Skip to main content
Glama

pod — least-privilege compiler for AI agents

CI Sponsor

Your agent ran for a week. pod compiles what it actually did into the smallest policy it needs.

让 AI Agent 只拥有它真正需要的权限——从真实行为编译最小权限策略。

Record → compile → enforce → prove.

Most agent security tools stop at one of two places: a scanner that tells you what your agent could touch, or a gateway that asks you to hand-write a policy. pod closes the loop — run your agent in record-only mode for a few days, compile a least-privilege policy from its real tool calls, enforce it, and keep tamper-evident evidence for everything that ran.

record real calls ──▶ compile least-privilege policy ──▶ enforce (deny > approve > allow)
       │                        │                                  │
       │                        │                                  ▼
       │                        │                    ┌──────────────────────────┐
       └── SHA-256 hash chain ───┴───────────────────▶│ tamper-evident audit     │
          (every call, hashes only)                  │ verify / export evidence │
                                                     └──────────────────────────┘

中文速览

  • 不是又一个 MCP 网关:网关让你手写策略;pod 从 agent 的真实行为里编译出最小权限策略。

  • 闭环pod record(只录不拦)→ pod policy draft(生成策略 + 与基线 diff)→ 人工复核 → pod serve(执法)。

  • 证据:每一次工具调用进入 SHA-256 哈希链,可校验、可导出为证据包(敏感内容只存哈希)。

  • 本地优先:策略、审计、密钥不出你的机器;Pod Cloud 是可选控制平面。

Related MCP server: Proofpane

See it in 5 minutes

No agent, no account, no data leaves your machine — everything runs in a temp directory:

git clone https://gitee.com/suhuisoftwares/pod.git && cd pod
pnpm install && pnpm build
bash scripts/demo-least-privilege.sh

It seeds a realistic week of tool calls (reads, writes, a delete, and one .env access), then compiles a policy from that corpus and diffs it against a permissive baseline:

## 策略 diff(baseline → draft)

| server     | tool                 | baseline | draft      | 变化     |
|------------|----------------------|----------|------------|----------|
| *          | *                    | allow    | deny       | 默认决策 |
| filesystem | read_file            | allow    | deny       | 收紧     |
| filesystem | write_file           | allow    | approve    | 收紧     |
| filesystem | delete_file          | allow    | deny       | 收紧     |
| github     | create_pull_request  | allow    | approve    | 收紧     |
| shell      | execute_command      | allow    | approve    | 收紧     |
| filesystem | get_file_info        | allow    | (unlisted) | 移除     |

**汇总**:收紧 8 · 新增 0 · 移除 1 · 放宽 0

Two details matter here: read_file is locked down because it touched .env once (observation beats guessing), and get_file_info is removed because it never appeared in the corpus (least privilege = don't grant what you didn't observe).

Install

# macOS / Linux — builds from source, no npm account needed
# 链接钉在发布版上(可复现):想跟主干就把 v0.4.2 换成 main
curl -fsSL https://gitee.com/suhuisoftwares/pod/raw/v0.4.2/scripts/install.sh | sh
# 主源连不上时用 GitHub 镜像(同一个脚本):
# curl -fsSL https://raw.githubusercontent.com/suhui-organization/pod/v0.4.2/scripts/install.sh | sh
pod --help

The installer clones v0.4.2 to ~/.pod/src, builds, and puts pod in ~/.local/bin. Override with POD_SRC, POD_BIN_DIR, POD_REPO_URL, POD_VERSIONPOD_VERSION=main 跟主干)。

中文 / English:CLI 输出支持中英切换——pod --lang en-US <cmd>,或设一次 POD_LANG=en-US(也会读 LC_ALL / LANG)。默认中文;未翻译的句子原样显示, 不会出现空白或 key 名。pod guardpod harden 的报表、威胁目录与交付物 整篇有英文(含 finding 正文与策略草稿的判定依据),由 CI 断言守门。 覆盖进度自查:bash scripts/i18n-coverage.sh (列出还没英文词条的串和词表里的僵尸键,--strict 有缺口时退出 1);控制台另有 真机逐页验收 bash scripts/web-acceptance.sh(指到 k8s 后端、无头 Chrome 点一遍, 断言"每页都渲染了内容且没有非数据中文")。

Run the MCP gateway as a container

同一个网关也能以自包含镜像运行:镜像里已经构建好 CLI、预装了上游 filesystem server, 默认用 baseline 策略(只读工具放行,写操作进审批),从 stdio 暴露 MCP。

docker build -f deploy/Dockerfile.mcp -t pod-mcp .
docker run -i --rm pod-mcp        # 接到任意 MCP 客户端即可(stdio)

要换成别的上游 server 或策略,覆盖 entrypoint 参数即可;默认等价于 pod serve --agent glama --server filesystem --command mcp-server-filesystem --arg /workspace。 (公开目录收录时要求的检查也是这两步:进程能启动、能响应 initialize / tools/list。)

Requires Node.js ≥ 22.13 (pnpm 11's runtime floor) and git.

What's in this repo

一个仓库包含完整闭环:本地在 agent 机器上执法,云端(可选)做跨机器视图。

路径

是什么

怎么装

packages/

核心库:策略求值、审计哈希链、网关、能力图、控制平面姿态、身份/委托/JIT、扫描器

pnpm install && pnpm build

apps/cli

pod 命令行(网关 + 策略编译 + 证据 + 控制平面命令)

bash scripts/install.sh

apps/web

本地控制台(pod ui:读为主,写操作只有纳管/移除)

随 CLI 构建

cloud/server

可选云端控制平面后端(FastAPI):agent 注册、审计同步、策略中心、告警、时间线、控制平面事件

bash deploy/install.sh

cloud/web

云端控制台前端(Vue 3 + Element Plus)

同上(随 docker 构建)

deploy/

一键部署:install.sh + docker-compose.yml + .env.example(含每个配置项说明)

bash deploy/install.sh

cloud/server/deploy/k8s/

Kubernetes 清单(参考,适合本机 kind/Docker-Desktop 集群)

bash cloud/server/deploy/k8s/install-local.sh

能力与价值速览见 docs/FEATURES.md

From source:

git clone --branch v0.4.2 --depth 1 https://gitee.com/suhuisoftwares/pod.git && cd pod
pnpm install && pnpm build
node apps/cli/dist/index.js --help

npm i -g @podsec/cli is not live yet — use the installer above until the package is published.

From zero to enforcement

pod scan                              # 1. see what is exposed (read-only)
pod onboard                           # 2. preview the takeover plan (dry-run)
pod onboard --yes                     #    wrap agents in record-only mode (backups kept)
# ... use your agents normally for a day or two ...
pod policy draft --diff <baseline>    # 3. compile least-privilege policy + show the diff
pod lint --policy ~/.pod/policies/draft.json
pod serve --agent <name> --server <name> --policy ~/.pod/policies/draft.json \
  --command <cmd> --arg <value>       # 4. switch to enforcement
pod watch                             # 5. approve high-risk calls from a second terminal
pod verify-audit                      #    tamper check over the whole chain
pod export-evidence                   #    verifiable evidence bundle

What pod is / is not

pod is

pod is not

A policy compiler: turns real tool-call corpora into least-privilege rules

A sandbox or a container runtime

A policy enforcement point on the MCP boundary (fail-closed)

A replacement for your agent's own sandbox

A tamper-evident audit + evidence layer across agents

An LLM content-moderation firewall

Local-first: policies, audits and secrets stay on your machine

A cloud service that needs your logs

Compared with the rest of the market: platform-native sandboxes (Claude Code, Codex, Gemini CLI) protect one agent; MCP gateways (agentgateway, ToolHive, ContextForge, Docker) give you a place to enforce hand-written rules; scanners (Snyk Agent Scan, mcp-guard) tell you what is exposed. pod is the missing step between "what is exposed" and "what is allowed": it writes the policy for you from observed behavior, then proves what happened.

Core capabilities

  • pod policy draft — compile a least-privilege policy from recorded calls. Read-only tools → allow, write/exec → approve, destructive → deny; any observed sensitive-path or secret hit forces deny. --diff <baseline.json> prints exactly what got tightened, added, removed or loosened.

  • Policy gate — evaluated deny > secrets-input > approve > allow, fail-closed by default; unlisted servers/tools are denied.

  • Approval gate — high-risk calls suspend and wait for a human; timeout fails closed; approvals are recorded with approver + reason.

  • Tamper-evident audit — append-only SHA-256 hash chain; pod verify-audit detects any historical edit; sensitive content is stored as hashes only.

  • Evidence bundlespod export-evidence / pod verify-evidence produce and verify a portable evidence bundle plus a one-page report.

  • Secret gates — sensitive input paths (.env, .ssh, .aws, …), known-format output regexes, and high-entropy fallback detection for unknown secret formats.

  • Rollback pointspod serve --snapshot captures write operations; pod rollback restores files.

  • Coverage + driftpod coverage --strict exits non-zero when an MCP server is bypassing the gateway.

  • Supply-chain gate (T4) — the gateway validates the declared server source (command / package / version) before startup.

  • Control-plane posture (pod posture) — same rules, applied to the control plane: lifecycle hooks, frozen config, memory files, MCP package sources, agent identities, delegation chains. Drift is reported against a pod posture freeze baseline; --strict exits 1.

  • User-owned rules — every verdict comes from ~/.pod/rules.json (or --rules <file>): risk patterns, severities, thresholds, trusted sources, egress lists. Code ships defaults; you own the decisions. Invalid rules fail closed.

  • Hardening audit deliverable (pod harden) — one command runs multi-harness scan + exposure scan + control-plane posture + least-privilege compilation + evidence export and writes a client-ready report directory: executive summary, scope and method, prioritized to-dos with runnable commands, an honest coverage-boundary section, and a per-file sha256 manifest. --client / --auditor / --engagement stamp the cover; pod harden --verify <dir> lets the recipient re-check every artifact by hash without trusting the sender. Local only, never uploaded; secrets appear as masks, never prefixes.

  • Continuous agent/harness guard (pod guard) — scans 16 harnesses (Claude Code, Codex, Cursor, DSH, OpenClaw, OpenCode, Gemini CLI, Windsurf, Zed, VS Code, Cline, Kilo, Amazon Q, Copilot CLI, Amp, Continue), 5 config formats (incl. Codex TOML) plus project-level .mcp.json / .cursor/mcp.json / .vscode/mcp.json, and reports against an 18-entry threat catalog (AG-01…AG-18, each with cited sources and an honest coverage verdict). Output opens with the three things to do first — each a copy-paste pod command bound to the harness it affects (pod agents enroll --harness claude-code) plus the command that confirms it worked — then the vulnerability list and a prioritized recommendation list, and finally a hand-off to the deliverable (pod harden). pod guard baseline + pod guard watch make it continuous: it only speaks on new/changed/gone findings and writes those to the hash chain. pod guard remediate --llm has a model draft proposals from an outbound allowlist that carries no paths, no hostnames and no config text; rule deltas must pass the same relaxation guard as pod rules apply, and any non-pod command is stripped.

  • Enrollment from the console (pod agents / the "Enroll" button) — one click scans the host for installed harnesses and lists them as cards with their evidence, MCP-server count, how many of those bypass the gateway, and their pod guard finding counts. Enrolling an agent creates an ed25519 identity, a zero-permission policy (unregistered servers denied) and an audit directory, then appends kind=identity / config-change events to that agent's hash chain — so pod sync carries them to the cloud's control-plane view (machine-wide facts stay on the local _control chain). It never rewrites harness configuration — that stays with pod onboard --yes (which backs up and can revert). Enrolling is idempotent, removable (forget, identity kept by default), and pod ui --read-only turns the whole write path off. The console's POST endpoints require the token, Content-Type: application/json and a same-origin Origin.

  • Takeover (pod agents onboard / the "Take over" button) — step two: rewrites each MCP server's command to pod serve --record-only … --command <original> so calls actually cross the gateway. Because it edits your files, the console shows the before/after command per server, the backup path and the "records but does not block" caveat before you confirm. It only touches user-level configs (never repo-level .mcp.json), refuses to run when pod is not on PATH (a broken wrapper would take every MCP server down), and reuses your existing zero-permission policy instead of writing an allow:['*'] template — so dropping --record-only later fails closed rather than open. pod agents revert --agent <name> restores from the most recent .pod-backup-*.

  • Enforcement switch (pod agents enforce / the "Enforce" button) — step three: drops --record-only and points the wrapper at your compiled policy, so the gateway actually decides. The failure mode here is not "broke the config" but "looks enforced while protecting nothing", so it hard-refuses unless a policy exists that is bound to the agent, has server rules, and is not allow:["*"] — and the dialog shows which policy is in force, its allow/approve/deny counts and how much corpus it was compiled from. Switching back to record-only, or "restore config" (which undoes one step at a time), are both one click.

  • Subscribed rules (pod rules) — rules ship as signed Ed25519 packs (pack / verify / apply / pull). Network sources must be verified. A pack that would loosen any of your existing rules is refused unless you pass --allow-relax, so an "update" can never silently weaken your posture.

  • Policy red team (pod redteam) — attack scenarios are drilled against your policy through the same pure pipeline the gateway uses (decideCall), so "blocked" means blocked in production too, and the results are reproducible in CI. A model can propose scenarios (--llm), but only as data: it never gets a verdict, never gets execution, and never touches an MCP server. Only the capability surface (server/tool names + verdicts) leaves the machine, and every model call is written to the hash chain as kind=llm-call.

  • Agent identities + delegation narrowing (pod identity / pod delegate) — ed25519 keypair per agent; delegations are signed hop-by-hop and must narrow capabilities; --ttl bounds every hop.

  • JIT grants (pod grant) — signed, time-boxed, scope-limited tokens; a valid grant satisfies an approve decision without a human in the loop, and single-use grants are consumed atomically.

  • Circuit breaker (pod quarantine) — quarantine an agent and the gateway denies its calls on the next invocation (no restart), with the decision written to the audit chain.

  • Trust-propagation anomalies + pollution tracing (pod anomaly / pod trace) — thresholds from rules.anomaly; trace walks the delegation chain and the audit chain to find where a poisoned agent came from and who it could reach.

Policy example

{
  "version": "0.1.0",
  "agent": "openclaw",
  "defaultDecision": "deny",
  "servers": {
    "filesystem": {
      "allow":   ["read_file", "list_directory", "search_files"],
      "approve": ["write_file", "edit_file"],
      "deny":    ["delete_file"]
    }
  },
  "secrets": {
    "deny_input_paths": ["~/.ssh", ".env", "credentials", "id_rsa", ".aws", "known_hosts"],
    "deny_output_matching": ["ghp_[A-Za-z0-9]{36}", "sk-[A-Za-z0-9]{20,}", "AKIA[0-9A-Z]{16}"],
    "entropy": { "enabled": true, "min_length": 24, "threshold": 4.5, "block": true }
  }
}

CLI

pod init            scaffold policy templates (baseline / record)
pod onboard         discover local MCP servers and wrap them behind pod (dry-run by default)
pod serve           run the gateway (stdio / Streamable HTTP)
pod record          record-only mode: log every call without blocking (corpus collection)
pod policy draft    compile a least-privilege policy from real calls (+ --diff baseline)
pod approve|deny|pending   side-channel approvals
pod watch           resident approval queue
pod snapshots       list write-operation snapshots (rollback points)
pod rollback        restore files from a snapshot (serve --snapshot enables capture)
pod timeline        audit timeline filtered by agent / tool / time
pod verify-audit    verify the full hash chain, emit a report
pod digest          local weekly security digest (no network)
pod coverage        managed vs. unmanaged MCP servers; --strict exits 1 on drift
pod export-evidence / verify-evidence   export & verify evidence bundles
pod lint | doctor   policy lint / environment health
pod scan            free local security scan (config & bypass checks)
pod guard [scan]    continuous multi-agent / multi-harness vulnerability scan → vulnerability list + prioritized recommendations
pod guard watch     re-scan on an interval; speaks only on new/changed/gone findings, records them in the audit chain
pod guard remediate --llm   model drafts hardening proposals (never auto-applied; must pass the relaxation guard)
pod guard catalog   the threat catalog (AG-01…AG-18) with sources and pod's coverage for each
pod agents [scan]   list the harnesses installed on this machine (and whether each is already enrolled)
pod agents enroll --harness <id>   enroll one: identity + zero-permission policy + audit dir (never touches harness config)
pod agents onboard --harness <id> [--yes]   take over (rewrite that harness's MCP servers to go through the gateway; backup + revert)
pod agents enforce --harness <id> [--record-only] [--yes]   switch to enforcement (or back to record-only) — refuses unless a compiled policy exists
pod agents revert --agent <name>   restore the config from the most recent .pod-backup-*
pod agents forget --agent <name>   remove the enrollment (policy deleted; identity kept unless --purge-identity)
pod ui [--read-only]   local console; the "Scan this machine" + "Enroll" + "Take over" buttons call the same write paths as pod agents
pod harden          one-shot hardening audit: harness scan + exposure + posture + policy draft + evidence → client-ready report directory (--verify re-checks a delivered one)
pod posture [freeze]   control-plane posture: hooks / frozen config / memory / packages / identities / delegations
pod rules              rule packs for subscribed hardening: show | pack | verify | apply | pull
pod redteam            attack scenarios vs. your policy (offline built-in library, or --llm generated); exit 1 on a high-severity bypass
pod identity           per-agent ed25519 identity: init | list | verify
pod delegate           signed delegation: issue | verify | check (capability narrowing)
pod grant              JIT capability tokens: issue | list (signed, TTL, scope, single-use)
pod quarantine         circuit breaker: list | add | remove (enforced by the gateway)
pod anomaly            convention-burst / capability-spread signals over the rules window
pod trace <agent>      pollution tracing: delegation chain + related audit entries
pod graph build     static capability graph from agent configs + tool schemas
pod graph toxic     source→sink toxic paths + targeted policy diff
pod graph explain   trace a path back to evidence
pod sync / pull-policy   optional Pod Cloud sync & policy distribution

Supported agents

Agent

Transport

Status

Hermes

Streamable HTTP

✅ verified end-to-end

OpenClaw

stdio wrapper

✅ verified end-to-end

Codex

stdio wrapper + PostToolUse hook

✅ ready (see docs)

DSH / Claude Code / Cursor

MCP

pluggable via MCP

Documentation

云端控制平面原先分两个独立仓库(podcloud-server / podcloud-web), 已并入本仓库 cloud/ 下并归档原仓库——历史链接会看到指向这里的告示。

Pod Cloud (optional, in this repo)

本地部分开箱可用,云端是可选的:没有它,pod 照样编译策略、执法、留证据。 需要跨机器/跨 agent 的统一视图、策略下发、告警与合规报告时,一条命令起一个:

bash deploy/install.sh            # 单机 Docker Compose(首次 2-5 分钟)
# 或带管理员:ADMIN_EMAIL=you@x.com ADMIN_PASSWORD='...' bash deploy/install.sh

数据方向是单向的:本地只推 SHA-256 哈希上云,审计原文不出你的机器;云端不参与本地执法(云端挂了 agent 不受影响)。 必填配置只有一项(JWT 密钥,脚本自动生成),其余见 docs/deploy-cloud.md

Sponsor

pod is Apache-2.0 and stays that way: the CLI, the gateway, the audit chain and the evidence export are complete on your own machine, and nothing is locked behind a sponsorship. Sponsorship pays for the parts that do not demo well — CI minutes, a machine to run the multi-harness attack suites on, and the security maintenance that only shows up as absence of incidents.

The only official channel is GitHub Sponsors: github.com/sponsors/suhui-organization (or the Sponsor button at the top of this repository).

赞助不是解锁功能的前置条件——核心能力本地全都有。不给钱也一样欢迎:提一个真实的 误报、贴一份 pod scan 的输出、或者帮下一个人装起来,都是等价的帮忙。

License

Apache-2.0 — see LICENSE. Security notes: SECURITY.md.

Available Tools

14 tools
create_directoryCreate DirectoryA
Idempotent

Create a new directory or ensure a directory exists. Can create multiple nested directories in one operation. If the directory already exists, this operation will succeed silently. Perfect for setting up directory structures for projects or ensuring required paths exist. Only works within allowed directories.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
contentYes

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations provide idempotent and non-destructive; description adds that existing directories succeed silently and that operation is scoped to allowed directories, providing full behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four concise sentences, each adding distinct value without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers behavior, constraints, and use cases; missing return value info but not critical for simple creation tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has no description for 'path' and description doesn't specify format or examples; since coverage is low, this is a gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clear verb 'create' and resource 'directory'; distinguishes from sibling tools by mentioning nested creation and idempotent behavior.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states ideal use cases (setting up structures, ensuring paths) and constraint (only within allowed directories), giving clear when-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

directory_treeDirectory TreeB
Read-only

Get a recursive tree view of files and directories as a JSON structure. Each entry includes 'name', 'type' (file/directory), and 'children' for directories. Files have no children array, while directories always have a children array (which may be empty). The output is formatted with 2-space indentation for readability. Only works within allowed directories.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes
excludePatternsNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
contentYes

TDQS

B3.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds behavioral detail beyond the readOnlyHint annotation by specifying the recursive nature and JSON structure of the output. It also mentions the constraint of working only within allowed directories, which is useful context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise (two sentences) and well-structured, with no redundant information. Every sentence adds meaningful detail about the tool's behavior and constraints.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

While the description mentions 'within allowed directories', it fails to explain the required 'path' parameter or the optional 'excludePatterns' parameter. Given the schema has no descriptions and the output schema is not visible, the description is insufficient for full usage clarity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has zero description coverage, and the tool description does not explain any of the two parameters (path and excludePatterns). Without compensation, the agent cannot fully understand what values are valid or how they affect the output.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific verb ('Get') and resource (recursive tree view). It distinguishes from sibling tools like list_directory by emphasizing 'recursive', making its purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines1/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance is provided on when to use this tool versus alternatives. It does not mention that list_directory or search_files are better suited for flat or filtered needs, leaving the agent to infer usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

edit_fileEdit FileA
Destructive

Make line-based edits to a text file. Each edit replaces exact line sequences with new content. Returns a git-style diff showing the changes made. Only works within allowed directories.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes
editsYes
dryRunNoPreview changes using git-style diff format

Output Schema

ParametersJSON Schema
NameRequiredDescription
contentYes

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes beyond the annotations by revealing that the tool returns a git-style diff and is restricted to allowed directories. It confirms the destructive nature (edits) consistent with the destructiveHint annotation but adds useful behavioral context about the output and scope. It does not fully disclose edge-case behaviors (e.g., multiple matches, error handling), but the additional information is valuable.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, consisting of two short sentences. It packs essential information—purpose, mechanism, output, and constraint—without any redundant or fluff content. Every sentence adds value, and the structure is straightforward and easy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with three parameters and a nested edits array, the description provides sufficient context to understand the main functionality: line-based edits with exact matching and a diff result. It also covers the directory restriction. It omits details like error handling when oldText is not found, the exact format of the diff, and the behavior of dryRun, but these are not critical for a basic understanding. The description is complete enough for typical usage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description explains the core semantics of the edits array by stating that each edit replaces exact line sequences (oldText) with new content (newText). It also indirectly describes the path via the allowed-directories constraint and mentions the diff output, which relates to the dryRun parameter (though not explicitly named). However, it does not clarify the dryRun flag's purpose or behavior, and path semantics are only implied, so coverage is partial given three parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: making line-based edits to a text file. It specifies the action (edits), the resource (text file), and the specific mechanism (replacing exact line sequences). It also distinguishes itself from sibling tools by mentioning the git-style diff output and the restriction to allowed directories, making its scope clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when to use the tool (for precise line-based changes) by explaining that it replaces exact line sequences and returns a diff, but it does not explicitly compare it to alternatives like write_file or search_files. The constraint 'Only works within allowed directories' is more of a limitation than a usage guideline, so the guidance is implicit rather than explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_file_infoGet File InfoA
Read-only

Retrieve detailed metadata about a file or directory. Returns comprehensive information including size, creation time, last modified time, permissions, and type. This tool is perfect for understanding file characteristics without reading the actual content. Only works within allowed directories.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
contentYes

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description accurately reflects the readOnlyHint annotation by framing the operation as retrieval with no side effects. It adds the meaningful constraint that it only works within allowed directories, though it does not describe error behavior for invalid paths.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well-structured, using two sentences to convey purpose, output content, and constraints without extraneous detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple metadata-retrieval tool, the description covers the key aspects: what it returns, that it does not read content, and the access boundary. It lacks explicit error/edge-case details, but these are not critical given the read-only, closed-world annotations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description does not mention the 'path' parameter at all, and the input schema provides only its type and required status. Since schema coverage is 0%, the description fails to compensate by explaining what the path should refer to.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific action ('Retrieve') and resource ('detailed metadata about a file or directory'), and explicitly distinguishes itself from content-reading tools by noting it returns metadata without reading content. This clearly differentiates it from siblings like read_file and list_directory.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides clear context on when to use it ('understanding file characteristics without reading actual content') and states the allowed-directory constraint. It does not explicitly enumerate alternative tools, but the intended use case is evident from the description.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_allowed_directoriesList Allowed DirectoriesA
Read-only

Returns the list of directories that this server is allowed to access. Subdirectories within these allowed directories are also accessible. Use this to understand which directories and their nested paths are available before trying to access files.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
contentYes

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses that the tool returns allowed directories and that subdirectories are also accessible, adding useful behavioral context. Since readOnlyHint=true is already annotated, the description does not need to restate read-only behavior but still provides additional scope information.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, front-loaded with the primary purpose, and then provides usage context. No redundant information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simplicity of the tool (no parameters) and the presence of an output schema, the description fully covers the purpose and usage. No missing information for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the schema coverage is 100% by definition. Baseline for 0 params is 4; the description appropriately does not need to add parameter-specific details.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool returns the list of allowed directories, distinguishing it from sibling tools like list_directory or read_file. It is specific about the resource (allowed directories) and the action (listing).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly tells the agent when to use it: before trying to access files, to understand which directories and nested paths are available. This provides clear guidance and implicitly contrasts with guessing directory paths.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_directoryList DirectoryB
Read-only

Get a detailed listing of all files and directories in a specified path. Results clearly distinguish between files and directories with [FILE] and [DIR] prefixes. This tool is essential for understanding directory structure and finding specific files within a directory. Only works within allowed directories.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
contentYes

TDQS

B3.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The readOnlyHint annotation indicates no modifications, and the description does not contradict this. It adds the constraint of working only within allowed directories, which is useful context beyond the annotation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well-structured, with the purpose stated first and the prefix detail second. The third sentence contains some redundant fluff about being essential, but overall it is efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description mentions the [FILE] and [DIR] prefixes but does not specify whether the listing is recursive or how the paths are formatted. It also lacks information about error handling or the exact output structure, leaving some gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The only parameter 'path' is described merely as 'a specified path' in the description, with no details on format (relative/absolute) or constraints. Since the schema has no description, the tool description fails to adequately define the parameter semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states that the tool lists files and directories in a given path and highlights the [FILE] and [DIR] prefixes. It distinguishes from sibling tools by focusing on a simple listing, though it doesn't explicitly contrast with directory_tree or list_directory_with_sizes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for exploring directory structure and finding files, but it does not explicitly specify when to prefer this over search_files or directory_tree. It provides a constraint that it only works within allowed directories, but lacks direct comparisons to alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_directory_with_sizesList Directory with SizesB
Read-only

Get a detailed listing of all files and directories in a specified path, including sizes. Results clearly distinguish between files and directories with [FILE] and [DIR] prefixes. This tool is useful for understanding directory structure and finding specific files within a directory. Only works within allowed directories.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes
sortByNoSort entries by name or sizename

Output Schema

ParametersJSON Schema
NameRequiredDescription
contentYes

TDQS

B3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds useful behavioral context beyond the readOnlyHint and openWorldHint annotations by stating that the tool only works within allowed directories and that results use [FILE] and [DIR] prefixes. This does not contradict the annotations and gives the agent additional expectations about output and constraints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is reasonably concise at three sentences, but the sentence 'This tool is useful for understanding directory structure and finding specific files within a directory' adds little value and could be removed or replaced with more specific guidance. The core information is present without excessive verbosity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the output schema exists, return-value details are not required, but the description omits important operational details such as whether listing is recursive, how hidden files are handled, and what path values are valid. It also lacks differentiation from list_directory, leaving the agent without enough context to confidently select and invoke this tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is only 50%: sortBy has a description and enum, but path has no description. The tool description does not compensate by explaining path format, whether it must be absolute/relative, or how it relates to allowed directories. This leaves a key parameter underspecified.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: to get a detailed listing of files and directories in a specified path, including sizes. It also mentions the distinguishing [FILE] and [DIR] prefixes, which sets it apart from the sibling list_directory, though it does not explicitly name the alternative.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no explicit guidance on when to use this tool versus the sibling list_directory or other tools. The phrase 'useful for understanding directory structure and finding specific files' is generic and applies equally to list_directory, so it does not help an agent choose between them.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

move_fileMove FileA
Destructive

Move or rename files and directories. Can move files between directories and rename them in a single operation. If the destination exists, the operation will fail. Works across different directories and can be used for simple renaming within the same directory. Both source and destination must be within allowed directories.

ParametersJSON Schema
NameRequiredDescriptionDefault
sourceYes
destinationYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
contentYes

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description reveals a key behavioral trait: the operation fails if the destination already exists, which prevents accidental overwrites. This complements the annotations (destructiveHint=true, readOnlyHint=false) by specifying a concrete safety behavior. However, it does not explicitly state that the source is removed after a successful move, though this is implied by the semantics.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and to the point, but it contains slight redundancy (e.g., 'Can move files between directories and rename them in a single operation' appears twice with similar phrasing). Overall, it is efficient and not verbose, fitting within a couple of sentences.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the primary behavior and a critical failure condition, which is sufficient for a basic move operation. It does not describe the output (likely void or a confirmation), but this is not essential for the agent to invoke the tool correctly. The context provided by the description and annotations is adequate for the given complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema provides only parameter names (source, destination) with no descriptions. The tool's name and description imply they are file paths, but the description does not elaborate on expected formats, relative vs. absolute paths, or whether directories are allowed. The basic intent is clear, but the lack of explicit detail leaves some ambiguity for edge cases.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: moving and renaming files/directories. It explicitly differentiates between moving across directories and renaming, and the verb 'Move' is specific enough to distinguish it from other file operation tools like read, write, or edit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains what the tool does but does not provide explicit guidance on when to use it versus alternatives (e.g., copy, edit). The mention of 'move between directories or rename' gives some context, but no direct comparison or conditional advice is given, leaving the decision to the agent's inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

read_fileRead File (Deprecated)A
Read-only

Read the complete contents of a file as text. DEPRECATED: Use read_text_file instead.

ParametersJSON Schema
NameRequiredDescriptionDefault
headNoIf provided, returns only the first N lines of the file
pathYes
tailNoIf provided, returns only the last N lines of the file

Output Schema

ParametersJSON Schema
NameRequiredDescription
contentYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already provide readOnlyHint and openWorldHint, so the safety profile is covered. The description adds useful non-annotation context: the tool is deprecated and returns file contents as text. This goes beyond what the structured annotations alone communicate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences contain the core operation and the deprecation directive. The critical information is front-loaded, and there is no filler or repetition of schema details.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a deprecated read-only tool with an output schema present, this description is complete: it states the operation, the return type, the deprecation status, and the replacement tool. Remaining behavioral details such as partial reads are already present in the schema, so nothing critical is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 67%; head and tail are documented in the schema, and path is self-evident from its name and type. The description adds no further parameter-level meaning, but the existing schema coverage is adequate enough that the description does not need to compensate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: 'Read the complete contents of a file as text.' The DEPRECATED label and pointer to read_text_file make the differentiation from sibling tools explicit. There is no ambiguity about what this tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says 'DEPRECATED: Use read_text_file instead.' This is direct when-not-to-use guidance and names the exact alternative. An agent can immediately route to the correct tool without needing sibling-tool inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

read_media_fileRead Media FileA
Read-only

Read a file and return it as a base64-encoded content block with its MIME type. Image and audio files are returned as image/audio content; any other file type is returned as an embedded resource. Only works within allowed directories.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
contentYes

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds the constraint about allowed directories, which is not present in the annotations. It is consistent with the readOnlyHint and does not introduce any side effects, but does not describe error behavior or failure modes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences, concise and directly to the point. No extraneous information is included.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description provides enough information about the output format and behavior for different file types for an agent to use the tool effectively. It does not detail the output schema or error handling, but these are not critical for a simple read operation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The path parameter is not described in the schema or the tool description beyond the context of reading a file. This is adequate for a simple string path, but lacks any detail about expected format or validation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool reads a file and returns a base64-encoded content block with its MIME type. It also distinguishes behavior for image/audio versus other file types, making its purpose distinct from sibling tools like read_file and read_text_file.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description mentions the restriction that it only works within allowed directories, but does not explicitly state when to prefer this tool over alternatives such as read_file or read_text_file. This leaves some room for inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

read_multiple_filesRead Multiple FilesA
Read-only

Read the contents of multiple files simultaneously. This is more efficient than reading files one by one when you need to analyze or compare multiple files. Each file's content is returned with its path as a reference. Failed reads for individual files won't stop the entire operation. Only works within allowed directories.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathsYesArray of file paths to read. Each path must be a string pointing to a valid file within allowed directories.

Output Schema

ParametersJSON Schema
NameRequiredDescription
contentYes

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint annotation, the description adds valuable behavioral detail: operation can partially succeed, individual file failures don't stop the batch, results include the path as a reference, and access is limited to allowed directories. These are the kind of behaviors an agent needs to know and the annotations do not provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four tight sentences, each adding relevant information: purpose, when to use it, return shape, failure behavior, and scope. There is no filler, and the most important content comes first.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With one parameter, complete schema coverage, an output schema, and helpful annotations, the description covers everything needed to call it correctly: partial-failure semantics, per-file path referencing, and directory restrictions. Nothing critical is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage for the single 'paths' parameter is 100%, so the baseline is 3. The description adds some context about multi-file behavior but does not provide any per-parameter semantics beyond what the schema already states about paths pointing to valid files within allowed directories.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Read the contents of multiple files simultaneously.' It further distinguishes itself from single-file reads by noting its efficiency when analyzing or comparing multiple files, so an agent can clearly tell it apart from read_file and similar siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly says when to use this tool: 'more efficient than reading files one by one when you need to analyze or compare multiple files.' It also notes the allowed-directory constraint. However, it does not explicitly address read_text_file or read_media_file, so the guidance is clear but not exhaustive.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

read_text_fileRead Text FileA
Read-only

Read the complete contents of a file from the file system as text. Handles various text encodings and provides detailed error messages if the file cannot be read. Use this tool when you need to examine the contents of a single file. Use the 'head' parameter to read only the first N lines of a file, or the 'tail' parameter to read only the last N lines of a file. Operates on the file as text regardless of extension. Only works within allowed directories.

ParametersJSON Schema
NameRequiredDescriptionDefault
headNoIf provided, returns only the first N lines of the file
pathYes
tailNoIf provided, returns only the last N lines of the file

Output Schema

ParametersJSON Schema
NameRequiredDescription
contentYes

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already indicate readOnlyHint and openWorldHint. The description adds context about error messages and the restriction to allowed directories, which goes beyond the annotations and clarifies expected behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is information-dense without being verbose. It front-loads the core purpose and then explains the head/tail options and constraints. All sentences contribute meaningful details, though a slight redundancy exists in repeating the purpose at the start.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers when to use the tool, what it does, and its constraints (allowed directories, encoding handling). Since an output schema is present (as indicated), the absence of return-format details is acceptable. Overall, an agent has sufficient context to call this tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema covers head and tail descriptions (67% coverage). The description explicitly explains the head and tail parameters and their partial-read behavior. The path parameter is not described in the schema, but its role is implied by the tool's purpose and the 'single file' wording, so the description compensates adequately.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (read), the resource (file), and the scope (complete contents as text). It distinguishes itself from siblings like read_media_file and read_multiple_files by explicitly mentioning 'as text' and 'single file', so an agent can select it appropriately.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly states when to use the tool ('when you need to examine the contents of a single file') and explains head/tail for partial reads. It does not explicitly state when not to use it, but the sibling names and the 'single file' and 'as text' qualifiers provide implicit alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_filesSearch FilesA
Read-only

Recursively search for files and directories matching a pattern. The patterns should be glob-style patterns that match paths relative to the working directory. Use pattern like '.ext' to match files in current directory, and '**/.ext' to match files in all subdirectories. Returns full paths to all matching items. Great for finding files when you don't know their exact location. Only searches within allowed directories.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes
patternYes
excludePatternsNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
contentYes

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses key behaviors: recursive search, returning full paths, glob-style pattern matching, and restricting to allowed directories. It does not contradict the readOnlyHint annotation. However, it omits details about edge cases (e.g., no matches) which might be expected but are covered by the output schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is succinct and well-organized. It provides essential information in a few sentences, includes illustrative examples, and avoids unnecessary jargon or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the core functionality, usage context, and constraints (allowed directories). It does not address error conditions or performance implications, but the output schema likely defines return structure, and the sibling tools list offers alternatives. Overall it is reasonably complete for the tool's complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description explains the 'pattern' parameter well with examples and clarifies path relativity, but it does not explicitly define the 'path' parameter or mention 'excludePatterns' at all. Since schema coverage is 0%, the description only partially compensates for the missing parameter documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Recursively search for files and directories matching a pattern.' It also provides concrete examples of pattern usage, making the intended action and resource unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description notes it is 'Great for finding files when you don't know their exact location,' which gives a clear use case. It also implies a contrast with tools like read_file or list_directory, though it does not explicitly name alternatives or provide a decision tree.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

write_fileWrite FileA
DestructiveIdempotent

Create a new file or completely overwrite an existing file with new content. Use with caution as it will overwrite existing files without warning. Handles text content with proper encoding. Only works within allowed directories.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes
contentYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
contentYes

TDQS

A4.4/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the destructiveHint annotation, the description adds behavioral details: overwrites without warning, handles text encoding, and only works within allowed directories. This provides transparency about side effects and constraints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, with three sentences covering purpose, caution, and constraints. It is well-structured and contains no unnecessary information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the essential aspects: purpose, caution, text handling, and directory restrictions. It does not mention output/return values, but an output schema exists, so that is not required. It could mention idempotency or error conditions, but these are not critical for basic usage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema provides only types for path and content with no descriptions, and the description does not elaborate on these parameters. While straightforward, the description adds no meaning beyond the parameter names.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action (create/overwrite), the resource (file), and the scope (new content vs. existing file), distinguishing it from sibling tools like edit_file or create_directory.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly warns about overwriting without confirmation and notes the constraint of allowed directories, giving clear guidance on when to use this tool and what to expect.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 14 tool updatesv0.3.2
    • First observedcreate_directory
    • First observeddirectory_tree
    • First observededit_file
    • First observedget_file_info
    • First observedlist_allowed_directories
    • First observedlist_directory
    • First observedlist_directory_with_sizes
    • First observedmove_file
    • First observedread_file
    • First observedread_media_file
    • First observedread_multiple_files
    • First observedread_text_file
    • First observedsearch_files
    • First observedwrite_file

TDQS

A3.7/5.0

Scored across 14 tools

Disambiguation4/5

Most tools have distinct purposes, but there is overlap between read_file (deprecated) and read_text_file, and between list_directory and list_directory_with_sizes. The descriptions clearly differentiate them, so an agent should select correctly, though the redundancy is slightly confusing.

Naming Consistency4/5

Tool names predominantly follow a verb_noun snake_case pattern (e.g., read_text_file, create_directory, move_file). Minor deviation: directory_tree uses a noun-only name, and read_file is deprecated but retained. Overall, the pattern is predictable and consistent.

Tool Count5/5

With 14 tools, the server covers file system operations without being bloated. Each tool serves a clear purpose (read, write, edit, list, move, search, metadata), and the count is appropriate for the domain.

Completeness3/5

The surface covers reading, writing, editing, moving, listing, searching, and metadata retrieval, but lacks delete operations for files or directories. This is a notable gap that would require workarounds or fail typical file management workflows. Copy functionality is also absent, though move partially covers it.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    A
    maintenance
    Local zero-trust permission gateway for AI agents. Enforces policy-based tool authorization, human approvals, scoped permissions, and cryptographically verifiable audit logs.
    4
    115 PyPI
    5
    Apache 2.0
  • A
    license
    B
    quality
    A
    maintenance
    A governance proxy for AI tools — every MCP/agent tool call is policy-gated, secret-redacted, and written to a hash-chained, offline-verifiable audit trail.
    13
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    Governed MCP gateway that lets AI agents call tools with policy enforcement, prompt-injection screening, a kill-switch, and tamper-evident signed audit logs.
    Apache 2.0
  • A
    license
    Not graded
    quality
    B
    maintenance
    A local-first MCP server that lets AI agents use gated APIs without holding keys, enforcing declarative policies, injecting secrets server-side, and auditing access without content.
    2
    Apache 2.0