Unlimited Agent
Unlimited Agent
Unlimited Agent 允许私有 ChatGPT 应用程序操作其所有者配对的 Windows 电脑:文件、PowerShell、程序、屏幕截图、鼠标和键盘、剪贴板以及 Chrome。
它使用 ChatGPT 作为大脑。它不调用模型 API、不消耗 Codex 令牌、也不安装 OpenAI 模型 API 密钥。用户仍然需要一个受限的安全 MCP 隧道运行时凭据(隧道:读取 + 使用),以便本地网桥能够向自己的隧道进行身份验证;该凭据无法执行模型推理,并使用 Windows DPAPI 加密。
[!WARNING] 完全远程控制功能强大。仅安装在所有者已知情同意的计算机上。除非您了解更改默认
平衡 + 危险批准策略的后果,否则请保持该策略不变。
功能
读取、搜索、创建、编辑、复制、移动和删除可访问的文件
立即或在后台作业中运行 PowerShell 命令
启动本地程序并检查 Windows/系统信息
捕获主桌面或虚拟桌面
列出、聚焦、调整大小、最小化、最大化或关闭窗口
发送鼠标点击、滚动、热键和文本输入
读取或替换剪贴板文本
打开 URL、选择 Chrome 配置文件以及控制标签页/导航
发出 HTTP 请求并下载文件,不继承隧道凭据
Windows 登录后自动重新连接
完整的 21 种工具合约见 docs/TOOL_CONTRACT.md。
Related MCP server: Secure Local AI Agent MCP
系统要求
Windows 10 或 11,x64 架构
一个可以启用开发者模式和私有应用/连接器的 ChatGPT 账户
访问 OpenAI 平台安全 MCP 隧道
用于 Chrome 特定工具的 Google Chrome(其他工具不需要)
安装与配对
从最新版本下载
Unlimited-Agent-Setup-v0.1.0.exe和SHA256SUMS.txt。(可选)验证下载:
Get-FileHash .\Unlimited-Agent-Setup-v0.1.0.exe -Algorithm SHA256运行安装程序并接受知情同意通知。Windows SmartScreen 可能会发出警告,因为社区构建未进行代码签名;在选择仍然运行之前验证 SHA-256。
在设置窗口中,选择打开安全 MCP 隧道。在OpenAI 平台隧道设置中创建一个隧道,然后复制其
tunnel_...ID。在OpenAI 平台 API 密钥中,创建一个专用的项目密钥,权限限制为隧道:读取 + 使用。不要授予模型或其他 API 权限。将其粘贴到设置窗口中。
选择权限。推荐的默认设置为:
权限模式:
balanced本地批准:
dangerous敏感读取批准:启用
允许文件夹:您的 Windows 用户配置文件
选择保存并连接。网桥在后台启动,并为当前 Windows 用户在登录时注册。
在 ChatGPT 中,打开设置 → 应用与连接器 → 高级设置,启用开发者模式,创建一个私有应用,并选择您刚配对的隧道。将其命名为
Unlimited Agent。
打开桌面快捷方式 Unlimited Agent Status。已连接并就绪 表示隧道可以为私有 ChatGPT 应用服务。向 ChatGPT 提问:“使用 Unlimited Agent 显示我的 Windows 系统信息。”
OpenAI 目前将安全 MCP 隧道记录为私有开发者模式测试功能。它们不支持公共 ChatGPT 应用目录提交或共享的公共隧道。因此,尽管安装程序和源代码是公开的,每个用户仍必须创建自己的私有隧道和私有应用。请参阅官方安全 MCP 隧道指南。
权限模式
模式 | 行为 |
| 仅运行检查工具。更改、输入、启动和网络调用被拒绝。 |
| 路径必须保持在允许文件夹内。危险操作遵循批准设置。由于命令可以访问任意资源,PowerShell 仅在配置的批准后可用。 |
| 已登录 Windows 用户可访问的所有路径均在范围内。批准设置仍然适用。 |
批准 | 行为 |
| 对于写入、命令、输入、启动、浏览器/网络操作和其他变更操作,将显示本地审核窗口。启用推荐的敏感读取选项后,它还涵盖屏幕截图、窗口标题和剪贴板读取。 |
| 每次工具调用都需要本地批准。 |
| 无本地提示。仅在完全信任的私有安装上使用。 |
在桌面上打开 Unlimited Agent Settings 以重新配对、更改隧道凭据或更改权限。设置更改无需重新安装。被拒绝的工具调用会向 ChatGPT 返回结构化的 PERMISSION_DENIED 结果。工具调用是串行化的,因此 Unlimited Agent 无法使用其自己的鼠标/键盘工具点击待处理的批准窗口。
示例请求
“查找文档中本周修改的所有
.docx文件并汇总其名称。不要更改任何内容。”“在我的桌面上创建一个名为
Trip的文件夹,将选中的照片移动进去,并验证数量。”“运行
C:\work\my-app中的测试套件;持续轮询直到完成并修复第一个失败。”“截取屏幕截图,聚焦 Chrome,打开项目仪表板,并告诉我可见内容。”
“启动记事本,输入此会议笔记,保存到文档,然后确认文件存在。”
对于 GUI 任务,ChatGPT 应迭代执行:屏幕截图 → 窗口聚焦 → 输入 → 屏幕截图。Unlimited Agent 无法绕过密码、CAPTCHA、MFA、UAC 安全桌面或锁定的 Windows 会话。
架构
flowchart LR
A[Private ChatGPT app] --> B[OpenAI Secure MCP Tunnel]
B -->|outbound HTTPS session| C[tunnel-client]
C -->|stdio MCP| D[Unlimited Agent server]
D --> E[Central policy + local approval]
E --> F[Files / PowerShell / HTTP]
E --> G[Windows UI / Chrome / clipboard]server.mjs注册 MCP 工具并包含其实现。policy.mjs为每个工具注册包装规范路径权限、防重新解析/防硬链接文件夹检查、完整的本地批准细节、覆盖和审计检查。scripts/windows-ui.ps1通过 Windows API 提供屏幕、窗口、输入和剪贴板原语。scripts/start-tunnel.ps1将每个用户的运行时凭据解密足够长时间以启动tunnel-client。MCP 服务器在处理调用前删除凭据环境变量,子进程接收清理过的环境。scripts/watch-tunnel.ps1提供单实例后台恢复。scripts/settings.ps1负责配对和权限设置。凭据使用 DPAPICurrentUser;非秘密策略为 JSON。installer/生成一个自包含的 x64 Windows 安装可执行文件。
不会创建入站监听器或防火墙例外。本地服务器仅限 stdio;tunnel-client 提供 ChatGPT 选择的远程 MCP 端点。
本地开发
git clone https://github.com/yungsuk53-pixel/unlimited-agent.git
cd unlimited-agent
npm ci --ignore-scripts
npm testnpm test 达到验证级别 2:模式/注释检查、真实的 stdio MCP 会话、文件操作、PowerShell 凭据隔离、本地 HTTP、屏幕截图、窗口、输入管道、系统策略和后台作业。
构建和全新安装测试:
npm run build:installer
npm run test:install构建过程下载固定的 Node.js、tunnel-client 和 ripgrep x64 版本,并根据构建脚本中提交的不可变 SHA-256 值进行验证。CI 重复 MCP 测试、安装程序构建、DPAPI 往返、合成全新安装以及已安装运行时工具测试。测试凭据是合成的,永远不会联系 OpenAI。
要测试真实隧道,请安装生成的 EXE,配对专用隧道凭据,检查 Unlimited Agent Status,并在 ChatGPT 开发者模式下连接私有应用。
数据位置
安装文件及当前用户数据位于:
%LOCALAPPDATA%\UnlimitedAgent\
config\config.json non-secret policy and tunnel ID
config\credential.dpapi DPAPI-encrypted restricted runtime key
data\audit.jsonl tool decision audit (names, decisions, hashes)
data\logs\ tunnel and watchdog diagnostics项目从不记录明文隧道凭据。日志会屏蔽符合 OpenAI 密钥格式的字符串,工具启动的进程会接收一个最小化的普通 Windows 环境变量白名单,而不是继承环境中的令牌或密钥。
故障排除
状态显示正在重新连接或不可用
打开 Unlimited Agent Settings,重新输入隧道 ID 和有效的受限运行时密钥。
确认密钥具有
隧道:读取 + 使用权限,并且属于拥有该隧道的组织/工作空间。检查
%LOCALAPPDATA%\UnlimitedAgent\data\logs\bridge.log和watchdog.log。404错误通常表示 ChatGPT 选择了不同的隧道/应用、运行时已停止,或者私有应用未从相同的 ChatGPT/OpenAI 组织上下文中创建。
工具被拒绝
本地响应会指明拒绝原因:只读模式、允许文件夹边界、每工具覆盖或拒绝的批准。
打开 Unlimited Agent Settings 更改策略。不要仅仅为了隐藏真实的安全边界而削弱权限。
鼠标或键盘操作无响应
Windows 必须已登录且解锁。
UAC 安全桌面、登录屏幕、某些高权限应用、使用独占输入的游戏以及受保护媒体无法从普通用户进程可靠地自动化。
Chrome 打开了错误的配置文件
要求 ChatGPT 调用
open_url或browser_control并指定 Chrome 配置文件目录名称,例如Default或Profile 2。
卸载与撤销
运行桌面快捷方式 Uninstall Unlimited Agent。它将停止/删除本地运行时、删除自动启动项、删除加密的凭据以及删除安装目录。
然后在 OpenAI 平台撤销专用的受限密钥,如果隧道不再使用,请将其删除。如果 PC 或 Windows 账户可能被入侵,撤销操作至关重要。
安全与许可
在启用完全访问之前,请阅读 SECURITY.md。安全报告应使用 GitHub 私有漏洞报告功能,而不是公开问题。
Unlimited Agent 根据 MIT 许可证 提供。捆绑的运行时声明见 THIRD_PARTY_NOTICES.md。
Available Tools
21 toolsbrowser_controlControl Google ChromeA
Open a URL or send navigation/tab shortcuts to the focused Chrome window. For reliable GUI browsing, list windows, focus Chrome, act, then capture a screenshot.
| Name | Required | Description | Default |
|---|---|---|---|
| url | No | ||
| action | Yes | ||
| profile | No | Default | |
| windowHandle | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate not read-only and not destructive, but the description adds a behavioral requirement: it acts on a 'focused Chrome window,' which implies the need to focus Chrome first. It does not describe potential side effects (e.g., closing tabs) or failure modes. There is no contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very concise, two sentences, with the core purpose stated upfront. No fluff has to earn its place. The second sentence adds practical usage advice.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 4 parameters and no output schema, the description gives a workflow but omits detailed explanations for what happens with each action (e.g., what happens when close_tab is used, whether confirmation occurs, how windowHandle affects behavior). It relies heavily on the schema for context but the schema has no descriptions. It is not fully complete for an agent to safely use all features.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With a schema description coverage of 0%, the description must explain parameter meaning. It loosely covers 'url' (for open) and 'action' (for shortcuts/tabs), but completely ignores 'profile' and 'windowHandle'. The enum for 'action' is self-explanatory, but the additional parameters are left undefined. The description does not compensate for the low coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Open a URL or send navigation/tab shortcuts to the focused Chrome window.' This uses specific verbs (open, send) and a specific resource (Chrome window), and distinguishes it from siblings like open_url (which may target any browser) and window_control (which handles window management).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a recommended usage sequence: 'For reliable GUI browsing, list windows, focus Chrome, act, then capture a screenshot.' This tells the agent when to use it and in what context. However, it does not explicitly mention when not to use it or provide alternative approaches, which is a minor gap.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
clipboardRead or write Windows clipboardA
Read text from or write text to the interactive Windows clipboard.
| Name | Required | Description | Default |
|---|---|---|---|
| text | No | ||
| action | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate this is not a read-only tool, and the description accurately reflects read/write behavior without contradicting annotations. However, beyond the basic dual-action behavior, it does not disclose details such as what happens on a non-text clipboard, whether setting overwrites existing content, or possible failure modes.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, compact sentence that is front-loaded with the tool's purpose. There is no filler or redundant restatement of the tool name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple two-parameter clipboard tool, the description is minimally adequate, but it leaves gaps: it does not specify the return behavior for `get`, nor the dependency between `action=set` and the `text` field. The lack of an output schema makes these omissions more noticeable.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description needed to compensate by explaining how `action` and `text` relate. Instead, it merely restates 'read text' and 'write text' without mapping those actions to the get/set enum or clarifying that `text` is needed for the set action. The schema provides names and enum values but no semantic guidance.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function with specific verbs 'read' and 'write' plus the resource 'Windows clipboard' in the title and description. It is immediately distinguishable from sibling tools like read_file, write_file, and computer_input.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description communicates the core use case but provides no explicit guidance on when to prefer this tool over alternatives or when not to use it. Usage context is implied by the 'interactive Windows clipboard' phrasing, but no exclusions or alternative tool references are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
computer_inputControl mouse and keyboardADestructive
Send mouse, keyboard, text, scrolling, and wait actions to the interactive Windows desktop. Take a screenshot first, focus the target window, act, then screenshot again to verify.
| Name | Required | Description | Default |
|---|---|---|---|
| actions | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations indicate destructiveHint=true, and the description appropriately warns that actions affect the live desktop. It adds operational context by recommending a screenshot-verify loop, which goes beyond the annotations. However, it does not detail all potential destructive outcomes (e.g., keystrokes affecting unsaved work) or permission/security implications.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences and immediately fronts the core behavior. Every word adds value: the first sentence identifies the input categories, the second provides the exact workflow. No fluff or redundant restating of the tool name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with one complex parameter, nested objects, no output schema, and destructive annotations, the description is reasonably complete. It tells the agent what to do (send actions) and how to use it safely (screenshot first, verify after). However, it lacks explicit details on when not to use it or how the wait action works relative to screen transitions.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description carries the burden. It lists action types (mouse, keyboard, text, scrolling, wait) and gives workflow hints, but it does not explain individual fields like x, y, delta, button, milliseconds, or key formats. The enum values in the schema are self-explanatory for an AI agent, and the description covers the high-level categories, but some parameter semantics remain implicit.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: sending mouse, keyboard, text, scrolling, and wait actions to the interactive Windows desktop. It lists specific action categories and distinguishes itself from sibling tools like browser_control and window_control by targeting the desktop-level input.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides an explicit workflow: take a screenshot first, focus the target window, act, then screenshot again to verify. This implies when to use the tool (for interactive desktop manipulation) but does not explicitly state exclusions or mention alternative tools for specific scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
edit_fileEdit local text fileADestructive
Replace exact text in a UTF-8 local file. Use for focused edits that preserve the rest of the file.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| newText | Yes | ||
| oldText | Yes | ||
| replaceAll | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already disclose destructiveHint=true, but the description adds valuable context beyond that: it emphasizes 'exact text' matching and 'preserve the rest of the file,' which clarifies the non-destructive-to-unmatched-content nature of the edit. This is particularly useful because it signals that the tool does not truncate or rewrite the entire file. No contradiction with annotations; in fact, it reinforces them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short, direct sentences with no filler. The most important action ('Replace exact text') comes first, followed by a parenthetical-style usage note. Every word earns its place. This is a model of conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive mutation tool with four parameters and no output schema, this description is functional but thin. It covers the core 'what' but leaves out edge cases like what happens if oldText is not found, whether matching is case-sensitive, and the behavior of replaceAll (since it defaults to false). Given the straightforward nature of the operation and the clear sibling distinction, it's adequate but not rich. A 3 reflects that it's the minimum viable for safe usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage, the description bears full responsibility for parameter meaning. It says 'exact text,' which hints that oldText/newText must be precise substrings, but it doesn't explicitly map to parameters or mention the replaceAll flag, path semantics, or error behavior. The description is a good start but leaves much of the parameter reasoning to inference. A 3 is appropriate because it gives some guidance but doesn't fully compensate for the lack of schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description starts with a specific verb+resource: 'Replace exact text in a UTF-8 local file.' It clearly distinguishes this from siblings like write_file (which overwrites entire files) and file_operation (generic) by emphasizing 'focused edits' and 'preserve the rest of the file.' This is a textbook case of purpose clarity and sibling differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The second sentence, 'Use for focused edits that preserve the rest of the file,' provides explicit guidance on when to use this tool. While it doesn't explicitly name alternatives like write_file, the context makes clear that this is for targeted modifications rather than full rewrites. It could be improved by mentioning when not to use it, but the guidance is sufficient for basic selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
execExecute PowerShellADestructive
Run an arbitrary PowerShell command on this Windows PC. Use for local development, package installation, system configuration, services, processes, and tasks not covered by a more specific tool. Verify changes afterward.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Working directory; defaults to the Windows user profile | |
| command | Yes | PowerShell command to run | |
| timeoutSeconds | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already disclose destructiveHint=true, openWorldHint=true, and idempotentHint=false, so the description doesn't need to repeat those. The description adds a caution to 'Verify changes afterward,' which is helpful, but it doesn't elaborate on side effects, permissions, or potential system impact beyond what the annotations imply. Given the annotations carry the risk profile, the description's additional behavioral context is minimal but appropriate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three concise sentences: the primary action, a list of appropriate use cases, and a verification instruction. The purpose is front-loaded in the first sentence. No filler or redundancy. Every sentence adds value, making it highly efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an arbitrary command execution tool, the description covers the essential aspects: what it does, when to use it, and a caution to verify. It does not describe return output or error handling, but there is no output schema, so that is not strictly required. Given the complexity of the tool and the existence of many specific siblings, the description is sufficiently complete to guide an agent in selecting and using it appropriately.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description provides no detail about the parameters themselves. The input schema covers 'command' and 'cwd' with descriptions, but 'timeoutSeconds' lacks a description (schema coverage is 67%). The description does not compensate for this missing parameter information, nor does it add any meaning beyond the schema for the existing parameters. Since the coverage is moderate but not high, the description should have at least mentioned the timeout or working directory behavior, but it doesn't.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the primary action: 'Run an arbitrary PowerShell command on this Windows PC.' It specifies the resource (PowerShell on Windows) and the scope (arbitrary). It also lists common use cases (local development, package installation, system configuration, services, processes) and explicitly distinguishes from more specific tools by saying 'tasks not covered by a more specific tool,' which differentiates it from the sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly provides usage guidance: 'Use for local development, package installation, system configuration, services, processes, and tasks not covered by a more specific tool.' This tells when to use it and implies when not to use it (when a more specific tool exists). It also adds a safety instruction: 'Verify changes afterward,' which is a clear directive for safe usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
file_operationManage local files and foldersADestructive
Copy, move, delete, or create local files and folders. Use exact resolved targets and verify consequential operations afterward.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | ||
| source | Yes | ||
| overwrite | No | ||
| recursive | No | ||
| destination | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true and readOnlyHint=false, but the description adds useful behavioral guidance: 'Use exact resolved targets and verify consequential operations afterward.' This goes beyond the annotations by advising post-operation verification and caution with path resolution, though it does not detail what may be destroyed or under what conditions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise: two sentences, no filler. It front-loads the core actions in the first sentence and adds a practical caution in the second. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's moderate complexity (5 parameters, destructive operation, no output schema), the description covers the purpose and a verification warning but leaves out important parameter semantics (e.g., overwrite behavior, recursive handling, destination requirement). The annotations cover the destructive nature, allowing a slightly higher score, but the incomplete parameter context still prevents a higher rating.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description does not explain the parameters other than implying the 'action' enum via the verbs. It doesn't clarify the meaning or usage of 'overwrite', 'recursive', 'source', or 'destination'. For a tool with 5 parameters (2 required), this is a significant gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description begins with specific verbs and a resource: 'Copy, move, delete, or create local files and folders.' This clearly enumerates the tool's actions and distinguishes it from sibling tools like read_file or list_directory, which handle reading/listing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for when to use the tool (any operation that copies, moves, deletes, or creates local files/folders), but it does not explicitly state when not to use it or mention alternatives such as write_file for editing. The caution to 'Use exact resolved targets' implies careful use, but no exclusion or alternative is stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
http_requestMake HTTP request or downloadB
Call an HTTP/HTTPS URL from this PC or download the response to a local file. Does not inherit OpenAI or tunnel credentials.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | ||
| body | No | ||
| method | No | GET | |
| saveTo | No | ||
| headers | No | ||
| timeoutSeconds | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the annotations, the description adds meaningful context: the request is made 'from this PC' and it 'does not inherit OpenAI or tunnel credentials,' which lets agents know explicit headers are needed for authenticated endpoints. It also exposed the side effect of downloading to a local file, which is not fully captured by the annotation flags.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short and front-loaded: the first sentence states the core capability and the second gives a useful credential caveat. Every sentence earns its place; no filler or title repetition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description communicates the primary use cases and an important authentication constraint, but with six parameters, no output schema, and no parameter descriptions, it leaves gaps around response return values, error behavior, and request-side details such as headers/body when not covered by the schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema_description_coverage, the description is expected to compensate by explaining parameters, but it only vaguely maps to 'URL' and 'local file.' There is no meaningful detail added for body, method, headers, timeout, or saveTo semantics beyond what generic names and types already provide.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The tool states a concrete action: 'Call an HTTP/HTTPS URL from this PC' and additionally mentions downloading the response locally, which clarifies the intended scope. It doesn't explicitly distinguish itself from siblings like open_url or file tools, so it stops short of a perfect score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explains what the tool does but provides no guidance on when to prefer it over alternatives such as open_url, exec, or file_operation. The credential note is useful behaviorally but isn't shaped as 'use this when' or 'avoid this when' guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
job_statusCheck background jobARead-onlyIdempotent
List background jobs or inspect one job with running state and recent stdout/stderr. Poll until completion and verify the resulting files or application state.
| Name | Required | Description | Default |
|---|---|---|---|
| jobId | No | ||
| tailBytes | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide read-only, idempotent, and non-destructive flags. The description adds meaningful context beyond those annotations by disclosing observable behavior: it exposes running state and recent stdout/stderr, and supports polling until completion.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very compact and front-loaded. Two sentences cover the main action, inspectable state, log tail access, and polling context with no filler or redundant restatement of the tool name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple input schema and strong annotations, the description gives enough context about what the tool returns and why it should be used. It could be more explicit about the output shape when listing all jobs vs inspecting a single one, but it is not critically incomplete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It only indirectly implies jobId via 'inspect one job' and tailBytes via 'recent stdout/stderr,' but it does not explicitly explain their meaning, relationship, or effect on the returned output.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a concrete action: 'List background jobs or inspect one job with running state and recent stdout/stderr.' It clearly distinguishes itself from lifecycle-related siblings like start_job and stop_job by focusing on observation and status verification.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly tells the agent when to use the tool: poll until completion and verify resulting files or application state. It does not name exclusions or compare directly with read_file or related observation tools, but the usage intent is clear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
launch_programLaunch local programB
Launch a local executable or script with arguments, optionally visible. Use list_windows and screenshot after launching GUI applications.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | ||
| args | No | ||
| visible | No | ||
| executable | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate readOnly=false, idempotent=false, destructive=false. The description adds a small behavioral hint about GUI verification and 'optionally visible', but it omits important behaviors such as process lifecycle, whether the call blocks, or what output/exit status is returned. No contradiction exists, but transparency is only intermediate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Highly concise as two sentences in 22 words. The main verb and resource are front-loaded, and the follow-up GUI guidance is directly relevant and efficiently placed. No filler or redundant content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and a four-parameter tool, the description misses essential context about process lifetime, return value, whether the program is blocking, working-directory assumptions, and session visibility. The GUI follow-up guidance is helpful, but overall the description leaves too much uncertainty for safe, autonomous tool invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It mentions 'executable or script', 'with arguments', and 'optionally visible', but omits 'cwd' entirely and gives no details about argument handling or vocabulary defaults. The description adds some semantic clarity for executable/args/visible but not enough for key parameters like cwd.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the action ('Launch a local executable or script') and key modifiers ('with arguments, optionally visible'). It distinguishes from related tools by emphasizing local executable/script, though it doesn't explicitly differentiate from 'exec' or 'start_job'. This is clear enough for selection.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description includes a clear follow-up directive: use list_windows and screenshot after launching GUI applications. This gives useful context for the expected workflow, but it does not mention when not to use this tool or present alternatives, so it falls short of explicit exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_directoryList local directoryARead-onlyIdempotent
List files and folders with type, size, and modified time. Use before guessing paths or choosing files to edit.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | /root | |
| maxDepth | No | ||
| recursive | No | ||
| maxEntries | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already cover the read-only, non-destructive, idempotent nature of the tool. The description adds value beyond the annotations by telling the agent what kind of information it will receive (file type, size, modified time), which helps set expectations for downstream decisions. There is no contradiction with annotations, and no additional behavioral disclosure about truncation or depth limits is made, but the annotations lower the bar for this dimension.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is only two sentences, both of which carry meaningful content. The primary purpose is front-loaded and the usage hint is brief. There is no redundancy or filler, making it as concise as possible while still providing useful guidance.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With four parameters, no schema descriptions, and no output schema, the tool requires more explanatory detail than this description offers. It covers the basic listing action and return fields, but omits key operational details like path scoping, recursion behavior, depth limits, and entry cap semantics. This leaves too much room for agent misconfiguration.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description bears the full responsibility for explaining parameters. It mentions no parameter semantics at all: 'path', 'maxDepth', 'recursive', and 'maxEntries' are all left unexplained. This is a critical gap for an agent trying to decide what values to pass or what each control does.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('List') and the resource ('files and folders'), and specifies the returned attributes ('type, size, and modified time'). This makes it instantly distinguishable from sibling tools like read_file, edit_file, and search_files, so an agent can confidently select it for directory inspection.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The sentence 'Use before guessing paths or choosing files to edit' provides explicit situational guidance and tells the agent when this tool should be invoked. However, it does not name alternative tools or explicitly state when not to use it, which keeps it just below a perfect score.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_windowsList desktop windowsARead-onlyIdempotent
List top-level Windows desktop windows with title, process ID, handle, position, size, and minimized state. Use to target window_control reliably.
| Name | Required | Description | Default |
|---|---|---|---|
| includeHidden | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare the tool read-only, idempotent, and non-destructive. The description adds useful behavioral context about scope (top-level windows), platform (Windows), and output fields. No contradiction with annotations found.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two crisp sentences: the first states the operation and output fields, the second gives usage guidance. No wasted words or redundant repetition of schema or annotations.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only listing tool, this is almost complete: it identifies the target resource, lists output fields, and links to its downstream use (window_control). The only significant gap is the undocumented includeHidden parameter.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The only parameter, includeHidden, has no schema description and the tool description does not explain its effect—especially whether it includes minimized windows, hidden windows, or other invisible top-level windows. With 0% schema description coverage, the description should compensate but does not.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Uses specific verb 'List' and clear resource 'top-level Windows desktop windows', enumerates returned fields (title, process ID, handle, position, size, minimized state), and separates it from window_control by stating its purpose of enabling reliable targeting.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly tells the agent to use this when wanting to target window_control, giving a clear use context. It does not explicitly say when not to use it or name alternatives, but the context is strong enough.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
open_urlOpen URL in logged-in ChromeA
Open an HTTP/HTTPS URL in Google Chrome using a profile belonging to the current Windows user.
| Name | Required | Description | Default |
|---|---|---|---|
| url | Yes | ||
| profile | No | Default |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already signal side effects (readOnlyHint=false, openWorldHint=true, idempotentHint=false), so the description needs less behavioral detail. It adds the useful context that Chrome uses a profile belonging to the current Windows user, but it does not explain whether a new tab or window is opened, whether Chrome is launched if not running, or how failures are reported.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no filler or repeated annotation data. Every part contributes to understanding what the tool does.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with two parameters and no output schema, the description is mostly complete enough for an agent to select and invoke it. It clearly identifies the URL and Chrome profile; the main missing pieces are the exact session/tab behavior and platform failure modes, but these are not blocking for a basic open-URL action.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% parameter description coverage in the schema, the description must compensate. It adds some meaning by clarifying that URL must be HTTP/HTTPS and that profile is associated with the current Windows user, but it leaves details unclear such as how profiles are resolved or what the default 'Default' profile means beyond standard Chrome behavior.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action (open an HTTP/HTTPS URL) and a specific resource (Google Chrome using a profile belonging to the current Windows user). This is more informative than the title and clearly differentiates the tool from generic siblings like launch_program or browser_control.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance about when to prefer this tool over alternatives such as http_request, browser_control, or launch_program. It also omits any conditions, exclusions, or prerequisites beyond the implied Windows/Chrome context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
path_infoInspect local pathARead-onlyIdempotent
Check whether a local path exists and return detailed file, folder, or symbolic-link metadata.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is well covered. The description adds that it checks existence and returns metadata, but it does not disclose not-found behavior, symlink resolution, or whether the returned metadata is stat-like.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is one sentence, front-loaded with the core action, and contains no filler. Every phrase ('exists', 'detailed metadata', 'symbolic-link') earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple, one-parameter, read-only inspection tool with strong annotations, the description covers the essential purpose and result type. The main gap is the lack of an output schema or explanation of what happens when the path does not exist, but the overall tool complexity is low enough that this is still reasonably complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema provides no parameter description, so the description's mention of 'local path' and 'file, folder, or symbolic-link' adds meaningful semantics beyond the bare string type. It stops short of specifying accepted formats like absolute vs relative paths, but for a single obvious parameter it is adequately clarifying.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Check whether') and a concrete resource ('local path'), and names the exact result: detailed file, folder, or symbolic-link metadata. This clearly distinguishes it from sibling tools like list_directory or read_file by focusing on path existence and metadata rather than contents.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The usage context is implied: it is for inspecting whether a local path exists and retrieving metadata. However, it provides no explicit when-to-use versus alternatives, no exclusions, and no mention of when list_directory or file_operation would be more appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_fileRead local fileARead-onlyIdempotent
Read any local file accessible to the current Windows user. Use utf8 for text and base64 for binary files.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| encoding | No | utf8 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare the operation as read-only and idempotent. The description adds useful context by restricting access to files available to the current Windows user and by directing base64 for binary files. It does not discuss error cases, but the annotation safety profile lowers that burden.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loads the main purpose, and every phrase adds useful information. No filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-file tool with no output schema and strong read-only/idempotent annotations, the description covers the core scope and encoding behavior. It does not mention error handling, missing files, or response format, but for a straightforward local read tool this is not a critical gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema only provides names and an enum for encoding, while the description enriches the encoding parameter by explaining that utf8 is for text and base64 is for binary. It also clarifies the path parameter as a local file accessible to the current user, though it does not detail path formatting requirements.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'Read any local file accessible to the current Windows user,' which clearly identifies the action, resource, and scope. It distinguishes this tool from write/edit tools by emphasizing local file reading.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear contextual guidance: it is for local file reading, and it specifies when to use utf8 vs base64 encoding. It does not explicitly name sibling alternatives, but the local-file scope and encoding instructions make usage largely unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
screenshotCapture Windows screenARead-onlyIdempotent
Capture the primary display or full virtual desktop as a PNG image. Use before and after graphical actions to locate controls and verify outcomes.
| Name | Required | Description | Default |
|---|---|---|---|
| capture | No | virtual |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and idempotentHint=true. The description adds meaningful context by specifying the capture scopes (primary vs. virtual desktop) and the PNG output format, which goes beyond the structured annotations. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no fluff. The first sentence front-loads the action and resource; the second provides usage guidance. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only tool with one optional enum parameter, strong annotations, and no output schema, the description covers the capture scope, output format, and intended use pattern. It provides everything an agent needs to decide when and how to invoke it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 0% parameter description coverage, so the description carries the burden. It explains both enum values: 'primary display' for 'primary' and 'full virtual desktop' for 'virtual'. It does not state the default, but the schema already shows that.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Capture') and names the exact resources ('primary display or full virtual desktop') along with the output format ('PNG image'). It clearly distinguishes this from sibling tools like list_windows, read_file, or computer_input.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to use the tool ('Use before and after graphical actions to locate controls and verify outcomes'). It gives clear contextual guidance, though it does not name alternative tools or negative conditions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_filesSearch local filesARead-onlyIdempotent
Fast local search using ripgrep. Search file names or text contents before reading large directory trees.
| Name | Required | Description | Default |
|---|---|---|---|
| glob | No | ||
| mode | No | content | |
| root | No | /root | |
| query | Yes | ||
| regex | No | ||
| maxResults | No | ||
| caseSensitive | No | ||
| includeHidden | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare the tool as read-only, idempotent, and non-destructive. The description adds that it uses ripgrep and is fast, but does not mention potential nuances like respect for .gitignore, output format, or error behavior. Given the annotations, this is adequate but not exceptional.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise and to the point, consisting of two sentences. It avoids unnecessary fluff and clearly communicates the core functionality and recommended usage.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description lacks essential context for effective use. With 8 parameters, no parameter descriptions, and no output schema, the agent is left without guidance on expected results (e.g., paths, line numbers), return format, or how to combine parameters. The description is too minimal to fully equip an agent to use this tool correctly in all scenarios.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description provides no explanation for any of the 8 parameters. While names like 'query', 'glob', and 'maxResults' are somewhat intuitive, the lack of any description for parameters like 'root', 'regex', or 'caseSensitive' leaves ambiguity. The tool description does not compensate for the missing schema descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: fast local search using ripgrep, covering both file names and text contents. It distinguishes itself from file reading and listing tools by advising to search before reading large directory trees.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives a clear usage context: use before reading large directory trees to avoid unnecessary scanning. It implies this tool is efficient for locating files or content, but does not explicitly contrast with sibling tools like grep or list_directory, though the context is strong enough.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
start_jobStart background PowerShell jobADestructive
Start a long-running PowerShell command in the background with persistent stdout/stderr logs. Poll with job_status instead of waiting in exec.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | ||
| label | No | ||
| command | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate destructiveHint=true. The description adds context about background execution and persistent logs, but does not elaborate on potential side effects or non-blocking behavior beyond the annotation. It provides some value without contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two clear, concise sentences that convey the core action, key behavior (background, logs), and usage guidance. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Provides good high-level context (long-running, background, logs, polling advice) but omits how the job ID is returned or how to reference the job with job_status. Since there is no output schema, this is not strictly required, but it would improve usability.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has no per-parameter descriptions. The description mentions 'PowerShell command' (implying the 'command' parameter) but does not explain the purpose of 'cwd' or 'label'. With 0% schema coverage, it should compensate but fails to describe two of three parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Clearly states that it starts a long-running PowerShell command in the background with persistent logs, distinguishing it from synchronous execution (exec) and monitoring (job_status).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly advises polling with job_status instead of waiting in exec, giving a clear alternative and implied use case for long-running tasks. Could be stronger by stating when not to use this tool (e.g., for quick commands).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
stop_jobStop background jobADestructive
Force-stop a background job and its child process tree by job ID.
| Name | Required | Description | Default |
|---|---|---|---|
| jobId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotation 'destructiveHint: true' is consistent with the description's 'Force-stop' and 'child process tree' language. The description adds the nuance that it kills the entire process tree, which is not implied by annotations alone. However, it does not explicitly state irreversibility or side effects like data loss, though it is strongly implied.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, compact sentence with no filler. It front-loads the action and scope, making it immediately understandable. Perfectly concise for a simple tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter tool with no output schema, the description is sufficiently complete. It covers the core action and scope. It could mention error behavior (e.g., what happens if jobId doesn't exist) but given the simplicity and the sibling context, the current level is adequate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema only specifies 'jobId' as a UUID. Since schema description coverage is 0%, the description must compensate. It mentions 'by job ID', which clarifies the parameter's purpose, but it does not explain how to obtain a job ID (e.g., from 'start_job') or valid formats beyond the schema. This is minimal compensation for a single parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific action ('Force-stop') on a specific resource ('background job') with an additional detail ('child process tree') and identification method ('by job ID'). It unambiguously distinguishes from sibling tools like 'start_job' and 'job_status'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
While the description implies when to use the tool (to stop a job), it does not explicitly state when not to use it or mention alternatives (e.g., 'use job_status to check first' or 'use exec for non-background tasks'). It relies on inference rather than explicit guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
system_infoInspect Windows systemARead-onlyIdempotent
Return local Windows, CPU, memory, user, host, runtime, and server capability information without changing the PC.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds a clear non-destructive guarantee ('without changing the PC'), which complements the readOnlyHint and destructiveHint annotations. While it doesn't discuss permissions or side effects, the core behavioral trait is transparently disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that efficiently lists the categories of information returned. There is no superfluous text or ambiguity in structure.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity and lack of output schema, the description fully covers its purpose and safety behavior. It clearly outlines what the user can expect without needing additional details.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has no input parameters, and the description appropriately avoids discussing them. Since there are no params, the baseline is 4; the description adds value by specifying what kind of information is returned, which is more than sufficient.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool returns system information (Windows, CPU, memory, user, host, runtime, server capability) and explicitly notes it does so without changing the PC. This is specific and distinguishes it from sibling tools like exec or file operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies safe usage ('without changing the PC') but does not explicitly state when to use this tool versus alternatives. It lacks direct comparison to other tools or scenarios, leaving the usage context implicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
window_controlControl desktop windowADestructive
Focus, minimize, maximize, restore, or close a desktop window by the handle returned from list_windows.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | ||
| handle | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false and destructiveHint=true, so the mutation/destruction risk is known. The description adds the useful context that the handle originates from list_windows, but otherwise it largely restates the action enum without explaining side effects such as focus stealing or irreversible close. This is acceptable but not rich behavioral disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The entire description is a single sentence that front-loads the action verbs and immediately names the handle source. There is no redundancy or filler; every phrase contributes to selecting and invoking the tool correctly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a two-parameter tool with an enum constraint, annotations, and no output schema, the description contains enough information to invoke it correctly: the handle provenance and the allowed actions. It could mention edge cases like close being irreversible, but the destructiveHint annotation already covers the main safety concern.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the schema itself provides an enum for action and an integer type with minimum for handle. The description adds one meaningful semantic beyond the schema: the handle is specifically the one returned by list_windows. However, it does not elaborate on the effects or prerequisites of each action, so it only partially compensates for the missing parameter descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb set ('Focus, minimize, maximize, restore, or close') and a clear resource ('a desktop window'), then ties the handle to list_windows, which distinguishes it from window enumeration and other sibling tools. This is a specific, actionable definition rather than a generic restatement of the title.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'by the handle returned from list_windows' clearly implies the prerequisite workflow: first list windows, then control one by its handle. It does not explicitly list when not to use the tool, but no sibling tool appears to overlap with desktop-window manipulation, so the context is sufficient.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
write_fileWrite local fileADestructive
Create, overwrite, or append to any local file. Create missing parent folders when requested, then verify important writes with read_file or path_info.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | No | overwrite | |
| path | Yes | ||
| content | Yes | ||
| encoding | No | utf8 | |
| createParents | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With destructiveHint already provided by annotations, the description adds useful behavioral context: it can overwrite existing content, append, and create parent directories only when requested. It also signals that the responsible pattern is to verify important writes afterward.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences with no filler. It front-loads the operation, then adds the important parent-folder behavior and verification recommendation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description covers the core write semantics, the optional parent-directory creation, and the verification mechanism despite the lack of an output schema. It is slightly incomplete because it does not mention encoding behavior or success/error semantics, though the schema covers the parameter values.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the description clarifies the meanings of overwrite/append behavior and the createParents behavior. However, encoding is left entirely to the schema and the description does not explain why or when to choose encoding options.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states exactly what the tool does: 'Create, overwrite, or append to any local file.' This clearly defines the operation type and resource scope, making it easy to distinguish from read-focused siblings like read_file and path_info.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives clear guidance on when verifying results is appropriate by recommending read_file or path_info after important writes. However, it does not explicitly explain when to prefer write_file over alternatives like edit_file or file_operation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
21 tool updates
v0.1.0- First observed
browser_control - First observed
clipboard - First observed
computer_input - First observed
edit_file - First observed
exec - First observed
file_operation - First observed
http_request - First observed
job_status - First observed
launch_program - First observed
list_directory - First observed
list_windows - First observed
open_url - First observed
path_info - First observed
read_file - First observed
screenshot - First observed
search_files - First observed
start_job - First observed
stop_job - First observed
system_info - First observed
window_control - First observed
write_file
TDQS
Scored across 21 tools
Each tool has a clearly distinct purpose: file operations (read, write, edit, list, search, path, copy/move/delete) are separate from process execution (exec, launch, background jobs), GUI automation (screenshot, list/control windows, input, clipboard, open_url, browser_control), web requests, and system info. No two tools could be easily confused.
All tool names follow a consistent snake_case verb_noun or verb_phrase pattern (e.g., read_file, list_windows, start_job, system_info). No mixing of styles or vague verbs, making the API predictable and intuitive.
With 21 tools, the set is on the higher end of the typical range but still well-scoped for a comprehensive Windows automation server. Each tool earns its place; no obvious bloat. Slight overage compared to the ideal 3-15 range, but justified by the breadth of capabilities.
The tool surface covers file CRUD, directory listing, search, file operations, arbitrary command execution, GUI interaction (screenshot, window control, mouse/keyboard, clipboard, browser control), web requests, background job management, and system info. No significant gaps for the stated purpose of local Windows automation.
Maintenance
Related MCP Connectors
Use your Mac, Windows or Linux computer from ChatGPT, Claude or Codex: files, commands, documents.
Remote Desktop Commander: use files, terminal and processes on your own computers from any AI app.
Securely control computers you explicitly pair through files, terminals, processes, screenshots, desktop UI/input, clipboard, browser automation, diagnostics, and document tools.
Mac & Windows: let ChatGPT, Claude & Cursor use your email, calendar, iMessage, Teams, files.
Related MCP Servers
- FlicenseCqualityDmaintenanceEnables ChatGPT to control a Windows PC remotely via OpenAI Secure MCP Tunnel, executing file operations, PowerShell commands, and system actions through a local MCP server.15-
- AlicenseNot gradedqualityBmaintenanceEnables ChatGPT to securely control a Windows PC via a local agent, supporting file operations, Chrome automation, and allowlisted apps with audit logging and approval workflows.MIT
- AlicenseAqualityAmaintenanceMCP server that lets a private ChatGPT app remotely control a paired Windows PC, including files, PowerShell, programs, screenshots, mouse/keyboard, clipboard, and Chrome.214MIT
- AlicenseNot gradedqualityAmaintenanceEnables ChatGPT to access approved local Windows folders, run commands, control the desktop, and manage session history through a permission-bounded MCP server.4,767MIT