agy-worker-mcp
Allows running Google Antigravity CLI (agy) as an asynchronous worker agent, managing detached jobs with lifecycle state, permissions profiles, logs, and result retrieval from any MCP client.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@agy-worker-mcpStart a job to research the codebase and summarize findings."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
This MCP is under development. there's a bunch of security issues and crashes. Don't use it on your project
agy-worker-mcp
An MCP server that runs the Google Antigravity CLI (agy) as an asynchronous
worker agent, callable from Claude Code, Codex, and any other MCP client.
Jobs are detached from the client that started them: a job's process outlives the MCP connection, its stdout/stderr are redirected to files rather than piped, and its state lives in a project-local SQLite database. Any client connected to the same project can start a job, watch it, take it over after its original caller disconnected, or resume its conversation later.
Why detached jobs
agy runs turns that take minutes to an hour. A plain stdio MCP server tied to
one client's process would lose the job the moment that client disconnects, and
would give a second client (Codex checking on a job Claude Code started) no way
to see it. Detaching the process, redirecting its output to disk, and
coordinating through SQLite makes the job durable and visible independent of
who is currently connected.
Related MCP server: agy-headless-bridge MCP server
The one fact that matters most
agy's own exit code and status cannot be trusted. A permission denial and
a sandbox network block both surface as exit 0 / status: SUCCESS — agy
itself does not know it was blocked, and will often report success after
quietly failing or working around the block.
Every result this server returns carries a broker-computed outcome, derived
from actual events, exit status, and filesystem checks, kept deliberately
separate from agy's self-report (agent_report). Read outcome and
contract_status; never agent_report.status.
Requirements
Node.js ≥ 22.5
The
agyCLI onPATH(developed against 1.1.23).agy_capabilitiestells you whether the server can find it.
Install
Not published to npm yet. Install straight from GitHub:
npm install -g github:thezoot3/agy-worker-mcpThat builds on install (prepare) and puts agy-worker-mcp on your PATH.
Register it — Claude Code, project-scoped, which is easy to undo and affects nothing else:
claude mcp add agy --scope project -- agy-worker-mcpCodex (~/.codex/config.toml):
[mcp_servers.agy]
command = "agy-worker-mcp"git clone https://github.com/thezoot3/agy-worker-mcp.git
cd agy-worker-mcp
npm install # `prepare` builds dist/ for you
claude mcp add agy --scope project -- node "$PWD/dist/server.js"Registering by absolute path means the server runs whatever is in dist/ —
re-run npm run build after editing src/.
Check the registration with claude mcp list, and remove it with
claude mcp remove agy --scope project.
The server discovers the project root by walking up from its cwd to a git
root, or honors AGY_WORKER_PROJECT as an override. Per-project state lives
under ~/.agy-worker/projects/<hash>/ — never inside your repository, so
nothing here needs a .gitignore entry.
Quick start
agy_capabilities -- profiles, models, discovered root
agy_start { prompt, profile } -- returns job_id immediately
agy_wait { job_id, wait_ms } -- loop until lifecycle == "finished"
agy_result { job_id, section } -- verdict, verification, response text
agy_logs { job_id } -- only if you want the stream itselfagy_start with dry_run: true resolves configuration and policy without
spawning agy, so you can settle permissions before spending quota.
When a job comes back blocked, agy_result's verification.blockers[] says
who refused. Each entry carries actionable (can a different agy_start lift
it) and remedy (what to change — for our own gate, the rule string to paste
into the next permissions.allow). actionable: false means no rule will
help: agy's own permission engine refused, or the command tried to leave the
workspace.
Tools
Tool | Role |
| Start a job, return |
| Long-poll until the job finishes or |
| Full, paged result: broker verdict, agent self-report, verification. |
| Raw or normalized event stream, by byte cursor or tail. |
| Queue a follow-up turn on a session-mode job. Cannot interrupt a running turn. |
| Kill a running job and its whole process group. |
| Running and recently finished jobs in this project. |
| List, inspect, or close |
| Models, profiles, limits, discovered project root, server version. |
Parameter-level detail, the outcome vocabulary, and the two "blocked" classes
are in docs/tools.md.
Permissions
Two profiles ship today:
research_readonly(default) — read-only workspace access and shallowgitinspection. No writes, no interpreters, no network.general_worker— read/write inside the workspace,git,pytest, and the common build commands (./gradlew,gradle,mvn,npm test,npm run,javac,java), network opt-in.git push, package installs,rm, andsudoare hard-denied regardless of what a client requests.
Client-requested permissions can only narrow a profile: allow is
intersected with the ceiling, deny always wins. agy_start reports what the
ceiling did to your request — policy_summary.allow_count and a
source: "policy_ceiling" blocker per rejected rule. Watch for
allow_count: 0: a fully rejected allow request collapses the effective list
to empty and takes the profile's own defaults with it.
⚠
general_workeris not a trust boundary. Itsdefault_decisionisask, which delegates toagy's own engine, and that engine auto-approves underproceed-in-sandbox— so any shell command not on a deny list runs, and an allowed interpreter can write anywhere. Shell redirection out of the workspace is blocked by the gate, butagy's--sandboxdoes not confine writes (measured). Onlyresearch_readonly, whose fall-through verdict isdeny, blocks anything for real. Run untrusted prompts under it.docs/permissions.mdhas the whole model, including what the gate does not see and where it fails open.
Full model — evaluation order, containment, denial recovery, sessions and locks
— in docs/permissions.md.
Documentation
docs/tools.md— the nine tools, parameter by parameter, and the result vocabularydocs/permissions.md— profiles, gate, containment, denial recovery, sessionsdocs/operations.md— state layout, lifecycle, locks, timeouts, retention, test suites
Development
npm run typecheck # tsc --noEmit
npm test # vitest, against test/fake-agy — never the real agy binary
npm run build # emits dist/server.js, dist/runner.js, dist/gate.jsnpm test and CI run exclusively against the scripted fake in
test/fake-agy/; the real agy CLI is never invoked there,
since every invocation spends real quota. The real binary is exercised only by
the opt-in live suite:
npm run test:live # spends real agy quotaLicense
MIT
Available Tools
9 toolsagy_cancelCancel jobADestructiveIdempotent
Kill a running job and its whole process group.
| Name | Required | Description | Default |
|---|---|---|---|
| job_id | Yes | ||
| reason | No | ||
| grace_ms | No | Milliseconds between SIGTERM and SIGKILL. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide idempotentHint and destructiveHint. The description adds concrete behavioral detail by specifying that it kills the entire process group, which goes beyond the generic destructive hint and clarifies the blast radius.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, focused sentence that conveys the core action and scope without any redundant words. It is highly efficient and easy to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simple nature, the description is adequate but incomplete. It lacks usage context, parameter explanations for job_id and reason, and any indication of return behavior, but the destructive/idempotent hints and process-group detail provide some context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only grace_ms has a schema description; job_id and reason rely on name inference. The tool description does not explain any parameter meanings or relationships, and with only 33% schema coverage, this leaves important gaps for the agent.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'Kill' with the resource 'a running job' and clarifies the scope as 'its whole process group.' This clearly distinguishes it from siblings like agy_start and agy_wait, making the tool's purpose unmistakable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not state when to use this tool versus alternatives, nor does it mention any exclusions or prerequisites. Usage must be inferred from the word 'running,' but no explicit guidance or sibling comparison is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
agy_capabilitiesServer capabilitiesARead-onlyIdempotent
Report models, profiles, limits, discovered project root, and server version.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and idempotentHint=true, covering the safety profile. The description adds no extra behavioral context beyond listing the report contents, which is minimal but not contradictory.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, compact sentence that immediately states the tool's purpose and output contents. Every word earns its place with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter read-only tool, the description fully specifies what information will be returned. No output schema exists, but the listed items (models, profiles, limits, project root, version) are sufficient for an agent to know what to expect.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are zero parameters, so the baseline for this dimension is 4. The description does not need to elaborate on parameter meanings since none exist.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool reports specific items (models, profiles, limits, discovered project root, server version) with a precise verb 'Report'. This differentiates it from sibling tools like agy_logs or agy_send, which handle other concerns.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is used to retrieve server capability information but does not explicitly state when to use it versus alternatives. Since it is a zero-parameter read-only capability query, usage context is intuitive but not explicitly articulated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
agy_list_jobsList jobsBRead-onlyIdempotent
List running and recently finished jobs in this project.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Exact match on the canonical workspace path. | |
| limit | No | ||
| since_ms | No | Only jobs created in the last N ms. | |
| lifecycle | No | Restrict to these lifecycle states. | |
| session_id | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide readOnlyHint=true and idempotentHint=true, so the safety profile is covered. The description adds the scope of 'running and recently finished', but this conflicts somewhat with the lifecycle parameter which allows other states like 'queued' and 'canceling' – the description implies a fixed subset when the tool actually supports filtering. No contradiction with annotations, but behavioral details like default ordering or limits are absent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no filler words, making it efficient and easy to parse. It front-loads the primary action and scope. Minor deduction for not using the available sentence to clarify the ambiguous 'recently finished'.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and 5 parameters, the description is too sparse to fully specify behavior. It doesn't mention default limit, result ordering, whether the response is a list of job summaries or details, or how 'recently finished' is computed. Sibling tools like agy_cancel suggest mutation, but this list tool's interaction with them is not addressed. The annotations cover read-only, but contextual completeness for correct invocation is lacking.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 60%, with 3 of 5 parameters described. The description does not add meaning beyond the schema; it only vaguely aligns with the lifecycle parameter. limit and session_id have no schema descriptions, and the tool description doesn't compensate for these gaps. Baseline 3 due to moderate schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('List') and resource ('jobs') and scopes to 'running and recently finished', making the core purpose clear. However, it does not differentiate from sibling tools like agy_result or agy_logs, and the meaning of 'recently finished' is ambiguous without a time frame.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given about when to use this tool versus alternatives such as agy_cancel or agy_wait. The description only states what it lists, leaving the agent to infer when this is the right tool. There is no mention of exclusions or conditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
agy_logsRead job logsARead-onlyIdempotent
Read raw events, normalized human-readable lines, or stderr for a job, by byte cursor or tail.
| Name | Required | Description | Default |
|---|---|---|---|
| job_id | Yes | ||
| stream | No | events = raw NDJSON, normalized = one readable line per meaningful step. Defaults to normalized. | |
| max_bytes | No | ||
| tail_lines | No | Last N lines. Mutually exclusive with after_cursor. | |
| after_cursor | No | Byte offset from a previous call. Mutually exclusive with tail_lines. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and idempotentHint=true, so the safety profile is covered. The description adds useful behavioral context (stream types, byte cursor/tail modes) but doesn't disclose defaults (e.g., normalized stream), pagination behavior beyond cursor semantics, or response structure. This is adequate but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence conveys the core purpose, stream options, and access methods with zero redundancy. Every word contributes information, and the most important distinctions are front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity, no output schema, and annotations covering readonly/idempotent behavior, the description provides the essential information needed to understand what the tool does. Minor gaps like default stream selection are already captured in the schema's stream description. Overall, it is sufficiently complete for an agent to invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 60% (stream, tail_lines, after_cursor have descriptions) while job_id and max_bytes lack descriptions. The description loosely maps to parameters via 'byte cursor or tail' and lists stream types, but adds no significant meaning beyond what the schema already provides for covered parameters and doesn't compensate for undocumented ones.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Read' with a clear resource 'raw events, normalized human-readable lines, or stderr for a job'. It distinguishes itself from sibling tools like agy_send or agy_cancel by focusing on reading logs, and mentions distinct stream types and access methods.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives like agy_result or agy_list_jobs. There is no mention of exclusions or prerequisites; the description only states capabilities, leaving the agent to infer appropriate usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
agy_resultGet job resultARead-onlyIdempotent
Full, paged result of a finished job: broker summary, agent self-report, and verification (blockers[] with source / actionable / remedy for each thing that stood in the way).
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Character count for the "response" section. | |
| job_id | Yes | ||
| offset | No | Character offset into the "response" section, for paging a long agent response. | |
| section | No | Which part to return. Defaults to summary. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and idempotentHint, so the safety profile is known. The description adds value by disclosing the paged nature, the sections available, and the structure of blockers (source/actionable/remedy), which goes beyond simple read-only hints.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One compact sentence packed with useful information: it states the resource type, the paged nature, the three main components, and the blocker detail structure. No filler words; every phrase earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the parameter schema and annotations cover safety and parameter meanings, the description adds the essential conceptual model (what each section contains) and confirms paging capability. It doesn't explicitly mention return format (no output schema exists), but the description's breakdown of sections gives a good picture. It's slightly less complete because it doesn't state default section behavior, but the schema's property description already says 'Defaults to summary.'
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 75%, with limit, offset, and section having descriptions. The description adds meaning by explaining the 'response' section is paged and that blockers have specific fields, which helps understand the section parameter's impact. It doesn't fully compensate for the undocumented job_id parameter, but that parameter's meaning is obvious from context.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it returns the full, paged result of a finished job, enumerating specific components: broker summary, agent self-report, and verification with blockers. This specific verb and resource distinguishes it from siblings like agy_list_jobs (listing jobs) and agy_logs (logs).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for finished jobs ('finished job'), which sets context for when to use it, but it doesn't explicitly contrast with siblings or state when not to use it (e.g., when job is still running, use agy_wait). The 'finished job' qualifier provides some exclusion.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
agy_sendQueue follow-up turnA
Queue a follow-up turn on a session-mode job. Only takes effect after the in-flight turn finishes; there is no way to interrupt a running turn.
| Name | Required | Description | Default |
|---|---|---|---|
| text | No | The follow-up turn. Omit when only closing. | |
| close | No | Close stdin after this turn, ending the agy process at EOF. | |
| job_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations provide only a title, so the description carries the full burden. It discloses key behavioral constraints: the queueing nature, that it takes effect only after the current turn finishes, and that there is no way to interrupt a running turn. This goes beyond typical schema details and informs the agent about timing and irreversibility of interruption. It does not mention whether the action is reversible or if it has side effects on job state, but the disclosure is sufficient for safe invocation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences of clear, front-loaded prose. It states the core action first, then provides the key constraint without any fluff or redundant details. Every word contributes to understanding the tool's behavior, making it an exemplar of conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with two optional parameters and one required parameter, the description covers the essential aspects: the action, the scope (session-mode job), and the timing/limitation. It does not explain the expected result or return value, but there is no output schema and the operation is simple enough that an agent can infer the outcome. The description is complete enough for correct invocation in most scenarios.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 67% (two of three parameters explicitly described). The description does not add meaning beyond what the schema already provides for `text` and `close`, and `job_id` remains undocumented. However, the description's mention of 'session-mode job' gives context that the job must be in session mode, which is useful. With moderate coverage, this is an adequate score.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description specifies the action ('Queue a follow-up turn') and the resource ('a session-mode job'), clearly distinguishing it from siblings like agy_cancel (which interrupts) and agy_start (which starts). The verb-noun combination is unambiguous and leaves no room for confusion with the other tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description states that it applies to session-mode jobs and that it only takes effect after the in-flight turn finishes, which implies when it should be used. However, it does not explicitly name alternatives or state when not to use this tool (e.g., if you need to cancel or interrupt a running turn). Given that siblings exist for cancellation and waiting, a clearer directive would elevate this to a 4.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
agy_sessionsManage sessionsBRead-onlyIdempotent
List, inspect, or close agy conversations (sessions). A session is one agy conversation; a job is one turn.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| state | No | ||
| action | No | Defaults to list. | |
| session_id | No | Required for get and close. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description claims the tool can 'close' sessions, which is a mutating operation. However, annotations include readOnlyHint=true, indicating the operation should be read-only. This is a direct contradiction, making the behavioral information misleading.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and front-loaded: the first sentence lists the actions and resource, and the second clarifies domain vocabulary. No unnecessary words or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the core actions but leaves parameter semantics incomplete, especially for limit and state. It also conflicts with the readOnly annotation, undermining reliability. Since there is no output schema, the description should clarify return behavior, but it does not. The tool is not fully specifiable from this description alone.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 50%, and the tool description fails to compensate. It adds no meaning to 'limit' or 'state', which remain undocumented, and merely echoes 'action' and 'session_id' without additional insight. An agent would not know what values to pass for those parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's actions ('List, inspect, or close') on a specific resource (agy conversations/sessions). It also distinguishes sessions from jobs, helping disambiguate from sibling tools like agy_list_jobs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives a useful context cue by defining sessions vs. jobs, but it does not explicitly state when to use this tool instead of siblings or when not to use it. Alternatives and exclusions are absent, so usage is only implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
agy_startStart agy jobA
Begin a new agy job. Returns job_id immediately; never blocks — plus policy_summary and blockers[] for what the profile ceiling did to your permissions request. Use dry_run to resolve config and policy without spawning agy or spending quota.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Workspace directory. Must be inside the project root. Defaults to the project root. | |
| mode | No | agy execution mode, e.g. accept-edits or plan. | |
| model | No | ||
| effort | No | ||
| prompt | Yes | Task for the agent. Sent as --print=<prompt>. | |
| dry_run | No | Resolve configuration and policy without spawning agy. Costs no quota. | |
| profile | No | Permission profile ceiling. research_readonly cannot write or run interpreters. Defaults to research_readonly. | |
| on_denial | No | What to do on the first policy denial. Default continue. | |
| session_id | No | Continue an existing agy conversation. Omit to create a new session. | |
| timeout_ms | No | ||
| json_schema | No | Path to a JSON schema for structured output. | |
| permissions | No | Narrowing only. allow is intersected with the profile ceiling; deny always wins. | |
| requested_by | No | ||
| session_mode | No | oneshot closes stdin after the prompt; session keeps it open for agy_send. | |
| parent_task_id | No | ||
| idle_timeout_ms | No | session_mode "session" only. Closes stdin (ending the process) after this many ms of no agy_send following the last completed turn. Does not affect timeout_ms/deadline_at — agy_send never extends those. Ignored for oneshot. | |
| expected_artifacts | No | Workspace-relative paths that must exist afterwards. Missing ones block verified_success. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses key behaviors beyond the openWorldHint annotation: it returns job_id immediately, never blocks, and includes policy_summary and blockers[] in the response. It also explains that dry_run avoids spawning and quota usage. This gives the agent a clear model of the tool's execution and side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences, each carrying essential information: purpose, behavior, and dry_run alternative. It is front-loaded with the core action and avoids any filler or repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (17 parameters, no output schema), the description provides crucial return-value context (job_id, policy_summary, blockers[]) that would otherwise be unknown. It also clarifies the non-blocking nature and cost behavior, covering the main aspects an agent needs for correct invocation and expectation setting.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 71%, so the schema already documents most parameters. The description adds general context about the job start flow but does not elaborate on the undocumented parameters (e.g., mode, model, requested_by, parent_task_id). It does not significantly augment the schema descriptions, so a baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description begins with a specific verb and resource: 'Begin a new agy job.' It clearly differentiates this from sibling tools by noting immediate return and non-blocking behavior, and it contrasts with dry_run. This makes the tool's purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives explicit guidance on when to use dry_run versus actually starting a job, including the cost/quota implication. It implies the primary use case is starting a new job, but it does not explicitly contrast with continuing via sibling tools like agy_send or when to use session_id. Still, it provides sufficient context for typical invocation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
agy_waitWait for job stateARead-onlyIdempotent
Long-poll a job until it FINISHES or wait_ms runs out — it does not return early on intermediate transitions like queued->running (200ms internal polling; wait_ms=0 for an immediate snapshot). A short wait_ms is a poll interval, not a change notification: each call blocks for the whole budget unless the job finished. Returns the judgement packet only, not full logs or the response text.
| Name | Required | Description | Default |
|---|---|---|---|
| job_id | Yes | ||
| wait_ms | No | Max time to block. 0 returns the current state immediately. | |
| after_cursor | No | Byte offset from a previous call, applied to the in-progress log tail. A finished job returns the full judgement packet and its end-of-stream cursor regardless. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only provide readOnlyHint and idempotentHint. The description adds substantial behavioral detail: internal polling at 200ms, no early return on intermediate transitions, wait_ms=0 as an immediate snapshot, how after_cursor applies to the log tail, and that only the judgement packet is returned. This far exceeds what annotations convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is dense but every sentence carries operational information: blocking behavior, polling interval, wait_ms=0 semantics, return content scope. It is a bit long, but it avoids redundancy and front-loads the most critical behavioral caveat (does not return early on intermediate transitions) early. Slight over-length keeps it from a 5.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has no output schema, the description adequately explains the return payload ('judgement packet only, not full logs or the response text'). Combined with annotations covering safety, the description is sufficient for an agent to invoke it correctly. It lacks explicit mention of error handling or edge cases (e.g., job not found), but those are not essential for basic usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 67% schema coverage, the description compensates by explaining the behavioral semantics of wait_ms (blocking budget, 0 returns immediate snapshot) and after_cursor (byte offset applied to in-progress log tail, finished job returns full packet). This adds meaning beyond the schema descriptions, though job_id is not described beyond its presence in the required field.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool's purpose: 'Long-poll a job until it FINISHES or wait_ms runs out'. It specifies a precise verb (long-poll), a resource (job), and the termination condition. It also differentiates from siblings by noting it returns only the judgement packet, not logs or response text, helping distinguish from agy_result and agy_logs.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains the blocking behavior and the meaning of wait_ms, which implies when to use it (e.g., to wait for a job to finish). However, it does not explicitly state when to use this tool versus alternatives like agy_result or agy_logs, or when not to use it. The usage context is present but left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
TDQS
Each tool targets a distinct aspect of job/session lifecycle: start, wait, result, logs, cancel, send, list, sessions, capabilities. No two tools overlap in purpose, making agent selection unambiguous.
All tools share the 'agy_' prefix and use lowercase_with_underscores, but the suffix mixes nouns (result, logs, sessions, capabilities) and verbs (send, cancel, wait, start). The pattern is predictable after exposure, though not strictly verb_noun throughout.
With 9 tools, the server is well-scoped for managing agy jobs and sessions. Each tool serves a necessary function without redundancy or bloat.
The tool surface covers the full job lifecycle: start, wait, retrieve result, read logs, cancel, list, send follow-ups, manage sessions, and inspect capabilities. No obvious dead ends or missing operations for the stated purpose.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Remote MCP for Antigravity agent run receipt MCP, structured receipts, audit logs, and reviewer-read
Remote MCP for Android CLI agent build gate, structured receipts, audit logs, and reviewer-ready evi
Remote MCP for AI Studio Android release gate MCP, structured receipts, audit logs, and reviewer-rea
Remote MCP for Gemini upgrade evals, prompt regressions, output diffs, and eval receipts.
Related MCP Servers
- AlicenseAqualityDmaintenanceWraps Google Antigravity CLI into 11 typed MCP tools, enabling any MCP client to invoke agy for code review, prototyping, execution, and long-running tasks.1120MIT
- AlicenseBqualityAmaintenanceEnables calling Google's Antigravity CLI (agy) headlessly through MCP, providing tools like agy_ask and agy_research for agents like Claude Code.215MIT
- AlicenseAqualityCmaintenanceEnables MCP clients to submit long-running jobs that are executed safely in isolated child processes with a durable SQLite queue, configurable timeouts, retries with backoff, and backpressure.5MIT
- AlicenseNot gradedqualityAmaintenanceIntegrates Google Antigravity's agy agent into MCP, enabling asynchronous delegation of complex tasks like code analysis and file management with job polling.1052MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/thezoot3/agy-worker-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server