibling tools partially compensates.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_forward_listB
List active SSH port forwards.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided; description only states purpose without any behavioral traits (e.g., read-only, authentication needs, side effects).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single, clear sentence with no waste. Could be slightly more informative, but efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Output schema exists, so return values are not required in description. However, no extra context beyond purpose; minimal for a simple tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters defined in schema; schema coverage is 100%. Description adds no additional param info, but baseline for 0 params is 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description uses a specific verb 'list' and resource 'active SSH port forwards', clearly distinguishing it from sibling tools like ssh_forward (create) and ssh_forward_close (close).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use vs. alternatives. Implicit from name, but no explicit context or exclusions provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_hostsA
Show the resolved host inventory (ssh_config + inventory file).
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided; description only says 'Show' implying read-only, but lacks details on resolution behavior, caching, or performance implications. Minimal disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, front-loaded with action and resource, no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given zero parameters and presence of output schema (not shown), description adequately conveys purpose and data sources. Could mention output format but not required.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist (schema coverage 100%), so description does not need to add parameter info. Baseline score of 4 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description uses specific verb 'Show' and resource 'resolved host inventory' with clear indication of combining ssh_config and inventory file, distinguishing it from sibling tools like ssh_exec or ssh_check.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives (e.g., checking specific hosts) or when not to use it. The description provides no context for selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_spawnB
Open a persistent interactive PTY on a remote host; returns a session id.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | ||
| command | No | ||
| cols | No | ||
| rows | No | ||
| user | No | ||
| port | No | ||
| key_path | No | ||
| known_hosts | No | ||
| jump | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must disclose behavioral traits. It mentions 'persistent interactive' but omits key details like authentication requirements, error handling, timeout behavior, and how to manage the session (e.g., session_kill).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no wasted words. It is front-loaded with the core purpose. Could potentially be expanded to include parameter details without losing conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (9 parameters, 1 required) and no annotations, the description is insufficient. It does not cover parameter semantics, prerequisites, or session lifecycle, though the output schema likely documents the returned session id.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It provides no explanation for any of the 9 parameters (host, command, cols, etc.), leaving their purpose and valid values entirely undefined.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Open', the resource 'persistent interactive PTY', and the output 'returns a session id'. It effectively distinguishes from sibling tools like ssh_exec (non-interactive) and shell_spawn (local PTY).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for interactive remote sessions but does not provide explicit when-to-use or alternatives. No exclusions or prerequisites are mentioned, leaving the agent to infer from context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_uploadB
Upload a file or tree to a remote host via SFTP.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | ||
| local_path | Yes | ||
| remote_path | Yes | ||
| recursive | No | ||
| user | No | ||
| port | No | ||
| key_path | No | ||
| known_hosts | No | ||
| jump | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states 'Upload' (a write operation) but does not mention destructive potential (overwriting files), authentication requirements, error handling, or other behaviors beyond the basic action.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no wasted words. It efficiently conveys the core purpose, earning its place without any fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (9 parameters, no annotations, 0% schema coverage), the description is too sparse. It does not cover authentication, prerequisites, or parameter relationships, leaving significant gaps for the agent to handle properly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds minimal meaning beyond the schema: 'file or tree' hints at the recursive parameter, but it does not explain any other parameters (host, user, key_path, etc.). With 0% schema description coverage, the description fails to compensate adequately.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Upload' and the resource 'a file or tree to a remote host via SFTP'. It distinguishes this tool from siblings like ssh_download (download) and ssh_exec (execute command) by specifying the action and protocol.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like ssh_download or ssh_exec. It does not mention prerequisites (e.g., SSH access) or scenario-specific advice, leaving the agent without context for decision-making.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
18 tool updates
v0.1.0- First observed
server_info - First observed
session_kill - First observed
session_list - First observed
session_recv - First observed
session_resize - First observed
session_send - First observed
shell_exec - First observed
shell_script - First observed
shell_spawn - First observed
ssh_check - First observed
ssh_download - First observed
ssh_exec - First observed
ssh_forward - First observed
ssh_forward_close - First observed
ssh_forward_list - First observed
ssh_hosts - First observed
ssh_spawn - First observed
ssh_upload
TDQS
Scored across 18 tools
Most tools target distinct operations (e.g., session vs shell vs SSH), but shell_exec and shell_script overlap in running commands, and session_send/recv are closely tied to shells. Overall, an agent can distinguish them with careful reading.
Naming is predominantly <domain>_<action> with underscores, e.g., ssh_upload, session_kill. A few exceptions like server_info (reverse order) and ssh_hosts (noun) break the pattern slightly, but consistency is high overall.
18 tools cover a well-scoped domain of remote execution and session management without being excessive. Each tool serves a clear purpose, and the count feels appropriate for the functionality offered.
The set covers local and remote execution, interactive sessions, file transfer, port forwarding, and server info. Minor gaps exist (e.g., no remote file listing, no SSH key management), but core workflows are supported.
Maintenance
Related MCP Connectors
Scoped, audited SSH exec, sessions, and SFTP on your saved servers without exposing credentials
Termalin's hosted MCP server. Claude, ChatGPT or any MCP client runs commands, moves files over SFTP, queries databases and reads server metrics and monitoring alerts on your servers, keylessly through Termalin Connectors: no SSH key is handed over and no inbound port is opened. Per-host command policy and an audit log. Needs a termal.in Pro or Team account (new accounts start with a 14-day Pro trial).
MCP server for mandates, delegation, policy-gated execution, credential grants, and audit.
Remote MCP server exposing your Node Command fleet (files, shell, processes, browser) to AI hosts.
Related MCP Servers
- AlicenseCqualityDmaintenanceA secure server that implements the Model Context Protocol (MCP) to enable controlled execution of authorized shell commands with stdin support.1MIT
- AlicenseBqualityDmaintenanceA server that enables remote command execution over SSH through the Model Context Protocol (MCP), supporting both password and private key authentication.15 npm2MIT
- FlicenseAqualityDmaintenanceA local Model Context Protocol server that allows LLMs to securely execute shell commands on remote Linux and Windows systems via SSH connections.69 npm2-
- AlicenseAqualityAmaintenanceA Model Context Protocol server that allows LLMs to securely execute shell commands on remote Linux and Windows systems via SSH. It supports password and key-based authentication, command timeouts, and sudo elevation for administrative tasks.145,023 npm805MIT