Skip to main content
Glama

plctap

中文 | English

Agent 的 PLC 驱动层 — 让 Claude / Codex / Cursor 直接连接、读写、诊断 Modbus TCP / Modbus RTU over TCP / FINS / MELSEC / Siemens S7comm / IEC 60870-5-104 / EtherNet/IP (CIP) 设备的 MCP Server。

CI PyPI MCP Registry License: MIT

demo

状态: v0.6 (协议自动识别 + 透明代理 + 故障注入监听 + 八协议端点接入 (含 OPC UA 连接级诊断), 六端点可写 (IEC 104 / OPC UA 仅读); IEC 104 经 lib60870、EtherNet/IP 经 pycomm3 官方实现交叉验证, OPC UA 为 asyncua 官方库台架自洽验证)。

工具

工具

说明

连接

detect_device

协议自动识别: 给 IP 并发探测标准端口, 按响应指纹判定协议/端口/置信度, deep 模式验证读并生成可执行的 plc_read 建议; 全程只读

连接

probe_device

连通性探测 + 四类失败分层归因 (MELSEC 支持 3E binary/ASCII 自动回退; IEC 104 为 STARTDT+TESTFR 握手探测)

连接

plc_read

读数据区并按 datatype/字节序解释 (八个协议端点: modbus / modbus_rtu / fins / melsec / s7 / iec104 / enip / opcua); datatype 缺省返回 uint16/int16/float32 四种字序 (abcd/cdab/badc/dcba)/int32 多解释 (opcua 返回 UA 原生类型)

连接

plc_browse

地址空间浏览: 从 node 展开一层子节点, 摸清设备数据结构后再读 (仅 OPC UA; 输出预算 200 子节点, 截断带 total/shown 计数)

诊断

parse_frame / validate_frame

单帧结构化解析 / 规范校验清单

诊断

diagnose

规则引擎 + 故障知识库 → 结构化候选报告

诊断

parse_pcap

解析 Wireshark 导出 pcap, 逐流逐帧 (每条 TCP 流独立判别协议, 需 uv sync --extra eval)

监听

start_listener / stop_listener / get_listener_frames

钓鱼模式: 设备只能当 client 时立假 server 收帧分析 (三档: record_only / respond_normal / inject_errors 故障注入轮转; MELSEC 回帧支持全部 4 种帧格式; IEC 104 回 STARTDT/TESTFR CON 与总召罐头帧; EtherNet/IP 回 RegisterSession CON 与读 tag 应答罐头帧)

监听

start_proxy / stop_proxy / get_proxy_frames

透明代理: 上位机 → 代理 → 真实 PLC, 透传同时分帧录制双向帧, 在线联调免 Wireshark (modbus/fins/melsec)

执行

plc_write / send_frame

默认不注册, PLCTAP_ALLOW_WRITE=true 才启用 (闸门)

全部工具带 MCP annotations hint (wire 逐键锁定于 tests/test_tool_annotations.py): 纯本地解析类 readOnlyHint=true / openWorldHint=false, 联网读/探测/取帧类 readOnlyHint=true, 监听/代理 启停为非只读状态变更 (非破坏、非幂等), 写类 destructiveHint=true 且默认不注册 —— 客户端可 据此判断并行安全性与调用前确认级别。

Related MCP server: wago-plc-mcp-server

写能力

PLCTAP_ALLOW_WRITE=true 后八端点中六个可写 (modbus_rtu 与 modbus 同轨同语义; iec104 与 opcua 仅读):

协议

写语义

options

Modbus

fc16 批量写寄存器 (默认) / fc05 线圈 / fc06 单寄存器

point_type, options.function_code, options.values

S7

16 位字写入 DB/M/I/Q 区

options.area, options.db_number

FINS

0102 存储区写字 (CIO/W/H/A/DM/EM)

options.area

MELSEC

1401 批量写字, 全部 4 种帧格式

options.device, options.frame_format

EtherNet/IP

CIP tag 写 (0x4D); 整数默认 DINT, 浮点需显式 options.type="REAL"

point_type="tag", options.type

所有写/发送动作逐帧写入审计日志 (发送前留痕, 失败也留)。

协议速查

八个端点的寻址模型与常用参数 (接入前先对表; 工具内 list_protocols 亦可动态获取):

端点

默认端口

地址语义

常用 options

modbus

502

寄存器地址 0 基, count=寄存器数

options.function_code: 3=保持寄存器 (默认), 4=输入寄存器

modbus_rtu

网关自定义 (常见 502 / 8899)

modbus (TCP 上跑裸 RTU 帧, 无 MBAP 头)

modbus

fins

9600

字地址, count=字数

options.area: CIO/W/H/A/DM/EM (默认 DM)

melsec

44818 (SLMP; 5007 亦常见)

起始编号, count=点数 (位软元件按 16 点/字)

options.device: D/R/W=字, X/Y/B/M=位 (默认 D); options.frame_format 4 种 (默认 3e_binary)

s7

102

字节地址, count=字节数

options.area: DB/M/I/Q (默认 DB); options.db_number (默认 1); rack/slot (默认 0/1, S7-300 槽位通常 2)

iec104

2404 (2405 亦常见)

IOA 信息对象地址, 总召收集式读, count=连续 IOA 点数 (M_ME_NC 短浮点每点占 2 个 16 位字)

options.ca: 公共地址 (默认 1); options.qoi: 总召 QOI (默认 20 站总召)

enip

44818 (2222 亦常见; 与 MELSEC SLMP 同端口, detect 按响应指纹区分)

tag 名字符串 (如 "alpha[0]"), count=元素个数 (数组 tag)

写: options.type: DINT (默认) / REAL 等; 读支持 dint / bool 等 CIP 类型

opcua

4840

NodeId 字符串 (如 "ns=2;i=5" / "ns=2;s=Demo.Double"), count=数组节点返回元素上限 (0=全部); 值按 UA 内建类型原生返回

仅 SecurityPolicy None (诊断场景); plc_browse 从 ns=0;i=85 摸地址空间; 不做帧级诊断 (parse_frame/validate_frame 显式拒绝)

datatype 支持 uint16 / int16 / float32 / int32; byteorder 仅影响 float32 的寄存器对顺序 (big=ABCD, little=DCBA)。datatype 缺省时返回全部常见类型 × 字序的多解释, 字序存疑时直接比对。

示例调用 (客户端中按参数填写):

plc_read(protocol="modbus",     host="10.0.0.10",    port=502,   address=0,          count=2,  datatype="float32", byteorder="big")
plc_read(protocol="modbus_rtu", host="192.168.1.50", port=8899,  unit=2,             address=100, count=10)
plc_read(protocol="fins",       host="10.0.0.30",    port=9600,  address=100,        count=10, options={"area": "DM"})
plc_read(protocol="melsec",     host="10.0.0.40",    port=44818, address=100,        count=10, options={"device": "D"})
plc_read(protocol="s7",         host="10.0.0.20",    port=102,   address=0,          count=4,  datatype="float32", options={"area": "DB", "db_number": 1})
plc_read(protocol="iec104",     host="10.0.0.60",    port=2404,  address=1,          count=5,  options={"ca": 1})
plc_read(protocol="enip",       host="10.0.0.70",    port=44818, address="alpha[0]", count=3,  datatype="dint")

modbusmodbus_rtu 怎么选: 网关/上位机已封装 MBAP 头 (标准 Modbus TCP) → modbus; 串口服务器或网关工作在 RTU 透传模式 (TCP 上是裸 RTU 帧) → modbus_rtu

典型工作流 (现场诊断)

  1. detect_device(host=...) — 不知道对面是什么: 并发探测标准端口, 按响应指纹判定协议/端口/置信度, 返回可直接执行的 plc_read 建议 (全程只读)。

  2. probe_device(protocol, host, port) — 连通性确认; 失败时四类分层归因 (connection_refused / timeout / connected_but_no_reply / exception_response), 直接告诉您该查网络路由还是查协议配置 (IEC 104 为 STARTDT+TESTFR 握手探测)。

  3. plc_read(...) — 按「协议速查」读数, 与上位机显示或预期值比对。

  4. 读数不对 / 通信故障 → 抓包帧喂 parse_frame / validate_frame 做结构化解析与规范校验; 日志文本喂 diagnose 得到带证据链的结构化候选结论。

  5. 要看上位机 ↔ PLC 全部交互 → start_proxy 透明代理 (上位机改指向代理即可, 免 Wireshark); 设备只能当 client 主动外连 → start_listener 假 server 钓帧, 支持 inject_errors 故障注入档做上位机容错回归。

快速开始

uvx plctap          # 或 pipx install plctap

已收录于 MCP 官方 Registry: io.github.ymxc152/plctap (支持按名称检索与安装的客户端可直接发现本服务)。

Claude Desktop 接入 (claude_desktop_config.json)

{
  "mcpServers": {
    "plctap": {
      "command": "uvx",
      "args": ["plctap"],
      "env": { "PLCTAP_ALLOW_WRITE": "false" }
    }
  }
}

本地开发 (仓库检出路径):

{
  "mcpServers": {
    "plctap": {
      "command": "uv",
      "args": ["--directory", "C:/path/to/plctap", "run", "plctap"]
    }
  }
}

Codex 接入 (~/.codex/config.toml)

[mcp_servers.plctap]
command = "uvx"
args = ["plctap"]

[mcp_servers.plctap.env]
PLCTAP_ALLOW_WRITE = "false"   # 写闸门默认关闭
PLCTAP_DEFAULT_TIMEOUT_MS = "2000"

配置 (环境变量, 均有默认值)

变量

默认

说明

PLCTAP_ALLOW_WRITE

false

写类工具默认不注册 (安全闸门)

PLCTAP_POOL_MAX_PER_TARGET

2

每目标连接池上限

PLCTAP_IDLE_TIMEOUT_SEC

30

空闲连接回收秒数

PLCTAP_DEFAULT_TIMEOUT_MS

2000

网络超时 (串口网关 / 远程站点等慢链路可调大)

PLCTAP_AUDIT_LOG

~/.plctap/audit.jsonl

审计日志路径 (写/发送动作逐帧留痕)

安全

  • 写操作默认完全不注册; 显式 PLCTAP_ALLOW_WRITE=true 才启用。

  • 所有写/发送动作逐条写入 JSONL 审计日志 (~/.plctap/audit.jsonl, 不可关)。

  • 发送类调用请配合客户端审批弹窗使用 (用户可见目标 IP 与完整帧)。

  • 审计日志样例: {"ts":"2026-09-04T01:20:33+0800","tool":"plc_write","target":"modbus://127.0.0.1:15020 unit=1","frame_hex":"0002000000060106000104d2","caller":"mcp"}

开发

uv sync --extra eval --group e2e
uv run pytest -q   # 单测 (codec/适配器/诊断/监听) + 跨厂商 e2e + MCP 冒烟
uv run plctap      # 本地启动 stdio server

质量保障

  • 569 项测试(codec 纯函数 + 适配器(含 Modbus RTU / IEC 104 / EtherNet/IP / OPC UA)+ 诊断引擎 + 监听器 + 透明代理 + detect_device + MCP 冒烟),CI 每次推送回归。

  • 跨厂商 e2etests/e2e):plctap 与 pymodbus、python-snap7、 pymcprotocol、pypi fins、MZ Automation 官方 lib60870.NET、pycomm3(Rockwell 官方客户端库)六个第三方权威实现做真实 socket 交叉验证 (读写闭环、读数逐值比对、钓鱼监听互通),CI 随行(uv sync --group e2e); IEC 104 交叉验证需 .NET 8 SDK(缺省自动跳过)。OPC UA 端点为 asyncua 官方库 + 台架自洽验证(会话协议无帧级诊断,与本节其余端点的字节级交叉验证口径不同,如实区分)。

  • 八档评测 49/49:单帧 / RTU 完整性 / 批量日志 / FINS·MELSEC 专项 / 主动探测归因 / 协议自动识别 / IEC 104 专项 / EtherNet/IP 专项 (detect 档含"回显服务器欺骗"与"证据压过端口先验"两类反例);与裸模型的双跑对比见下节。

评测对比 (裸模型基线双跑: 五档 35 用例)

档位

plctap 工具链

裸模型直接问答*

单帧 Modbus TCP

8/8

8/8

RTU 完整性/CRC

5/5

4/5

批量日志 (混排)

5/5

3/5

FINS/MELSEC 专项

12/12

5/12

主动探测归因

5/5

4/5

合计

35/35 (100%)

24/35 (68.6%)

* 同一批语料双跑, 除工具外一切相同: 裸模型 (glm-5.3-flash, 无工具, temperature=0) 直接问答; 确定性关键词判分 (事实等价集, 双模式共用); 6 例因推理端点超时未获有效答案计 FAIL (排除超时后 24/29 = 82.8%)。裸模型跑分日期 2026-09-04, 语料版本 317e868 (跑分时点; fins 语料其后于 b319374 随线上格式修正同步更新, 判分语义不变)。 范围说明: 语料建于 M2 (v0.2 时代), 覆盖帧解析 / CRC 完整性 / 日志混排 / 冷门协议语义 / 主动探测归因; v0.3+ 功能 (plc_write / parse_pcap / 透明代理 / modbus_rtu 端点 / vendor_hints / iec104 端点 / enip 端点 / opcua 端点) 未纳入基线。detect 档 (4 用例, v0.4 新增)、iec104 档 (6 用例, v0.5.2 新增) 与 enip 档 (4 用例, v0.5.3 新增) 需起真实网络服务/台架做主动探测与交互, 不适合裸问答 形式, 故未纳入对比 —— 工具模式八档合计 49/49 (2026-09-07 按当前语料复跑, 见「质量保障」)。 结论: 单帧翻译裸模型已能胜任, 价值差距集中在冷门协议语义与多故障混排场景 —— 这正是确定性解析 + 结构化知识库的所在。方法学与复跑步骤见 eval/README.md

运行时边界: eval/ 是开发期基准测试 harness (裸模型基线对比), 仅复跑评测时需要 PLCTAP_ 前缀环境变量 (key/端点/模型全部显式提供, 仓库不内置任何厂商端点); 发布产物只含 src/plctap —— MCP server 运行时零 AI/LLM 依赖, 不读也不需要任何模型 API 凭据。

多模型裸基线矩阵 (2026-09-08: 4 模型 × 双跑 × 五档 35 用例)

模型 (档位)

run1

run2

无答案 run1/run2*

glm-5.3-flash (Agent 同款)

13/35

13/35

12 / 11

glm-5-2 (强)

10/35

10/35

13 / 14

doubao-seed-turbo (弱)

9/35

9/35

14 / 13

deepseek-v4-flash (中)

8/35

8/35

2 / 2

plctap 工具链 (对照, 同语料)

35/35

35/35

换任何裸模型 (弱/中/强/Agent 同款) 都在 8~13/35 徘徊, 冷门协议档 8 轮合计 0/96; 挂上 plctap 工具层后 49/49 (八档), 且与模型强弱无关。 两种失败模式同时被工具层免疫: 推理跑飞 (八轮 81 次零输出, 单例实测烧满 32768 reasoning tokens 无正文) 与 "流畅的错误" (deepseek-v4-flash 无答案仅 2/2 却总分最低, FINS/MELSEC 档 12 条全错)。

* 无答案 = 模型零输出 (推理超时), 计 FAIL (09-04 口径沿用)。本矩阵与上表 (2026-09-04, 24/35) 不可同表硬比: 端点不同 (火山方舟 vs Codex 本地代理)、服务端模型版本可能漂移、 判分等价集为当期校准 —— 同名模型 ≠ 同条件。双跑总分逐分复现 (temperature=0), 分档内部 有小幅漂移。完整矩阵与方法学见 eval/README.md

版本与兼容承诺

自 v0.6.1 起遵循稳定化纪律:

  • 向后兼容: MCP 工具名、参数名与各工具的返回结构保持兼容。返回结构由 pydantic 模型 定义并锁定 (tests/test_tool_shapes.py 黄金校验; 例外: list_protocols 的 protocols 条目为自由形态 dict); 新增协议端点、新增工具、新增可选参数只增不改。

  • 工具 annotations: 17 个工具的 readOnlyHint/destructiveHint/idempotentHint/openWorldHint 四项全显式 (server.py _ANN_* 四分组), 黄金值锁定于 tests/test_tool_annotations.py; annotations 属只增元数据, 任何取值变化按 wire 变化对待。

  • 破坏性变更: 若不可避免, 在工具 docstring、本 README 与 Release notes 三处提前标注, 并尽量提供迁移期。

  • 不承诺面: src/plctap 内部模块组织、诊断知识库条目数、评测数字随版本正常演进。

  • 1.0 (语义定稿) 的宣布条件: 上述纪律经过至少一个完整发布周期的验证, 届时另行公告。

License

MIT

Available Tools

15 tools
detect_deviceDetect DeviceA
Read-onlyIdempotent

设备自动识别: 给定 host 自动扫端口并判定协议 (v0.4, 全程只读)。

流程: 并发扫描候选端口 (缺省 102/502/2000/2404/44818/4840/5007/6000/9600/9601, 单端口连接预算 0.5s) -> 开放端口并发跑已注册协议 probe 指纹 (单协议预算 timeout_ms/1000, 缺省 0.8s; 个别协议有独立预算如 opcua 的完整会话握手) -> high 候选按协议做一次最小读验证 (deep=True 缺省; 成功升级 verified, 失败留痕保持 high; deep=False 跳过验证读)。 只读保证: 全程只发握手帧 + 最小读帧, 不写任何数据; 且识别 ≠ 可访问 —— 例如 S7 PUT/GET 被关闭时识别照样成功, 读 DB 仍可能失败。 返回 DetectResult: candidates 按置信度降序 (同级先验匹配端口优先, next_step 可直接作为 plc_read 调用), unknown_services 为开放但 已注册协议都不认识的端口 (可用 start_listener 钓帧分析)。

ParametersJSON Schema
NameRequiredDescriptionDefault
deepNo
hostYes
portsNo
timeout_msNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
hostYes
candidatesYes
elapsed_msYes
open_portsYes
closed_countYes
scanned_portsYes
unknown_servicesYes
network_assessmentYes

TDQS

A4.2/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and idempotentHint=true. The description goes beyond by explicitly guaranteeing read-only behavior (only handshake and minimal read frames, no writes), reveals optional deep verification, and explains that identification does not guarantee access. This adds significant behavioral context beyond annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Description is detailed and front-loaded with purpose, but it is lengthy with multiple clauses. It covers essential details without excessive fluff, but could be more compact. Structure is logical: purpose, flow, assurances, return format.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity and output schema exists, the description covers main workflow, parameter semantics, and return behavior. It doesn't detail edge cases like host unreachable or all ports closed, but is adequate for an agent to invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must explain parameters. It explains deep (default true, performs minimal read verification), ports (default list of candidate ports, null likely means use defaults), timeout_ms (per-probe budget, default 0.8s), and host (target device). This adds meaning beyond the schema for all parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific action: auto-scan ports and identify protocol for a given host. The description distinguishes it from siblings like probe_device by clarifying it is read-only and focused on identification, not probing. However, the exact protocol detection scope is implicit but clear enough.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides detailed workflow and default ports, and clarifies the tool is for identification, not full access verification. It mentions that if S7 PUT/GET is closed, read may fail, implying use for reconnaissance. Does not explicitly state when to use alternatives like probe_device or plc_read, but context is fairly clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

diagnoseDiagnoseA
Read-onlyIdempotent

综合观测给出结构化的故障候选结论 (确定性规则, 不编故事; 全程只读)。

三种证据可任意组合 (至少给一种):

  • frame_hex: 一帧报文 hex (解析 + 校验 + 规则匹配)

  • log_snippet: 通信日志文本, 自动提取其中的 hex 帧逐帧解析

  • host + port: 连上设备做一次探测, 把探测归因纳入推理 返回 DiagnosticReport: candidates 按 confidence 降序, 每条含 symptom/root_cause/evidence(证据链)/suggested_action/next_tools; evidence 与 observations 保留原始观测供复核。空 candidates = 知识库未覆盖, 不硬凑结论。

ParametersJSON Schema
NameRequiredDescriptionDefault
hostNo
portNo
unitNo
protocolYes
frame_hexNo
log_snippetNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
candidatesNo
next_toolsNo
observationsNo

TDQS

A4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover read-only, idempotent, open-world, non-destructive. The description goes beyond annotations by disclosing that it uses deterministic rules ('不编故事'), performs a live probe when host+port is used, automatically extracts hex frames from log_snippet, and returns empty candidates rather than forcing a conclusion when the knowledge base doesn't cover the case. These are important behavioral traits that an agent needs to know. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose, then structured as a bulleted list of evidence sources and output details. Every sentence earns its place, and the formatting makes the options and constraints easily scannable. It is not overly verbose despite including substantial behavior and return information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (6 params, multiple evidence modes, output schema), the description is largely complete. It explains the output structure and the meaning of empty candidates. The main gaps are the lack of explanation for the required protocol parameter, no guidance on when to use this vs. sibling tools, and no mention of any network/access requirements for the host+port probing mode. These are notable but not fatal, so a 4 is appropriate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It explains the semantics of frame_hex, log_snippet, and host+port as evidence types, including how they are processed. However, it does not mention the required protocol parameter or the unit parameter at all, leaving an agent to guess what values are expected. Thus it adds meaning to half the parameters but fails to clarify critical required inputs.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: to produce structured fault candidate conclusions from observations. It specifies the resource (observations) and the output (DiagnosticReport with candidates), and distinguishes its reasoning behavior (deterministic rules, no fabrication) from simpler parse/validate tools. However, it does not explicitly name sibling tools or state when this tool is preferred over them, so it lacks explicit sibling differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the use case: when you have at least one evidence source (frame_hex, log_snippet, host+port) and want a diagnostic conclusion, you can call this tool. It lists acceptable evidence combinations and the condition 'at least one'. But it does not name alternatives like validate_frame or parse_frame, nor does it specify when not to use this tool, so usage guidance is only implied, not explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_listener_framesGet Listener FramesA
Read-onlyIdempotent

取监听收下的帧 (direction/peer/frame_hex), 供 parse_frame/diagnose 分析。

取最新 limit 条; 环形缓冲硬上限 1000 条 (limit 超限自动截到缓冲 大小, limit<=0 返回空) —— 输出量受 limit 与缓冲上限双重约束。

ParametersJSON Schema
NameRequiredDescriptionDefault
portYes
limitNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description significantly enriches the annotations by disclosing the ring-buffer hard cap of 1000 entries, automatic truncation when limit exceeds buffer size, and empty result when limit<=0. These are meaningful behavioral constraints beyond the readOnlyHint/idempotentHint annotations, with no contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two dense sentences that front-load the purpose and then add the critical limiting behavior. There is no filler or repetition; every clause adds useful information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the output schema exists and annotations indicate a safe read-only, idempotent operation, the description covers purpose, usage context, and key behavioral edge cases. It lacks only minor context such as requiring an already-started listener, which is inferable from sibling tools like start_listener.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It explains 'limit' behavior well (latest N, truncation, <=0 means empty), but does not clarify what 'port' refers to beyond the implied listener context. This is partial compensation, not complete.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description uses a specific verb ('取/get') and resource ('监听收下的帧' / listener frames), and names the returned fields (direction/peer/frame_hex). It also states the downstream purpose (供 parse_frame/diagnose 分析), which helps an agent distinguish it from sibling tools like get_proxy_frames.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly implies when to use the tool: after capturing listener frames and before parse_frame/diagnose analysis. However, it does not explicitly mention alternatives like get_proxy_frames or state when not to use this tool, so it stops short of full exclusion guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_proxy_framesGet Proxy FramesA
Read-onlyIdempotent

取代理录制的双向透传帧 (direction: c2s=上位机→PLC, s2c=PLC→上位机)。

取最新 limit 条; 环形缓冲硬上限 1000 条 (limit 超限自动截到缓冲 大小, limit<=0 返回空)。

ParametersJSON Schema
NameRequiredDescriptionDefault
portYes
limitNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the read-only/idempotent annotations, the description discloses meaningful behavior: the ring buffer hard cap of 1000, automatic truncation of limit, and empty result for limit<=0. These are concrete runtime behaviors that annotations do not convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and every sentence carries useful information: the data source, direction meaning, and limit/buffer semantics. No filler or repetition of schema types.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers limit and buffer semantics wellwing and an output schema exists, so return structure is likely handled elsewhere. But the required port parameter is undocumented, and there is no statement about ordering or behavior when no frames have been recorded. These are modest gaps for an otherwise simple read tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description must compensate, and it does for limit: latest N frames, truncation at buffer cap, non-positive returns empty. However, the required port parameter is left entirely unexplained in both schema and description, which is a notable gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action and resource: fetch proxy-recorded bidirectional passthrough frames, with direction conventions c2s and s2c. It is clearly distinguishable from sibling get_listener_frames by the explicit 'proxy-recorded' scope, though it does not name that alternative directly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The tool's context is implied: it is for reading frames captured by the proxy, after proxy operation. However, it gives no explicit guidance on when to prefer this over get_listener_frames or other sibling tools, and no when-not-to-use conditions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_protocolsList ProtocolsA
Read-onlyIdempotent

列出本 server 支持的工业协议及其能力。

返回每个协议的端口提示、地址模型、数据类型和品牌线索, Agent 可据此推断 "这个设备该用什么协议" 而无需问用户。 不确定协议名时先调用本工具。 不确定协议/端口时先调用 detect_device。

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
hintYes
protocolsYes
allow_writeYes

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and destructiveHint, so the safe read-only behavior is covered. The description adds useful behavioral context: it returns capability details per protocol and is meant to let the agent infer the correct protocol without asking the user. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences: purpose, output content, and usage guidance. Every sentence earns its place and the key call-decision rule is front-loaded near the end without excess wording.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With zero parameters, comprehensive annotations, and an output schema present, the description fully covers why and when to call the tool as well as what it returns. Nothing needed for correct invocation is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters and the schema is complete, so the description has no parameter burden. Baseline 4 applies; the description instead enriches understanding of the output, which is appropriate for a no-argument discovery tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action and resource: '列出本 server 支持的工业协议及其能力' (list the protocols supported by this server and their capabilities). It further specifies what is returned per protocol (port hints, address model, data types, brand clues), making the tool's purpose concrete and distinct from siblings like detect_device.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit routing guidance: call this tool when the protocol name is uncertain, and call detect_device when the protocol/port is uncertain. This directly tells the agent when to use this tool versus an alternative.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

parse_frameParse FrameA
Read-onlyIdempotent

把一帧报文 hex 逐字段结构化解析 (不需要连接设备)。

每个字段带 byte_offset 与 raw_hex 证据; 支持正常请求/响应与异常 响应帧; 畸形帧不抛错, 而是尽量解析并在 errors 里说明哪里坏 —— "解析失败的方式"本身是诊断证据。 direction: "auto" 按帧结构判别, 也可显式传 "req" / "resp"。 frame_format (仅 melsec): "3e_binary" / "3e_ascii" / "4e_binary" / "4e_ascii"。

  • modbus: 异常帧/非 12 字节按响应, 12 字节按请求 (fc05/06 的响应 与请求逐字节相同, 任一解释一致)

  • fins: TCP 命令 0x00 按请求 / 0x01、0x02 按响应; 0x04 按 FINS ICF bit6 判别 (响应置位)

  • melsec: 副头部 50 00/54 00 按请求, D0 00/D4 00 按响应 (ASCII 帧 "5000"/"5400"/"D000"/"D400" 同理)

  • s7: rosctr=0x01 (Job) 按请求, 0x03 (Ack_Data) 按响应; 显式传 direction 时按传入值

ParametersJSON Schema
NameRequiredDescriptionDefault
protocolYes
directionNoauto
frame_hexYes
frame_formatNo3e_binary

Output Schema

ParametersJSON Schema
NameRequiredDescription
validNo
errorsNo
fieldsNo
protocolYes
directionYes

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description adds valuable behavioral context beyond annotations: it states that malformed frames are parsed best-effort and errors are reported as diagnostic evidence, that direction auto-detection follows protocol-specific heuristics, and that explicit direction overrides auto-detection. It does not describe output structure in detail, but an output schema exists, so that burden is reduced. Minor gap: no mention of rate limits or large-frame handling, but not essential for a read-only parser.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but well-structured: a one-sentence summary, then a paragraph on error behavior, then a bulleted list of protocol-specific direction rules. Every sentence earns its place, and the most important scoping info (no device connection, structured parsing) is front-loaded. It is longer than the typical description, but the length is justified by the protocol-specific rules that are essential for correct invocation. Slight deduction for density that may require careful reading.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (4 protocols, direction auto-detection, malformed-frame handling) and the presence of an output schema, the description is complete. It covers what the tool does, when to use it, how parameters behave, and what happens on malformed input. The output schema handles return-value documentation. An agent has everything needed to select and invoke this tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It does: it explains the direction parameter's 'auto' default and explicit 'req'/'resp' values, and it explains frame_format's allowed values ('3e_binary'/'3e_ascii'/'4e_binary'/'4e_ascii') and that it only applies to melsec. It does not explain protocol or frame_hex in detail, but those are self-evident from the tool name and description. The description adds meaning beyond the bare schema, though it could have explicitly listed protocol values.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: '把一帧报文 hex 逐字段结构化解析' (parse a frame's hex into structured fields per field), and immediately distinguishes itself from device interaction by noting '不需要连接设备' (no device connection needed). It clearly differentiates from siblings like validate_frame (which validates) and parse_pcap (which parses captures), and the protocol-specific direction rules further clarify its scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit when-to-use guidance: it handles normal request/response frames and abnormal response frames, and it explicitly states that malformed frames do not throw but are parsed best-effort with errors reported. It also gives detailed protocol-specific direction auto-detection rules for modbus, fins, melsec, and s7, and notes that frame_format only applies to melsec. This is far beyond minimal usage guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

parse_pcapParse PcapA
Read-onlyIdempotent

解析 Wireshark 导出 pcap: 按 TCP 流聚合载荷 -> 按协议切帧 -> 逐帧 parse_auto。

每个流返回完整帧序列 (带结构化解析) 与尾部半帧 (partial, 截断也是 诊断信息)。protocol 缺省时按"完整帧数最多的协议"自动判别。 需要可选依赖 scapy (uv sync --extra eval)。大批量帧场景比逐条 frame_hex 高效得多。 输出受 64KB token 预算约束: 超出时按流序/帧序装帧并截断, 末尾追加 一条 flow 以 "truncated:" 开头的 sentinel 流 (frames 为空, 带 total/shown 计数)。需要其余帧时用 protocol= 过滤或拆分 pcap 再解析。

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes
protocolNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover the safety profile (readOnly, idempotent, non-destructive), and the description adds substantial behavior beyond them: the optional scapy dependency with install command, the 64KB token-budget truncation rule, the 'truncated:' sentinel flow format with total/shown counts, partial-frame handling, and protocol auto-detection when the parameter is omitted. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The core pipeline is front-loaded, then the description flows logically through output structure, parameter default, dependency, and truncation behavior. Every sentence carries distinct information; the length is justified by the tool's genuine complexity around truncation, sentinel flows, and dependencies.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers the essential operational context: dependency requirements, truncation budget, sentinel flow shape, auto-detection default, and efficiency characteristics. Since an output schema exists, return-value structure is already handled elsewhere. Minor gaps: no explicit error conditions for invalid paths or malformed pcaps, and the path parameter format is not stated.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It explains protocol's semantics well — auto-detect by the protocol with the most complete frames when omitted, and use it as a filter to retrieve remaining frames — but path is only implied by the phrase 'Wireshark 导出 pcap' rather than explicitly documented as the pcap file path to read.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource — parse Wireshark-exported pcap — and details a distinct three-stage pipeline: aggregate by TCP flow, split by protocol, then parse_auto per frame. The batch/flow-aggregation scope clearly differentiates it from single-frame siblings like parse_frame, and the explicit efficiency comparison against per-frame frame_hex reinforces that distinction.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides clear context: suited for Wireshark-exported pcap files and large batch scenarios where it is 'much more efficient' than parsing frame by frame, plus a concrete follow-up strategy ('use protocol= to filter or split the pcap to re-parse') when frames are missing. It does not explicitly name alternative sibling tools or state when not to use it, but the implied usage scope is largely sufficient.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

plc_browsePlc BrowseA
Read-onlyIdempotent

浏览地址空间: 从 node 展开一层子节点 (诊断场景的"列目录")。

返回 {node, children, total, shown, truncated}: children 每项含 node_id / display_name / node_class; 超出输出预算时 truncated=true 且 total 给出全量数 —— 需要更深层级就对着子 node_id 再调一次。 默认从 Objects 文件夹 (ns=0;i=85) 起步; 对 plc_read 前先摸清 设备地址空间结构时用。 当前仅 OPC UA 支持 (会话协议无帧概念, browse 是它的"读目录"形态); 其他协议用 list_protocols 的 read_options 直接构造地址。 输出预算: 单次最多 200 个子节点 (约 30KB), 防止大地址空间撑爆上下文。

ParametersJSON Schema
NameRequiredDescriptionDefault
hostYes
nodeNons=0;i=85
portYes
unitNo
limitNo
protocolYes
timeout_msNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
nodeYes
shownYes
totalYes
childrenNo
truncatedYes

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds behavioral details beyond the annotations: it explains the return structure ({node, children, total, shown, truncated}), the output budget (max 200 children, ~30KB), truncation behavior, default starting node, and the need to call again with a child node_id for deeper levels. It also notes the protocol limitation. No contradiction with the readOnlyHint.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, dense paragraph that front-loads the core function and return format. It is efficient, but slightly long; however, every sentence adds value, covering purpose, usage, and behavioral constraints.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the essential aspects: return structure, truncation behavior, default node, usage context, protocol limitation, and output budget. The output schema likely defines the return format, so the description focuses on behavior. It could detail more parameters, but overall it is complete enough for the tool's scope.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must compensate. It explains the 'node' parameter (default ns=0;i=85) and 'limit' (output budget of 200), and implies 'protocol' by restricting to OPC UA. However, it does not describe host, port, unit, or timeout_ms, leaving these to be inferred from context.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: browse the address space by expanding one level of child nodes from a given node, framed as a 'list directory' for diagnostics. It differentiates from siblings like plc_read (reading values) and list_protocols (listing protocols) by specifying when to use it and what it returns.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly says to use this before plc_read to understand the address space structure, and notes that it only supports OPC UA, directing users of other protocols to use list_protocols' read_options instead. This gives clear when-to-use and when-not-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

plc_readPlc ReadA
Read-onlyIdempotent

从 PLC 读取数据区并按数据类型解释。

address/count 为通用地址与数量, 语义由协议决定:

  • Modbus: address 为 0 基寄存器地址, count 为寄存器个数

  • FINS: address 为字地址, count 为字数

  • MELSEC: address 为起始编号, count 为点数 (位软元件按 16 点/字)

  • S7: address 为字节地址, count 为字节数 (count=4 + uint16 → 2 个值)

  • EtherNet/IP: address 为 tag 名字符串 (如 "alpha[0]"), count 为元素个数

  • OPC UA: address 为 NodeId 字符串 (如 "ns=2;i=5" / "ns=2;s=Demo.Double"), count 为数组节点返回元素上限 (0=全部); 值按 UA 内建类型原生返回

datatype 取 uint16/int16/float32, None 返回原始 16 位值 + 所有常见数据类型的多解释 (interpretations 字段), 便于 Agent 识别正确的数据类型。 byteorder 仅影响 float32 寄存器对顺序 (big=ABCD, little=DCBA)。

options: 协议特有参数, 由各协议 adapter 自行定义与校验。 用 list_protocols 查看每个协议的 read_options 说明。

ParametersJSON Schema
NameRequiredDescriptionDefault
hostYes
portYes
unitNo
countNo
addressYes
optionsNo
datatypeNo
protocolYes
byteorderNobig
timeout_msNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
targetYes目标设备标识, 同时是连接池 key 的组成部分 (D1)。
addressYes
elapsed_msYes
interpretedNo
raw_registersYes
request_frameYes
interpretationsNo

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark readOnlyHint=true, openWorldHint=true, idempotentHint=true, destructiveHint=false, and the description adds protocol-specific behavior such as S7 count being byte-based, OPC UA returning native values, and datatype None returning multiple interpretations. This meaningfully supplements the annotation safety profile without contradicting it.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but well-organized, with protocol-specific semantics in a scannable bullet-like layout. Every sentence carries useful operational information, and the most critical parameter behavior is front-loaded before lower-level detail. No word is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity—10 parameters, 6 protocols, protocol-dependent semantics—and the absence of schema descriptions, the description is remarkably complete for tool selection and correct invocation. It covers protocol semantics, datatype behavior, byteorder effects, and options, while an output schema exists to cover return-value structure. Nothing essential for calling this tool correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries full responsibility for parameters. It provides detailed semantics for address/count across six protocols, explains datatype choices including the None fallback, clarifies byteorder's effect on float32 pairs, and points to list_protocols for options. This thoroughly compensates for the lack of schema-level descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

State a specific verb and resource: read data areas from a PLC and interpret values by datatype. The protocol-specific address/count semantics make its scope concrete and distinguish it from sibling tools like plc_browse or probe_device. The title and name align cleanly with the described behavior.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear operational guidance for when this tool is appropriate across different PLC protocols, and explicitly instructs agents to consult list_protocols for adapter-specific read_options. It does not explicitly name alternatives for non-read tasks, but the protocol coverage makes invocation conditions unambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

probe_deviceProbe DeviceA
Read-onlyIdempotent

测试能否连上 PLC 并通信, 失败时给出层级归因。

reachable = 传输层可达 (TCP 已建立; 设备回异常响应也算在线)。 failure_class 取:

  • connection_refused: 端口没人监听/网络不可达 (查网络与端口)

  • timeout: 连接超时 (查网络路由/防火墙)

  • connected_but_no_reply: TCP 通了但设备不回话 (查协议配置)

  • exception_response: 设备回异常码 (查 unit/寄存器配置, 带 exception_code) 典型用法: 设备"读不到数据"时先调本工具分层定位, 再决定下一步。

ParametersJSON Schema
NameRequiredDescriptionDefault
hostYes
portYes
unitNo
protocolYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
identityNo
reachableYes
layer_hintNo
failure_classNo
exception_codeNo

TDQS

A4.1/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With readOnlyHint=true and idempotentHint=true already covering safety, the description adds valuable behavioral semantics: reachable is defined as TCP established and includes exception responses, and each failure_class value is tied to a likely cause. This goes well beyond the annotations and gives the agent a mental model of expected outcomes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose, then organized as a compact taxonomy of failure_class values, and ends with a typical-use directive. Each line earns its place, and the structured list makes the behavior easy to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the output schema exists and annotations cover side effects, the description is nearly complete for invoking the tool. It still leaves protocol/host/port/unit semantics to inference and doesn't mention the relationship to detect_device, so slightly more context would make it fully self-sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It implicitly explains port (via connection_refused), protocol (via connected_but_no_reply), and unit (via exception_response), but it never formally defines the parameters or their allowed values/relationships. This is adequate for a PLC-expert agent but leaves gaps for less obvious parameters like protocol format.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific purpose: test whether a PLC connection and communication are possible, with failure_class attribution on failure. It is clear about the resource and behavior, but it does not explicitly contrast with the similar-sounding sibling detect_device, so sibling differentiation is only implicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives a clear trigger: when the device 'cannot read data', call this tool first for layer-by-layer diagnosis. It does not spell out when not to use it or name alternative tools such as detect_device or diagnose, so it falls short of the strongest guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

start_listenerStart ListenerA

起钓鱼模式监听: 待测设备只能当 client 时, 立假 server 钓出它的帧行为。

mode 三档: record_only=只收帧不回复 (纯被动) / respond_normal=对读类 请求回最小"正常响应" (数据恒 0, 目的只是让设备继续吐帧, 非通用模拟器) / inject_errors=正常回帧但按 faults 列表轮转注入确定性故障 (评测语料 生产 + 诊断引擎回归)。 faults (仅 inject_errors): modbus 可选 exception/bad_length/truncate, fins/melsec 可选 end_code/bad_length, 全协议通用 garbage。 收下的帧用 get_listener_frames 取, 再喂 parse_frame/diagnose。 port=0 由系统分配, 返回实际端口。建议收满样本后 stop_listener, 并提醒用户恢复设备原配置。

ParametersJSON Schema
NameRequiredDescriptionDefault
hostNo0.0.0.0
modeNorecord_only
portNo
faultsNo
protocolYes
idle_timeout_secNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
hostYes
modeYes
portYes
faultsNo
statusYes
protocolYes
recordedYes

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description is highly transparent about side effects beyond what annotations declare. It discloses that this is a stateful operation (consistent with readOnlyHint=false), that respond_normal minimally responds with constant-zero data, that inject_errors applies deterministic faults, and — critically — that starting this listener may alter the device under test and requires restoration to original config afterward. This cleanup warning goes well beyond the annotations and gives the agent an accurate mental model of consequences.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but well-organized: purpose first, then mode semantics, then fault injection rules, then the companion-tool workflow, then cleanup guidance. Every sentence carries meaningful operational information — no filler. It is on the longer side, but for a 6-parameter multi-mode tool with zero schema descriptions, that length is justified.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex tool (6 params, 0% schema coverage, multi-mode, protocol-specific fault lists), the description is nearly complete. It covers the purpose, all modes, fault options, port behavior, the companion tool chain, and the required cleanup. The only omissions are host and idle_timeout_sec semantics, which the agent would have to infer or guess. Given the output schema exists (not shown), the return contract is at least partially specified elsewhere.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description carries the full burden, and it largely succeeds. It fully documents mode (all three values with behavior), faults (protocol-specific options: modbus exception/bad_length/truncate, fins/melsec end_code/bad_length, universal garbage), and port=0 system-assignment semantics. Protocol is implied via the fault options. However, host and idle_timeout_sec are left entirely unexplained — a real gap given no schema descriptions exist.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource — starting a fake server (listener) to fish out frame behavior from a device that can only act as a client. It names the exact trigger condition (待测设备只能当 client) and the mechanism (立假 server), which clearly distinguishes it from sibling tools like start_proxy and get_listener_frames. The purpose is unambiguous and actionable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit when-to-use context (device is client-only) and lays out a complete workflow: start the listener, collect frames via get_listener_frames, feed them to parse_frame/diagnose, then stop_listener and restore device config. It also sets expectations by noting respond_normal is not a general-purpose simulator. It does not explicitly contrast with start_proxy as an alternative, which is a minor gap given that sibling exists.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

start_proxyStart ProxyA

起透明代理: 上位机 → 代理 → 真实 PLC, 透传同时按协议分帧录制双向帧。

现场联调时把上位机目标地址改成本代理, 无需 Wireshark 即可拿到全部 交互帧 (get_proxy_frames), 再喂 parse_frame/diagnose 做在线分析。 protocol 当前支持 modbus/fins/melsec (S7 TPKT 分帧暂不支持); listen_port=0 由系统分配。代理是诊断设施: 只透传与录制, 不改写帧。

ParametersJSON Schema
NameRequiredDescriptionDefault
protocolYes
listen_hostNo127.0.0.1
listen_portNo
target_hostYes
target_portYes
idle_timeout_secNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
hintYes
statusYes
targetYes
protocolYes
recordedYes
listen_portYes

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate readOnlyHint=false, destructiveHint=false, and idempotentHint=false, so the description doesn't need to restate those. It adds valuable behavioral context: the proxy is a diagnostic facility that only forwards and records frames, never rewrites them; listen_port=0 means the system assigns a port; and protocol support is limited to modbus/fins/melsec. This goes beyond the annotations and helps the agent understand side effects and constraints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded: the first sentence states the core function, the second gives the use case and workflow, and the third covers constraints and special values. Every sentence earns its place, and the structure makes it easy for an agent to quickly understand what the tool does and when to use it.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (6 params, no schema descriptions, output schema present), the description covers the essential context: purpose, use case, protocol limitations, and the diagnostic-only guarantee. It doesn't explain idle_timeout_sec or the output schema, but the output schema exists and the parameter names are reasonably self-explanatory. The description is complete enough for an agent to select and invoke the tool correctly in most cases.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It explains the meaning of protocol (supported values: modbus/fins/melsec), listen_port=0 (system-assigned), and the overall role of target_host/target_port (the real PLC address). It doesn't explain idle_timeout_sec or listen_host, but the parameter names are fairly self-explanatory and the description covers the most critical semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('起透明代理'), the resource (上位机 → 代理 → 真实 PLC), and the core behavior (透传同时按协议分帧录制双向帧). It clearly distinguishes this from sibling tools like start_listener and get_proxy_frames by explaining the transparent proxy role and recording function.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly tells when to use this tool: during on-site debugging, point the upper computer at this proxy instead of the real PLC, and you can capture all interaction frames without Wireshark. It also names the workflow: use get_proxy_frames to retrieve frames, then feed them to parse_frame/diagnose. It even states a limitation (S7 TPKT framing not supported), which helps the agent decide when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

stop_listenerStop ListenerA

停掉指定端口的监听, 返回收/发帧统计。

ParametersJSON Schema
NameRequiredDescriptionDefault
portYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
modeYes
portYes
sentYes
statusYes
recordedYes

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate readOnlyHint=false, destructiveHint=false, and idempotentHint=false. The description adds that the operation returns receive/transmit frame statistics, which is useful, but it does not disclose behavior when no listener exists on the port or whether buffered frames are cleared.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is one compact sentence that leads with the action and immediately states the return value. There is no filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with a single required integer parameter and an output schema, the description covers the core action and return behavior. Minor gaps remain around prerequisites and failure cases, but overall the context is sufficient for straightforward use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate for the port parameter. It only repeats the notion of a 'specified port' without adding range, format, default, or semantic details beyond the property name 'port'.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('停掉' / stop) and a concrete resource ('指定端口的监听' / the listener on a specified port), and it adds an observable outcome (receive/transmit frame statistics). This separates it clearly from sibling tools like start_listener and get_listener_frames.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The wording implies the tool is meant to stop a listener that was previously started for a port, but it never explicitly states when to use it or when to prefer a sibling like stop_proxy. No alternative guidance is provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

stop_proxyStop ProxyA

停掉指定端口的代理, 返回录制统计 (c2s/s2c 帧数)。

ParametersJSON Schema
NameRequiredDescriptionDefault
portYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
c2sYes
s2cYes
portYes
statusYes
targetYes
recordedYes

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already signal that this is a mutating, non-idempotent, non-destructive action. The description adds the return behavior (recording stats with c2s/s2c frame counts) beyond the annotations, but it does not disclose side effects such as whether in-flight traffic is dropped, whether recording is preserved, or what happens if the port has no active proxy.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single compact sentence with no filler. The action and return value are front-loaded, and the format is appropriate for a simple one-parameter tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's low complexity, the description plus annotations and output-schema presence largely cover what an agent needs to invoke it: supply a port and expect recording statistics. The main gap is usage guidance, but that is already accounted for in the usage_guidelines dimension.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description carries the burden for the port parameter. The phrase '指定端口的代理' does clarify that the port identifies which proxy to stop, which is the key semantic relationship. However, it does not explain what the port represents precisely, valid ranges, or error conditions for invalid ports.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a clear action: '停掉指定端口的代理' (stop the proxy on the specified port), naming both the verb and the resource. It also states what the tool returns, which further disambiguates it from siblings like start_proxy and stop_listener.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance about when to use this tool instead of related siblings such as stop_listener or start_proxy. It also does not mention prerequisites, such as whether the proxy must already be running, or any conditions under which this tool should not be used.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

validate_frameValidate FrameA
Read-onlyIdempotent

对一帧报文跑规范校验清单, 逐项 pass/fail (不需要连接设备)。

Modbus TCP: MBAP 长度一致性、协议号、功能码、unit 范围、PDU 自洽、数量/地址边界、异常码 (Modbus TCP 无 CRC, RTU 才有)。 FINS/TCP: magic、TCP 长度自洽、TCP 命令合法、error 字段、 FINS 端结码、载荷完整性。 MELSEC 3E: 副头部、数据长度自洽、命令/软元件代码、结束代码。 direction 取 req 或 resp。

ParametersJSON Schema
NameRequiredDescriptionDefault
protocolYes
directionNoresp
frame_hexYes
frame_formatNo3e_binary

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly, idempotent, and non-destructive. The description adds behavioral detail: it supports exactly three protocols, runs a checklist per protocol, and clarifies the direction parameter. It also notes a Modbus TCP nuance (no CRC, unlike RTU). This goes beyond the annotations without contradicting them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a compact paragraph that front-loads the core purpose, then organizes protocol-specific checks in a list-like format. It is efficient, though slightly dense with technical terms. No wasted words, but could be more scannable with bullet points.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (multiple protocols and many validation items) and zero schema coverage, the description is reasonably complete for its core function. However, it omits details on frame_hex formatting and frame_format options, and does not describe the output structure (though an output schema exists). The protocol-specific check lists are thorough, but the parameter gaps lower completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must explain all parameters. It clarifies 'direction' (req or resp) and implicitly defines 'protocol' by listing supported protocols, but it does not explain 'frame_hex' format (e.g., with/without separators) nor 'frame_format' beyond the default '3e_binary'. This is a significant gap given zero schema help.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool validates a frame against a specification checklist, producing pass/fail per item. It names the specific protocol checks (Modbus TCP, FINS/TCP, MELSEC 3E) and explicitly notes it requires no device connection, distinguishing it from sibling tools like parse_frame (which would decode) and probe_device (which requires a device).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage context by stating 'no need to connect device' and by listing the protocols it handles, but it does not explicitly say when to use this tool versus parse_frame or get_proxy_frames. It gives context (offline validation) but lacks explicit exclusions or alternative routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 10 tool updatesv0.6.1
    • Changedget_listener_frames4 fields changed
      • changedOutput schema / properties / result / items / additionalProperties
        Previous value: -trueNew value: +false
      • addedOutput schema / properties / result / items / description
        Added value: +"get_listener_frames / get_proxy_frames 共用的单帧记录。"
      • addedOutput schema / properties / result / items / properties
        Added value: +{
        +  "direction": {
        +    "type": "string"
        +  },
        +  "frame_hex": {
        +    "type": "string"
        +  },
        +  "peer": {
        +    "type": "string"
        +  },
        +  "ts": {
        +    "type": "string"
        +  }
        +}
      • addedOutput schema / properties / result / items / required
        Added value: +[
        +  "ts",
        +  "direction",
        +  "peer",
        +  "frame_hex"
        +]
    • Changedget_proxy_frames4 fields changed
      • changedOutput schema / properties / result / items / additionalProperties
        Previous value: -trueNew value: +false
      • addedOutput schema / properties / result / items / description
        Added value: +"get_listener_frames / get_proxy_frames 共用的单帧记录。"
      • addedOutput schema / properties / result / items / properties
        Added value: +{
        +  "direction": {
        +    "type": "string"
        +  },
        +  "frame_hex": {
        +    "type": "string"
        +  },
        +  "peer": {
        +    "type": "string"
        +  },
        +  "ts": {
        +    "type": "string"
        +  }
        +}
      • addedOutput schema / properties / result / items / required
        Added value: +[
        +  "ts",
        +  "direction",
        +  "peer",
        +  "frame_hex"
        +]
    • Changedlist_protocols4 fields changed
      • changedOutput schema / additionalProperties
        Previous value: -trueNew value: +false
      • addedOutput schema / description
        Added value: +"list_protocols 输出: 外层三键锁定; protocols 内条目保持自由形态\ndict (meta 条件键\"缺键而非 null\"——建模会把缺键变 null, wire 即变)。"
      • addedOutput schema / properties
        Added value: +{
        +  "allow_write": {
        +    "type": "boolean"
        +  },
        +  "hint": {
        +    "type": "string"
        +  },
        +  "protocols": {
        +    "additionalProperties": {
        +      "additionalProperties": true,
        +      "type": "object"
        +    },
        +    "type": "object"
        +  }
        +}
      • addedOutput schema / required
        Added value: +[
        +  "protocols",
        +  "allow_write",
        +  "hint"
        +]
    • Addedplc_browse
    • Changedplc_read5 fields changed
      • addedInput schema / properties / address / anyOf
        Added value: +[
        +  {
        +    "type": "integer"
        +  },
        +  {
        +    "type": "string"
        +  }
        +]
      • removedInput schema / properties / address / type
        Removed value: -"integer"
      • changedOutput schema / description
        Previous value: -"plc_read 输出。raw_registers 为寄存器原始 16 位值; interpreted 为按\ndatatype/byteorder 解释后的值。request_frame 保留 hex 便于人工核对。"New value: +"plc_read 输出。raw_registers 为寄存器原始 16 位值; interpreted 为按\ndatatype/byteorder 解释后的值。request_frame 保留 hex 便于人工核对。\naddress: 整数地址 (modbus/fins/melsec/s7) 或 tag 名字符串 (enip)。"
      • addedOutput schema / properties / address / anyOf
        Added value: +[
        +  {
        +    "type": "integer"
        +  },
        +  {
        +    "type": "string"
        +  }
        +]
      • removedOutput schema / properties / address / type
        Removed value: -"integer"
    • Changedprobe_device2 fields changed
      • changedOutput schema / description
        Previous value: -"probe_device 输出: 连通性探测 + 四类失败归因 (PLAN.md 第 3 节)。\n\nreachable 语义 = 传输层可达 (TCP 已建立)。设备回异常响应\n(exception_response) 说明设备在线且协议栈正常, 此时 reachable=True,\nfailure_class/exception_code 给出应用层异常 —— 分层归因的锚点。\nreachable=True 且 failure_class=None 表示可正常交换数据。"New value: +"probe_device 输出: 连通性探测 + 四类失败归因。\n\nreachable 语义 = 传输层可达 (TCP 已建立)。设备回异常响应\n(exception_response) 说明设备在线且协议栈正常, 此时 reachable=True,\nfailure_class/exception_code 给出应用层异常 —— 分层归因的锚点。\nreachable=True 且 failure_class=None 表示可正常交换数据。"
      • addedOutput schema / properties / identity
        Added value: +{
        +  "anyOf": [
        +    {
        +      "additionalProperties": true,
        +      "type": "object"
        +    },
        +    {
        +      "type": "null"
        +    }
        +  ],
        +  "default": null
        +}
    • Changedstart_listener4 fields changed
      • changedOutput schema / additionalProperties
        Previous value: -trueNew value: +false
      • addedOutput schema / description
        Added value: +"start_listener 输出。"
      • addedOutput schema / properties
        Added value: +{
        +  "faults": {
        +    "default": [],
        +    "items": {
        +      "type": "string"
        +    },
        +    "type": "array"
        +  },
        +  "host": {
        +    "type": "string"
        +  },
        +  "mode": {
        +    "type": "string"
        +  },
        +  "port": {
        +    "type": "integer"
        +  },
        +  "protocol": {
        +    "type": "string"
        +  },
        +  "recorded": {
        +    "type": "integer"
        +  },
        +  "status": {
        +    "type": "string"
        +  }
        +}
      • addedOutput schema / required
        Added value: +[
        +  "status",
        +  "protocol",
        +  "host",
        +  "port",
        +  "mode",
        +  "recorded"
        +]
    • Changedstart_proxy4 fields changed
      • changedOutput schema / additionalProperties
        Previous value: -trueNew value: +false
      • addedOutput schema / description
        Added value: +"start_proxy 输出。"
      • addedOutput schema / properties
        Added value: +{
        +  "hint": {
        +    "type": "string"
        +  },
        +  "listen_port": {
        +    "type": "integer"
        +  },
        +  "protocol": {
        +    "type": "string"
        +  },
        +  "recorded": {
        +    "type": "integer"
        +  },
        +  "status": {
        +    "type": "string"
        +  },
        +  "target": {
        +    "type": "string"
        +  }
        +}
      • addedOutput schema / required
        Added value: +[
        +  "status",
        +  "protocol",
        +  "listen_port",
        +  "target",
        +  "recorded",
        +  "hint"
        +]
    • Changedstop_listener4 fields changed
      • changedOutput schema / additionalProperties
        Previous value: -trueNew value: +false
      • addedOutput schema / description
        Added value: +"stop_listener 输出: 收帧统计。"
      • addedOutput schema / properties
        Added value: +{
        +  "mode": {
        +    "type": "string"
        +  },
        +  "port": {
        +    "type": "integer"
        +  },
        +  "recorded": {
        +    "type": "integer"
        +  },
        +  "sent": {
        +    "type": "integer"
        +  },
        +  "status": {
        +    "type": "string"
        +  }
        +}
      • addedOutput schema / required
        Added value: +[
        +  "status",
        +  "port",
        +  "mode",
        +  "recorded",
        +  "sent"
        +]
    • Changedstop_proxy4 fields changed
      • changedOutput schema / additionalProperties
        Previous value: -trueNew value: +false
      • addedOutput schema / description
        Added value: +"stop_proxy 输出: 双向录制统计。"
      • addedOutput schema / properties
        Added value: +{
        +  "c2s": {
        +    "type": "integer"
        +  },
        +  "port": {
        +    "type": "integer"
        +  },
        +  "recorded": {
        +    "type": "integer"
        +  },
        +  "s2c": {
        +    "type": "integer"
        +  },
        +  "status": {
        +    "type": "string"
        +  },
        +  "target": {
        +    "type": "string"
        +  }
        +}
      • addedOutput schema / required
        Added value: +[
        +  "status",
        +  "port",
        +  "target",
        +  "recorded",
        +  "c2s",
        +  "s2c"
        +]
  2. 14 tool updatesv0.4.0
    • First observeddetect_device
    • First observeddiagnose
    • First observedget_listener_frames
    • First observedget_proxy_frames
    • First observedlist_protocols
    • First observedparse_frame
    • First observedparse_pcap
    • First observedplc_read
    • First observedprobe_device
    • First observedstart_listener
    • First observedstart_proxy
    • First observedstop_listener
    • First observedstop_proxy
    • First observedvalidate_frame

TDQS

A4.2/5.0

Scored across 15 tools

Disambiguation5/5

Each tool targets a distinct diagnostic phase: protocol listing, frame parsing/validation, live probing, data reading/browsing, capture via proxy/listener, and final diagnosis. Even the two capture retrieval tools (get_proxy_frames vs get_listener_frames) are clearly separated by capture source, and parser/validator/diagnose have non-overlapping purposes.

Naming Consistency4/5

Most tools follow a clear verb_noun snake_case pattern (list_protocols, validate_frame, probe_device, parse_frame, start_listener, stop_proxy). The only minor deviation is plc_read and plc_browse, which invert the pattern to noun_verb, but the pair is internally consistent and still readable.

Tool Count5/5

15 tools is at the upper edge of the well-scoped range but every tool earns its place in the diagnostic workflow: detection, parsing, validation, capture, reading, browsing, and analysis. There is no redundancy or padding, and the count matches the breadth of the industrial protocol domain.

Completeness5/5

The tool surface covers the full diagnostic lifecycle: detect/probe devices, parse and validate frames, capture live traffic via proxy or listener, retrieve captured frames, browse address spaces, read PLC data, and produce structured diagnoses. The read-only focus is consistent and intentional, with no dead ends in the workflow.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • F
    license
    Not graded
    quality
    A
    maintenance
    MCP server that connects WAGO PLCs to LLM agents via the WDx/WDA REST API, enabling AI assistants to read sensor values, change configuration, trigger firmware updates, or monitor entire PLC fleets without custom code.
    3
    -
  • F
    license
    B
    quality
    B
    maintenance
    Universal MCP server for industrial PLC communication, enabling AI agents to read sensors, alarms, status, setpoints, and write setpoints via adapters for Modbus, S7, or custom PLCs.
    6
    -