Skip to main content
Glama

Everything2MCP

语言 / Language: 中文 · English

万物都能 MCP — 本机能力、异构协议、协作套件 → 一个 MCP 表面(诚实标注 Implemented / Thin / leftover;Apache-2.0)。

Everything can become MCP — local caps, protocols, and chat suites → one MCP surface (honest maturity labels; Apache-2.0; not every adapter is production-ready).

License: Apache-2.0 Node ≥18.18 Release Demo Tests MCP Phase CI npm shcdwz1234/Everything2MCP MCP server Stars

Everything2MCP 把本机能力与南向协议收敛成 一个 MCP 表面,面向 Agent / IDE 用户与集成方。协议成熟度诚实标注 Implemented / Thin / leftover(见 docs/PROTOCOLS.md)——不声称全部生产就绪。许可:Apache-2.0。

English (above the fold)

Everything can become MCP — discover local & platform caps, bridge OpenAPI / gRPC / MQTT / queues, Safe/Full gates, Partner + Feishu/DingTalk/WeCom. One hot-reload MCP surface. Apache-2.0.

Demo: console → discover/OpenAPI → tool call

Social / OG card

Flow: console → discover / enable (OpenAPI & Partner) → Agent tools/call. Full walkthrough: docs/DEMO.md. Release: v0.1.0. 中文见下方.

Install (npm / npx)

Package name: everything2mcp (bin: everything2mcp). Node ≥ 18.18. Native deps (better-sqlite3) need a working C/C++ toolchain on first install.

# Live on npm (everything2mcp@0.1.0):
npx everything2mcp
# or
npm install -g everything2mcp && everything2mcp

# From this repo (dev / contribute):
git clone https://github.com/shcdwz1234/Everything2MCP.git
cd Everything2MCP
npm ci && npm run build
npm start                                 # stdio MCP (Cursor / Claude Desktop)
EVERYTHING2MCP_TRANSPORT=http npm start   # console at http://127.0.0.1:8742/ui/

Published tarball ships prebuilt dist/ (see files + prepare in package.json). Git installs run prepare to build when dist/ is missing. everything2mcp@0.1.0 is on npm — https://www.npmjs.com/package/everything2mcp (npx everything2mcp / npm i -g everything2mcp).


Related MCP server: linkedmcp

中文

定位:万物都能 MCP

目标不是「又一个 MCP demo」,而是:凡是 Agent 够得着的东西,都尽量能变成 MCP tools——本机 OS / Docker / 文件系统、私网服务、OpenAPI / gRPC / MQTT / 队列 / 工业总线、飞书·钉钉·企微 Partner 入口……统一热注册到同一 MCP server。

诚实边界:Implemented / Thin / leftover(见 docs/PROTOCOLS.md)。Thin = 可用但收窄。不声称全部生产就绪。 许可:Apache-2.0。

为什么关心

Agent 不该为 REST、MQTT、飞书、本机 Docker、对象存储各接一套客户端。Everything2MCP 把它们收成 一个 MCP server:

痛点

Everything2MCP 怎么解

协议碎片化

OpenAPI / gRPC / MQTT / 队列 / 工业总线 / SQL / 对象存储… 热注册成 MCP tools

本机能力被闲置

自动发现私网与平台能力(os_info、Docker、文件系统等),候选只读、默认不自动启用

安全焦虑

默认 Safe、allowWrite=false;黑名单 Full 也开;Agent 永不扫 CIDR

厂商不愿写 MCP

Partner 清单 + HTTP invoke;飞书 / 钉钉 / 企微等 native 适配器;mcp_bridge 仅兜底

远程运维

默认绑 127.0.0.1;HTTP token;Tailscale / 内网友好(设 token 后可安全暴露)

三步心智模型:mcp_add / 发现启用 → 适配器映射 tools → Agent 普通 tools/call。无需重启(热注册)。

面向谁

  • Agent / IDE 用户(Cursor、Claude Desktop…)——要一个稳定 MCP 入口,而不是 N 个协议客户端

  • 平台与集成开发者——用 Partner SDK 把应用挂进来,零 MCP 代码(见 examples/partner-demo-chat/)

  • 安全敏感的自托管场景——Safe/Full、黑名单、审计、HMAC 完整性、限流

  • 中国协作栈——飞书 / 钉钉 / 企微 native 路径(模拟器 + allowWrite 闸;细节见协议目录)

你得到什么

  1. 一个 MCP(stdio 默认;可选 Streamable HTTP /mcp + 遗留 SSE)

  2. 自动发现 —— 控制台私网扫描 + Agent 单主机探测;本机/平台能力可热加载

  3. Safe / Full 政策 —— 默认只读数据面;Full ≠ 关掉黑名单

  4. 同进程控制台 —— /ui/ 深色 UX:能力 / 活动 / 设置;向导含「测试连接」

  5. Partner 入口 —— 南向应用不写 MCP;ingress 徽章:partner / native / mcp_bridge

  6. 诚实协议表 —— Implemented(真实客户端 + 测试)vs Thin(可用但收窄)vs leftover

配置面优势(诚实版): 自动扫描本机 / 私网 / 平台能力,热加载进同一个 MCP 表面——不必为每个功能手写一份 MCP tools 配置。三方对接走 Partner(清单 + HTTP invoke)或 native 适配:对方按协议挂载即可,不必各自实现 / 维护一整套 MCP server;管理台可动态启停。仍可能要在控制台启用候选、设 token / Safe·Full / allowWrite / 发现范围;Agent 侧只需配置这一个 Everything2MCP 入口(stdio 或 HTTP)。

Screenshots

实机控制台截图(Edge headless → http://127.0.0.1:8742/ui/)。本地先 EVERYTHING2MCP_TRANSPORT=http npm start。

View

Preview

Capabilities(当前适配器 / tools)

Capabilities

Discovery / candidates

Discovery candidates

Settings(自动发现)

Settings

Security(Safe / Full)

Security

Partner

Partner

3 分钟上手: docs/DEMO.md

安装(npm / npx)

包名:everything2mcp(bin 同名)。Node ≥ 18.18。首次安装原生依赖(better-sqlite3)需要本机 C/C++ 工具链。

# 已上 npm(everything2mcp@0.1.0):
npx everything2mcp
# 或
npm install -g everything2mcp && everything2mcp

# 从本仓库构建(开发 / 贡献):
git clone https://github.com/shcdwz1234/Everything2MCP.git
cd Everything2MCP
npm ci && npm run build
npm start
EVERYTHING2MCP_TRANSPORT=http npm start   # 控制台 http://127.0.0.1:8742/ui/

发布物含预构建 dist/;从 git 安装时若无 dist/ 会走 prepare 自动 build。everything2mcp@0.1.0 已发布到 npm — https://www.npmjs.com/package/everything2mcp(`npx everything2mcp/npm i -g everything2mcp`)。Release:v0.1.0 · Demo:docs/DEMO.md。

快速开始

克隆本仓库后:

git clone https://github.com/shcdwz1234/Everything2MCP.git everything2mcp
cd everything2mcp
npm ci          # 或 npm install
npm run build
npm test        # 应全绿

Node ≥ 18.18。默认 stdio MCP(给 Cursor / Claude Desktop;不要当终端 REPL 用):

npm start

控制台 + Streamable HTTP + 遗留 SSE(看 UI 用这条):先 npm run build,再

EVERYTHING2MCP_TRANSPORT=http EVERYTHING2MCP_HTTP_PORT=8742 npm start
# 控制台:         http://127.0.0.1:8742/ui/
# Streamable HTTP: http://127.0.0.1:8742/mcp
# SSE:             http://127.0.0.1:8742/sse  (POST /messages?sessionId=…)
# REST:            http://127.0.0.1:8742/api/health
# 探活(无 token): http://127.0.0.1:8742/health

Windows PowerShell(连接符用 ;,不用 &&):

$env:EVERYTHING2MCP_TRANSPORT = "http"
$env:EVERYTHING2MCP_HTTP_PORT = "8742"
npm start

鉴权:设置 EVERYTHING2MCP_HTTP_TOKEN(离开本机回环前必须设置),客户端带 Authorization: Bearer <token> 或 x-api-key。未设置时仅适合受信回环。Tailscale / 内网曝露前必须设 token(默认绑 127.0.0.1,友好配合内网)。EVERYTHING2MCP_TRANSPORT=sse 与 http 绑定同一监听器。

同进程控制台在 /ui/,REST 在 /api/*,复用 management tools。详见 docs/CONSOLE.md。顶栏可粘贴同一 HTTP token。一级页:能力(当前能力 / 可支持能力 / 黑名单 三 tab,摘要条计数与 tab 对应)、活动、设置(自动发现、安全模式);Tools / Discovery / Import / 矩阵 / 审计 / 计划桥 / 安全 / 热加载 / 伙伴 收进侧栏「高级」。添加能力走按协议 configSchema 生成的向导,先测试连接再保存。写操作需二次确认且仍受 allowWrite。私网自动发现默认开启(自动 / 手动 / 关闭),规则见 docs/DISCOVERY.md。南向 ingress 徽章:partner / native / mcp_bridge(兜底)。

开发模式:npm run dev(tsx watch,仍默认 stdio)。

环境变量:

变量

默认

含义

EVERYTHING2MCP_DATA_DIR

data

注册持久化目录(JSON)

EVERYTHING2MCP_DISCOVERY_ENABLED

true

是否暴露 discovery_probe;false 同时关闭自动发现

EVERYTHING2MCP_DISCOVERY_MODE

auto

控制台自动发现:auto / manual / off(node --test 下默认 off)

EVERYTHING2MCP_DISCOVERY_INTERVAL_MIN

30

自动模式间隔(5–1440 分钟)

EVERYTHING2MCP_DISCOVERY_SCOPES

—

额外私网范围(主机 / 域名 / CIDR ≤ /16),逗号分隔

EVERYTHING2MCP_DISCOVERY_EXCLUDE

—

自动发现排除列表

EVERYTHING2MCP_DISCOVERY_ALLOW_SCAN

忽略

死变量。不能让 Agent 工具接受 CIDR;设置了会打日志并强制 allowScan=false

EVERYTHING2MCP_DISCOVERY_TIMEOUT_MS

2500

单次探测超时

EVERYTHING2MCP_TRANSPORT

stdio

stdio(默认)/ http / sse

EVERYTHING2MCP_HTTP_HOST

127.0.0.1

HTTP/SSE 绑定地址

EVERYTHING2MCP_HTTP_PORT

8742

HTTP/SSE 端口(避免 3000/5173/8080)

EVERYTHING2MCP_HTTP_PATH

/mcp

Streamable HTTP 路径

EVERYTHING2MCP_SSE_PATH

/sse

遗留 SSE GET 路径

EVERYTHING2MCP_SSE_MESSAGES_PATH

/messages

遗留 SSE POST 路径

EVERYTHING2MCP_HTTP_TOKEN

(空)

共享密钥;离开回环前必填;空则不鉴权(仅适合本机)

EVERYTHING2MCP_HTTP_TOKEN_HEADER

(空)

额外 token header(仍接受 Authorization / x-api-key)

EVERYTHING2MCP_INTEGRITY_KEY

(空)

可选 HMAC 密钥;也可放 dataDir/.integrity-key。空则只用 SHA-256

EVERYTHING2MCP_RATE_LIMIT_INVOKE

60

Safe 下每分钟业务 invoke 上限;0 = 不限。Full 跳过

EVERYTHING2MCP_RATE_LIMIT_DISCOVER

20

Safe 下每分钟 discover 上限;0 = 不限。Full 跳过

Docker

默认绑定安全:compose 只把宿主机 127.0.0.1:8742 映射进容器。容器内监听 0.0.0.0:8742(容器网络需要)。对外网卡暴露时必须设置 token。

# 建议先生成 token
export EVERYTHING2MCP_HTTP_TOKEN="$(openssl rand -hex 24)"   # Windows: 用安全随机串

docker compose up --build
# UI:  http://127.0.0.1:8742/ui/
# MCP: http://127.0.0.1:8742/mcp   (Authorization: Bearer $EVERYTHING2MCP_HTTP_TOKEN)

或直接:

docker build -t everything2mcp .
docker run --rm -p 127.0.0.1:8742:8742 \
  -e EVERYTHING2MCP_HTTP_TOKEN=replace-me \
  -v e2m-data:/data \
  everything2mcp

详见 Dockerfile、docker-compose.yml。数据目录挂到 /data(对应 EVERYTHING2MCP_DATA_DIR);不要把含 token 的宿主机 data/ 提交进 git。

架构(单进程五包)

transport  →  control  →  catalog
control    →  discovery
catalog    →  runtime/bootstrap  →  adapters

包

职责

Transport

stdio(默认)+ Streamable HTTP /mcp + SSE /sse + 同进程 /ui /api;无业务逻辑

Control Plane

mcp_* 管理工具、政策网关(Safe/Full)、黑名单、REST

Catalog / Registry

热注册表、data/registrations.json、校验、list_changed

Discovery & Import

单主机探测、discovery_suggest、schema_import

Adapter Runtime

SPI + 扁平 src/adapters/<protocol>/;v1 只有 builtins

硬约束:adapters 不得 import control/transport;无 src/core / src/management shim。逻辑平面(Environment / Platform / Capability Lifecycle / Policy)叠在五包上,不是新目录。详见 docs/ARCHITECTURE.md。

热加载 / 热卸载(Phase V 引入,Phase W 补齐热卸载)

Boot 不会把 os_info / docker / 本机盘点结果写进 catalog。增长与收缩走同一条 Policy Gateway 管道:

  1. 控制台「高级 → 热加载」#/hotload(原 #/capabilities;日常添加用「能力 → + 添加」向导):环境盘点或手动 config → 建议列表 → 确认热加载(Safe+只读可勾 auto)。已挂能力可 热卸载(二次确认;不要求 allowWrite)。

  2. Agent:environment_inventory → capability_register(auto:true 仅 Safe + allowWrite/allowShell/allowDesktop/allowReadSecrets 非 true + 非黑名单)

  3. Agent / 控制台:capability_unregister { id }(与 mcp_remove 同一 Catalog.remove;黑名单不拦卸载,但拦再注册)

capability_register / mcp_add / mcp_add_from_discovery / POST /api/adapters 走同一 add()。capability_unregister / mcp_remove / POST /api/capabilities/unregister(confirm:true)/ DELETE /api/capabilities/:id?confirm=true 走同一 remove()。卸载后 tools 立刻从 Catalog 与 MCP tools/list 消失,无需重启。建议列表 从不批量自动注册。

新管理工具:environment_inventory、capability_register、capability_unregister、capability_configure、partner_list、compat_scan。

Partner / Compat(Phase X)

北向 = MCP only。南向优先级见 docs/PARTNER.md 与 docs/COMPAT.md:

  1. Partner 协议(应用不写 MCP)。清单 + HTTP invoke。Demo:examples/partner-demo-chat/(零 MCP 代码)。

  2. Native 适配器:feishu / dingtalk / wecom / slack / notion / github(模拟器 + allowWrite 闸)。

  3. mcp_bridge 兜底导入本地 mcpServers JSON(live spawn = E_UNSUPPORTED)。

Drops:~/.everything2mcp/drops/*.json(Windows %LOCALAPPDATA%\everything2mcp\drops)。扫描成功 ≠ 打开写/桌面/密钥。个人微信私聊 不宣称 Partner 兼容。

安全(已锁定,不再重开)

  • 默认 Safe。数据面默认 allowWrite=false。Full ≠ 全局可写(适配器 assertCanWrite 仍闸)。

  • 黑名单 ALWAYS on,包括 Full(bypassInFullControl=false)。粒度:目标 / 能力实例 / 工具 glob(docs/BLACKLIST.md)。

  • Agent 工具只扫单主机;EVERYTHING2MCP_DISCOVERY_ALLOW_SCAN 死变量。控制台自动发现只扫私网(网卡 ≤ /24、手动 ≤ /16、每轮上限),永不扫 link-local / 云 metadata;候选只读、默认不自动启用(L5 修订,见 docs/SECURITY_ARCHITECTURE.md)。transport 合同不变;无 shim。

  • Actor-bound audience(Phase M): Agent 不能伪造 audience=console 看见已拉黑 tools。控制台 REST 写入 actor.kind=console。

  • 政策网关、HMAC 完整性(security.json / blacklist.json / registrations.json)、audit.jsonl、限流、密钥脱敏。

  • Plugin SPI:v1 只加载 builtins;inject/replace 钩子留给日后;非 builtin → E_UNSUPPORTED。不做 v2 本地 JS / v3 npm、不做 Agent 写 challenge。

详见 docs/SECURITY_ARCHITECTURE.md、docs/BLACKLIST.md。

接入 Cursor / Claude Desktop

MCP 使用 stdio。把 args 换成本机仓库里 dist/index.js 的绝对路径(或相对路径,见 examples/cursor-mcp.json):

{
  "mcpServers": {
    "everything2mcp": {
      "command": "node",
      "args": ["/absolute/path/to/everything2mcp/dist/index.js"]
    }
  }
}

相对路径示例见 examples/cursor-mcp.json(需在仓库根、且已 npm run build)。远程 / Streamable HTTP(需先 EVERYTHING2MCP_TRANSPORT=http npm start):

{
  "mcpServers": {
    "everything2mcp": {
      "url": "http://127.0.0.1:8742/mcp",
      "headers": { "Authorization": "Bearer replace-me" }
    }
  }
}

启动后,Agent 应能看到管理工具:mcp_list、mcp_add、mcp_update、mcp_remove、mcp_query_by_protocol、mcp_health、mcp_explain_tool、mcp_plan_bridge、mcp_add_from_discovery、schema_import、discovery_suggest、environment_inventory、capability_register / capability_unregister / capability_configure、partner_list、compat_scan,以及可选的 discovery_probe / discovery_scan_host。黑名单管理工具 mcp_blacklist_* 给操作员用,默认不要当业务层。

Agent 自主使用

目标:让 Agent 自己找协议、自己注册、自己调用,而不是等人手写 mcp_add。

推荐顺序:

  1. mcp_plan_bridge — 用自然语言描述目标(「把 10.0.0.8 上的 REST 和 MQTT 接进来」)。返回推荐协议、示例 config、下一步该调哪些 MCP 工具。

  2. discovery_scan_host — 只扫 一个 hostname/IP。并行探测 OpenAPI/WSDL/GraphQL、gRPC reflection、常见消息/工业/数据端口,以及 Phase N–U 指纹(FTP/SNMP/etcd/WebDAV、IMAP/POP3/Consul、SFTP/Memcached/TFTP、CalDAV/ZK、Cassandra/CouchDB/Whois、Solr 8983 / RabbitMQ management 15672 / Kubernetes 6443 等)。完整表见 docs/DISCOVERY.md。默认拒绝 CIDR/网段,并拦截云 metadata IP(SSRF)。

  3. discovery_suggest 或直接用 scan 返回的 suggestions。

  4. mcp_add_from_discovery — 把 suggestion 一键变成热注册 tools。

  5. 若已有 spec 文件/URL:schema_import(OpenAPI / WSDL / proto / GraphQL SDL / AsyncAPI)。

  6. mcp_health / mcp_explain_tool — 确认适配器是否 live、某个 openapi.foo.bar 怎么调。空注册表时 health 会给出 golden-path hints。

黄金路径有专用回归:tests/p5-golden-path.test.ts。

无 proto 的 gRPC:

{ "protocol": "grpc", "name": "edge", "config": { "target": "127.0.0.1:50051", "reflection": true } }

AsyncAPI / Sparkplug 示例见 examples/streetlights.asyncapi.json、examples/sparkplug-node.json。

不会做的事: 让 Agent 扫网段、扫 1–65535 全端口、探测云 metadata、NFS 完整客户端。(私网范围与有界 mDNS/SSDP 组播只在控制台自动发现里做。)详见 docs/DISCOVERY.md、docs/ROADMAP.md。

管理工具

Tool

参数

作用

mcp_list

verbose?, layer?

按层列出:默认 business;management / all

mcp_add

protocol, name, config

连接适配器并注册其 tools

mcp_update

id, config

合并配置并重连

mcp_remove

id

断开并卸载 tools

mcp_query_by_protocol

protocol

按协议过滤

mcp_health

verbose?

进程 + 适配器健康

mcp_explain_tool

name

解释某个 MCP tool 属于哪个适配器

mcp_plan_bridge

goal, host?

自然语言目标 → 推荐协议与下一步

mcp_add_from_discovery

suggestion

按探测草案注册

schema_import

source, kind?, register?

导入 spec 并可选注册

discovery_probe

host, port?

单端口 OpenAPI/SOAP/GraphQL 路径

discovery_scan_host

host, port?

单主机多协议并行探测

discovery_suggest

host 或 candidates

探测结果 → mcp_add 草案

environment_inventory

(无)

本机盘点 → suggest(不注册)

capability_register

suggestion 或 protocol/name/config,auto? confirm?

热加载(与 mcp_add 同一闸)

capability_unregister

id

热卸载(控制面,不要求 allowWrite;缺 id → E_NOT_FOUND)

capability_configure

id, config

热重配

注册 id 形如 openapi:widgets。业务 tools 命名:{protocol}.{name}.{operationId}。

tools/list 里每条 tool 带 _meta.layer:management(mcp_* / discovery_* / environment_inventory / capability_* / schema_import)或 business。Agent 应优先 mcp_list { "layer": "business" },避免管理工具把上下文撑满。annotations.title 也有 Management · / Business · 前缀。

添加 OpenAPI 示例

对 MCP 客户端调用 mcp_add:

{
  "protocol": "openapi",
  "name": "widgets",
  "config": {
    "spec": "./examples/petstore.openapi.json",
    "baseUrl": "https://your-api.example/v1",
    "auth": { "type": "bearer", "token": "replace-me" }
  }
}

成功后会出现 openapi.widgets.listWidgets、openapi.widgets.getWidget 等 tools。完整配置见 examples/。

MQTT

{
  "protocol": "mqtt",
  "name": "local",
  "config": {
    "url": "mqtt://127.0.0.1:1883",
    "topics": ["sensors/#"]
  }
}

暴露 mqtt.local.publish、mqtt.local.subscribe_once、mqtt.local.list_topics。

SOAP / WSDL

{
  "protocol": "soap",
  "name": "calculator",
  "config": {
    "wsdl": "./examples/calculator.wsdl",
    "endpoint": "http://127.0.0.1:8080/calculator"
  }
}

限制(刻意保持薄实现): 按 WSDL 列出 operation,调用时把参数包进 SOAP 1.1 envelope 做 HTTP POST。不解析复杂 XML Schema、WS-Security、MTOM。详见 docs/PROTOCOLS.md。

gRPC

{
  "protocol": "grpc",
  "name": "greeter",
  "config": {
    "proto": "./examples/greeter.proto",
    "target": "127.0.0.1:50051",
    "tls": false
  }
}

暴露 unary / server-stream / client-stream / one-shot bidi 以及 session bidi(bidi_open / bidi_send / bidi_recv / bidi_close)。unary invoke:{ "body": { "name": "Ada" } }。one-shot bidi:{ "messages": [{ "name": "Ada" }], "maxMessages": 8 }。session:bidi_open { "method": "Greeter_Chat" } 后按 streamId send/recv/close;未读满 maxMessages 会 pause。只读动词 RPC 默认放行;Chat/SayHello 等写侧需 allowWrite: true。可选 ca/cert/key PEM。也可用 protoInline。

WebSocket

{
  "protocol": "websocket",
  "name": "echo",
  "config": {
    "url": "ws://127.0.0.1:8080/echo",
    "protocols": [],
    "headers": {}
  }
}

别名 ws。暴露 websocket.echo.send、websocket.echo.receive_once。无自动重连。

GraphQL

{
  "protocol": "graphql",
  "name": "api",
  "config": { "url": "http://127.0.0.1:4000/graphql", "introspect": true }
}

graphql.api.query / mutate / introspect / subscribe_once。Introspection 成功时还有 Query_*、Mutation_*。subscribe_once 需 wsUrl(graphql-ws)或 simulator:true。

AMQP / Kafka / RabbitMQ management

{ "protocol": "amqp", "name": "rabbit", "config": { "url": "amqp://127.0.0.1", "queue": "jobs" } }
{ "protocol": "kafka", "name": "events", "config": { "brokers": ["127.0.0.1:9092"], "topic": "orders" } }
{ "protocol": "rabbitmq", "name": "mgmt", "config": { "url": "http://127.0.0.1:15672", "allowWrite": false } }

AMQP:publish、consume_once / get / ack、list_queues(线协议 5672)。Kafka:produce、consume_once、list_topics、group_status(one-shot;无事务/EOS;idempotent 只是 KafkaJS producer 标志)。rabbitmq 是 management HTTP :15672,不是 AMQP。

薄适配器(工业 / 消息 / 数据 / 平台)

状态分两档(完整合同见 docs/PROTOCOLS.md):

  • Implemented — 真实客户端路径 + hermetic 测试;可连 live 目标(仍受 allowWrite / Safe 闸)

  • Thin — 已注册且 listTools/invoke 可用,但能力故意收窄(模拟器、编码器、或有限 HTTP/线协议子集);不是「未实现」

下表为摘要;以 docs/PROTOCOLS.md 为准。

protocol

配置要点

tools

限制

opcua

endpoint, nodes, simulator?

read write browse subscribe_once wait_data_change

默认内存地址空间;subscribe_once 一次性;wait_data_change 为内存 monitored-item

coap

host, port

CRUD + observe_once/observe_cancel

无 DTLS

nats

servers / simulator?

core + js_publish/js_next/js_ack

JetStream consumer/ack/interest 子集

fix

sender, target, allowWrite?

logon/heartbeat/logout + encode/decode/status + NOS

会话 logon/logout/NOS 需 allowWrite;内存 loopback

asyncapi

spec, brokerUrl?

list_channels publish subscribe_once

MQTT/WS/Kafka bind 或 dry-run

sparkplug

url, groupId, edgeNode, hostId?, encoding?

encode/decode/parse + nbirth/ndeath/publish + host_state

官方 protobuf;Host STATE 只读 stub + Host MVP

sqs

queue, endpoint?, allowWrite?

list_queues send receive delete

内存 / unsigned JSON HTTP;无 SigV4;写入需 allowWrite

ldap

url, base, tls?, allowWrite?

bind/sasl_bind/search/compare + add/modify/delete

写入需 allowWrite;SASL PLAIN only;无 GSSAPI

bacnet

host, port?, udp?, allowWrite?

who_is i_am read_property list_objects write_property

unicast Who-Is;写入需 allowWrite

ethernetip / enip

host?, tcp?, allowWrite?

list_identities list_tags read_tag write_tag

CIP List Identity;本地 tags;无 Forward Open

s7

host?, rack?, slot?, tcp?, allowWrite?

read list_areas write

ISO-TCP + Read Var 子集;默认只读

mtconnect

url / fixture / xml

probe current sample

HTTP Agent 拉;无 Assets

sql / sqlite / postgres / mysql

driver+filename/url,native?

query execute list_tables describe

CI mock / node:sqlite;native:true 可选 pg/mysql2/better-sqlite3

mongodb

simulator:true 或 url

list_collections find insert_one

无 url 内存;url 走 OP_MSG 子集;无 aggregation

elasticsearch / opensearch

url / simulator

list_indices search index_doc

HTTP _cat/_search/_doc;OpenSearch 同路径别名

clickhouse

url / simulator

query execute

HTTP POST + FORMAT JSONEachRow;INSERT/DDL 需 allowWrite

neo4j

url / simulator

cypher

HTTP /db/{db}/tx/commit;Bolt 仍 E_UNSUPPORTED

sftp

host, user?, password?

list get put delete

ssh2 SSH-2;不是 FTP;写需 allowWrite

memcached

host?, port?

get set delete stats

文本协议;写需 allowWrite

tftp

host?, port?

get put

RFC1350 RRQ/WRQ;不是 FTP

caldav

url?

propfind report freebusy get put

time-range + freebusy;iTIP E_UNSUPPORTED;写需 allowWrite

carddav

url?

propfind report get put

addressbook-query 子集;写需 allowWrite

beanstalkd

host?, port?

stats put reserve delete

文本协议;写需 allowWrite

zookeeper

host?, port?

ruok get create watch_once multi

一次性 watch + MULTI;ACL/SASL E_UNSUPPORTED

redis

url, allowWrite?

kv + hash/list/stream + pub/sub

写入需 allowWrite

s3 / gcs / oss

bucket

list get put

内存 / 签名子集(S3 SigV4、GCS Bearer、OSS HMAC)

dns

host? / simulator?

query

单播 A/AAAA/TXT/PTR;无 AXFR / 无组播

cassandra

host? / simulator?

list_keyspaces cql

native v4 STARTUP/QUERY;写闸

couchdb

url? / simulator?

all_docs get put

HTTP;写需 allowWrite

whois

host? / simulator?

query

TCP 43 只读

solr

url? / simulator?

list_cores select update

HTTP;写需 allowWrite

rabbitmq

url? / simulator?

list_queues publish get

management HTTP;不是 AMQP

kubernetes / k8s

url? / simulator?

list/get pods/services/configmaps

只读;exec/apply 恒 E_UNSUPPORTED

os_info

(空)

uname

本机 OS;热加载,不在 boot 挂载

platform_fs

roots?

list read roots

闸根目录;不可 allowWrite

platform_process

allowShell?

process_list shell_exec

Linux /proc;Win/mac 注入或 gap;shell_exec 闸+stub

platform_service

allowShell?

service_list

systemd/sc/launchctl;缺工具 E_UNSUPPORTED

docker

url? / simulator?

list/inspect

Engine HTTP 只读;run 恒 stub

journal

path? / simulator?

read

syslog 文件;wevtutil/journalctl stub

prometheus

url / simulator?

query query_range remote_write

protobuf+snappy 写需 allowWrite;内存 query 按名

influx / influxdb

bucket, url?

write_points delete_points query

Flux + /api/v2/delete;写/删需 allowWrite

snmp / ftp / webdav / etcd

见 PROTOCOLS

get/walk;list/retr;propfind;range/put

SNMP 无 v3;FTP 不是 SFTP

imap / pop3

host

list/select/fetch;stat/retr

写闸;不是 SMTP 发信

consul / azureblob

url

kv/catalog;list/get

Azure SharedKey 子集 / SAS

新增协议示例(XML-RPC / JSON-RPC / FIX / Redis / SMTP / LDAP)

{ "protocol": "xmlrpc", "name": "blog", "config": { "url": "http://127.0.0.1:8080/RPC2", "introspect": true } }
{ "protocol": "jsonrpc", "name": "api", "config": { "url": "http://127.0.0.1:8545" } }
{ "protocol": "fix", "name": "desk", "config": { "sender": "BUY", "target": "EXCH" } }
{ "protocol": "redis", "name": "cache", "config": { "url": "redis://127.0.0.1:6379" } }
{ "protocol": "smtp", "name": "mail", "config": { "host": "127.0.0.1", "port": 587, "from": "bot@example.com", "starttls": true } }
{ "protocol": "ldap", "name": "dir", "config": { "url": "ldap://127.0.0.1:389", "base": "dc=example,dc=com" } }
  • XML-RPC:list_methods / call,可 introspect 成 rpc_*

  • JSON-RPC 2.0:call / notify / batch(HTTP,可选 WebSocket)

  • FIX:内存 transport 上 logon/heartbeat/logout + seq(不是交易所)。logon/logout/NOS 当写;encode/decode/session_status 只读

  • Redis:GET/SET/DEL/KEYS/PUBLISH/SUBSCRIBE_ONCE + hash/list/stream

  • SMTP:send_mail(需 allowWrite)+ noop;raw:true EHLO/MAIL/DATA;STARTTLS 未广告 → E_UNSUPPORTED;不是 IMAP/POP3

  • LDAP:bind / sasl_bind PLAIN / search / compare;add/modify/delete 需 allowWrite;tls / starttls;无 GSSAPI

  • 数据面:优先 sqlite / postgres / mysql / mongodb / qdrant 等具体 id。泛化 sql 只是 driver 门面。

完整合同见 docs/PROTOCOLS.md。示例配置见 examples/(含 solr-local.json、rabbitmq-local.json、kubernetes-local.json)。

认证占位

config.auth:

{ "type": "none" }
{ "type": "bearer", "token": "..." }
{ "type": "apiKey", "apiKey": "...", "headerName": "X-API-Key" }
{ "type": "basic", "username": "...", "password": "..." }

MVP 不包含 OAuth、密钥托管或多租户。

发现

discovery_scan_host 只探测单个 host。网段 / CIDR / 通配符直接拒绝,并拦截 metadata IP。控制台自动发现(自动 / 手动 / 关闭)在私网范围内逐主机调用同一探测,结果进「能力 → 可支持能力」;link-local 与云 metadata 永不扫描,组播有界且只收私网应答者。设计见 docs/DISCOVERY.md。

仓库结构

src/transport/     stdio(默认)+ Streamable HTTP `/mcp` + SSE `/sse`;无业务逻辑
src/control/       mcp_* 管理工具、policy、security plane、console REST
src/catalog/       热注册表、JSON 持久化、校验、blacklist、list_changed
src/discovery/     单主机探测;suggest/import 已挂成 MCP 工具
src/runtime/       内核:types/errors/auth/load/log/invoke
src/adapters/      SPI + 扁平协议实现 + 可选 pack 分组
examples/          配置与 OpenAPI/WSDL/proto 夹具
tests/             注册表 + 各适配器 + MCP 语义(~140 suites)
docs/              架构 / ADR / 协议目录 / 发现 / 安全 / 发布说明
ui/                同进程控制台源;构建进 dist/ui

依赖:transport → control → catalog;control → discovery;适配器经 runtime/bootstrap 注册;adapters 不得 import control/transport。详见 docs/ARCHITECTURE.md。

文档

索引(中英):docs/README.md。

发版与基线见 docs/RELEASE_NOTES.md。贡献见 CONTRIBUTING.md;安全报告见 SECURITY.md。

开发脚本

脚本

作用

npm run build

tsc → dist/,并 ui:build 到 dist/ui

npm run ui:build

控制台 SPA → dist/ui

npm start

运行 MCP server(默认 stdio;见 EVERYTHING2MCP_TRANSPORT)

npm test

tsx --test(当前基线 115 / 494)

npm run dev

tsx watch

有意不做 / 环境挡住(不是漏写)

  • Kafka 真 EOS / cooperative rebalance(需集群;hermetic 状态机 ≠ 线上事务)

  • SQL CI 真 Postgres/MySQL Docker 镜像(本环境无 Docker;native:true 可选动态驱动)

  • LDAP GSSAPI

  • v2 本地 JS / v3 npm 外部安全插件加载

  • MCP Agent 写 challenge(只有控制台 confirm:true)

  • NFS 完整客户端 / SHOWMOUNT(已有 NFSv3 NULL ping + simulator exports)

  • Agent 侧 mDNS 组播浏览(单播 host:5353 已有;控制台自动发现有有界组播)

  • 部署时批量注册能力 / 默认打开桌面控制

  • allowShell / allowDesktop 真执行(只有闸与 stub;扫描从不打开)

  • SMB/CIFS 完整 TREE_CONNECT 文件客户端(已有 SMB2 NEGOTIATE + simulator)

English

Positioning: Everything can become MCP

Everything2MCP’s goal is Everything can become MCP — turn local capabilities, private-network services, heterogeneous wire protocols, and collaboration suites into one hot-reloadable MCP surface for agents.

Honesty: protocols are labeled Implemented vs Thin vs leftover in docs/PROTOCOLS.md. Thin means usable but intentionally narrow (simulator, encoder, or limited ops). We do not claim every adapter is production-ready.

One-liner

Everything can become MCP — discover local & platform caps, bridge OpenAPI / gRPC / MQTT / queues, Safe/Full gates, Partner + Feishu/DingTalk/WeCom. One hot-reload MCP surface. Apache-2.0.

Why it exists

Agents should not maintain a separate client for every REST API, queue, industrial bus, or chat suite. Everything2MCP is a single-process MCP server that:

  • Discovers private-network endpoints and local/platform capabilities (console auto / manual / off; agent tools scan one host only)

  • Registers them as hot-reloadable MCP tools (shared Policy Gateway for add/remove)

  • Gates invokes with Safe vs Full, always-on blacklist, default allowWrite=false

  • Exposes a same-process dark console at /ui/ plus Streamable HTTP /mcp (and legacy SSE)

  • Prefers Partner protocol and native OpenAPI adapters (Feishu / DingTalk / WeCom / Slack / Notion / GitHub); mcp_bridge is an explicit last resort

Config-surface win (honest): Auto-scan local / private-network / platform capabilities and hot-load them onto one MCP surface—no hand-written per-capability MCP tools JSON. Third parties mount via Partner (manifest + HTTP invoke) or native adapters without each shipping a full MCP server; the console can enable/disable dynamically. You may still enable candidates, set token / Safe·Full / allowWrite / discovery scopes; the Agent client configures only this Everything2MCP entry (stdio or HTTP).

Who it is for

MCP client users (Cursor / Claude Desktop), integrators who refuse to rewrite apps as MCP servers, self-hosters who want Safe defaults and Tailscale-friendly loopback-first HTTP, and teams on Feishu / DingTalk / WeCom.

Quick start

See Install (npm / npx) above. From a clone:

npm ci && npm run build && npm test
EVERYTHING2MCP_TRANSPORT=http EVERYTHING2MCP_HTTP_PORT=8742 npm start
# Console: http://127.0.0.1:8742/ui/
# MCP:     http://127.0.0.1:8742/mcp

Release: v0.1.0 · Demo: docs/DEMO.md · OG card: docs/images/og.png

PowerShell (; not &&):

npm ci; npm run build; npm test
$env:EVERYTHING2MCP_TRANSPORT = "http"; $env:EVERYTHING2MCP_HTTP_PORT = "8742"; npm start

Set EVERYTHING2MCP_HTTP_TOKEN whenever HTTP is reachable beyond trusted loopback (including Tailscale). Default bind is 127.0.0.1.

Walkthrough + screenshots: docs/DEMO.md. Architecture: docs/ARCHITECTURE.md. Security (locked): docs/SECURITY_ARCHITECTURE.md. Contributing: CONTRIBUTING.md. License: Apache-2.0.

Public status: test baseline ~147 suites / 599 tests; see docs/RELEASE_NOTES.md for the latest snapshot. Southbound protocols are not MCP by default.

Docs language layout

Index: docs/README.md.

  • Root docs (README.md, CONTRIBUTING.md, SECURITY.md, CODE_OF_CONDUCT.md, docs/DEMO.md): CN then EN sections in the same file.

  • Longer docs under docs/: CN-primary body with an English summary block at the top (or CN/EN section headers). Paired *.zh-CN.md / *.en.md only when a doc grows too large to keep dual in one file.

Available Tools

22 tools
capability_configureC

Reconfigure a live capability (same path as mcp_update). Does not silently enable writes.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYes
configYes

TDQS

C2.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already disclose readOnlyHint=false and openWorldHint=true, so the mutating/open nature is covered. The description adds one genuinely useful guarantee beyond that ('Does not silently enable writes'), but says nothing about merge-vs-replace semantics for config, reversibility, or effect on a running capability.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with the action and no filler. The parenthetical is the only slightly wasteful/ambiguous element.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

A live-state mutation tool with an open-ended nested config object, no output schema, and zero parameter documentation needs more than two sentences. Nothing explains what a 'capability' is here, what config accepts, or what the caller should expect afterward.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% for two required parameters, and the description adds no meaning for either. The 'config' parameter is a free-form nested object (additionalProperties: true) whose expected keys are undocumented in both the schema and the description, leaving the agent to guess at the shape.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource: 'Reconfigure a live capability'. It gestures at the sibling relationship with '(same path as mcp_update)', which helps separate it from capability_register / capability_unregister, though the parenthetical is cryptic rather than clarifying. Purpose is clear but the line against mcp_update is fuzzy.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit when-to-use, when-not-to-use, or prerequisite guidance. '(same path as mcp_update)' implies overlap with a sibling but does not tell the agent which to pick or under what conditions, so usage must be inferred.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

capability_registerB

Hot-add a capability through the shared Policy Gateway (same path as mcp_add). Pass a suggestion or protocol/name/config. auto:true only works for Safe + readonly + non-blacklist. Suggest never bulk-registers.

ParametersJSON Schema
NameRequiredDescriptionDefault
autoNoOnly Safe+readonly+non-blacklist
nameNo
configNo
confirmNoOperator confirm (console)
protocolNo
suggestionNo

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations declare readOnlyHint=false and openWorldHint=true, so the detailed safety burden is lower. The description adds real behavioral context: the shared Policy Gateway path, the Safe+readonly+non-blacklist restriction on auto:true, and that suggestions never bulk-register. It still omits what happens on failure, auth/prerequisite needs, or the confirm gate's role.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Brief and front-loaded, leading with the core action before the constraints. The telegraphic phrasing ('Suggest never bulk-registers') is terse but each sentence carries information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 6-parameter, zero-required, mutating tool with nested objects and no output schema or full annotation coverage, the description covers the key constraints but omits return behavior, prerequisites, and details on several parameters, leaving gaps an agent must infer.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is only 33%, so the bar to compensate is higher; the description names the relevant parameters (suggestion, protocol, name, config) and explains the auto flag constraint, but says nothing about confirm semantics or the shape of suggestion/config objects.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource: 'Hot-add a capability through the shared Policy Gateway', and ties itself to the sibling mcp_add by noting it takes the 'same path'. It's clear what the tool does, though it doesn't distinguish itself from mcp_add's role beyond the shared gateway.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives usage hints ('Pass a suggestion or protocol/name/config') and a constraint for auto mode, but never says when to choose this tool over the many siblings like mcp_add, capability_configure, or capability_unregister. Usage is implied rather than explicitly scoped.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

capability_unregisterA
Destructive

Hot-delete a live capability through the shared Policy Gateway (same path as mcp_remove). Removes the adapter instance and its tools immediately. Control-plane: does not require allowWrite. Console REST requires confirm:true. Missing id is E_NOT_FOUND.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYes

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already flag destructiveHint=true, and the description goes well beyond them: deletion is immediate and hot, it tears down the adapter instance and all its tools, it bypasses the allowWrite permission gate, and a missing id returns E_NOT_FOUND. These are exactly the operational consequences an agent needs before invoking an irreversible delete.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four short, dense sentences with the destructive action front-loaded and no filler. Every clause carries distinct information: mechanism, effect, permission model, and failure mode.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter destructive tool with no output schema, the description covers the mechanism, the blast radius, the auth/permission implication, and the failure mode. Nothing an agent needs in order to call it safely is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With one required parameter at 0% schema description coverage, the description should carry the load. It does add error semantics for the id (missing id yields E_NOT_FOUND) and implies the id names a registered capability, but it never states the id's expected form or provenance (e.g., the name returned by capability_register). Partial compensation only.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource ("Hot-delete a live capability") and adds scope details: removes the adapter instance and its tools immediately. It also names the sibling path it mirrors ("same path as mcp_remove"), so an agent can distinguish it from mcp_remove and capability_register without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear routing context: it is the control-plane path that does not require allowWrite, whereas the Console REST path requires confirm:true. That tells the agent when this variant is the right call. It stops short of an explicit when-not/alternative statement (e.g., use capability_configure for edits), so it is clear but not fully prescriptive.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compat_scanC
Read-only

Compat Catalog scan: P0 installed∩catalog + Partner drops; P1 login clues; P2 ports; P3 mcpServers as mcp_bridge 兜底 only; P4 desktop UI deferred. Scan never opens write/desktop/secrets.

ParametersJSON Schema
NameRequiredDescriptionDefault
includeInventoryNo

TDQS

C2.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotation already declares readOnlyHint=true; the description usefully extends this by specifying the read scope ("Scan never opens write/desktop/secrets") and listing what is deferred ("P4 desktop UI deferred"). That adds concrete behavioral context beyond the annotation, though it does not cover the return shape or fallback semantics of the bridge mode.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

It is short, but the compression comes at the cost of readability: a wall of terse P0-P4 fragments and mixed-language jargon ("兜底") rather than front-loaded, scannable prose. Density here is under-specification, not conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema and an undocumented parameter, the description needs to carry the burden of explaining what a scan returns and how includeInventory affects it. Instead it only enumerates opaque scan layers, leaving the agent unable to predict results or call it confidently.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the single parameter (includeInventory) is never mentioned in the description. The description does not compensate for the coverage gap, so the agent has no guidance on what toggling inventory on/off does.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose2/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a resource ("Compat Catalog scan") but the verb/behavior is buried under opaque priority jargon: "P0 installed∩catalog + Partner drops", "P1 login clues", "P2 ports". An agent cannot form a clear mental model of what the scan actually produces, and it is not distinguished from siblings like environment_inventory or discovery_scan_host.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is only an implicit hint that P3 mcpServers is "兜底 only" (fallback only). There is no explicit when-to-use, no when-not-to-use, and no named alternative among the many sibling tools (environment_inventory, discovery_scan_host, capability_register).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

discovery_probeB
Read-only

Probe a single host+port for common OpenAPI/SOAP/GraphQL paths. CIDR / ranges are never allowed.

ParametersJSON Schema
NameRequiredDescriptionDefault
hostYesHostname or single IP. CIDR / ranges / wildcards are never allowed.
portNoTCP port (default 80, or 443 if https=true)
httpsNo
protocolsNoLimit probes: openapi, soap, graphql

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=true, so the non-destructive, external-network nature is covered. The description adds the important scoping constraint (single host, no ranges), but discloses nothing about rate limits, probing behavior, or what a probe returns.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two compact sentences with the core action front-loaded and the constraint second; no filler. Slightly terse given it could clarify scope relative to siblings, but nothing is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only probe with annotations and no output schema, the description covers the action and scope but omits what a probe yields and when to choose it over sibling discovery tools. Adequate but with clear gaps for an agent selecting among several discovery options.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 75%, with host, port, and protocols described; only https lacks a description (though its name and default are self-evident). The description echoes the host/port and no-ranges constraint but adds no syntax or format detail beyond the schema, so the baseline 3 holds.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb 'Probe' with the resource 'single host+port' and names what it hunts for (common OpenAPI/SOAP/GraphQL paths). The 'single' scoping implicitly separates it from scan/host-wide siblings like discovery_scan_host, though no sibling is named explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The 'CIDR / ranges are never allowed' clause gives a hard constraint for when this tool applies versus a broader scan. However, it never explicitly says when to prefer discovery_probe over discovery_scan_host or discovery_suggest, leaving the routing decision implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

discovery_scan_hostB
Read-only

Parallel single-host discovery: OpenAPI/WSDL/GraphQL paths, gRPC reflection, Redis PING, MQTT CONNECT, Modbus, CoAP, NATS INFO, JSON-RPC/XML-RPC, Pulsar 8080/6650, GCS 4443, Influx 8086, OSS headers, SMTP 25/587 220-banner. CIDR / ranges are never allowed (EVERYTHING2MCP_DISCOVERY_ALLOW_SCAN is ignored). Timeouts + SSRF (blocks metadata IPs).

ParametersJSON Schema
NameRequiredDescriptionDefault
hostYesSingle hostname or IP. CIDR / ranges / wildcards are never allowed.
portNoIf set, HTTP probes this port; well-known protocol ports still tried unless onlyGivenPort
httpsNo
protocolsNo
onlyGivenPortNo

TDQS

B3.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover read-only/open-world semantics, and the description adds real operational context beyond them: the allow-scan env var is ignored, timeouts apply, and SSRF protection blocks metadata IPs. This is meaningful governance/security disclosure for a scanning tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The core purpose and the single-host constraint are front-loaded, and the long protocol enumeration is information-dense rather than filler. It reads as compact but slightly list-heavy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema and a complex multi-protocol scan, the description omits what the scan actually returns and roughly how long it takes. The safety constraints are well covered, but the result-shape gap leaves the agent under-informed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is only 40%, and three parameters (https, protocols, onlyGivenPort) are undocumented in both schema and description. The protocol list hints at probe targets but never clarifies that 'protocols' filters, what accepted values are, or how onlyGivenPort interacts with the port argument. It fails to compensate for the coverage gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific action (parallel discovery scan) scoped to a single host and enumerates exactly which protocols/services it probes, making the resource and coverage unambiguous. It doesn't explicitly differentiate itself from close siblings like discovery_probe or compat_scan, which keeps it short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states a hard exclusion (CIDR/ranges never allowed) but offers no positive when-to-use guidance and never names an alternative sibling (e.g., discovery_probe, discovery_suggest). An agent must infer the routing context itself.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

discovery_suggestB
Read-only

Map probe/scan candidates to one-click mcp_add drafts (protocol, name, config, confidence). Pass candidates or a host to scan first.

ParametersJSON Schema
NameRequiredDescriptionDefault
hostNo
portNo
httpsNo
protocolsNo
candidatesNo

TDQS

B3.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=true, so safety is covered. The description adds value beyond that by disclosing the output shape (protocol, name, config, confidence) and that results are drafts rather than applied changes — meaningful since there is no output schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences with zero filler, front-loaded with the core action before the input hint. It is efficient, though the input hint is compressed to the point of being ambiguous.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 5-parameter tool with no output schema and no required-parameter guidance, the description leaves three inputs (port, https, protocols) undocumented and never explains how candidates vs. host interplay. It is too thin to fully equip an agent to call this correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% for 5 parameters, so the description must carry parameter meaning. It only touches two inputs ('candidates or a host'); port, https, and protocols are left entirely unexplained in both schema and description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a concrete transformation: mapping probe/scan candidates into 'one-click mcp_add drafts' with named fields (protocol, name, config, confidence). This distinguishes it from mcp_add (which applies) and from discovery_probe/discovery_scan_host (which produce raw candidates), though it never names those siblings explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

'Pass candidates or a host to scan first' implies the precondition that you need prior probe/scan results, and hints at the input mode. But it does not say when to choose this over discovery_probe, discovery_scan_host, or mcp_add_from_discovery, so routing guidance is only implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

environment_inventoryA
Read-only

On-demand Environment Plane snapshot (OS/arch, permission hints, listening ports best-effort, runtimes, container clues, config paths). Feeds suggest only — never auto-registers, never sets allowWrite=true.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=true, so safety is partly covered; the description nonetheless adds real signal: ports are 'best-effort' (results may be incomplete), the snapshot is only a feed, and it will not flip allowWrite. It omits operational traits such as cost/duration of the scan or whether results are cached, which would matter for an open-world probe.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences: the payload is front-loaded in the first, the safety/behavioral constraint in the second. Every clause carries information and none is filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema and no parameters, the description does the heavy lifting by enumerating the returned fields, which is what an agent needs to decide if this snapshot answers its question. It stops short of saying how the snapshot is surfaced to the suggest feed (returned inline vs. persisted), a minor remaining gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes no parameters, so there is no parameter surface to document and the baseline is 4. Nothing in the description contradicts or obscures the empty input schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names the artifact precisely (an Environment Plane snapshot) and enumerates exactly what is captured: OS/arch, permission hints, listening ports, runtimes, container clues, config paths. The closing clause ('never auto-registers') implicitly separates it from mcp_add / capability_register / discovery_suggest, so an agent can place it without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states the trigger mode ('on-demand') and the downstream consumer ('feeds suggest only'), which tells the agent where this fits in a discovery workflow. It also gives hard exclusions (never auto-registers, never sets allowWrite=true), clarifying it is not a substitute for mcp_add. It does not explicitly say when to prefer this over siblings like discovery_probe or discovery_scan_host, so it stops short of a full when/when-not statement.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_addB

Dynamically register a protocol endpoint. Tools appear immediately as namespaced MCP tools (protocol.name.operation).

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesLogical name used in tool prefixes and registration id
configYesProtocol-specific config. openapi: { spec, baseUrl?, allowWrite? }. mqtt: { url, allowWrite? }. soap: { wsdl, endpoint?, soapVersion?, allowWrite? }. grpc: { proto | protoInline | reflection:true, target, allowWrite?, ca?|caFile?, cert?|certFile?, key?|keyFile? }. asyncapi: { spec, brokerUrl?, bind?, allowWrite? }. sparkplug: { url, groupId?, edgeNode?, hostId?, encoding?, allowWrite? }. websocket: { url, allowWrite? }. graphql: { url? | simulator:true | wsUrl?, allowWrite? } (subscribe_once = graphql-ws; HTTP is query/mutate). amqp: { url? | simulator:true, queue?, allowWrite? } (publish/rpc 写闸; get/ack/nack). kafka: { brokers, topic?, groupId?, groupInstanceId?, idempotent?, transactionalId? (recorded, unused), allowWrite? }. fix: { sender?, target?, allowWrite? (logon/logout/NOS are writes; encode/decode/status are not) }. opcua: { endpoint, simulator?, allowWrite? } (wait_data_change = memory monitored-item; subscribe_once 仍一次性). modbus: { host, port?, mode?: tcp|rtu, unitId?, simulator?, allowWrite? }. coap: { host, port?, allowWrite? }. nats: { servers | url | simulator:true, allowWrite? } (JetStream consumer/ack/interest 子集). xmlrpc: { url, allowWrite? }. jsonrpc: { url, allowWrite? }. redis: { url, allowWrite? }. smtp: { host, from?, raw?, starttls?, allowWrite? } (send_mail 写闸; noop 只读; raw:true 走 EHLO/MAIL/DATA; 不是 IMAP/POP3). ldap: { url, base?, tls?, starttls?, allowWrite? }. bacnet: { host?, port?, deviceId?, devices?, udp?, allowWrite? }. ethernetip: { host?, port?, tcp?, tags?, allowWrite? } (alias enip; CIP List Identity + local tags). s7: { host?, port?, rack?, slot?, tcp?, allowWrite? } (ISO-TCP/S7comm Read Var subset). mtconnect: { url | fixture | xml }. sql: { driver: sqlite|postgres|mysql|sqlserver|duckdb, filename? | url?, allowWrite? } (prefer specific protocol ids). sqlite: { filename?, native?:true (optional better-sqlite3), allowWrite? }. postgres: { url? | simulator:true | native:true + url (optional pg), allowWrite? }. mysql: { url? | simulator:true | native:true + url (optional mysql2), allowWrite? } (MariaDB compatible; alias mariadb). sqlserver: { url? | simulator:true, allowWrite? }. duckdb: { filename? | simulator:true, allowWrite? }. mongodb: { url? | simulator:true, allowWrite? } (无 url 内存; url 走 OP_MSG hello/find/insert/listCollections; 无 aggregation). elasticsearch: { url? | simulator:true, allowWrite? } (url 走 HTTP _cat/_search/_doc; 写闸). opensearch: { url? | simulator:true, allowWrite? } (ES 兼容 HTTP). clickhouse: { url? | simulator:true, allowWrite? } (HTTP POST query FORMAT JSONEachRow; INSERT/DDL 需 allowWrite). neo4j: { url? | simulator:true, allowWrite? } (http(s) /db/{db}/tx/commit; bolt 仍需注入 connectFn). qdrant: { url? | simulator:true, allowWrite? }. s3: { bucket, endpoint?, allowWrite?, unsigned?, accessKey?, secretKey?, region?, simulator? }. gcs: { bucket, endpoint?, allowWrite?, unsigned?, token?, simulator? }. oss: { bucket, endpoint?, allowWrite?, unsigned?, accessKey?, secretKey?, simulator? }. influx: { bucket, url?, org?, token?, allowWrite? } (alias influxdb; Flux + /api/v2/delete; not InfluxQL). prometheus: { url? | simulator:true, timeoutMs?, allowWrite? } (query/query_range; remote_write protobuf+snappy 需 allowWrite). sqs: { queue, endpoint?, unsigned?, allowWrite? }. pulsar: { topic, serviceUrl? (memory:// | http + unsigned | pulsar:// official LOOKUP | pulsar:// + dialect=e2p1 | pulsar+ssl://), tenant?, namespace?, subscription?, unsigned?, dialect?, allowWrite? }. snmp: { host?, port?, community?, simulator?, allowWrite? } (SNMPv2c Get/GetNext/walk/Set; not v3/USM). webdav: { url?, simulator?, allowWrite? } (PROPFIND/GET/PUT/DELETE/MKCOL). ftp: { host?, port?, user?, password?, simulator?, allowWrite? } (LIST/RETR/STOR/DELE; not SFTP/FTPS). etcd: { url?, simulator?, allowWrite? } (v3 HTTP KV range/put/delete; not watch/lease). imap: { host?, port?, user?, password?, simulator?, allowWrite? } (IMAP4rev1 LIST/SELECT/FETCH/SEARCH; APPEND/STORE/EXPUNGE 需 allowWrite; 不是 SMTP). pop3: { host?, port?, user?, password?, simulator?, allowWrite? } (STAT/LIST/RETR; DELE/RSET 需 allowWrite; 不是 SMTP). consul: { url?, token?, simulator?, allowWrite? } (HTTP KV + catalog/health; 写需 allowWrite; 无 Connect). azureblob: { container, endpoint?, unsigned?, sasToken?, account?, accountKey?, simulator?, allowWrite? } (SharedKey 子集或 SAS 查询串; 写需 allowWrite). sftp: { host?, port?, user?, password?, simulator?, allowWrite? } (SSH-2 SFTP; 不是 FTP). memcached: { host?, port?, simulator?, allowWrite? } (text GET/SET/DELETE/STATS). tftp: { host?, port?, simulator?, allowWrite? } (RFC1350 RRQ/WRQ; 不是 FTP/SFTP). caldav: { url?, simulator?, allowWrite? } (PROPFIND/REPORT time-range + freebusy; iTIP schedule E_UNSUPPORTED). carddav: { url?, simulator?, allowWrite? } (PROPFIND/REPORT addressbook-query/GET/PUT). beanstalkd: { host?, port?, tube?, simulator?, allowWrite? } (put/reserve/delete/stats). zookeeper: { host?, port?, simulator?, allowWrite? } (ruok + get/create + watch_once + multi; ACL/SASL E_UNSUPPORTED). dns: { host?, port?, simulator?, timeoutMs? } (unicast A/AAAA/TXT/PTR; 无 AXFR / 无组播). cassandra: { host? | url? | simulator:true, port?, allowWrite? } (CQL 子集; native v4 STARTUP/QUERY; 写闸). couchdb: { url? | simulator:true, allowWrite? } (_all_dbs / _all_docs / GET / PUT; 写闸). whois: { host? | url? | simulator:true, port? } (TCP 43 只读 query). solr: { url? | simulator:true, allowWrite? } (select/update HTTP; 写闸; 不是 SolrCloud admin). rabbitmq: { url? | simulator:true, vhost?, allowWrite? } (management HTTP 15672; 不是 AMQP 0-9-1). kubernetes: { url? | simulator:true, namespace?, token? } (只读 list/get/logs pods; exec/apply E_UNSUPPORTED). os_info: { } (本机 OS/arch 只读; 热加载,不在 boot 强制挂载). platform_fs: { roots?, maxBytes? } (gated list/read; 默认拒绝 / ; 不可 allowWrite). platform_process: { allowShell?, listFn? } (process_list; shell_exec 闸+stub). platform_service: { allowShell? } (systemd/sc/launchctl best-effort; 缺工具 E_UNSUPPORTED). docker: { url? | simulator:true, allowWrite? } (Engine API 只读 list/inspect/logs; run E_UNSUPPORTED). podman: { url? | simulator:true, allowWrite? } (docker-compat API; 同 docker). journal: { path? | simulator:true, format?: syslog|journal-export|evtx-xml, allowShell? }. smb: { host? | simulator:true, port? } (别名 cifs; 模拟 list/get; live 仅 SMB2 NEGOTIATE). nfs: { host? | simulator:true, port? } (NFSv3 NULL ping; live SHOWMOUNT E_UNSUPPORTED). vault: { url? | simulator:true, token?, allowReadSecrets? } (health/list keys; 读 secret 默认关; 别名 openbao). aws_iam: { simulator:true } (永不打 IMDS; live STS E_UNSUPPORTED). alertmanager: { url? | simulator:true, allowWrite? } (alerts/status 只读; create_silence 写闸). pubsub: { url? | simulator:true, project?, allowWrite? } (GCP Pub/Sub emulator HTTP; publish 写闸). jira: { url? | simulator:true, token? } (myself/search/get_issue 只读). browser: { allowDesktop? } (默认关; 即使打开也不启动 Chrome). partner: { capability_id, operations[], invoke:{kind:http,url} | simulator:true, heartbeatTtlMs?, allowWrite? } (E2MCP Partner; 应用不实现 MCP). feishu: { url? | simulator:true, token?, allowWrite? } (list_chats/search 只读; send_message 写闸). dingtalk: { url? | simulator:true, token?, allowWrite? } (probe 只读; work notice / robot 写闸). wecom: { url? | simulator:true, token?, allowWrite? } (dept/user 只读; send_app_message 写闸; 不是个人微信). slack: { url? | simulator:true, token?, allowWrite? } (conversations.list 只读; post_message 写闸). notion: { url? | simulator:true, token?, allowWrite? } (search/get_page 只读; create_page 写闸). github: { url? | simulator:true, token?, owner?, repo?, allowWrite? } (issues/PRs 只读; create_issue 写闸). mcp_bridge: { mcpServers | path, simulator? } (兜底导入 mcpServers JSON; live spawn E_UNSUPPORTED)
protocolYesAdapter protocol. Built-in: alertmanager, amqp, asyncapi, aws_iam, azureblob, bacnet, beanstalkd, browser, caldav, carddav, cassandra, cifs, clickhouse, coap, consul, couchdb, dingtalk, dns, docker, duckdb, elasticsearch, enip, etcd, ethernetip, feishu, fix, ftp, gcs, github, graphql, grpc, http, imap, influx, influxdb, jira, journal, jsonrpc, k8s, kafka, kubernetes, lark, ldap, mariadb, mcp_bridge, memcached, modbus, mongodb, mqtt, mtconnect, mysql, nats, neo4j, nfs, notion, opcua, openapi, openbao, opensearch, os_info, oss, partner, pg, platform_fs, platform_process, platform_service, podman, pop3, postgres, postgresql, prometheus, pubsub, pulsar, qdrant, rabbitmq, redis, s3, s7, sftp, slack, smb, smtp, snmp, soap, solr, sparkplug, sql, sqlite, sqlserver, sqs, tftp, vault, webdav, websocket, wecom, whois, ws, xmlrpc, zookeeper

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations provide only readOnlyHint=false, so the description carries most of the burden, and it does add one genuinely useful behavior: registration is dynamic and tools become available immediately under a protocol.name.operation prefix. It omits durability (persisted or session-only), the allowWrite gating model, and what happens for unsupported protocols or configs, which matters for an additive management operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with the action and then the observable consequence. Nothing is padding; the naming pattern is the one detail an agent could not get from the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The enormous config schema is fully self-documenting and there is no output schema, so return values need no explanation. Still, for a state-changing registration tool with minimal annotations, the description leaves out whether registrations survive restarts, default permission posture for writes, and failure modes for unknown protocols.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the config property already enumerates every protocol's required shape in exhaustive detail, so the schema does the heavy lifting. The description adds no parameter-level meaning beyond that baseline.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: 'Dynamically register a protocol endpoint', and explains the observable effect (namespaced tools appear as protocol.name.operation). It does not, however, distinguish itself from close siblings like mcp_add_from_discovery or capability_register, which an agent must choose between.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance and no exclusion of alternatives, despite the sibling list containing mcp_add_from_discovery (adds from discovery), mcp_plan_bridge, and capability_register, all plausible confusions. The agent must infer the selection rule from the names alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_add_from_discoveryC

Register an adapter from a discovery_suggest payload (protocol + name + config + confidence)

ParametersJSON Schema
NameRequiredDescriptionDefault
nameNo
configNo
protocolNo
suggestionNo

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The only annotation is readOnlyHint=false, so the description carries the burden of disclosing write behavior. It says 'Register' but does not say whether this persists an adapter, overwrites an existing registration of the same name, validates the payload, or is idempotent — critical for a mutation tool with no other behavioral coverage.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler; the trigger (discovery_suggest payload) leads and the payload fields follow. It is tight but verges on under-specification rather than true concision.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a four-parameter, nested-object mutation with 0% schema coverage and no output schema, the description is too thin: it never explains the 'suggestion' object, how top-level fields relate to it, whether parameters are required, or what is returned on success.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% and all four parameters (name, config, protocol, suggestion) are undocumented. The description names protocol/name/config, but its fourth item ('confidence') does not correspond to any top-level parameter and the required 'suggestion' object is never mentioned, so it only partially compensates and introduces ambiguity.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Register') plus the resource ('an adapter') and the source of its input ('a discovery_suggest payload'), which separates it from the sibling mcp_add (manual registration). A reader can tell what it does without opening the schema, though 'adapter' vs 'server' and the relationship to mcp_add remain implicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: the mention of a discovery_suggest payload suggests this should be called after discovery_suggest produces a suggestion. There is no explicit when-to-use, no precondition (e.g., must the suggestion be freshly probed?), and no statement of when to prefer mcp_add instead.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_blacklist_addA

Add a blacklist entry. kind=target (default): protocol + host+port or network url; blocks mcp_add, discovery register and invoke on matching adapters. kind=capability: adapterId (protocol:name); hides and blocks that one instance. kind=tool: pattern (exact tool name or glob, * = one segment, ** = any, e.g. redis.*.flushall); hides and blocks matching tools. Blacklist still applies in Full mode.

ParametersJSON Schema
NameRequiredDescriptionDefault
urlNoNetwork URL; file paths are ignored
hostNo
kindNo
portNo
reasonNo
patternNokind=tool: tool name or glob
protocolNo
adapterIdNokind=capability: registration id protocol:name

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With readOnlyHint=false the annotation already signals a write, and the description adds real behavioral context: it names exactly what gets blocked (mcp_add, discovery register, invoke) and notes that blacklisting 'still applies in Full mode', which is non-obvious policy detail. It omits reversibility and auth requirements, but disclosure is well beyond annotation coverage.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded with the verb and resource, then the three modes follow in compact clauses. It is dense but nearly every clause carries distinct meaning; minor redundancy in restating that each mode both hides and blocks.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an 8-parameter mutation tool with no output schema, the description covers the essential semantics (mode selection and pattern syntax) needed to invoke it correctly. It stops short of covering the reason field or any return/confirmation behavior, but annotations already carry the safety profile.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is only 38%, so the description must compensate, and it does: it maps host+port/url to target, adapterId (protocol:name) to capability, and pattern to tool, plus it documents glob syntax (* = one segment, ** = any) not present in the schema. Only the reason parameter is left unexplained, keeping it just shy of full coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Add) and resource (blacklist entry), then enumerates the three operational modes (target, capability, tool) with their distinct targets. An agent can distinguish this from siblings like mcp_blacklist_remove or mcp_remove purely from the description.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description effectively routes within the tool by explaining what each kind does (kind=target for protocol+host/port or url, kind=capability for adapterId, kind=tool for glob patterns), which tells the agent when to pick each mode. It lacks explicit guidance on when to use this tool versus alternatives like mcp_remove, so no exclusions are stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_blacklist_listA
Read-only

List operator blacklist entries. Match key is canonical protocol + host + port (or normalized url). See docs/BLACKLIST.md.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, so the safety profile is covered by structured data. The description adds genuine domain context — the canonical match key (protocol + host + port, or normalized url) — which explains how entries are identified. It still omits pagination/result-size behavior, so it is not fully transparent despite the lower annotated bar.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences with the purpose front-loaded and no filler. The trailing 'See docs/BLACKLIST.md' is a small dependency on external docs rather than self-contained information, which keeps it from being exceptional.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter read tool with readOnlyHint already given, the definition is close to sufficient. With no output schema, though, it does not describe the returned entry shape (fields, ordering, pagination), leaving an agent to guess what comes back.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so the baseline is 4; nothing in the schema needs compensating for. The mention of the match key adds interpretation value even though there is no parameter to describe.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'List operator blacklist entries.' This clearly separates it from the sibling write operations mcp_blacklist_add and mcp_blacklist_remove, though it never names them explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the verb 'List' — an agent knows to call it to inspect the blacklist. However, there is no explicit when-to-use guidance, no mention of alternatives (e.g. mcp_query_by_protocol for filtered lookups), and no exclusions or prerequisites.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_blacklist_removeC

Remove a blacklist entry by id (protocol|host|port, cap|, or tool|)

ParametersJSON Schema
NameRequiredDescriptionDefault
idYes

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only supply readOnlyHint=false, leaving the description to disclose behavior. It does not say whether removal is reversible, what happens when the id does not exist, or whether confirmation/permissions are required — significant gaps for a mutation tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single dense sentence with the action front-loaded and the id-format details parenthetically attached. No wasted words, though the cryptic delimiter notation slightly hurts readability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive management operation with only one annotation and no output schema, the description should at least state consequences or side effects of removal. It communicates the target identifier but not the outcome, so an agent cannot fully reason about the call.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must carry parameter meaning. It usefully enumerates the accepted id formats (protocol|host|port, cap|<adapterId>, tool|<pattern>), which is genuine added value, but it remains terse and leaves the exact syntax of the pipe-separated forms ambiguous.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Remove) plus resource (blacklist entry) and the identifier it operates on. It clearly distinguishes itself from mcp_blacklist_add and mcp_blacklist_list by naming the removal action, though it does not explicitly name those siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to remove an entry versus listing or adding one, nor any prerequisites (e.g., needing to know the exact id first). Usage is only implied by the verb itself.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_explain_toolB
Read-only

Explain a namespaced MCP tool: adapter, protocol, local operation, input schema

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesFull tool name, e.g. openapi.widgets.getWidget

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

readOnlyHint=true already tells the agent this is a safe non-mutating operation, lowering the disclosure bar. The description adds the useful detail that the output covers adapter, protocol, local operation, and input schema, but says nothing about error behavior when the name is unknown or the tool is unregistered.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded fragment that wastes no words. It is terse to the point of being a colon-list rather than a sentence, but every token carries information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description doing double duty by enumerating the explained facets is valuable. For a single-read-only-parameter introspection tool this is nearly sufficient; a note on failure mode for unknown names is the only notable gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% and the schema already provides a format example ('openapi.widgets.getWidget'). The description contributes nothing beyond what the schema states, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Explain) and a specific resource (a namespaced MCP tool), and enumerates the facets returned: adapter, protocol, local operation, input schema. This distinguishes it from enumerating siblings like mcp_list, though it never names an alternative explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No when-to-use guidance, no prerequisites, and no mention of alternatives such as mcp_list or mcp_query_by_protocol. The agent must infer that this is a follow-up to enumeration purely from the tool name and the 'namespaced' qualifier.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_healthB
Read-only

Process + adapter health snapshot for agents (live/restore_failed, tool counts)

ParametersJSON Schema
NameRequiredDescriptionDefault
verboseNo

TDQS

B3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

readOnlyHint=true already establishes this is a safe non-mutating read. The description adds some value by naming the returned sub-fields (live/restore_failed, tool counts), but says nothing about freshness, cost, or what 'restore_failed' implies operationally.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single tight sentence front-loads the resource and lists the salient outputs. No filler, though the parenthetical is slightly cryptic out of context.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only health check with annotations covering safety, this is nearly adequate, but with no output schema the description only partially characterizes the return payload and never explains the verbose parameter, leaving gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% and the single parameter 'verbose' is never mentioned in the description. Since this is a 1-param tool whose only knob controls output detail, the description should have explained what verbose toggles, but it does not.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific resource (process + adapter health) and the key outputs (live/restore_failed, tool counts), making it distinguishable from management siblings like mcp_list or mcp_query_by_protocol. It is clear what the tool reports, though the phrasing 'snapshot for agents' is slightly internal-facing.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no when-to-use guidance, prerequisites, or alternatives among the many sibling tools. An agent can infer it is a diagnostics call, but nothing tells it when this is preferable to environment_inventory or compat_scan.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_listA
Read-only

List tools by layer: management (mcp_*/discovery_*) vs business (protocol.name.op). Default layer=business so agents are not flooded.

ParametersJSON Schema
NameRequiredDescriptionDefault
layerNobusiness = registered adapter tools; management = catalog/discovery; all = bothbusiness
verboseNoInclude per-adapter health checks

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The readOnlyHint annotation already establishes this as a safe read, so the description's job is limited. It usefully discloses the defaulting behavior and the layer partition, but says nothing about return shape, result size, or how verbose alters output. Some added context, but not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single compact sentence with the core purpose and the default-rationale front-loaded; no filler. Every clause carries information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema and only a readOnlyHint annotation, the description should carry more of the return-value burden. It covers the layer concept and default adequately but omits what the listing returns and how verbose changes it, leaving a gap for an agent deciding how to consume results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so both parameters are already documented, but the description adds semantics beyond the schema by mapping management to mcp_*/discovery_* prefixes and business to protocol.name.op. The verbose parameter is only explained in the schema, not the description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb (List) and resource (tools) plus the organizing concept (layer), and it defines the two layer buckets by their naming patterns. It does not name or differentiate against siblings like mcp_query_by_protocol or mcp_health, so sibling routing is left implicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states the default (layer=business) and even justifies it ('so agents are not flooded'), which is useful implied guidance on how to call it safely. However, it never says when to prefer this over a sibling query tool or when to use layer=all/management explicitly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_plan_bridgeA
Read-only

Turn a natural-language goal into recommended protocols, example configs, and next MCP tool calls. Does not scan by itself.

ParametersJSON Schema
NameRequiredDescriptionDefault
goalYesWhat the agent wants to connect or automate
hostNoOptional single hostname/IP to include in the plan

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnlyHint=true and openWorldHint=true, so safety is covered structurally. The description adds a genuinely useful behavioral caveat — 'Does not scan by itself' — which is important given the openWorld hint, since an agent might otherwise assume this tool touches the network. It doesn't say whether the plan is persisted or whether prior registry state is required.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, zero waste, and the core transformation is front-loaded before the scope caveat. Every clause earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only, open-world planning tool with no output schema, the description effectively names the return content (protocols, example configs, next tool calls) and rules out scanning. An agent has enough to invoke it correctly, though guidance on how the plan relates to the sibling execution tools is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% with two well-described params, so the schema does the heavy lifting — baseline 3. The description's 'natural-language goal' echoes the goal param but adds no syntax or format detail, and the optional host param is not addressed at all.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb+resource: it turns a natural-language goal into recommended protocols, example configs, and next tool calls. It also carves out scope against the discovery/scan family with 'Does not scan by itself.' It stops short of naming a specific sibling (e.g., discovery_suggest), which prevents a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied: it's the planning step that consumes a goal. The 'Does not scan by itself' clause hints that scanning siblings are needed for actual probing, but it never states when to pick this over close siblings like discovery_suggest or discovery_probe. No explicit when/when-not routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_query_by_protocolC
Read-only

Filter live adapters and tools by protocol type

ParametersJSON Schema
NameRequiredDescriptionDefault
protocolYes

TDQS

C2.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The readOnlyHint annotation already declares this is a safe, non-mutating read. The description adds one piece of behavioral context beyond the annotations: the result set is scoped to 'live' adapters and tools rather than all registered entities. It does not explain what 'live' means operationally or how results are shaped.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, front-loaded sentence with no filler or redundancy. It is efficient, though it is arguably too terse for a tool whose key parameter is completely undefined.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, so the description is the only source for what the tool returns, and it says nothing about the return shape or pagination. Combined with a fully undocumented required parameter and no differentiation from sibling listing tools, the definition leaves material gaps for an agent trying to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the single 'protocol' parameter has no documented meaning anywhere except the phrase 'by protocol type'. The description does not enumerate accepted protocol values, state whether matching is exact or partial, or indicate case sensitivity, so the agent must guess at the accepted input format.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific action (filter) and resource (live adapters and tools) qualified by protocol type, so the intent is unambiguous on its own. However it never differentiates itself from sibling listing tools such as mcp_list or mcp_health, leaving the agent to guess which query surface applies.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit when-to-use or when-not-to-use guidance. The agent is not told how this differs from mcp_list, nor what condition should route it here rather than to another discovery or listing sibling.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_removeA
Destructive

Disconnect an adapter and unregister its tools (same Catalog path as capability_unregister). Control-plane: does not require allowWrite.

ParametersJSON Schema
NameRequiredDescriptionDefault
idYes

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint=true and readOnlyHint=false, so the bar is lower; the description adds the useful detail that this is a control-plane action needing no allowWrite, and specifies the two effects (adapter disconnected, tools unregistered). It does not state whether the removal is reversible or what happens on an unknown id.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, primary action front-loaded, parenthetical sibling reference kept tight; no filler or restated boilerplate.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter destructive tool with no output schema, the description covers the mutation's effects, its safety/authorization context, and its sibling equivalence. The main gap is the absence of any id-format or error-behavior detail, which the schema does not supply either.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% and the single 'id' parameter has no documented format or type constraint in the description; only implicitly is it identifiable as the adapter id from 'disconnect an adapter'. This partially compensates for the coverage gap but adds little concrete syntax or scoping detail.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource pair ('disconnect an adapter and unregister its tools') and immediately relates it to the sibling capability_unregister via a shared Catalog path, letting an agent place it among mcp_add/mcp_update/mcp_remove without opening any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives the operational context that selects this tool ('Control-plane: does not require allowWrite') and names capability_unregister as an equivalent path, but does not state when to prefer this over mcp_update or capability_unregister, nor any exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

mcp_updateC

Update an existing registration's config and reconnect/reload its tools

ParametersJSON Schema
NameRequiredDescriptionDefault
idYesRegistration id from mcp_list (protocol:name)
configYes

TDQS

C2.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

readOnlyHint=false already signals a mutation, so the bar is lower, but the description does add real behavioral context: the update triggers a reconnect/reload of the registration's tools. It does not say whether config replaces or merges existing settings, nor whether the operation is reversible or disrupts in-flight connections. Adds value beyond annotations without being fully transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One tight sentence with the action and its side effect front-loaded; no filler. It is arguably too terse for what it omits, but structurally there is no waste.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a mutation tool with a nested, undocumented config object, no output schema, and a side effect (reconnect/reload), the description omits the details an agent most needs: what a valid config looks like and whether the update overwrites the prior config.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 50%: id is documented in the schema, but config is an untyped object with additionalProperties=true and no description anywhere. The description only restates 'config' without explaining its shape or, critically, merge-vs-replace semantics, so it fails to compensate for the coverage gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (Update) and resource (an existing registration's config) and additionally names the resulting side effect (reconnect/reload its tools). It is clearly distinguishable from mcp_add and mcp_remove, though it never names those siblings explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no when-to-use guidance, no prerequisites, and no routing to alternatives (e.g. mcp_remove + mcp_add for a full replacement). Usage is only inferable from the word 'existing'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

partner_listB
Read-only

List southbound Partner connections (ingress=partner). Agent-facing northbound is still MCP only. Apps do not implement MCP.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

readOnlyHint=true already tells the agent this is a safe read. The description adds the scope that only ingress=partner entries are returned, which is genuinely useful filtering context. It says nothing about return shape, ordering, pagination, or why the extra architectural notes matter, so it adds modest value over the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The first sentence is front-loaded and efficient. The following two sentences ('Agent-facing northbound is still MCP only. Apps do not implement MCP.') are tangential architecture commentary that does not clearly help invoke this tool, adding noise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a parameterless list tool with no output schema, the description covers what it lists and the filter scope. The dangling sentences about MCP northbound and apps add confusion without completing the picture of what the caller gets back. Adequate but with clear gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With zero parameters and 100% schema coverage, there is nothing for the description to clarify about inputs. The '(ingress=partner)' note functions as an implicit fixed filter, which is helpful context even if no parameter exists.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource (list southbound Partner connections) and pins scope via the '(ingress=partner)' qualifier. It clearly names the resource, though it never names a sibling like mcp_list to sharpen the contrast. The trailing sentences about northbound/MCP/apps describe the surrounding architecture rather than this tool's action.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The contrast between 'southbound Partner connections' and 'northbound MCP' implies this tool covers a different domain than the mcp_* siblings, giving indirect usage context. However, it never states explicitly when to use this versus mcp_list or any alternative. Usage is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

schema_importA

Import OpenAPI, WSDL, proto, GraphQL SDL, or AsyncAPI from a URL or file (OpenAPI servers[] become config.baseUrl). OData / JSON:API / tRPC / Connect-RPC are import-first: export OpenAPI (or pass gRPC target for Connect proto).

ParametersJSON Schema
NameRequiredDescriptionDefault
urlNoGraphQL HTTP endpoint when importing SDL
kindNoForce schema kind; otherwise auto-detect. odata/jsonapi/trpc/connectrpc are import-first.
nameNo
configNoExtra adapter config merged in
sourceYesFile path or http(s) URL
targetNogRPC host:port when importing a .proto
registerNo

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=false and openWorldHint=true, so the agent knows this is a mutating, network-reaching operation. The description adds the useful config-mapping behavior (OpenAPI servers[] become config.baseUrl) but says nothing about side effects of import/register, auth requirements, or what gets created — modest added value against the already-declared write profile.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two front-loaded sentences with no filler; the primary format list leads and edge cases (import-first, Connect target) follow. Dense and jargon-heavy, but every clause carries information an agent can act on.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 7-param mutation tool with a nested config object and no output schema, the description covers format selection well but omits the register default's implications and any return/effect information. Adequate, not complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

At 71% schema coverage the schema documents most params, but the description still adds real meaning: 'source' accepts URL or file, 'target' is the gRPC host:port for .proto, and 'config' absorbs the servers[] mapping. Only name/register semantics go unaddressed, which keeps it below the top score.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Presents a specific verb (Import) plus a precise list of resources (OpenAPI, WSDL, proto, GraphQL SDL, AsyncAPI, and import-first formats), which is far more than a restatement of the name. The only gap is that it never distinguishes itself from siblings like mcp_add or mcp_add_from_discovery, so sibling routing is left to inference.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives conditional handling guidance for import-first formats ('export OpenAPI') and the Connect proto case, which implies when those branches apply. But it offers no explicit when-to-use-this-vs-alternatives statement against the many sibling management/discovery tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 22 tool updatesv0.1.0
    • First observedcapability_configure
    • First observedcapability_register
    • First observedcapability_unregister
    • First observedcompat_scan
    • First observeddiscovery_probe
    • First observeddiscovery_scan_host
    • First observeddiscovery_suggest
    • First observedenvironment_inventory
    • First observedmcp_add
    • First observedmcp_add_from_discovery
    • First observedmcp_blacklist_add
    • First observedmcp_blacklist_list
    • First observedmcp_blacklist_remove
    • First observedmcp_explain_tool
    • First observedmcp_health
    • First observedmcp_list
    • First observedmcp_plan_bridge
    • First observedmcp_query_by_protocol
    • First observedmcp_remove
    • First observedmcp_update
    • First observedpartner_list
    • First observedschema_import

TDQS

C2.8/5.0

Scored across 22 tools

Disambiguation2/5

Several tools have unclear boundaries: mcp_add vs capability_register, mcp_remove vs capability_unregister, mcp_update vs capability_configure, and mcp_add_from_discovery vs capability_register are nearly identical in purpose, with descriptions explicitly noting they share the same catalog/policy path. mcp_list, mcp_query_by_protocol, and various discovery tools have distinct scopes but overall the set is hard to distinguish.

Naming Consistency2/5

Mixed conventions: snake_case throughout but with inconsistent prefixes (mcp_*, capability_*, discovery_*, partner_*, environment_*, compat_*) and no predictable pattern. The use of both mcp_ and capability_ prefixes for essentially the same operations further breaks consistency.

Tool Count3/5

22 tools is on the high side for a server whose purpose seems to be managing MCP integrations and discovery. While each tool has a hypothetical role, many are redundant (e.g., multiple add/remove/update paths), making the surface feel heavy.

Completeness3/5

Core lifecycle operations (add, remove, update, list) are present, but the domain—managing MCP adapters, discovery, and blacklisting—has notable gaps: no explicit tool for querying tool details (except mcp_explain_tool), no pagination for mcp_list, and no clear way to manage partner connections beyond listing. Some operations are only partially covered.

Maintenance

ActivityMaintained
ResponsivenessWithin a week

Related MCP Connectors

Related MCP Servers