dos-mcp
The dos-mcp server enables modern AI/MCP clients to remotely observe and control DOS systems (real hardware or simulators) over a network bridge, without requiring modern software on the retro machine.
Capabilities:
Target Management: List available DOS targets (
dos.list_targets), get their current status (dos.get_status), and query their specific capabilities (dos.get_capabilities).Screen Capture: Capture the full text screen including attributes and cursor (
dos.capture_screen), or capture graphics framebuffers (CGA, Hercules, EGA, VGA) viados.capture_graphics(requires RA-TSR).Input Control: Inject text and named keys (e.g., Enter, F1, Ctrl+C) with configurable delay and settle time using
dos.send_keys.File Transfer: Download files from (
dos.download_file) and upload files to (dos.upload_file) a target's sandboxed file area, with overwrite option.Flexible Deployment: Supports foreground (
RAGENT.EXE), background/resident (RA-TSR.EXE), Linux PTY, and UDP simulator endpoints.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@dos-mcpcapture the current screen"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
DOS MCP
DOS MCP lets a modern MCP client observe and control DOS systems without putting MCP, JSON, HTTP, or an AI runtime on the retro machine. The modern Python bridge owns MCP, credentials, retries, target routing, policy, and structured results. DOS runs a small packet-driver endpoint.
Two DOS executables are retained:
RAGENT.EXE: the original foreground command-shell endpoint;RA-TSR.EXE: a loadable/unloadable resident endpoint for background observation, BIOS keyboard insertion, sandboxed file transfer, and raw standard graphics capture.
PicoMEM/PicoMEM2-specific code is intentionally absent.
Implemented MCP tools
dos.list_targetsdos.get_statusdos.get_capabilitiesdos.capture_screendos.capture_graphicsdos.send_keysdos.download_filedos.upload_file
All target-taking tools accept an optional target selector. It may be
omitted only when the bridge knows exactly one system.
Related MCP server: pov
Target matrix
Capability | Linux PTY | UDP simulator | RAGENT | RA-TSR |
Status/capabilities | Yes | Yes | Yes | Yes |
80×25 text capture | Yes | Yes | Yes | Yes |
Keyboard input | terminal | UDP | BIOS queue | BIOS queue |
Sandboxed file read/write | opt-in | opt-in | No | opt-in |
Raw graphics capture | No | fixture-dependent | No | CGA/Herc/EGA/VGA |
Background operation | host process | host process | No | Yes |
Load/unload | process | process | process | DOS TSR |
Named local discovery | No | No | No | Yes |
RA-TSR is built with 8086 instruction generation for 8088 through 486-class
machines. DOSBox-X verifies the complete resident path, including exact
text/VGA capture, keyboard-driven VER, binary upload/download, and unload.
Physical adapter, BIOS, video-card, and 4.77 MHz timing coverage remains an
explicit hardware-verification item.
Architecture
MCP client
│ MCP over stdio
▼
Python DOS MCP bridge
│ target registry + transport-independent Backend operations
├── Linux PTY backend
├── configured UDP target(s)
└── validated local discovery records
│ authenticated protocol v2 over UDP
├── Linux simulator
├── RAGENT.EXE
└── RA-TSR.EXE
│ FTP/Crynwr packet driver
└── Ethernet adapterDiscovery is only an unauthenticated address hint. Every target operation still performs the configured credentialed handshake. RA-TSR announcements use Ethernet/IP limited broadcast and TTL 1, and stop while connected.
Quick start: local Linux backend
Requirements are Linux, Python 3.12+, and
uv:
uv sync
uv run dos-mcpSelect a shell and starting directory:
DOS_MCP_ROOT=/path/to/workspace \
DOS_MCP_SHELL=/bin/bash \
uv run dos-mcpThe starting directory is not an OS sandbox; the child retains the bridge user's permissions.
Quick start: Linux-backed UDP simulator
# terminal 1
uv run dos-mcp-simulator \
--bind 127.0.0.1:21300 \
--password 'local-test-only' \
--root "$PWD" \
--allow-file-read \
--allow-file-write
# terminal 2
DOS_MCP_TARGET=127.0.0.1:21300 \
DOS_MCP_PASSWORD='local-test-only' \
DOS_MCP_ALLOW_FILE_READ=1 \
DOS_MCP_ALLOW_FILE_WRITE=1 \
uv run dos-mcpQuick start: DOS
For a hardware PC, copy the ready-to-commission bin/ directory to
C:\DOSMCP. It contains both endpoints, offline protocol/configuration tests,
an editable mTCP-style configuration, and load/unload batch files. Edit
C:\DOSMCP\MTCP.CFG, load the adapter packet driver, then run:
CD \DOSMCP
PROTOCHK
CFGCHK
STARTTSR Unique-Lab-PassphraseThe example IP addresses in bin/MTCP.CFG are documentation-only TEST-NET
addresses and must be replaced. STARTTSR sets MTCPCFG and uses its
IPADDR, PACKETINT, and HOSTNAME values.
Build with Open Watcom 2:
make -C dos WATCOM=/path/to/watcom allRegenerate the tracked commissioning bundle after a DOS source change:
make -C dos WATCOM=/path/to/watcom binForeground:
RAGENT pass:UniqueLabPass 192.168.10.55 21300 0x60Both DOS endpoints can instead share an mTCP configuration:
SET MTCPCFG=C:\MTCP.CFG
RAGENT pass:UniqueLabPass - 21300 -With MTCPCFG set, running a fresh RA-TSR without arguments takes its IP,
packet-driver interrupt, and visible name from IPADDR, PACKETINT, and
HOSTNAME (or DHCP's HOSTNAME_ASSIGNED). It installs in conspicuous open
mode with file access disabled. The unused default file root does not need to
exist in that mode.
Resident, named, with an explicit file root:
MD C:\REMOTE
RA-TSR pass:UniqueLabPass 192.168.10.55 21300 0x60 C:\REMOTE RW WORKBENCH-386For deliberate unrestricted access to every DOS drive, use the literal root
ALL. Network paths must then be absolute drive paths such as
C:\CONFIG.SYS; RA-TSR prints a prominent warning when ALL and write access
are enabled:
RA-TSR pass:UniqueLabPass 192.168.10.55 21300 0x60 ALL RW WORKBENCH-386The Linux bridge still requires its independent file-read and file-write flags shown below.
Connect directly:
DOS_MCP_TARGET=192.168.10.55:21300 \
DOS_MCP_PASSWORD=UniqueLabPass \
DOS_MCP_ALLOW_FILE_READ=1 \
DOS_MCP_ALLOW_FILE_WRITE=1 \
uv run dos-mcpOr listen for disconnected RA-TSRs:
DOS_MCP_DISCOVERY=1 \
DOS_MCP_PASSWORD=UniqueLabPass \
uv run dos-mcpFor multiple fixed machines:
DOS_MCP_TARGETS='{"desk8088":"192.168.10.21","lab386":"192.168.10.38"}' \
DOS_MCP_PASSWORD=UniqueLabPass \
uv run dos-mcpThe bridge currently uses one UDP credential per process. Separate bridge processes are recommended when targets have different secrets.
Credentials
A password/passphrase of any nonzero length supported by the invoking command line is deterministically reduced to a 128-bit key. A legacy 32-hex raw key is still accepted. The credential is optional on both peers; omission selects conspicuous open mode.
Open mode is unauthenticated and suitable only for an isolated test network. Credentialed protocol v2 authenticates but does not encrypt traffic and uses a deliberately short 32-bit packet tag for 8088 feasibility. Use a trusted private LAN, a unique high-entropy credential per deployment, and never forward the DOS operation port to the Internet.
Test
uv run ruff check .
uv run python tools/check_docs.py
uv run pytest
make -C dos WATCOM=/path/to/watcom allForeground and resident DOSBox-X harnesses:
WATCOM=/path/to/watcom \
DOSBOX_X=/path/to/dosbox-x \
PACKET_DRIVER=/path/to/NE2000.COM \
tools/test_dosbox_x.sh
WATCOM=/path/to/watcom \
DOSBOX_X=/path/to/dosbox-x \
PACKET_DRIVER=/path/to/NE2000.COM \
tools/test_dosbox_x_tsr.shDocumentation
Start with Documentation:
PROJECT.md is the original brief. AGENTS.md
contains the current contributor constraints.
License
A final open-source license has not yet been selected. Third-party packet drivers are not redistributed by this repository.
Available Tools
8 toolsdos.capture_graphicsCapture DOS graphics screenBRead-only
Capture a standard CGA, Hercules, EGA, or VGA graphics framebuffer.
| Name | Required | Description | Default |
|---|---|---|---|
| target | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint=true, so the agent knows the operation is safe. The description adds scoping to standard graphics framebuffers, but it does not discuss failure modes or behavior for unsupported modes. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, precise sentence that wastes no words and front-loads the action. It is appropriately concise and structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple and the output schema covers return values, so that aspect is handled. However, the 'target' parameter is undocumented, and the description does not differentiate from the sibling capture_screen, creating ambiguity. Overall, the description is adequate but has notable gaps in parameter and usage context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has a single optional 'target' parameter with no description (0% schema coverage). The description does not mention this parameter or explain its meaning, leaving the agent without guidance on how to use it. The description fails to compensate for the low schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's action: capturing a graphics framebuffer for specific video standards (CGA, Hercules, EGA, VGA). This distinguishes it from the sibling capture_screen by specifying 'graphics framebuffer' and the supported modes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is for graphics modes but does not explicitly state when to use it over capture_screen or other alternatives. It also lacks any mention of prerequisites or context for the target parameter, offering only implicit usage guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dos.capture_screenCapture DOS text screenARead-only
Capture the full fixed-width text screen, cell attributes, and cursor state.
| Name | Required | Description | Default |
|---|---|---|---|
| target | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnlyHint annotation, the description adds useful details about what is captured (cell attributes and cursor state), which is not evident from annotations alone. However, it does not disclose other behaviors like failure modes or return format details, but the output schema likely covers the latter.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that immediately states the action and scope. It avoids unnecessary words and is easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple nature of the tool, the description covers the primary purpose and output components, aided by annotations and an output schema. However, it omits any explanation of the 'target' parameter, leaving a gap in completeness for a tool with at least one parameter.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema includes one optional parameter 'target' with no description, and schema_description_coverage is 0%. The tool description does not mention or explain the parameter at all, failing to compensate for the missing parameter documentation. The name 'target' gives a vague hint but is insufficient.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool captures the full fixed-width text screen, cell attributes, and cursor state, specifying a distinct resource and action. It differentiates from the sibling tool 'capture_graphics' by explicitly mentioning 'text screen' and the fixed-width nature.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use it (for capturing text screen state) through the wording 'text screen,' but it does not explicitly mention alternatives or exclusions. There is no direct comparison to capture_graphics or other siblings, so usage context is only implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dos.download_fileDownload a file from DOSARead-only
Download one bounded binary file as base64 when file reads are enabled.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Path relative to the target's configured file sandbox. | |
| target | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, so the read-safe nature is covered. The description adds valuable context: the 'bounded' constraint (likely a size limit) and the conditional 'when file reads are enabled', which indicates the tool may fail if that setting is off. This goes beyond the structured annotations, though it stops short of detailing failure modes or file-size boundaries.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single clause, front-loaded with the verb 'Download' and contains all key information without redundancy. Every word earns its place; it is optimally concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The presence of an output schema covers return values, but the description leaves ambiguity about the 'bounded' limit and the 'enabled' condition. The optional target parameter is unexplained, and there is no indication of how the tool behaves if file reads are disabled. For a tool with only two parameters, this is a moderate gap in contextual completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 50% (only path has a description), and the tool description does not mention parameters at all. The path is explained in the schema, but the optional 'target' parameter is left unexplained in both schema and description. The description says 'one bounded binary file' but does not clarify how path or target affect the download, so it fails to compensate for the coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action: 'Download' a 'bounded binary file as base64'. It specifies the resource type (binary file) and output format (base64), which distinguishes it from sibling tools like upload_file. The phrase 'when file reads are enabled' adds a scope condition, making the purpose precise.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use cases (downloading files) but does not explicitly state when to use this tool versus alternatives. It does not mention that upload_file would be used for the reverse operation, nor does it describe exclusions or prerequisites beyond the 'enabled' condition. Usage is implied rather than explicitly guided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dos.get_capabilitiesGet DOS target capabilitiesARead-only
Report exactly which target operations and screen formats are supported.
| Name | Required | Description | Default |
|---|---|---|---|
| target | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, so the description doesn't need to repeat safety. It adds specific behavioral context by listing what is reported (operations and screen formats) and emphasizes precision ('exactly'), which is valuable beyond the annotation. There is no mention of side effects, but readOnlyHint covers that aspect.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence with no filler words. It front-loads the action and resource. While it could include more detail about the target parameter, the concise phrasing is appropriate for a simple tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, the description does not need to explain return values. However, it lacks guidance on usage context and leaves the target parameter unexplained, which are gaps in the overall completeness. It is sufficient for a basic understanding but not fully self-contained for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has one parameter 'target' with 0% description coverage, and the tool description does not explain the parameter's role or behavior when null. The meaning of 'target' is left entirely to inference from the schema name, and no guidance is given on how it affects the capabilities report.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'report' and the precise resource 'target operations and screen formats'. It is specific and easily distinguishes itself from sibling tools like get_status or list_targets, making the tool's purpose immediately clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not explicitly address when to use this tool versus alternatives, nor does it mention exclusions. However, the phrase 'exactly which target operations and screen formats are supported' implies it is used for discovering capabilities before calling other operations, so the usage is somewhat implied rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dos.get_statusGet DOS target statusARead-only
Report target identity, connection state, and current operating phase.
| Name | Required | Description | Default |
|---|---|---|---|
| target | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations include readOnlyHint: true, and the description uses 'report', so there is no contradiction. The description adds useful context by listing the specific aspects of the target that are reported, but it does not disclose behaviors like handling of a null target or error scenarios, which would add further transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, succinct sentence of 10 words that is front-loaded and contains no filler. Every word adds value, making it an ideal concise description.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only status tool with an output schema present, the description adequately covers what is reported. The optional target parameter and the output schema handle the remaining details, though it could briefly mention behavior when target is not provided.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has one optional 'target' parameter with 0% description coverage. The description does not explain what target accepts, what null means, or how it influences the report. It only uses the word 'target' generically, adding little beyond the parameter name.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool reports target identity, connection state, and current operating phase, using a specific verb ('report') and a defined resource. This distinguishes it from sibling tools like get_capabilities and upload_file, which serve different purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit guidance on when to use this tool versus alternatives. The description implies it is for checking status but does not provide context like pre/post command use, exclusions, or prerequisites. This leaves the agent without clear selection criteria.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dos.list_targetsList DOS targetsARead-only
List configured and locally discovered DOS systems and selectors.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide readOnlyHint=true and openWorldHint=false, covering the safety profile. The description adds the nuance that the tool lists both configured and locally discovered systems, which is valuable contextual information beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that front-loads the verb and resource. There is no redundant or extraneous information, and every word contributes to understanding the tool's function.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple, parameterless list operation with an output schema and read-only annotations, the description is fully adequate. It specifies what is listed and leaves return format details to the output schema, which is present.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the baseline of 4 applies. The description does not need to explain parameter meanings, and the schema is empty, confirming no additional semantics are required.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('List') and the resource ('configured and locally discovered DOS systems and selectors'). It is specific and distinguishes itself from sibling tools which perform actions like upload, download, or capture.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The name and description make it evident this is the tool for listing DOS targets. There are no sibling tools that serve the same purpose, and while no explicit 'when to use' guidance is provided, the context is clear enough for an agent to select it for enumeration tasks.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dos.send_keysSend keys to DOS targetB
Inject text and named keys into the target's input queue.
| Name | Required | Description | Default |
|---|---|---|---|
| keys | No | Named keys such as ENTER, ESC, TAB, arrows, CTRL_C, or F1 through F12. | |
| text | No | UTF-8 text to enter before named keys; limited to 4096 bytes. | |
| target | No | ||
| settle_ms | No | How long to collect resulting terminal output. | |
| inter_key_delay_ms | No | Delay between text bytes and named keys. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already declare readOnlyHint=false, so the mutating nature is known, but the description adds minimal context beyond 'input queue.' It fails to disclose that the tool collects terminal output after injecting keys, which is implied by the settle_ms parameter in the schema but not mentioned in the description. This is a significant behavioral gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no filler. Every word is relevant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
While the schema is fairly rich, the description is too terse to provide context such as when to use the tool, what happens after injection, or how to set up the target. The existence of an output schema covers return values, but the description itself leaves gaps in operational context for a tool with five optional parameters.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema covers 80% of parameters with descriptions, so the baseline is 3. The description does not add any parameter-specific meaning; it only gestures at 'text and named keys,' which the schema already explains. It does not clarify the ambiguous 'target' parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'inject' and identifies the resource as 'the target's input queue,' clearly distinguishing it from sibling tools like capture_screen, upload_file, and get_capabilities. It adds the detail of 'text and named keys' which maps to the parameters. This is a clear, non-tautological statement of function.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description contains no guidance on when to use this tool versus alternatives, nor any prerequisites or exclusions. It does not mention that the target must be active or how to choose among multiple targets, leaving the agent to infer usage from the name and schema alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
dos.upload_fileUpload a file to DOSADestructive
Upload one bounded binary file when writes are enabled at both peers.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Path relative to the target's configured file sandbox. | |
| target | No | ||
| overwrite | No | Permit atomic replacement of an existing target file. | |
| content_base64 | Yes | Binary file content encoded as strict RFC 4648 base64. |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and readOnlyHint=false, so the safety profile is known. The description adds the prerequisite about peer write permissions and the bounded nature of the upload. It does not describe additional side effects (e.g., default no-overwrite behavior) but does not contradict annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence of 11 words, front-loaded with the verb and object, and every word adds value. No redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Although annotations and an output schema exist, the description leaves ambiguities: the meaning of 'bounded' (not explicitly linked to the schema's maxLength), the reference to 'peers,' the role of the 'target' parameter, and the default overwrite behavior. These gaps make the description incomplete for fully autonomous use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema provides descriptions for 3 of 4 parameters (path, overwrite, content_base64), covering the required ones. The tool description adds no parameter-specific meaning, and the optional 'target' parameter has no schema description nor is clarified in the tool description. With 75% schema coverage, baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action 'Upload one bounded binary file' with a specific resource and target (DOS), and adds scope constraints ('bounded', 'when writes are enabled at both peers'). It distinguishes from the sibling tool dos.download_file by the upload verb.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a clear usage condition: 'when writes are enabled at both peers.' This implies when to use the tool. However, it does not explicitly name alternatives or state when not to use it, but the context is clear and free of misleading directions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
8 tool updates
v0.1.0- First observed
dos.capture_graphics - First observed
dos.capture_screen - First observed
dos.download_file - First observed
dos.get_capabilities - First observed
dos.get_status - First observed
dos.list_targets - First observed
dos.send_keys - First observed
dos.upload_file
TDQS
Scored across 8 tools
Each tool targets a distinct operation: capabilities, file transfer, target discovery, status, screen capture (text vs graphics), and key injection. No overlapping purposes; the distinction between capture_screen and capture_graphics is clear.
All tool names follow a consistent verb_noun snake_case pattern (get_capabilities, upload_file, list_targets, get_status, capture_screen, capture_graphics, send_keys, download_file). No mixed styles or irregular verbs.
Eight tools is well-scoped for a DOS remote-control server, covering file transfer, input, output, discovery, and status without excess. Each tool earns its place in the set.
The tool surface covers core remote interaction: file up/download, screen capture, input, target discovery, and status. The only minor gap is a lack of explicit command execution beyond send_keys, but send_keys can handle that indirectly.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Remote MCP server for supportsheep: run AI interviews and manage support content for your blog.
MCP server to assist with JxBrowser development.
MCP Server for Slima - AI Writing IDE for Novel Authors with AI Beta Reader.
Read-only MCP server for the OPERANT AI operating-agent calibration benchmark.
Related MCP Servers
- AlicenseBqualityDmaintenanceLocal + remote terminal interaction control MCP Server. Lets AI agents control interactive TUI programs the way a human would.297MIT
- AlicenseAqualityDmaintenanceEnables LLM agents to capture screenshots, control mouse/keyboard, and manage windows on desktop platforms, primarily Windows, via an MCP server.161MIT
- AlicenseBqualityBmaintenanceExposes Anthropic's computer-use action surface (screenshot, click, move, keyboard, clipboard, batch) against a persistent desktop display via MCP stdio protocol. Enables AI agents to control a virtual desktop environment through natural language instructions.24MIT
- AlicenseNot gradedqualityCmaintenanceBridges AI agents to a DOSBox emulator, enabling control of DOS programs via MCP tools for typing, screen reading, video capture, Lua scripting, and memory access.2GPL 2.0