Skip to main content
Glama
v4t0r

Nextcloud ChatGPT Bridge

by v4t0r

Nextcloud for ChatGPT & Codex

Nextcloud bridge mark

An open-source, tenant-isolated bridge that lets ChatGPT and Codex work with files in a user-owned Nextcloud workspace. The bridge keeps its OAuth identity separate from Nextcloud credentials and uses standards-based providers when native Nextcloud MCP capabilities are absent.

Product website: nextcloud-for-chatgpt.v4t0r.chatgpt.site

Landing page preview

Release status

v0.3.2 is the current maintenance release. The production MCP endpoint and reviewer OAuth were verified on 2026-10-17. OpenAI directory publication is blocked by an unavailable existing MCP configuration in the submission portal; the app is not published. See the current checkpoint. A source release is not store approval.

The repository contains the application-side pieces required for a universal OAuth-protected MCP service:

  • request-scoped bridge identity and pseudonymous tenant isolation

  • Nextcloud Login Flow v2 without collecting a user's Nextcloud password

  • tenant-scoped metadata plus encrypted PostgreSQL credential storage

  • root-bound WebDAV and OCS providers with explicit read/write tools

  • conservative household invoice review that never approves, books, pays, or transmits

  • rate limiting, request limits, security headers, trusted-host checks, and stateless MCP transport

  • a DNS-rebinding-resistant HTTPS egress proxy and network-isolated production composition

  • database migrations, readiness checks, maintenance cleanup, and release preflight

  • a Codex plugin package plus reviewer-ready OpenAI listing and test material

  • a production landing site with privacy, terms, support, and security pages

The production service is deployed, but this source release does not claim OpenAI approval. Self-hosted installations require their own production domain, OAuth configuration and credentials.

The MCP bridge itself works without directory publication. Codex CLI, ChatGPT desktop, and the Codex IDE extension can connect directly; compatible remote MCP hosts can use a deployed HTTPS endpoint. ChatGPT web requires developer-mode access for an unpublished connection or installation of a published plugin. See deployment modes.

Related MCP server: C2C Bridge

Real Nextcloud validation

The standards-based fallback path passed a live integration run against Nextcloud 33.0.7:

  • authenticated OCS discovery

  • WebDAV listing, create, upload, download, metadata lookup, move, and cleanup

  • user-visible app inventory and root-bound share inventory

  • isolated synthetic household workspace and invoice-review flow

Native Nextcloud Context Agent MCP was unavailable on that instance. The successful fallback run is therefore direct evidence that native MCP is optional rather than a hidden dependency. No credentials or instance-identifying values are recorded. See the compatibility matrix.

Architecture

ChatGPT / Codex
       |
       | OAuth access token
       v
Public stateless MCP boundary
       |
       | verified issuer + subject + scopes
       v
BridgeSessionContext
       |
       | pseudonymous tenant scope
       v
ConnectionService
       |-- PostgreSQL connection metadata
       `-- AES-256-GCM credential store
       |
       | Nextcloud Login Flow v2 credential
       v
Root-bound provider core
       |-- WebDAV files
       |-- OCS capabilities, apps, shares, revocation
       `-- Native Nextcloud MCP discovery when available

The bridge identity never contains a Nextcloud username or credential. Every connection, pending flow, household profile, and credential operation is scoped by the verified tenant context.

Public MCP tools

Read and discovery

  • get_nextcloud_capabilities

  • get_nextcloud_app_accesses

  • probe_native_nextcloud_mcp

  • list_files, search_files, list_nextcloud_shares

  • get_file_info, read_text_file, download_file_base64

  • list_nextcloud_connections, list_household_accounts, list_household_invoices

  • review_household_invoice

Create or modify private Nextcloud state

  • write_text_file, upload_file_base64, create_folder, move_file, delete_file

  • begin_nextcloud_connection, poll_nextcloud_connection, set_nextcloud_root

  • disconnect_nextcloud

  • configure_household_account, prepare_household_workspace

  • save_household_invoice_review

Every hosted tool has an explicit title, description, input schema, output schema, and risk annotations. The production tool contract is locked by automated tests and documented in submission/TOOL_ANNOTATIONS.md.

Security defaults

  • account root / and parent traversal are rejected before provider access

  • every returned WebDAV path is rechecked against the configured root

  • HTTPS and TLS verification are mandatory for hosted Nextcloud targets

  • public targets are resolved, validated, and IP-pinned by a CONNECT-only egress proxy

  • bearer tokens, app passwords, share tokens, raw invoice text, and full IBANs are excluded from model-visible results

  • credential ciphertext is tenant-bound through AES-GCM authenticated data

  • overwrite is opt-in; the configured root cannot be deleted

  • request body and transfer sizes are bounded

  • write, overwrite, move, delete, disconnect, and credential-revocation risks are explicit

  • hosted access is stateless and derives a fresh identity for every MCP request

Read SECURITY.md before deployment. Report vulnerabilities through GitHub private vulnerability reporting, never through a public issue containing secrets or private data.

Local development

Requires Python 3.11 or newer.

python -m venv .venv
source .venv/bin/activate  # Windows: .venv\Scripts\activate
pip install -e ".[dev,hosted]"
ruff check .
pytest

Copy .env.example to .env only for local testing. Use a dedicated Nextcloud account and app password, keep the root narrow, and never commit the resulting file.

Run the local stdio server:

nextcloud-chatgpt-bridge

Run sanitized read-only diagnostics or the explicit temporary write/cleanup smoke test:

nextcloud-chatgpt-diagnose
nextcloud-chatgpt-diagnose --write-test

Production deployment

The reference composition is in deploy/compose.production.yml. It separates PostgreSQL, the bridge, maintenance, egress, and TLS termination, and keeps the bridge off the direct external network.

cp deploy/.env.production.example deploy/.env.production
docker compose --env-file deploy/.env.production \
  -f deploy/compose.production.yml config
docker compose --env-file deploy/.env.production \
  -f deploy/compose.production.yml up -d

Supply database and encryption secrets as files outside Git. Apply migrations through the dedicated migrate service, then run nextcloud-chatgpt-preflight against the exact public MCP, OAuth, website, support, privacy, and terms URLs before any reviewer access.

See docs/PRODUCTION_DEPLOYMENT.md and docs/HOSTED_ACCEPTANCE.md.

OpenAI submission package

Repository-side review material lives in submission/:

  • canonical listing copy and starter prompts

  • positive and negative reviewer cases

  • reviewer fixture and runbook

  • exact tool-annotation inventory

  • release notes and final operational checklist

The final OpenAI submission remains an owner-controlled action. See docs/PLUGIN_SUBMISSION.md.

Project documents

License

Licensed under the Apache License 2.0. This independent project is not affiliated with or endorsed by Nextcloud GmbH or OpenAI.

Available Tools

14 tools
create_folderCreate Nextcloud folderA

Create one folder only inside the user's connected private Nextcloud workspace root.

Uses the stored account connection; does not create public shares or contact another host.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
etagNo
nameYes
pathYes
sizeNo
is_dirYes
content_typeNo
last_modifiedNo

TDQS

A3.6/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=false, openWorldHint=false, idempotentHint=false and destructiveHint=false. The description adds genuine context beyond that: it relies on a stored account connection (no credential parameters) and stays within a single host. It omits the most operationally relevant behavior, namely what happens if the folder already exists or if parent directories are missing.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences with zero filler, and the most important scoping constraint is front-loaded. The second sentence is telegraphic but still earns its place by ruling out shares and cross-host behavior.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, but the definition is thin for a mutation tool: existing-folder handling, parent-directory creation, and path syntax are all unaddressed. It is adequate to start a call and insufficient to predict the result.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single 'path' parameter has 0% schema description coverage, so the description must compensate. It partially does by implying the path is relative to the workspace root, but gives no format guidance (leading slash, trailing slash, nested segments, whether intermediate folders are created).

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Create one folder') and pins down scope ('only inside the user's connected private Nextcloud workspace root'), which no sibling tool does. An agent can distinguish it from write_text_file or upload_file_base64 without opening the schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description carves out what it will not do ('does not create public shares or contact another host'), which is useful boundary-setting, but never says when to prefer it or how to proceed if a file rather than a folder is needed. Usage is implied rather than stated.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

delete_fileDelete Nextcloud fileA
DestructiveIdempotent

Delete one item only inside the user's connected private Nextcloud workspace root.

Deleting the root itself is refused. Cannot target another account, host, or arbitrary URL.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
okNo
pathYes
messageYes

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint=true, idempotentHint=true and openWorldHint=false, so the safety profile is known; the description adds the non-obvious boundary facts (single item per call, root refused, confined to the connected workspace). It does not say whether deletion is permanent or moves to a trash/versions store, which is the one behavioral gap that matters for a destructive tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences with zero waste; the primary scope constraint is front-loaded and the refusal rules follow as compact negative constraints. No restatement of the tool name or annotations.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter destructive tool with an output schema and full annotation coverage, the description covers enough to call it safely: scope, target confinement, and the root refusal. The remaining gaps (path format, permanence/trash behavior) are real but minor against the annotations and output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% for the single `path` parameter, so the description must carry the load. It indirectly scopes the path to the user's private workspace root, which usefully rules out absolute URLs or other mounts, but never states whether the path is relative or absolute, leading-slash conventions, or whether folders are accepted.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ("Delete") and a tightly scoped resource ("one item only inside the user's connected private Nextcloud workspace root"). It is unmistakably the only destructive single-item removal tool among the siblings, though it never names an alternative (e.g. move_file) for non-destructive relocation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives concrete when-not conditions: deleting the root is refused, and other accounts/hosts/arbitrary URLs cannot be targeted. What's missing is positive routing guidance — nothing tells the agent to prefer move_file or a trash-based flow when the user may want to recover the item.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

download_file_base64Download Nextcloud file as base64A
Read-only

Read one small binary file from the user's private Nextcloud workspace as base64.

Enforces the transfer size limit; the destination is the stored account, not an arbitrary URL.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
pathYes
sizeYes
content_typeNo
content_base64Yes

TDQS

A3.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already establish readOnlyHint=true and openWorldHint=false, so safety is covered. The description adds meaningful behavioral context beyond annotations by disclosing the transfer size limit and clarifying that the destination is the stored account rather than an arbitrary URL.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is two short sentences, front-loads the core purpose, and includes only relevant constraints. There is no redundant filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple and has an output schema, so return values need not be described. Still, the lack of any path-format guidance is a notable gap for a one-parameter tool with 0% schema description coverage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the only parameter, path, receives no explanation in the description. The description does not clarify whether the path is absolute, relative to the Nextcloud root, or expected in another format.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: reading a small binary file from the user's private Nextcloud workspace as base64. It implicitly distinguishes itself from sibling read_text_file by specifying binary content, but it does not explicitly name alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives useful constraints such as 'small' and 'enforces the transfer size limit,' implying when the tool is appropriate. However, it does not explicitly say when to use this versus read_text_file, get_file_info, or other file-related siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_file_infoGet Nextcloud file infoA
Read-only

Read one item's metadata inside the user's connected private Nextcloud workspace root.

The relative path cannot select another account, host, or public internet resource.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
etagNo
nameYes
pathYes
sizeNo
is_dirYes
content_typeNo
last_modifiedNo

TDQS

A3.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false. The description adds useful behavioral context by clarifying that the path is confined to the user's private workspace root and cannot reach another account, host, or public internet resource, though it does not discuss error cases or permission behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences with the core action front-loaded and the security constraint immediately after. There is no filler and every sentence contributes useful scope information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The output schema handles return-value documentation, and annotations cover the read-only and closed-world safety profile. The description supplies the key path-scope constraint, though it could be more complete about path formatting and edge cases for a tool whose only parameter has no schema description.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It does add meaningful semantics for the path parameter by stating that it is relative and cannot escape the connected workspace root, but it does not specify formatting details, root-path behavior, or whether directories and files are both accepted.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: read metadata for one item inside the user's connected private Nextcloud workspace root. This separates it from content-reading siblings such as read_text_file and download_file_base64, though it does not explicitly name those alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives a scope constraint about the path, but no explicit guidance on when to use this tool instead of list_files, search_files, read_text_file, or download_file_base64. The agent must infer the selection rule from the phrase 'metadata' alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_nextcloud_app_accessesInspect accessible Nextcloud appsA
Read-only

Read apps visible to the user's connected private Nextcloud account.

Uses only that account's stored server and permissions; no administrator APIs or other hosts.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
appsYes
warningsYes
search_providersYes
nextcloud_versionYes

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, openWorldHint=false and destructiveHint=false, so safety is covered. The description adds real context beyond them: it uses only the connected account's stored server and permissions and touches no admin APIs or other hosts, which reinforces the closed-world scope.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with the verb and resource, and the scope caveat follows. Nothing here is filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need no explanation, and there are no parameters to document. The account-scoping and no-admin-API notes make the definition adequate for a simple read tool, with only the missing sibling routing as a gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so per the baseline rule a 4 applies. The description correctly adds no parameter noise.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a clear verb ('Read') and resource ('apps visible to the user's connected private Nextcloud account'), and scopes it to a single account. It implicitly separates itself from sibling file/share tools, though it never names an alternative for app-access questions.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The 'no administrator APIs or other hosts' line gives a useful boundary on what this will not reach. However, there is no explicit when-to-use statement or pointer to the sibling that answers a related question (e.g., get_nextcloud_capabilities).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_nextcloud_capabilitiesInspect Nextcloud capabilitiesA
Read-only

Read capability hints only from the user's authenticated, connected Nextcloud server.

The destination is the stored account connection, not an arbitrary URL or public web search.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
app_api_hintYes
version_majorNo
version_microNo
version_minorNo
assistant_hintYes
capability_groupsYes
nextcloud_versionNo
context_agent_hintYes
context_agent_mcp_urlYes

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile is covered. The description adds useful context by emphasizing that reads come only from the user's authenticated, connected server and that the destination is the stored account connection rather than an arbitrary URL.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, with the core action and source constraint front-loaded. The second sentence clarifies the destination constraint without repeating the first.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With annotations covering read-only/open-world behavior and an output schema covering return values, the description supplies the key missing context: authentication and connection scope. It could be slightly stronger by distinguishing this tool from related capability/app-access siblings.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so there is no parameter semantics burden for the description to carry. The baseline for a zero-parameter tool is 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: reading capability hints from the authenticated, connected Nextcloud server. It distinguishes the source from an arbitrary URL or public web search, but does not differentiate this tool from sibling tools such as probe_native_nextcloud_mcp or get_nextcloud_app_accesses.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives clear usage context and an explicit exclusion: use the stored authenticated account connection, not an arbitrary URL or public web search. It stops short of naming sibling alternatives or explaining when another tool should be preferred.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_filesList Nextcloud filesA
Read-only

List direct children inside the user's connected private Nextcloud workspace root.

Paths are relative to that root; this cannot browse another account, host, or the public web.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
pathYes
entriesYes

TDQS

A3.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile and the 'no public web' constraint are partly redundant with structured data. The description does add real context — the listing is non-recursive and scoped to the authenticated user's own workspace root — but says nothing about ordering, pagination/limits, hidden files, or how large directories are handled.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences with zero filler; the core action and scope lead, and the constraint sentence follows. Nothing is repeated from the title or annotations verbatim.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-optional-parameter read tool with an output schema (so return shape need not be described) and annotations covering safety and openness, the description supplies what remains: non-recursive listing and root-relative path scoping. Details like ordering and page limits are the only omissions and are minor at this complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% and the single 'path' parameter has no description, default-to-root explanation, or format guidance in the schema. The description partially compensates by stating paths are relative to the workspace root, but it never says what an empty/omitted path resolves to or whether a folder path requires a trailing slash.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource — list direct children of the connected private Nextcloud workspace root — and pins the scope with 'direct children' (implying non-recursive) plus the explicit exclusion of other accounts, hosts, and the public web. It never names the sibling it is most easily confused with (search_files), so sibling differentiation is left implicit rather than stated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is implied by the scope statement: it is the tool for enumerating one directory of the private workspace. The 'cannot browse another account, host, or the public web' sentence functions as a when-not, but no alternative tool is named and there is no guidance on when to prefer search_files or get_file_info instead.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_nextcloud_sharesList shares inside the Nextcloud workspaceB
Read-only

Read existing share metadata only for items inside the user's private workspace root.

Uses the connected account's permissions; never creates shares or publishes file content.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathNo
include_subfilesNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
pathYes
sharesYes

TDQS

B3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already declare readOnlyHint, destructiveHint=false and openWorldHint=false, so the safety profile is fully covered by structured data. The description adds modestly by noting it uses the connected account's permissions and "never creates shares or publishes file content," but adds nothing about output shape, pagination, or what happens when the path is outside the workspace.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with the read-only scope constraint. No wasted text, though the second sentence duplicates annotation-covered safety facts rather than spending words on the undocumented parameters.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, and annotations carry the safety profile. The remaining gap is the two undocumented parameters and the ambiguous empty-path default, which leaves the agent guessing on invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and both parameters (path, include_subfiles) are bare titles with defaults, yet the description says nothing about either one. With a low-coverage schema the description is obligated to compensate, and it does not — notably it never explains what include_subfiles recurses over.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb and resource ("Read existing share metadata") and confines scope to "items inside the user's private workspace root," which is enough for an agent to distinguish it from the file-oriented siblings like list_files or search_files. It stops short of 5 because it never uses the word "list" to describe the enumeration behavior implied by the tool name.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is a scoping constraint (private workspace root only) but no statement of when to call this versus alternatives, and no mention of prerequisites such as resolving a path first. Nothing tells the agent whether an empty path has special meaning.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

move_fileMove or rename Nextcloud fileB
Destructive

Move or rename an item within the user's connected private Nextcloud workspace root.

Both paths stay inside the same account and root; no transfer to another host or recipient.

ParametersJSON Schema
NameRequiredDescriptionDefault
sourceYes
overwriteNo
destinationYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
etagNo
nameYes
pathYes
sizeNo
is_dirYes
content_typeNo
last_modifiedNo

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint=true, non-idempotent, and closed-world, so the safety profile is known; the description adds a genuine constraint that both paths stay inside the same account and root. However, it omits the critical behavioral fact for a destructive tool: what happens when the destination already exists, and whether an existing file is silently clobbered, rejected, or gated by the overwrite flag.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, and the core action leads. The second sentence earns its place as a scoping constraint, though it is slightly padded ("to another host or recipient") for a closed-world tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be described, and annotations cover safety. The remaining gap is meaningful for a destructive, non-idempotent mutation: the overwrite default of false and its consequences are left entirely undocumented.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the full burden, yet it never mentions the overwrite parameter at all, nor the path format (absolute vs. root-relative) or whether destination may be a directory. Only the vague notion of 'source' and 'both paths' is conveyed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb pair (move/rename) and the resource (an item) plus its scope (within the user's connected private Nextcloud workspace root). This is enough to distinguish it from siblings like delete_file, create_folder, or write_text_file, though it does not name an alternative explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Implicitly tells the agent when to use it (relocating or renaming an existing item) and adds a useful exclusion: no cross-host or cross-recipient transfers. It gives no guidance on when to prefer this over upload/download-style tools, nor on overwrite vs. fail-if-exists behavior.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

probe_native_nextcloud_mcpProbe native Nextcloud MCPA
Read-only

Check MCP availability only on the user's stored Nextcloud account connection.

Performs discovery without invoking a native tool or contacting an unrelated destination.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
endpointYes
availableYes
tool_namesYes
tools_truncatedNo
protocol_versionNo

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false; the description reinforces this by stating discovery is done without invoking a native tool or contacting an unrelated destination, which is genuine added context about side effects. It stops short of describing failure behavior (e.g., whether unavailability surfaces as an error or a result field), though the output schema likely covers returns.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences with the core scope front-loaded, no filler. The second sentence's phrase "unrelated destination" is slightly vague and could have been stated more directly, but overall it earns its space by clarifying what the probe does not touch.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-argument, read-only probe with an output schema and full annotation coverage, the description supplies enough context to call it safely. The only meaningful gap is behavioral output on failure, which the output schema presumably handles.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool takes zero parameters, so the baseline is 4; the schema is empty and nothing in the description needs to explain inputs. The description correctly implies no arguments are required by tying the check to the already-stored account connection.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and target: "Check MCP availability" scoped to "the user's stored Nextcloud account connection," which is more precise than a generic probe. The negative framing ("without invoking a native tool or contacting an unrelated destination") separates it from the sibling operation tools, but it never distinguishes itself from get_nextcloud_capabilities, which an agent could easily mistake for the same check.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase "Check MCP availability only on the user's stored Nextcloud account connection" implies a pre-flight/verification use case, and the note about not invoking a native tool hints at when it is appropriate. However, there is no explicit when-to-use/when-not-to-use guidance and no naming of get_nextcloud_capabilities as the alternative for capability interrogation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

read_text_fileRead Nextcloud text fileA
Read-only

Read bounded UTF-8 content from the user's connected private Nextcloud workspace root.

Enforces the transfer size limit and cannot fetch arbitrary URLs or files outside that root.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
pathYes
sizeYes
contentYes
encodingNo

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes meaningfully beyond the annotations (readOnlyHint=true, openWorldHint=false) by disclosing that content is bounded, that a transfer size limit is enforced, and that arbitrary URLs or files outside the root cannot be fetched. It does not say what happens on limit breach (truncation vs error), which is the remaining gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences with the core scope front-loaded and the constraint second. No filler, though the phrasing is slightly compressed at the cost of precision on limits.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Annotations cover the safety profile and an output schema exists, so return values needn't be explained; the description covers scope, size limits, and root confinement. The only meaningful omission is the exact path format and the truncation-vs-error behavior at the size limit.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% for the single required 'path' parameter, so the description must carry it; it only implies root-relative addressing without specifying format (leading slash, subdirectory syntax, encoding). Partial compensation, not full.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Read bounded UTF-8 content') scoped to the user's private Nextcloud workspace root. It implicitly differentiates from download_file_base64 by specifying UTF-8 text rather than binary, though it never names a sibling explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: an agent can infer this is for text files inside the workspace root, not for binary downloads or searches. There is no explicit when-to-use/when-not statement or pointer to download_file_base64 versus this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_filesSearch files inside the Nextcloud workspaceB
Read-only

Search filenames only inside the user's connected private Nextcloud workspace root.

This is a bounded account search, not public web search or a search of other destinations.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathNo
queryYes
max_depthNo
max_resultsNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
pathYes
queryYes
entriesYes
truncatedYes
scanned_entriesYes

TDQS

B3.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, destructiveHint=false, openWorldHint=false; the description reinforces the closed-world profile ('bounded account search') and adds a genuinely new trait: only filenames are matched, not file contents, which tells the agent when to fall back to read_text_file. It does not mention depth or result-count bounding behavior, which limits it to a 4.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with the core action and scope, with no filler. The second sentence is slightly redundant with the first for a reader who already knows Nextcloud, but it earns its place as a disambiguation cue.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists so return values need no explanation, and the safety profile is covered by annotations. But with 4 undocumented parameters and no explanation of query matching semantics, an agent cannot confidently set path, max_depth, or max_results from this definition alone.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across four parameters, so the description carries the full burden—yet it says nothing about what 'query' matches (substring, case sensitivity, globs), what 'path' scopes relative to the workspace root, or what max_depth and max_results control. Only the workspace-root scope is hinted at.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (search) and a specific resource and scope: filenames only, inside the user's connected private Nextcloud workspace root. It explicitly rules out public web search and other destinations, though it never distinguishes itself from the sibling list_files, which an agent could plausibly choose instead.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The second sentence gives negative usage guidance—it is 'not public web search or a search of other destinations'—which narrows the context. However, there is no positive guidance on when to pick this over list_files or get_file_info, and no preconditions or exclusions relative to actual siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

upload_file_base64Upload Nextcloud file from base64A
Destructive

Write a small binary file only inside the user's private Nextcloud workspace root.

Enforces strict base64 and size limits. Existing files require overwrite=true; no public sharing.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes
overwriteNo
content_base64Yes

Output Schema

ParametersJSON Schema
NameRequiredDescription
etagNo
nameYes
pathYes
sizeNo
is_dirYes
content_typeNo
last_modifiedNo

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already flag destructiveHint=true and readOnlyHint=false, and the description adds real value on top: strict base64 enforcement, size limits, the overwrite precondition, and the no-public-sharing restriction. It doesn't quantify 'small' or state what error occurs on failure, which keeps it below a 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, with the core write action and scope front-loaded before the constraints. The fragments 'no public sharing' and the trailing clause are slightly terse/telegraphic but every sentence carries information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, and the description covers the key safety and precondition facts. The remaining gaps (the actual size limit behind 'small', path format) are minor but non-trivial for a zero-coverage schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the full burden and does touch all three params – path (workspace root), content_base64 (strict base64), overwrite (required for existing files). However it never specifies path format, whether it's relative to the root, or the actual size cap, leaving meaningful gaps.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (write) and resource (small binary file) plus a clear scope limit (private Nextcloud workspace root). This implicitly separates it from write_text_file and download_file_base64, though it never names the siblings explicitly, so an agent must infer the division of labor from the type keywords.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives one actionable rule – existing files require overwrite=true – and a constraint (no public sharing). But there is no explicit when-to-use versus the closely related write_text_file or create_folder, so the routing decision is only implied by 'binary' and 'workspace root'.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

write_text_fileWrite Nextcloud text fileA
Destructive

Write UTF-8 content only inside the user's connected private Nextcloud workspace root.

Existing files require overwrite=true. Does not publish content, create shares, or send messages.

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes
contentYes
overwriteNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
etagNo
nameYes
pathYes
sizeNo
is_dirYes
content_typeNo
last_modifiedNo

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint=true, readOnlyHint=false, and openWorldHint=false, so the safety profile is covered. The description adds the meaningful extras: the overwrite prerequisite for existing files and explicit disclosure that no shares, messages, or publishing side effects occur. It omits error behavior when overwrite is false and the file exists.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no filler, with the scope constraint front-loaded and the overwrite rule in the second position. The negative clause is compressed into a single line rather than expanded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be described, and annotations carry the mutation risk profile. The description is nearly sufficient for correct invocation; the remaining hole is path semantics and failure behavior on a non-overwrite collision.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It correctly explains the non-obvious overwrite flag, which is the highest-value parameter detail. However, path (format, whether intermediate directories are created, relative vs absolute) and content (size or encoding limits) receive no added meaning, leaving two of three parameters undocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

Names a specific verb (write) and resource (text file) and pins the scope to the connected private Nextcloud workspace root, which is more than a restatement of the name. It does not explicitly distinguish itself from the sibling upload_file_base64, which is the closest alternative, so an agent must infer the UTF-8-text vs base64-binary split.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives clear applicability constraints: writes only within the private workspace root, and existing files require overwrite=true. The negative clauses ('Does not publish content, create shares, or send messages') usefully exclude adjacent behaviors, though no sibling is named as the alternative when the content is binary or outside the root.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 14 tool updatesv0.3.0
    • First observedcreate_folder
    • First observeddelete_file
    • First observeddownload_file_base64
    • First observedget_file_info
    • First observedget_nextcloud_app_accesses
    • First observedget_nextcloud_capabilities
    • First observedlist_files
    • First observedlist_nextcloud_shares
    • First observedmove_file
    • First observedprobe_native_nextcloud_mcp
    • First observedread_text_file
    • First observedsearch_files
    • First observedupload_file_base64
    • First observedwrite_text_file

TDQS

A3.7/5.0

Scored across 14 tools

Disambiguation4/5

File operations are clearly separated by action and by text-vs-binary (read_text_file vs download_file_base64, write_text_file vs upload_file_base64). The three discovery tools (get_nextcloud_capabilities, get_nextcloud_app_accesses, probe_native_nextcloud_mcp) have distinct targets but their boundaries are subtler for an agent. No dangerous overlap among the core file tools.

Naming Consistency4/5

All 14 tools use consistent snake_case with meaningful action verbs (list_, get_, read_, write_, upload_, download_, create_, move_, delete_, search_, probe_). The only minor inconsistency is the redundant 'nextcloud' prefix in some metadata tool names (get_nextcloud_capabilities, get_nextcloud_app_accesses, probe_native_nextcloud_mcp) while others omit the domain.

Tool Count5/5

14 tools is well within the ideal range and each tool maps to a distinct file-management or metadata operation. The surface is neither bloated nor thin for a private workspace bridge.

Completeness4/5

Core lifecycle is covered: list/search/info, read text/binary, write/upload, create_folder, move/rename, delete. The notable gap is share management — list_nextcloud_shares exists but there is no create/delete share, so sharing workflows dead-end after reading. Minor and workable via other apps.

Maintenance

ActivityActive
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    A
    maintenance
    Enables coding agents like Codex to use the ChatGPT web app as a planning and review brain, letting ChatGPT read only needed code via OAuth MCP and submit locally authorized tasks without API keys or repository uploads.
    4
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables ChatGPT web to read local files, search code, run shell commands, and drive a local Codex CLI via an official MCP connector, with human approval for risky commands and full audit logging.
    1
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables ChatGPT to securely control remote development servers over OAuth-protected MCP, exposing workspace-bounded tools for file editing, command execution, Git operations, and running Codex or GitHub Copilot subagents.
    18 npm
    MIT