Unlimited Agent
Allows controlling Google Chrome: opening URLs, selecting Chrome profiles, managing tabs and navigation.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Unlimited Agentshow my Windows system information"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Unlimited Agent
Unlimited Agent lets a private ChatGPT app operate the Windows PC that its owner paired: files, PowerShell, programs, screenshots, mouse and keyboard, clipboard, and Chrome.
It uses ChatGPT as the brain. It does not call a model API, consume Codex tokens, or install an OpenAI model API key. A user still needs a restricted Secure MCP Tunnel runtime credential (Tunnels: Read + Use) so the local bridge can authenticate to their own tunnel; that credential cannot perform model inference and is encrypted with Windows DPAPI.
Full remote control is powerful. Install only on a computer whose owner has knowingly consented. Keep the defaultbalanced + dangerous approval policy unless you understand the consequences of changing it.
What it can do
Read, search, create, edit, copy, move, and delete accessible files
Run PowerShell commands immediately or as background jobs
Launch local programs and inspect Windows/system information
Capture the primary or virtual desktop
List, focus, resize, minimize, maximize, or close windows
Send mouse clicks, scrolling, hotkeys, and text input
Read or replace clipboard text
Open URLs, select a Chrome profile, and control tabs/navigation
Make HTTP requests and download files without inheriting the tunnel credential
Reconnect automatically after Windows sign-in
The full 21-tool contract is in docs/TOOL_CONTRACT.md.
Related MCP server: ChatGPT MCP Server
Requirements
Windows 10 or 11, x64
A ChatGPT account that can enable Developer mode and private apps/connectors
Access to OpenAI Platform Secure MCP Tunnels
Google Chrome for the Chrome-specific tools (the other tools do not require it)
Install and pair
Download
Unlimited-Agent-Setup-v0.1.0.exeandSHA256SUMS.txtfrom the latest release.Optionally verify the download:
Get-FileHash .\Unlimited-Agent-Setup-v0.1.0.exe -Algorithm SHA256Run the installer and accept the informed-consent notice. Windows SmartScreen may warn because community builds are not code-signed; verify the SHA-256 before choosing Run anyway.
In the setup window, select Open Secure MCP Tunnels. Create a tunnel in the OpenAI Platform tunnel settings, then copy its
tunnel_...ID.In OpenAI Platform API keys, create a dedicated project key restricted to Tunnels: Read + Use. Do not grant model or other API permissions. Paste it into the setup window.
Choose permissions. The recommended defaults are:
Permission mode:
balancedLocal approval:
dangerousSensitive-read approval: enabled
Allowed folder: your Windows user profile
Select Save and connect. The bridge starts in the background and is registered for the current Windows user at sign-in.
In ChatGPT, open Settings → Apps & Connectors → Advanced settings, enable Developer mode, create a private app, and select the tunnel you just paired. Name it
Unlimited Agent.
Open the desktop shortcut Unlimited Agent Status. CONNECTED and ready means the tunnel can serve the private ChatGPT app. Ask ChatGPT: “Use Unlimited Agent to show my Windows system information.”
OpenAI currently documents Secure MCP Tunnels as a private Developer-mode testing feature. They do not support public ChatGPT app-directory submission or one shared public tunnel. Consequently, every user must create their own private tunnel and private app even though the installer and source code are public. See the official Secure MCP Tunnel guide.
Permission modes
Mode | Behavior |
| Only inspection tools run. Changes, input, launches, and network calls are denied. |
| Paths must stay inside Allowed folders. Dangerous actions follow the approval setting. PowerShell remains available only after the configured approval because a command can address arbitrary resources. |
| All paths accessible to the signed-in Windows user are in scope. Approval settings still apply. |
Approval | Behavior |
| A local review window appears for writes, commands, input, launches, browser/network actions, and other mutations. With the recommended sensitive-read option, it also covers screenshots, window titles, and clipboard reads. |
| Every tool call requires local approval. |
| No local prompts. Use only on a fully trusted private installation. |
Open Unlimited Agent Settings on the desktop to re-pair, change the tunnel credential, or change permissions. Settings apply without reinstalling. A denied tool call returns a structured PERMISSION_DENIED result to ChatGPT. Tool calls are serialized, so Unlimited Agent cannot use its own mouse/keyboard tool to click a pending approval window.
Example requests
“Find all
.docxfiles modified this week in Documents and summarize their names. Don’t change anything.”“Create a folder on my desktop named
Trip, move the selected photos into it, and verify the count.”“Run the test suite in
C:\work\my-app; keep polling until it finishes and fix the first failure.”“Take a screenshot, focus Chrome, open the project dashboard, and tell me what is visible.”
“Start Notepad, type this meeting note, save it to Documents, then confirm the file exists.”
For GUI tasks, ChatGPT should iterate screenshot → window focus → input → screenshot. Unlimited Agent cannot bypass passwords, CAPTCHAs, MFA, UAC secure desktop, or locked Windows sessions.
Architecture
flowchart LR
A[Private ChatGPT app] --> B[OpenAI Secure MCP Tunnel]
B -->|outbound HTTPS session| C[tunnel-client]
C -->|stdio MCP| D[Unlimited Agent server]
D --> E[Central policy + local approval]
E --> F[Files / PowerShell / HTTP]
E --> G[Windows UI / Chrome / clipboard]server.mjsregisters the MCP tools and contains their implementations.policy.mjswraps every tool registration with canonical-path permission, reparse/hardlink-resistant folder checks, complete local approval details, overrides, and audit checks.scripts/windows-ui.ps1provides screen, window, input, and clipboard primitives through Windows APIs.scripts/start-tunnel.ps1decrypts the per-user runtime credential just long enough to starttunnel-client. The MCP server deletes credential environment variables before handling calls, and child processes receive a sanitized environment.scripts/watch-tunnel.ps1provides single-instance background recovery.scripts/settings.ps1owns pairing and permission settings. Credentials use DPAPICurrentUser; non-secret policy is JSON.installer/produces one self-contained x64 Windows setup executable.
No inbound listener or firewall exception is created. The local server is stdio-only; tunnel-client provides the remote MCP endpoint selected by ChatGPT.
Local development
git clone https://github.com/yungsuk53-pixel/unlimited-agent.git
cd unlimited-agent
npm ci --ignore-scripts
npm testnpm test reaches validation level 2: schema/annotation checks, a real stdio MCP session, file operations, PowerShell credential isolation, local HTTP, screenshots, windows, input plumbing, system policy, and background jobs.
Build and fresh-install test:
npm run build:installer
npm run test:installThe build downloads pinned Node.js, tunnel-client, and ripgrep x64 releases and verifies them against immutable SHA-256 values committed in the build script. CI repeats the MCP tests, installer build, DPAPI round trip, synthetic fresh install, and installed-runtime tool tests. Test credentials are synthetic and never contact OpenAI.
To test a real tunnel, install the generated EXE, pair a dedicated tunnel credential, check Unlimited Agent Status, and connect the private app in ChatGPT Developer mode.
Data locations
Installed files and current-user data are under:
%LOCALAPPDATA%\UnlimitedAgent\
config\config.json non-secret policy and tunnel ID
config\credential.dpapi DPAPI-encrypted restricted runtime key
data\audit.jsonl tool decision audit (names, decisions, hashes)
data\logs\ tunnel and watchdog diagnosticsThe project never logs the plaintext tunnel credential. Logs redact strings matching OpenAI key formats, and tool-launched processes receive a minimal allowlist of ordinary Windows environment variables instead of inheriting ambient tokens or secrets.
Troubleshooting
Status says reconnecting or unavailable
Open Unlimited Agent Settings and re-enter the tunnel ID and a valid restricted runtime key.
Confirm the key has
Tunnels: Read + Useand belongs to the organization/workspace that owns the tunnel.Check
%LOCALAPPDATA%\UnlimitedAgent\data\logs\bridge.logandwatchdog.log.A
404commonly means ChatGPT selected a different tunnel/app, the runtime is stopped, or the private app was not created from the same ChatGPT/OpenAI organization context.
A tool is denied
The local response states whether read-only mode, an Allowed folders boundary, a per-tool override, or a rejected approval caused it.
Open Unlimited Agent Settings to change the policy. Do not weaken permissions merely to hide a genuine safety boundary.
Mouse or keyboard actions do nothing
Windows must be signed in and unlocked.
UAC secure desktop, login screens, some elevated apps, games using exclusive input, and protected media cannot be reliably automated from a normal user process.
Chrome opens the wrong profile
Ask ChatGPT to call
open_urlorbrowser_controlwith the Chrome profile directory name, such asDefaultorProfile 2.
Uninstall and revoke
Run the desktop shortcut Uninstall Unlimited Agent. It stops/removes the local runtime, deletes autostart entries, removes the encrypted credential, and deletes the installation directory.
Then revoke the dedicated restricted key in OpenAI Platform and delete the tunnel if it will no longer be used. Revocation is important if the PC or Windows account may be compromised.
Security and license
Read SECURITY.md before enabling full access. Security reports should use GitHub private vulnerability reporting, not public issues.
Unlimited Agent is available under the MIT License. Bundled runtime notices are in THIRD_PARTY_NOTICES.md.
Available Tools
21 toolsbrowser_controlControl Google ChromeA
Open a URL or send navigation/tab shortcuts to the focused Chrome window. For reliable GUI browsing, list windows, focus Chrome, act, then capture a screenshot.
| Name | Required | Description | Default |
|---|---|---|---|
| url | No | ||
| action | Yes | ||
| profile | No | Default | |
| windowHandle | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate readOnlyHint=false (mutating) and destructiveHint=false (not destructive). The description adds value by mentioning that actions target the 'focused Chrome window' and that this is part of a reliable browsing workflow. However, it does not disclose edge cases (e.g., behavior when windowHandle is invalid, tab limits, or permission requirements) beyond what annotations provide.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no filler: the first clearly states purpose, the second provides actionable usage advice. Every word earns its place, and important information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 4 parameters, no output schema, and no parameter descriptions, the description is too sparse. It omits return values, error handling, prerequisites (e.g., 'Chrome must be running'), and behavior for unsupported actions. While the workflow hint helps, it does not cover the full complexity of browser control.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, placing full burden on the description to explain parameters. The description only mentions 'URL' and 'navigation/tab shortcuts' in passing, failing to document 'profile', 'windowHandle', or the specific 'action' enum values. This leaves the agent with only parameter names and types, which is insufficient for correct invocation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool opens URLs or sends navigation/tab shortcuts to the focused Chrome window. It distinguishes from sibling tools like 'open_url' (likely generic) and 'list_windows'/'window_control' (setup steps) by focusing on Chrome control. The specific verb+resource combination ('Open a URL or send navigation/tab shortcuts to the focused Chrome window') leaves no ambiguity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit workflow guidance: 'For reliable GUI browsing, list windows, focus Chrome, act, then capture a screenshot.' This tells the agent when and how to use the tool in sequence. However, it does not explicitly state when NOT to use it (e.g., if Chrome is not running) or compare to alternatives like 'open_url' for non-focused scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
clipboardRead or write Windows clipboardC
Read text from or write text to the interactive Windows clipboard.
| Name | Required | Description | Default |
|---|---|---|---|
| text | No | ||
| action | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations include readOnlyHint=false, destructiveHint=false, etc., but the description adds no behavioral context beyond what the title already implies. It does not disclose that setting the clipboard overwrites previous content, that the clipboard is shared across applications, or that only text is supported. The description is too minimal to add value given the sparse annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, very concise with no wasted words. It is front-loaded with the verb. However, it could benefit from a slight structure (e.g., separating read and write cases) or listing the action enum. It is not overly verbose but is borderline too brief.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with two parameters and no output schema, the description covers the basic functionality. However, it lacks details like the dependency of 'text' on the action, the return value of 'get', clipboard availability, or the limitation to text. Given the tool's simplicity, the description is adequate but has clear gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It implicitly links 'read' to the 'get' action and 'write' to the 'set' action, and mentions 'text' as the data. However, it does not explicitly explain that 'text' is required only for 'set', that the max length is 4MB, or the enum values. It adds some meaning but not enough for complete clarity.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool reads or writes text to the clipboard. It distinguishes from siblings like file operations and exec, as clipboard access is unique. However, the description is nearly a tautology of the title 'Read or write Windows clipboard' and adds only the word 'text' and 'interactive'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool over alternatives. Sibling tools like read_file, write_file, or exec could conceptually be used for similar data transfer, but no when-to-use or when-not-to-use advice is given. The description does not mention prerequisites or context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
computer_inputControl mouse and keyboardADestructive
Send mouse, keyboard, text, scrolling, and wait actions to the interactive Windows desktop. Take a screenshot first, focus the target window, act, then screenshot again to verify.
| Name | Required | Description | Default |
|---|---|---|---|
| actions | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already disclose destructiveHint=true, and the description adds a safety-oriented workflow (screenshot before and after) that goes beyond the annotation. It does not explain all potential side effects, but the verification protocol is valuable behavioral context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences that are compact, front-loaded with action types and workflow, and contain no unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description gives a clear workflow and enumerates action types, but the complex actions array with many nested properties and enums is not parameterized. Since there is no output schema, the verify-screenshot guidance helps, but gaps remain for a tool of this complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has one 'actions' parameter with zero description coverage, and the description only lists action categories (mouse, keyboard, text, scrolling, wait). It does not explain key fields like x, y, key, text, delta, button, or milliseconds, failing to compensate for the schema's lack of descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool sends mouse, keyboard, text, scrolling, and wait actions to the interactive Windows desktop. This specific verb+resource combination distinguishes it from sibling tools like exec, screenshot, or window_control.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides an explicit workflow: 'Take a screenshot first, focus the target window, act, then screenshot again to verify.' This gives clear usage context, though it does not explicitly mention when not to use the tool or alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
edit_fileEdit local text fileADestructive
Replace exact text in a UTF-8 local file. Use for focused edits that preserve the rest of the file.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| newText | Yes | ||
| oldText | Yes | ||
| replaceAll | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate destructiveHint=true and readOnlyHint=false, so the safety profile is clear. The description adds that edits are exact-text replacements (not regex) and UTF-8 encoded, which is useful. However, it fails to disclose what happens if oldText is not found, whether replaceAll is available, or any error/rollback behavior. For a destructive tool, more transparency would be warranted.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences long, front-loaded with the primary action ('Replace exact text'), and contains no superfluous information. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 4 parameters (3 required), a destructive annotation, and no output schema, the description is minimal. It omits key details such as replaceAll behavior, handling of path (absolute vs relative), character encoding beyond the initial mention, error cases, and required permissions. This leaves an agent with incomplete information to use the tool reliably.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must carry the burden of explaining parameters. It implies that oldText is the exact string to find and newText is the replacement, but it does not describe the path parameter or the replaceAll boolean. The description adds only minimal semantic value over the schema, leaving three out of four parameters without explanation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Replace exact text in a UTF-8 local file', specifying the verb (replace), resource (text in a local file), and encoding. It further distinguishes from siblings like write_file by noting 'focused edits that preserve the rest of the file', making the purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly advises 'Use for focused edits that preserve the rest of the file', giving clear context for when this tool is appropriate. However, it does not mention when not to use it (e.g., for larger rewrites prefer write_file) or name alternative siblings, which would strengthen guidance further.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
execExecute PowerShellADestructive
Run an arbitrary PowerShell command on this Windows PC. Use for local development, package installation, system configuration, services, processes, and tasks not covered by a more specific tool. Verify changes afterward.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Working directory; defaults to the Windows user profile | |
| command | Yes | PowerShell command to run | |
| timeoutSeconds | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide destructiveHint=true, openWorldHint=true, idempotentHint=false, and readOnlyHint=false. The description adds the behavioral note 'Verify changes afterward,' which hints at side effects. It does not elaborate on specific destructive actions, authorization needs, or output behavior. Given the comprehensive annotations, this is adequate but not exceptional.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences long, each serving a distinct purpose: stating the action, listing use cases, and providing guidance. No redundant or extraneous content. It is front-loaded with the core verb-resource pair, making it efficient for an agent to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a shell execution tool with no output schema, the description covers purpose, guidelines, and a safety remark. However, it omits details about return values (e.g., command output, error handling) and timeout behavior. Given the tool's open world nature and destructive hint, these omissions create slight gaps in completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 67% (two of three parameters have descriptions). The description adds no parameter-specific information beyond what the schema already provides. For instance, it does not explain the cwd default behavior or the timeoutSeconds range. With moderate coverage, the description should compensate but fails to do so, limiting its added value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description starts with a specific verb+resource: 'Run an arbitrary PowerShell command on this Windows PC.' It clearly defines the tool's scope and distinguishes it from siblings by mentioning 'tasks not covered by a more specific tool.' The listed use cases (local development, package installation, etc.) reinforce the purpose without ambiguity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states to use this tool for tasks 'not covered by a more specific tool,' which guides the agent to prefer dedicated tools from the sibling list. It also advises 'Verify changes afterward,' acting as a safety reminder. However, it does not name specific alternative tools or provide detailed when-not-to-use scenarios, which would elevate it to a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
file_operationManage local files and foldersBDestructive
Copy, move, delete, or create local files and folders. Use exact resolved targets and verify consequential operations afterward.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | ||
| source | Yes | ||
| overwrite | No | ||
| recursive | No | ||
| destination | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide destructiveHint=true, and the description reinforces destructive behavior by mentioning 'delete' and advising verification. It adds context about requiring resolved paths, which is helpful but does not elaborate on idempotency, overwrite behavior, or error handling beyond what annotations imply.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the core purpose. The second sentence is functional but could be clearer. Every sentence earns its place, leaving no unnecessary words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (5 parameters, no output schema, destructive operations, multiple siblings), the description is too sparse. It lacks guidance on return values, error states, prerequisites, and how to handle common scenarios (e.g., overwriting, recursive deletion). The agent would need to infer too much from the schema alone.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage and 5 parameters, the description must compensate but only vaguely alludes to 'targets'. It does not explain source, destination, overwrite, recursive, or their roles. The action enum is partially covered by the list of operations, but the remaining parameters are left undocumented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the tool performs copy, move, delete, and create operations on local files and folders. The verb+resource combination is specific and distinguishes it from sibling tools like read_file or list_directory, though it does not explicitly contrast with them.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The instruction 'Use exact resolved targets and verify consequential operations afterward' provides some guidance on safe usage, but it does not specify when to choose this tool over alternatives (e.g., when to use file_operation vs read_file). No explicit when-not or sibling comparisons are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
http_requestMake HTTP request or downloadB
Call an HTTP/HTTPS URL from this PC or download the response to a local file. Does not inherit OpenAI or tunnel credentials.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | ||
| body | No | ||
| method | No | GET | |
| saveTo | No | ||
| headers | No | ||
| timeoutSeconds | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide readOnlyHint=false, openWorldHint=true, idempotentHint=false, and destructiveHint=false. The description adds one meaningful behavioral detail: 'Does not inherit OpenAI or tunnel credentials,' which clarifies security context. However, it omits other traits like rate limits, authentication requirements, or side effects of `saveTo`. The description adds some value beyond annotations but is not comprehensive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise: two sentences, no filler. Every word serves a purpose, and the core functionality and a key behavioral note (credential isolation) are front-loaded. Despite its brevity, it does not waste space on trivialities.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (6 parameters, no output schema, external network interaction), the description is insufficient. It fails to explain return behavior, error handling, how `saveTo` works (path format, overwrite policy), or how `headers` are formatted. The output schema is absent, so the description should provide some return value hints, which it does not. The tool is under-described for reliable agent use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description carries the full burden of explaining parameters. It does not mention any of the six parameters (url, body, method, saveTo, headers, timeoutSeconds) or their roles. For example, it doesn't clarify that `method` supports GET/POST/etc., that `headers` expects key-value pairs, or that `body` is used for POST/PUT requests. This is a critical gap for tool selection and correct invocation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Call an HTTP/HTTPS URL from this PC or download the response to a local file.' This directly specifies the verb (call/download), resource (HTTP/HTTPS URL), and scope (from this PC, with optional file saving). It distinguishes http_request from sibling file and system tools by focusing on network requests.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives like exec, open_url, or browser_control. The description only warns about credential inheritance ('Does not inherit OpenAI or tunnel credentials'), which is a behavioral note, not usage context. An agent would need to infer from sibling names that http_request is for raw network calls, but no when-to-use or when-not-to-use information is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
job_statusCheck background jobARead-onlyIdempotent
List background jobs or inspect one job with running state and recent stdout/stderr. Poll until completion and verify the resulting files or application state.
| Name | Required | Description | Default |
|---|---|---|---|
| jobId | No | ||
| tailBytes | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations clearly show readOnlyHint=true, destructiveHint=false, idempotentHint=true, which already convey the safe, non-destructive nature. The description adds value by explicitly mentioning 'running state and recent stdout/stderr' as outputs and suggesting a polling workflow, but does not contradict annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences that front-load the main purpose and add a usage suggestion. Every sentence adds value; no fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only inspection tool with 0 required params no output schema, the description adequately covers listing vs inspecting, state info returned, and a typical usage pattern (polling, then verify). However, it does not explain what 'verify the resulting files or application state' means concretely, leaving some ambiguity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has two parameters (jobId, tailBytes) with 0% description coverage, so the schema provides no semantic hints. The description briefly implies 'one job' (via jobId) and 'recent stdout/stderr' (tailBytes), partially compensating for the poor schema. But it does not explain what happens when jobId is omitted (list vs inspect) nor the purpose of tailBytes clearly.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Describes two distinct use cases (list all jobs or inspect one) with specific verb+resource pairs: 'List background jobs or inspect one job with running state and recent stdout/stderr'. This clearly distinguishes the tool from siblings like exec, start_job, stop_job.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Implicitly suggests polling until completion and verifying files/state, which guides usage in a workflow context. However, it does not explicitly state when not to use this tool (e.g., prefer start_job to begin work, exec for synchronous commands) or exclude alternatives. No direct sibling differentiation is given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
launch_programLaunch local programA
Launch a local executable or script with arguments, optionally visible. Use list_windows and screenshot after launching GUI applications.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | ||
| args | No | ||
| visible | No | ||
| executable | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds behavioral context beyond annotations: it mentions that launched programs can be optionally visible, and advises post-launch steps for GUI apps. Annotations show destructiveHint: false and readOnlyHint: false, so the description helps clarify it's a launch action but does not detail side effects like process lifecycle or permissions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that immediately conveys the core action and parameters, followed by a practical usage tip. Every part is essential and adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (4 params, no output schema, no enum constraints) and zero schema description coverage, the description provides a reasonable overview but lacks detail on return values, error handling, or behavior when executable fails to launch. The follow-up advice for GUI apps is helpful but incomplete for the full parameter set.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, meaning none of the four parameters are described in the schema. The description adds value by explaining args and visible broadly, but does not document cwd or executable beyond their schema names. Baseline is 3 due to low coverage, and description partially compensates but not fully.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it launches a local executable or script with arguments and optionally controls visibility. It distinguishes from siblings like exec by specifying it launches programs and suggests using list_windows and screenshot afterward for GUI apps.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly recommends using list_windows and screenshot after launching GUI applications, giving clear follow-up steps. However, it does not provide guidance on when not to use this tool (e.g., versus exec or other launch mechanisms).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_directoryList local directoryARead-onlyIdempotent
List files and folders with type, size, and modified time. Use before guessing paths or choosing files to edit.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | /root | |
| maxDepth | No | ||
| recursive | No | ||
| maxEntries | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is well-covered. The description adds the behavioral trait that it returns file type, size, and modified time, but does not disclose important details like whether symbolic links are followed, error handling for invalid paths, or behavior when the path is a file. Since annotations cover the core safety aspects, a 3 is appropriate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loads the purpose and typical output, and uses the second sentence to provide usage guidance. Every sentence is necessary and adds value with no redundant or filler content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool is a simple directory listing with good annotations (readOnlyHint, idempotentHint), no output schema, and moderate complexity (4 parameters), the description covers the core functionality and usage context. It does not explain the return format precisely (e.g., whether paths are absolute/relative), but the purpose and output fields (type, size, modified time) are clear. With strong annotations and self-explanatory parameters, the description is largely complete for an agent to use correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. The description does not explicitly describe each parameter's semantics, but it implies that 'path' controls the directory to list, and 'recursive' and 'maxDepth' affect depth of listing (especially with the hint to use recursively). However, it does not explain 'maxEntries'. Despite the gap, the tool's parameters are self-explanatory from their names and schema defaults, and the description provides enough context for correct invocation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'List files and folders with type, size, and modified time', specifying the verb (list), resource (files and folders), and output details (type, size, modified time). It distinguishes from sibling tools like read_file (read content), write_file (write content), and path_info (path metadata) by focusing on directory listing with file metadata.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says 'Use before guessing paths or choosing files to edit', which provides clear context for when to use this tool (before path guessing or file selection). However, it does not explicitly mention when not to use it or name specific alternatives for other use cases (e.g., search_files for finding files by name).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_windowsList desktop windowsARead-onlyIdempotent
List top-level Windows desktop windows with title, process ID, handle, position, size, and minimized state. Use to target window_control reliably.
| Name | Required | Description | Default |
|---|---|---|---|
| includeHidden | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds value by specifying the behavioral scope ('top-level') and the exact data returned (title, PID, handle, position, size, minimized state), which is useful since there is no output schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the core purpose and expected output fields. The second sentence adds a practical usage tip without redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple listing tool with one optional parameter and no output schema, the description covers the core output and usage rationale. However, it omits the meaning of includeHidden, which affects how the agent should invoke the tool. Overall, it's mostly complete but with a small gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The only parameter, includeHidden, is not mentioned in the description. With 0% schema description coverage, the description should compensate by explaining the parameter's effect. Although the name is somewhat self-explanatory, the lack of explicit guidance leaves a semantic gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists 'top-level Windows desktop windows' and enumerates the exact returned fields (title, process ID, handle, position, size, minimized state). It also distinguishes from sibling window_control by explicitly noting its purpose is to 'target window_control reliably.'
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a clear use case: 'Use to target window_control reliably,' which tells the agent when this tool is appropriate. It doesn't list explicit exclusions or alternative tools, but the sibling context makes the purpose distinct enough.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
open_urlOpen URL in logged-in ChromeB
Open an HTTP/HTTPS URL in Google Chrome using a profile belonging to the current Windows user.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | ||
| profile | No | Default |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations (which already indicate non-read-only, open-world, non-idempotent, non-destructive), the description adds only the profile constraint. It does not disclose whether opening reuses an existing window, what happens if Chrome is not running, or error behavior for invalid URLs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single 17-word sentence that is front-loaded with the verb and resource. Every word is necessary, and no extraneous information is included.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (2 parameters, no output schema), the description provides a basic understanding but lacks details on behavior like blocking, tab reuse, or error handling. Siblings like 'http_request' have different semantics, but the description does not fully clarify this distinction.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description partially compensates by specifying that the URL must be HTTP/HTTPS and that the profile belongs to the current Windows user. However, it does not explain that 'profile' is optional with default 'Default', nor does it clarify valid profile names or URL format requirements.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool opens an HTTP/HTTPS URL in Google Chrome using a specific Windows user profile. It uses strong verb-resource language and distinguishes itself from siblings like http_request or browser_control by specifying interactive Chrome launch.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives such as http_request or browser_control. The description does not mention prerequisites (e.g., Chrome installed) or exclusions (e.g., not for headless browsing).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
path_infoInspect local pathARead-onlyIdempotent
Check whether a local path exists and return detailed file, folder, or symbolic-link metadata.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds value by specifying that the tool returns 'detailed file, folder, or symbolic-link metadata,' which goes beyond the safety profile. However, it does not enumerate what fields are included (e.g., size, permissions), so some behavioral detail is missing.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single 18-word sentence that is front-loaded with the core action. No superfluous words; every part earns its place. It is appropriately sized for a straightforward tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has one parameter, no output schema, and rich annotations, the description is adequate but not complete. It fails to specify what 'detailed metadata' includes, which is critical for the agent to interpret the response. Sibling tools like file_operation may overlap, but the description does not clarify the exact scope.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% for the single 'path' parameter. The description does not explain the required format (absolute vs relative, shell expansion, trailing slashes, etc.) beyond the schema's type and length constraints. For a simple tool, more guidance on the path parameter is expected from the description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: checking existence and returning detailed metadata for files, folders, or symlinks. It uses a specific verb ('check') and resource ('local path'), and distinguishes itself from sibling tools like read_file (content) and list_directory (listing contents).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no explicit guidance on when to use this tool versus alternatives like list_directory or search_files. There is no mention of when-not-to-use or which sibling tools are better suited for different scenarios. The agent must infer usage solely from the tool name and sibling list.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_fileRead local fileARead-onlyIdempotent
Read any local file accessible to the current Windows user. Use utf8 for text and base64 for binary files.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| encoding | No | utf8 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, destructiveHint=false, and idempotentHint=true, making the safety profile clear. The description adds minor behavioral context by specifying encoding options (utf8 for text, base64 for binary), but does not disclose potential size limits or error handling behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very concise with two short sentences, covering the core purpose and a key parameter detail. It is front-loaded with the essential action. Minor improvement possible by explicitly noting the Windows constraint more prominently or adding one more behavioral detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema, the description could better explain what is returned (file contents as string or base64). With 2 parameters and 0% schema coverage, it partially compensates but leaves the 'path' parameter without additional context. The annotations cover safety traits adequately.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must add meaning to parameters. It explains the 'encoding' parameter's purpose (utf8 for text, base64 for binary) and provides clear guidance beyond the enum values. However, the 'path' parameter remains unexplained beyond what the schema provides (required string).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool reads any local file accessible to the current Windows user, using a specific verb ('read') and resource ('local file'). It distinguishes itself from siblings like write_file, edit_file, and list_directory by focusing on reading content.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides basic usage context (reading files) and mentions encoding options but does not explicitly state when to use this tool over alternatives like search_files or path_info. There is no guidance on when not to use it or prerequisites like file existence or permissions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
screenshotCapture Windows screenARead-onlyIdempotent
Capture the primary display or full virtual desktop as a PNG image. Use before and after graphical actions to locate controls and verify outcomes.
| Name | Required | Description | Default |
|---|---|---|---|
| capture | No | virtual |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses that it captures a PNG image, but does not specify how the image is returned (e.g., base64 encoding, file path, or direct data). The annotations already cover read-only, idempotent, and non-destructive behavior, so the description adds limited behavioral insight beyond the omission of return format.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description consists of two succinct sentences with no wasted words. The first sentence states the purpose and output format, the second provides usage guidance. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one parameter, no output schema, and comprehensive annotations, the description covers purpose, usage context, and parameter meaning. It lacks precise output format specification, but is otherwise complete enough for an agent to use correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description compensates by explaining the two enum values ('primary display' and 'full virtual desktop'). However, it does not mention the default value ('virtual') or provide additional details about the parameter's behavior when omitted.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific verb 'capture' and resource 'primary display or full virtual desktop', and specifies the output format 'PNG image'. It also distinguishes from sibling tools like 'list_windows' by framing it for graphical actions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description advises using the tool 'before and after graphical actions to locate controls and verify outcomes', providing clear context. It does not explicitly mention alternatives or when not to use it, but the guidance is sufficient for typical scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_filesSearch local filesARead-onlyIdempotent
Fast local search using ripgrep. Search file names or text contents before reading large directory trees.
| Name | Required | Description | Default |
|---|---|---|---|
| glob | No | ||
| mode | No | content | |
| root | No | /root | |
| query | Yes | ||
| regex | No | ||
| maxResults | No | ||
| caseSensitive | No | ||
| includeHidden | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide readOnly, idempotent, and non-destructive hints. The description adds meaningful context: uses ripgrep, is fast, and searches either names or content. It does not describe the output format (e.g., returns file paths), which would be helpful given no output schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Both sentences are concise and front-loaded. The first sentence delivers the core action and tool, and the second adds valuable context without waste. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having 8 parameters, no output schema, and no parameter descriptions, the description lacks details on the output format, parameter semantics, and usage examples. It is too sparse to fully equip an agent for correct invocation and interpretation of results.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description must compensate but only implicitly covers the 'mode' parameter by mentioning file names vs. text contents. It fails to explain other critical parameters like glob, root, regex, maxResults, caseSensitive, or includeHidden, leaving the agent without guidance on their meaning.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states the tool performs fast local file search using ripgrep, with two modes (names or content). Differentiates from sibling file tools like read_file or list_directory by emphasizing search before reading, making its purpose distinct and unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Advises using this tool 'before reading large directory trees,' which is an explicit usage hint. However, it does not explicitly contrast with alternatives like list_directory or exec for more complex searches, nor does it state when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
start_jobStart background PowerShell jobADestructive
Start a long-running PowerShell command in the background with persistent stdout/stderr logs. Poll with job_status instead of waiting in exec.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | ||
| label | No | ||
| command | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate destructiveHint: true and readOnlyHint: false, so the agent knows this is a mutating operation. The description adds that it runs in the background, that logs are persistent (stdout/stderr), and that polling via job_status is required. This adds value beyond annotations by describing the async behavior and log retention. A score of 4 is appropriate since it clearly explains the key behavioral traits not fully covered by annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description consists of two sentences. The first states the purpose and behavior, the second gives actionable usage guidance. Every word earns its place, there is no fluff, and critical information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has no output schema, the description does not need to explain return values. It fully captures the core functionality: starting a long-running PowerShell background job with persistent logs and instructing the agent to poll for status instead of waiting. For a tool with 3 parameters, no nested objects, and no enums, this description is complete enough for the agent to use it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, meaning the schema provides no documentation for the three parameters. Despite this, the description does not describe the parameters individually, but it does imply that the command is a PowerShell command and that cwd may be used for working directory. However, label is not described at all. Since the description is concise and the overall purpose is clear, a 4 is given because the command parameter's role is obvious from context, but label and cwd could use some explanation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: to start a long-running PowerShell command as a background job, with persistent logs. It uses a specific verb ('Start') and resource ('background PowerShell job'), and distinguishes itself from siblings by mentioning 'poll with job_status instead of waiting in exec', which directly contrasts with the exec sibling.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit guidance on when to use this tool: for long-running commands, and importantly, it tells the agent not to wait for completion in-line but to poll with job_status. This is a clear directive that differentiates from exec, which would wait for output. No explicit 'when not to use' is needed as the context is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
stop_jobStop background jobADestructive
Force-stop a background job and its child process tree by job ID.
| Name | Required | Description | Default |
|---|---|---|---|
| jobId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true, so the agent knows it's destructive. The description adds context about Force-stop and child process tree, which is moderately helpful but does not elaborate on reversibility, error handling, or side effects beyond what annotations imply.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence that is front-loaded, clear, and concise. Every word contributes meaning without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the single required parameter, clear annotations, and no output schema, the description is mostly complete. It could mention what happens if the jobId is invalid or non-existent, but overall it provides sufficient context for an agent to understand the tool's purpose and usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description partially compensates by stating 'by job ID', but it does not clarify how to obtain the jobId or its format beyond what the schema already provides (uuid). The added value is minimal.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (Force-stop), the resource (background job and its child process tree), and the method (by job ID). It effectively distinguishes the tool from siblings like start_job and job_status.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for stopping a running job, possibly forcefully, but does not explicitly state when to use it versus alternatives (e.g., job_status for checking status, start_job to begin). It lacks prerequisites or conditions for appropriate use.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
system_infoInspect Windows systemARead-onlyIdempotent
Return local Windows, CPU, memory, user, host, runtime, and server capability information without changing the PC.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false, and openWorldHint=false, covering the safe read-only behavior. The description adds 'without changing the PC' which reinforces this and provides a list of information categories returned. No contradiction exists.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that efficiently states the tool's purpose and resource scope without any wasted words or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, read-only system information tool with good annotations, the description is complete. It lists the information categories and explicitly confirms no side effects. An output schema is absent but not necessary given the explanatory list of returned data.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with zero parameters, so the description has no additional burden to explain parameters. The description adds value by enumerating the specific categories of information returned, which helps the agent understand what to expect.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description specifies a clear verb 'Return' and lists the exact resources: local Windows, CPU, memory, user, host, runtime, and server capability information. It also explicitly states the tool does not change the PC, which distinguishes it from mutation tools like file_operation or write_file.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description states it 'does not change the PC', implying it is safe to use for inspection without side effects. However, it does not explicitly mention when not to use it or name alternatives among sibling tools such as path_info or list_windows for more specific diagnostics.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
window_controlControl desktop windowADestructive
Focus, minimize, maximize, restore, or close a desktop window by the handle returned from list_windows.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | ||
| handle | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide destructiveHint=true and readOnlyHint=false. The description confirms destructive actions (close) and specifies the handle source. However, it does not disclose error behavior (e.g., invalid handle), platform dependencies, or whether actions are synchronous.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence that is front-loaded with the verb 'Focus, minimize, maximize, restore, or close' and quickly provides the handle source. Zero waste, perfectly concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with 2 params and annotations, the description covers purpose, source of handle, and action options. Missing details on error handling and synchronous behavior, but these are minor given the tool's straightforward nature. There is no output schema to document, so no gap there.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description carries the burden. It lists the action enum values in text and links handle to list_windows output, adding meaning beyond the schema. However, it does not explain each action's effect (e.g., restore vs maximize), nor what 'handle' represents (OS window ID?).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it controls a desktop window by handle, listing all five actions. It specifies the handle source (list_windows), distinguishing it from sibling tools like list_windows (which obtains handles) and browser_control (browser-specific).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says to use the handle returned from list_windows, establishing a prerequisite. It implies usage context (after listing windows) but does not explicitly state when not to use it or name alternative tools for other window operations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
write_fileWrite local fileADestructive
Create, overwrite, or append to any local file. Create missing parent folders when requested, then verify important writes with read_file or path_info.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | overwrite | |
| path | Yes | ||
| content | Yes | ||
| encoding | No | utf8 | |
| createParents | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate destructiveHint=true and readOnlyHint=false. The description adds value by noting that parent folders can be created and that verification is recommended. However, it does not disclose other behavioral traits like potential data loss without backup, concurrent access behavior, or size limits (content maxLength is in schema but not mentioned). No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loads the core actions, and adds a single important detail (folder creation and verification). Every sentence earns its place with no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool is destructive, has 5 parameters, and no output schema, the description covers the primary actions but leaves gaps: no warning about overwriting, no mention of encoding or error conditions, and no description of the return value. The verification suggestion is helpful but incomplete for a tool of this complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, meaning the description should compensate. It does hint at the 'mode' ('overwrite' or 'append') and 'createParents' ('create missing parent folders'), but it does not explain other parameters like encoding, path constraints, or content max size. For a 5-parameter tool, this is minimal semantic enrichment beyond the schema's enums and defaults.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool creates, overwrites, or appends to local files, with a specific verb-resource pairing. It mentions creating parent folders, which adds detail. However, it does not explicitly distinguish itself from sibling 'edit_file' which is also a file modification tool, missing a clear differentiator.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives implicit usage context by suggesting verification after important writes, but it does not state when to prefer write_file over alternatives like edit_file or when not to use it. No explicit exclusion criteria or alternative tool names are given, leaving the agent with limited guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
21 tool updates
v0.1.0- First observed
browser_control - First observed
clipboard - First observed
computer_input - First observed
edit_file - First observed
exec - First observed
file_operation - First observed
http_request - First observed
job_status - First observed
launch_program - First observed
list_directory - First observed
list_windows - First observed
open_url - First observed
path_info - First observed
read_file - First observed
screenshot - First observed
search_files - First observed
start_job - First observed
stop_job - First observed
system_info - First observed
window_control - First observed
write_file
TDQS
Each tool has a clearly distinct purpose: file operations (read, write, edit, list, search, path, copy/move/delete) are separate from process execution (exec, launch, background jobs), GUI automation (screenshot, list/control windows, input, clipboard, open_url, browser_control), web requests, and system info. No two tools could be easily confused.
All tool names follow a consistent snake_case verb_noun or verb_phrase pattern (e.g., read_file, list_windows, start_job, system_info). No mixing of styles or vague verbs, making the API predictable and intuitive.
With 21 tools, the set is on the higher end of the typical range but still well-scoped for a comprehensive Windows automation server. Each tool earns its place; no obvious bloat. Slight overage compared to the ideal 3-15 range, but justified by the breadth of capabilities.
The tool surface covers file CRUD, directory listing, search, file operations, arbitrary command execution, GUI interaction (screenshot, window control, mouse/keyboard, clipboard, browser control), web requests, background job management, and system info. No significant gaps for the stated purpose of local Windows automation.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Turns a phone into a camera+Bluetooth remote so AI assistants can see and control any PC.
Let ChatGPT, Claude & Cursor use your Mac: email, calendar, iMessage, Teams, files. Local, free.
Operate Linux, macOS and Windows from your LLM. Every action runs through an auditable allowlist.
Eyes and hands on real Windows PCs — observe, click, type via Glasswarp API.
Related MCP Servers
- FlicenseCqualityCmaintenanceProvides comprehensive Windows system control including file operations, process management, window control, screenshots, clipboard access, PowerShell/CMD execution, and optional mouse/keyboard automation and browser control capabilities.41-
- FlicenseNot gradedqualityDmaintenanceEnables ChatGPT to perform filesystem operations, execute PowerShell commands, and manage n8n workflows on a Windows machine.-
- FlicenseCqualityCmaintenanceEnables ChatGPT to control a Windows PC remotely via OpenAI Secure MCP Tunnel, executing file operations, PowerShell commands, and system actions through a local MCP server.15-
- AlicenseNot gradedqualityBmaintenanceEnables ChatGPT to securely control a Windows PC via a local agent, supporting file operations, Chrome automation, and allowlisted apps with audit logging and approval workflows.MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/yungsuk53-pixel/unlimited-agent'
If you have feedback or need assistance with the MCP directory API, please join our Discord server