Skip to main content
Glama
WARNING

This MCP is under development. there's a bunch of security issues and crashes. Don't use it on your project

agy-worker-mcp

An MCP server that runs the Google Antigravity CLI (agy) as an asynchronous worker agent, callable from Claude Code, Codex, and any other MCP client.

Jobs are detached from the client that started them: a job's process outlives the MCP connection, its stdout/stderr are redirected to files rather than piped, and its state lives in a project-local SQLite database. Any client connected to the same project can start a job, watch it, take it over after its original caller disconnected, or resume its conversation later.

Why detached jobs

agy runs turns that take minutes to an hour. A plain stdio MCP server tied to one client's process would lose the job the moment that client disconnects, and would give a second client (Codex checking on a job Claude Code started) no way to see it. Detaching the process, redirecting its output to disk, and coordinating through SQLite makes the job durable and visible independent of who is currently connected.

Related MCP server: agy-headless-bridge MCP server

The one fact that matters most

agy's own exit code and status cannot be trusted. A permission denial and a sandbox network block both surface as exit 0 / status: SUCCESSagy itself does not know it was blocked, and will often report success after quietly failing or working around the block.

Every result this server returns carries a broker-computed outcome, derived from actual events, exit status, and filesystem checks, kept deliberately separate from agy's self-report (agent_report). Read outcome and contract_status; never agent_report.status.

Requirements

  • Node.js ≥ 22.5

  • The agy CLI on PATH (developed against 1.1.23). agy_capabilities tells you whether the server can find it.

Install

Not published to npm yet. Install straight from GitHub:

npm install -g github:thezoot3/agy-worker-mcp

That builds on install (prepare) and puts agy-worker-mcp on your PATH.

Register it — Claude Code, project-scoped, which is easy to undo and affects nothing else:

claude mcp add agy --scope project -- agy-worker-mcp

Codex (~/.codex/config.toml):

[mcp_servers.agy]
command = "agy-worker-mcp"
git clone https://github.com/thezoot3/agy-worker-mcp.git
cd agy-worker-mcp
npm install          # `prepare` builds dist/ for you
claude mcp add agy --scope project -- node "$PWD/dist/server.js"

Registering by absolute path means the server runs whatever is in dist/ — re-run npm run build after editing src/.

Check the registration with claude mcp list, and remove it with claude mcp remove agy --scope project.

The server discovers the project root by walking up from its cwd to a git root, or honors AGY_WORKER_PROJECT as an override. Per-project state lives under ~/.agy-worker/projects/<hash>/ — never inside your repository, so nothing here needs a .gitignore entry.

Quick start

agy_capabilities                       -- profiles, models, discovered root
agy_start { prompt, profile }          -- returns job_id immediately
agy_wait  { job_id, wait_ms }          -- loop until lifecycle == "finished"
agy_result { job_id, section }         -- verdict, verification, response text
agy_logs  { job_id }                   -- only if you want the stream itself

agy_start with dry_run: true resolves configuration and policy without spawning agy, so you can settle permissions before spending quota.

When a job comes back blocked, agy_result's verification.blockers[] says who refused. Each entry carries actionable (can a different agy_start lift it) and remedy (what to change — for our own gate, the rule string to paste into the next permissions.allow). actionable: false means no rule will help: agy's own permission engine refused, or the command tried to leave the workspace.

Tools

Tool

Role

agy_start

Start a job, return job_id immediately.

agy_wait

Long-poll until the job finishes or wait_ms runs out. Returns a compact judgement packet, not logs.

agy_result

Full, paged result: broker verdict, agent self-report, verification.

agy_logs

Raw or normalized event stream, by byte cursor or tail.

agy_send

Queue a follow-up turn on a session-mode job. Cannot interrupt a running turn.

agy_cancel

Kill a running job and its whole process group.

agy_list_jobs

Running and recently finished jobs in this project.

agy_sessions

List, inspect, or close agy conversations.

agy_capabilities

Models, profiles, limits, discovered project root, server version.

Parameter-level detail, the outcome vocabulary, and the two "blocked" classes are in docs/tools.md.

Permissions

Two profiles ship today:

  • research_readonly (default) — read-only workspace access and shallow git inspection. No writes, no interpreters, no network.

  • general_worker — read/write inside the workspace, git, pytest, and the common build commands (./gradlew, gradle, mvn, npm test, npm run, javac, java), network opt-in. git push, package installs, rm, and sudo are hard-denied regardless of what a client requests.

Client-requested permissions can only narrow a profile: allow is intersected with the ceiling, deny always wins. agy_start reports what the ceiling did to your request — policy_summary.allow_count and a source: "policy_ceiling" blocker per rejected rule. Watch for allow_count: 0: a fully rejected allow request collapses the effective list to empty and takes the profile's own defaults with it.

general_worker is not a trust boundary. Its default_decision is ask, which delegates to agy's own engine, and that engine auto-approves under proceed-in-sandbox — so any shell command not on a deny list runs, and an allowed interpreter can write anywhere. Shell redirection out of the workspace is blocked by the gate, but agy's --sandbox does not confine writes (measured). Only research_readonly, whose fall-through verdict is deny, blocks anything for real. Run untrusted prompts under it. docs/permissions.md has the whole model, including what the gate does not see and where it fails open.

Full model — evaluation order, containment, denial recovery, sessions and locks — in docs/permissions.md.

Documentation

Development

npm run typecheck   # tsc --noEmit
npm test            # vitest, against test/fake-agy — never the real agy binary
npm run build       # emits dist/server.js, dist/runner.js, dist/gate.js

npm test and CI run exclusively against the scripted fake in test/fake-agy/; the real agy CLI is never invoked there, since every invocation spends real quota. The real binary is exercised only by the opt-in live suite:

npm run test:live   # spends real agy quota

License

MIT

Available Tools

9 tools
agy_cancelCancel jobA
DestructiveIdempotent

Kill a running job and its whole process group.

ParametersJSON Schema
NameRequiredDescriptionDefault
job_idYes
reasonNo
grace_msNoMilliseconds between SIGTERM and SIGKILL.

TDQS

A3.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already provide idempotentHint and destructiveHint. The description adds concrete behavioral detail by specifying that it kills the entire process group, which goes beyond the generic destructive hint and clarifies the blast radius.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, focused sentence that conveys the core action and scope without any redundant words. It is highly efficient and easy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simple nature, the description is adequate but incomplete. It lacks usage context, parameter explanations for job_id and reason, and any indication of return behavior, but the destructive/idempotent hints and process-group detail provide some context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Only grace_ms has a schema description; job_id and reason rely on name inference. The tool description does not explain any parameter meanings or relationships, and with only 33% schema coverage, this leaves important gaps for the agent.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses the specific verb 'Kill' with the resource 'a running job' and clarifies the scope as 'its whole process group.' This clearly distinguishes it from siblings like agy_start and agy_wait, making the tool's purpose unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description does not state when to use this tool versus alternatives, nor does it mention any exclusions or prerequisites. Usage must be inferred from the word 'running,' but no explicit guidance or sibling comparison is provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

agy_capabilitiesServer capabilitiesA
Read-onlyIdempotent

Report models, profiles, limits, discovered project root, and server version.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and idempotentHint=true, covering the safety profile. The description adds no extra behavioral context beyond listing the report contents, which is minimal but not contradictory.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single, compact sentence that immediately states the tool's purpose and output contents. Every word earns its place with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter read-only tool, the description fully specifies what information will be returned. No output schema exists, but the listed items (models, profiles, limits, project root, version) are sufficient for an agent to know what to expect.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There are zero parameters, so the baseline for this dimension is 4. The description does not need to elaborate on parameter meanings since none exist.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool reports specific items (models, profiles, limits, discovered project root, server version) with a precise verb 'Report'. This differentiates it from sibling tools like agy_logs or agy_send, which handle other concerns.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the tool is used to retrieve server capability information but does not explicitly state when to use it versus alternatives. Since it is a zero-parameter read-only capability query, usage context is intuitive but not explicitly articulated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

agy_list_jobsList jobsB
Read-onlyIdempotent

List running and recently finished jobs in this project.

ParametersJSON Schema
NameRequiredDescriptionDefault
cwdNoExact match on the canonical workspace path.
limitNo
since_msNoOnly jobs created in the last N ms.
lifecycleNoRestrict to these lifecycle states.
session_idNo

TDQS

B3.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already provide readOnlyHint=true and idempotentHint=true, so the safety profile is covered. The description adds the scope of 'running and recently finished', but this conflicts somewhat with the lifecycle parameter which allows other states like 'queued' and 'canceling' – the description implies a fixed subset when the tool actually supports filtering. No contradiction with annotations, but behavioral details like default ordering or limits are absent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single sentence with no filler words, making it efficient and easy to parse. It front-loads the primary action and scope. Minor deduction for not using the available sentence to clarify the ambiguous 'recently finished'.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema and 5 parameters, the description is too sparse to fully specify behavior. It doesn't mention default limit, result ordering, whether the response is a list of job summaries or details, or how 'recently finished' is computed. Sibling tools like agy_cancel suggest mutation, but this list tool's interaction with them is not addressed. The annotations cover read-only, but contextual completeness for correct invocation is lacking.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 60%, with 3 of 5 parameters described. The description does not add meaning beyond the schema; it only vaguely aligns with the lifecycle parameter. limit and session_id have no schema descriptions, and the tool description doesn't compensate for these gaps. Baseline 3 due to moderate schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('List') and resource ('jobs') and scopes to 'running and recently finished', making the core purpose clear. However, it does not differentiate from sibling tools like agy_result or agy_logs, and the meaning of 'recently finished' is ambiguous without a time frame.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given about when to use this tool versus alternatives such as agy_cancel or agy_wait. The description only states what it lists, leaving the agent to infer when this is the right tool. There is no mention of exclusions or conditions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

agy_logsRead job logsA
Read-onlyIdempotent

Read raw events, normalized human-readable lines, or stderr for a job, by byte cursor or tail.

ParametersJSON Schema
NameRequiredDescriptionDefault
job_idYes
streamNoevents = raw NDJSON, normalized = one readable line per meaningful step. Defaults to normalized.
max_bytesNo
tail_linesNoLast N lines. Mutually exclusive with after_cursor.
after_cursorNoByte offset from a previous call. Mutually exclusive with tail_lines.

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and idempotentHint=true, so the safety profile is covered. The description adds useful behavioral context (stream types, byte cursor/tail modes) but doesn't disclose defaults (e.g., normalized stream), pagination behavior beyond cursor semantics, or response structure. This is adequate but not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence conveys the core purpose, stream options, and access methods with zero redundancy. Every word contributes information, and the most important distinctions are front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's moderate complexity, no output schema, and annotations covering readonly/idempotent behavior, the description provides the essential information needed to understand what the tool does. Minor gaps like default stream selection are already captured in the schema's stream description. Overall, it is sufficiently complete for an agent to invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 60% (stream, tail_lines, after_cursor have descriptions) while job_id and max_bytes lack descriptions. The description loosely maps to parameters via 'byte cursor or tail' and lists stream types, but adds no significant meaning beyond what the schema already provides for covered parameters and doesn't compensate for undocumented ones.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb 'Read' with a clear resource 'raw events, normalized human-readable lines, or stderr for a job'. It distinguishes itself from sibling tools like agy_send or agy_cancel by focusing on reading logs, and mentions distinct stream types and access methods.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives like agy_result or agy_list_jobs. There is no mention of exclusions or prerequisites; the description only states capabilities, leaving the agent to infer appropriate usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

agy_resultGet job resultA
Read-onlyIdempotent

Full, paged result of a finished job: broker summary, agent self-report, and verification (blockers[] with source / actionable / remedy for each thing that stood in the way).

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNoCharacter count for the "response" section.
job_idYes
offsetNoCharacter offset into the "response" section, for paging a long agent response.
sectionNoWhich part to return. Defaults to summary.

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint and idempotentHint, so the safety profile is known. The description adds value by disclosing the paged nature, the sections available, and the structure of blockers (source/actionable/remedy), which goes beyond simple read-only hints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One compact sentence packed with useful information: it states the resource type, the paged nature, the three main components, and the blocker detail structure. No filler words; every phrase earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the parameter schema and annotations cover safety and parameter meanings, the description adds the essential conceptual model (what each section contains) and confirms paging capability. It doesn't explicitly mention return format (no output schema exists), but the description's breakdown of sections gives a good picture. It's slightly less complete because it doesn't state default section behavior, but the schema's property description already says 'Defaults to summary.'

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 75%, with limit, offset, and section having descriptions. The description adds meaning by explaining the 'response' section is paged and that blockers have specific fields, which helps understand the section parameter's impact. It doesn't fully compensate for the undocumented job_id parameter, but that parameter's meaning is obvious from context.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it returns the full, paged result of a finished job, enumerating specific components: broker summary, agent self-report, and verification with blockers. This specific verb and resource distinguishes it from siblings like agy_list_jobs (listing jobs) and agy_logs (logs).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage for finished jobs ('finished job'), which sets context for when to use it, but it doesn't explicitly contrast with siblings or state when not to use it (e.g., when job is still running, use agy_wait). The 'finished job' qualifier provides some exclusion.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

agy_sendQueue follow-up turnA

Queue a follow-up turn on a session-mode job. Only takes effect after the in-flight turn finishes; there is no way to interrupt a running turn.

ParametersJSON Schema
NameRequiredDescriptionDefault
textNoThe follow-up turn. Omit when only closing.
closeNoClose stdin after this turn, ending the agy process at EOF.
job_idYes

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations provide only a title, so the description carries the full burden. It discloses key behavioral constraints: the queueing nature, that it takes effect only after the current turn finishes, and that there is no way to interrupt a running turn. This goes beyond typical schema details and informs the agent about timing and irreversibility of interruption. It does not mention whether the action is reversible or if it has side effects on job state, but the disclosure is sufficient for safe invocation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two sentences of clear, front-loaded prose. It states the core action first, then provides the key constraint without any fluff or redundant details. Every word contributes to understanding the tool's behavior, making it an exemplar of conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with two optional parameters and one required parameter, the description covers the essential aspects: the action, the scope (session-mode job), and the timing/limitation. It does not explain the expected result or return value, but there is no output schema and the operation is simple enough that an agent can infer the outcome. The description is complete enough for correct invocation in most scenarios.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 67% (two of three parameters explicitly described). The description does not add meaning beyond what the schema already provides for `text` and `close`, and `job_id` remains undocumented. However, the description's mention of 'session-mode job' gives context that the job must be in session mode, which is useful. With moderate coverage, this is an adequate score.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description specifies the action ('Queue a follow-up turn') and the resource ('a session-mode job'), clearly distinguishing it from siblings like agy_cancel (which interrupts) and agy_start (which starts). The verb-noun combination is unambiguous and leaves no room for confusion with the other tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states that it applies to session-mode jobs and that it only takes effect after the in-flight turn finishes, which implies when it should be used. However, it does not explicitly name alternatives or state when not to use this tool (e.g., if you need to cancel or interrupt a running turn). Given that siblings exist for cancellation and waiting, a clearer directive would elevate this to a 4.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

agy_sessionsManage sessionsB
Read-onlyIdempotent

List, inspect, or close agy conversations (sessions). A session is one agy conversation; a job is one turn.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
stateNo
actionNoDefaults to list.
session_idNoRequired for get and close.

TDQS

B3.1/5.0
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description claims the tool can 'close' sessions, which is a mutating operation. However, annotations include readOnlyHint=true, indicating the operation should be read-only. This is a direct contradiction, making the behavioral information misleading.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and front-loaded: the first sentence lists the actions and resource, and the second clarifies domain vocabulary. No unnecessary words or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the core actions but leaves parameter semantics incomplete, especially for limit and state. It also conflicts with the readOnly annotation, undermining reliability. Since there is no output schema, the description should clarify return behavior, but it does not. The tool is not fully specifiable from this description alone.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 50%, and the tool description fails to compensate. It adds no meaning to 'limit' or 'state', which remain undocumented, and merely echoes 'action' and 'session_id' without additional insight. An agent would not know what values to pass for those parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's actions ('List, inspect, or close') on a specific resource (agy conversations/sessions). It also distinguishes sessions from jobs, helping disambiguate from sibling tools like agy_list_jobs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives a useful context cue by defining sessions vs. jobs, but it does not explicitly state when to use this tool instead of siblings or when not to use it. Alternatives and exclusions are absent, so usage is only implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

agy_startStart agy jobA

Begin a new agy job. Returns job_id immediately; never blocks — plus policy_summary and blockers[] for what the profile ceiling did to your permissions request. Use dry_run to resolve config and policy without spawning agy or spending quota.

ParametersJSON Schema
NameRequiredDescriptionDefault
cwdNoWorkspace directory. Must be inside the project root. Defaults to the project root.
modeNoagy execution mode, e.g. accept-edits or plan.
modelNo
effortNo
promptYesTask for the agent. Sent as --print=<prompt>.
dry_runNoResolve configuration and policy without spawning agy. Costs no quota.
profileNoPermission profile ceiling. research_readonly cannot write or run interpreters. Defaults to research_readonly.
on_denialNoWhat to do on the first policy denial. Default continue.
session_idNoContinue an existing agy conversation. Omit to create a new session.
timeout_msNo
json_schemaNoPath to a JSON schema for structured output.
permissionsNoNarrowing only. allow is intersected with the profile ceiling; deny always wins.
requested_byNo
session_modeNooneshot closes stdin after the prompt; session keeps it open for agy_send.
parent_task_idNo
idle_timeout_msNosession_mode "session" only. Closes stdin (ending the process) after this many ms of no agy_send following the last completed turn. Does not affect timeout_ms/deadline_at — agy_send never extends those. Ignored for oneshot.
expected_artifactsNoWorkspace-relative paths that must exist afterwards. Missing ones block verified_success.

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses key behaviors beyond the openWorldHint annotation: it returns job_id immediately, never blocks, and includes policy_summary and blockers[] in the response. It also explains that dry_run avoids spawning and quota usage. This gives the agent a clear model of the tool's execution and side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three sentences, each carrying essential information: purpose, behavior, and dry_run alternative. It is front-loaded with the core action and avoids any filler or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (17 parameters, no output schema), the description provides crucial return-value context (job_id, policy_summary, blockers[]) that would otherwise be unknown. It also clarifies the non-blocking nature and cost behavior, covering the main aspects an agent needs for correct invocation and expectation setting.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 71%, so the schema already documents most parameters. The description adds general context about the job start flow but does not elaborate on the undocumented parameters (e.g., mode, model, requested_by, parent_task_id). It does not significantly augment the schema descriptions, so a baseline score of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description begins with a specific verb and resource: 'Begin a new agy job.' It clearly differentiates this from sibling tools by noting immediate return and non-blocking behavior, and it contrasts with dry_run. This makes the tool's purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit guidance on when to use dry_run versus actually starting a job, including the cost/quota implication. It implies the primary use case is starting a new job, but it does not explicitly contrast with continuing via sibling tools like agy_send or when to use session_id. Still, it provides sufficient context for typical invocation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

agy_waitWait for job stateA
Read-onlyIdempotent

Long-poll a job until it FINISHES or wait_ms runs out — it does not return early on intermediate transitions like queued->running (200ms internal polling; wait_ms=0 for an immediate snapshot). A short wait_ms is a poll interval, not a change notification: each call blocks for the whole budget unless the job finished. Returns the judgement packet only, not full logs or the response text.

ParametersJSON Schema
NameRequiredDescriptionDefault
job_idYes
wait_msNoMax time to block. 0 returns the current state immediately.
after_cursorNoByte offset from a previous call, applied to the in-progress log tail. A finished job returns the full judgement packet and its end-of-stream cursor regardless.

TDQS

A4.3/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only provide readOnlyHint and idempotentHint. The description adds substantial behavioral detail: internal polling at 200ms, no early return on intermediate transitions, wait_ms=0 as an immediate snapshot, how after_cursor applies to the log tail, and that only the judgement packet is returned. This far exceeds what annotations convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but every sentence carries operational information: blocking behavior, polling interval, wait_ms=0 semantics, return content scope. It is a bit long, but it avoids redundancy and front-loads the most critical behavioral caveat (does not return early on intermediate transitions) early. Slight over-length keeps it from a 5.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has no output schema, the description adequately explains the return payload ('judgement packet only, not full logs or the response text'). Combined with annotations covering safety, the description is sufficient for an agent to invoke it correctly. It lacks explicit mention of error handling or edge cases (e.g., job not found), but those are not essential for basic usage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 67% schema coverage, the description compensates by explaining the behavioral semantics of wait_ms (blocking budget, 0 returns immediate snapshot) and after_cursor (byte offset applied to in-progress log tail, finished job returns full packet). This adds meaning beyond the schema descriptions, though job_id is not described beyond its presence in the required field.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the tool's purpose: 'Long-poll a job until it FINISHES or wait_ms runs out'. It specifies a precise verb (long-poll), a resource (job), and the termination condition. It also differentiates from siblings by noting it returns only the judgement packet, not logs or response text, helping distinguish from agy_result and agy_logs.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains the blocking behavior and the meaning of wait_ms, which implies when to use it (e.g., to wait for a job to finish). However, it does not explicitly state when to use this tool versus alternatives like agy_result or agy_logs, or when not to use it. The usage context is present but left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

TDQS

A4/5.0
Disambiguation5/5

Each tool targets a distinct aspect of job/session lifecycle: start, wait, result, logs, cancel, send, list, sessions, capabilities. No two tools overlap in purpose, making agent selection unambiguous.

Naming Consistency4/5

All tools share the 'agy_' prefix and use lowercase_with_underscores, but the suffix mixes nouns (result, logs, sessions, capabilities) and verbs (send, cancel, wait, start). The pattern is predictable after exposure, though not strictly verb_noun throughout.

Tool Count5/5

With 9 tools, the server is well-scoped for managing agy jobs and sessions. Each tool serves a necessary function without redundancy or bloat.

Completeness5/5

The tool surface covers the full job lifecycle: start, wait, retrieve result, read logs, cancel, list, send follow-ups, manage sessions, and inspect capabilities. No obvious dead ends or missing operations for the stated purpose.

Maintenance

ActivityMaintained
ResponsivenessNo issues

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/thezoot3/agy-worker-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server