Skip to main content
Glama

winrm-mcp

A focused MCP server for running PowerShell and CMD commands on Windows hosts over WinRM, with a multi-host inventory, parallel execution across tagged hosts, sandboxed file transfer and an operator-controlled security policy. It leaves out SSH, persistent sessions, jobs and command groups (see ssh-winrm-mcp for those).

  • Accurate exit codes, including PowerShell exit N; timed-out commands are stopped on the remote host.

  • output_format="json" returns PowerShell objects as parsed JSON instead of formatted text.

  • Every tool declares MCP annotations so clients can ask before running remote commands.

Install in your agent

Install in VS Code Install in VS Code Insiders Install in Cursor

It works with any MCP client that can start a stdio command. It needs uv. uvx fetches the pinned release, so no clone or virtualenv is needed. Pick your agent below.

Variable

Meaning

Example

WINRM_MCP_HOST

Default Windows host

192.168.1.50

WINRM_MCP_USERNAME

Default user

Administrator

WINRM_MCP_PASSWORD

Default password

your-password

All three are optional defaults. Without them, pass the connection in each tool call or use the multi-host inventory. Other defaults use the same WINRM_MCP_ prefix: WINRM_MCP_AUTH (ntlm), WINRM_MCP_SSL, WINRM_MCP_PORT, WINRM_MCP_CERT_VALIDATION. See Install and run.

The VS Code buttons ask for each value, keeping secrets out of files. The Cursor button writes placeholders: edit them in ~/.cursor/mcp.json afterwards. Elsewhere, replace the example values.

claude mcp add winrm -s user -e WINRM_MCP_HOST=192.168.1.50 -e WINRM_MCP_USERNAME=Administrator -e WINRM_MCP_PASSWORD=your-password -- uvx --from git+https://github.com/bigbatmanorg/winrm-mcp.git@v0.3.0 winrm-mcp

Settings → Developer → Edit Config (claude_desktop_config.json):

{
  "mcpServers": {
    "winrm": {
      "command": "uvx",
      "args": [
        "--from",
        "git+https://github.com/bigbatmanorg/winrm-mcp.git@v0.3.0",
        "winrm-mcp"
      ],
      "env": {
        "WINRM_MCP_HOST": "192.168.1.50",
        "WINRM_MCP_USERNAME": "Administrator",
        "WINRM_MCP_PASSWORD": "your-password"
      }
    }
  }
}

Use the button above, or add this to .vscode/mcp.json (workspace) or to the user mcp.json (command MCP: Open User Configuration):

{
  "inputs": [
    {
      "type": "promptString",
      "id": "winrm_mcp_host",
      "description": "Default Windows host",
      "password": false
    },
    {
      "type": "promptString",
      "id": "winrm_mcp_username",
      "description": "Default user",
      "password": false
    },
    {
      "type": "promptString",
      "id": "winrm_mcp_password",
      "description": "Default password",
      "password": true
    }
  ],
  "servers": {
    "winrm": {
      "type": "stdio",
      "command": "uvx",
      "args": [
        "--from",
        "git+https://github.com/bigbatmanorg/winrm-mcp.git@v0.3.0",
        "winrm-mcp"
      ],
      "env": {
        "WINRM_MCP_HOST": "${input:winrm_mcp_host}",
        "WINRM_MCP_USERNAME": "${input:winrm_mcp_username}",
        "WINRM_MCP_PASSWORD": "${input:winrm_mcp_password}"
      }
    }
  }
}

Use the button above, or add this to ~/.cursor/mcp.json (global) or .cursor/mcp.json (project):

{
  "mcpServers": {
    "winrm": {
      "command": "uvx",
      "args": [
        "--from",
        "git+https://github.com/bigbatmanorg/winrm-mcp.git@v0.3.0",
        "winrm-mcp"
      ],
      "env": {
        "WINRM_MCP_HOST": "192.168.1.50",
        "WINRM_MCP_USERNAME": "Administrator",
        "WINRM_MCP_PASSWORD": "your-password"
      }
    }
  }
}

Add this to ~/.codeium/windsurf/mcp_config.json:

{
  "mcpServers": {
    "winrm": {
      "command": "uvx",
      "args": [
        "--from",
        "git+https://github.com/bigbatmanorg/winrm-mcp.git@v0.3.0",
        "winrm-mcp"
      ],
      "env": {
        "WINRM_MCP_HOST": "192.168.1.50",
        "WINRM_MCP_USERNAME": "Administrator",
        "WINRM_MCP_PASSWORD": "your-password"
      }
    }
  }
}
codex mcp add winrm --env WINRM_MCP_HOST=192.168.1.50 --env WINRM_MCP_USERNAME=Administrator --env WINRM_MCP_PASSWORD=your-password -- uvx --from git+https://github.com/bigbatmanorg/winrm-mcp.git@v0.3.0 winrm-mcp

Or add this to ~/.codex/config.toml:

[mcp_servers.winrm]
command = "uvx"
args = ["--from", "git+https://github.com/bigbatmanorg/winrm-mcp.git@v0.3.0", "winrm-mcp"]
env = { WINRM_MCP_HOST = "192.168.1.50", WINRM_MCP_USERNAME = "Administrator", WINRM_MCP_PASSWORD = "your-password" }

Add this to ~/.gemini/settings.json (or to .gemini/settings.json in a project):

{
  "mcpServers": {
    "winrm": {
      "command": "uvx",
      "args": [
        "--from",
        "git+https://github.com/bigbatmanorg/winrm-mcp.git@v0.3.0",
        "winrm-mcp"
      ],
      "env": {
        "WINRM_MCP_HOST": "192.168.1.50",
        "WINRM_MCP_USERNAME": "Administrator",
        "WINRM_MCP_PASSWORD": "your-password"
      }
    }
  }
}

Deep Agents CLI: add this to ~/.deepagents/.mcp.json (all projects) or to .mcp.json in a project. ${VAR} values are read from your shell or ~/.deepagents/.env, so secrets stay out of the file.

{
  "mcpServers": {
    "winrm": {
      "command": "uvx",
      "args": [
        "--from",
        "git+https://github.com/bigbatmanorg/winrm-mcp.git@v0.3.0",
        "winrm-mcp"
      ],
      "env": {
        "WINRM_MCP_HOST": "${WINRM_MCP_HOST}",
        "WINRM_MCP_USERNAME": "${WINRM_MCP_USERNAME}",
        "WINRM_MCP_PASSWORD": "${WINRM_MCP_PASSWORD}"
      }
    }
  }
}

Python library (pip install deepagents langchain-mcp-adapters):

import asyncio
import os

from deepagents import create_deep_agent
from langchain_mcp_adapters.client import MultiServerMCPClient

client = MultiServerMCPClient({
    "winrm": {
        "transport": "stdio",
        "command": "uvx",
        "args": ["--from", "git+https://github.com/bigbatmanorg/winrm-mcp.git@v0.3.0", "winrm-mcp"],
        "env": {
            "WINRM_MCP_HOST": os.environ["WINRM_MCP_HOST"],
            "WINRM_MCP_USERNAME": os.environ["WINRM_MCP_USERNAME"],
            "WINRM_MCP_PASSWORD": os.environ["WINRM_MCP_PASSWORD"],
        },
    }
})


async def main():
    tools = await client.get_tools()
    agent = create_deep_agent(model="anthropic:claude-sonnet-5-5", tools=tools)
    result = await agent.ainvoke({"messages": [{"role": "user", "content": "What can you do?"}]})
    print(result["messages"][-1].content)


asyncio.run(main())

Save this as agent.yaml, then run docker agent run agent.yaml:

agents:
  root:
    model: anthropic/claude-sonnet-5-5
    description: Assistant with the winrm MCP tools
    instruction: Use the winrm tools to answer the user's requests.
    toolsets:
      - type: mcp
        command: uvx
        args:
          - "--from"
          - "git+https://github.com/bigbatmanorg/winrm-mcp.git@v0.3.0"
          - "winrm-mcp"
        env:
          WINRM_MCP_HOST: "192.168.1.50"
          WINRM_MCP_USERNAME: "Administrator"
          WINRM_MCP_PASSWORD: "your-password"

Add this to ~/.hermes/config.yaml, then run /reload-mcp in a chat:

mcp_servers:
  winrm:
    command: uvx
    args: ["--from", "git+https://github.com/bigbatmanorg/winrm-mcp.git@v0.3.0", "winrm-mcp"]
    env:
      WINRM_MCP_HOST: "192.168.1.50"
      WINRM_MCP_USERNAME: "Administrator"
      WINRM_MCP_PASSWORD: "your-password"

MCP Servers → Configure (cline_mcp_settings.json / mcp_settings.json):

{
  "mcpServers": {
    "winrm": {
      "command": "uvx",
      "args": [
        "--from",
        "git+https://github.com/bigbatmanorg/winrm-mcp.git@v0.3.0",
        "winrm-mcp"
      ],
      "env": {
        "WINRM_MCP_HOST": "192.168.1.50",
        "WINRM_MCP_USERNAME": "Administrator",
        "WINRM_MCP_PASSWORD": "your-password"
      }
    }
  }
}

Add this to settings.json:

{
  "context_servers": {
    "winrm": {
      "command": "uvx",
      "args": [
        "--from",
        "git+https://github.com/bigbatmanorg/winrm-mcp.git@v0.3.0",
        "winrm-mcp"
      ],
      "env": {
        "WINRM_MCP_HOST": "192.168.1.50",
        "WINRM_MCP_USERNAME": "Administrator",
        "WINRM_MCP_PASSWORD": "your-password"
      }
    }
  }
}

Add this to opencode.json (project) or ~/.config/opencode/opencode.json:

{
  "$schema": "https://opencode.ai/config.json",
  "mcp": {
    "winrm": {
      "type": "local",
      "command": [
        "uvx",
        "--from",
        "git+https://github.com/bigbatmanorg/winrm-mcp.git@v0.3.0",
        "winrm-mcp"
      ],
      "environment": {
        "WINRM_MCP_HOST": "192.168.1.50",
        "WINRM_MCP_USERNAME": "Administrator",
        "WINRM_MCP_PASSWORD": "your-password"
      },
      "enabled": true
    }
  }
}

Run goose configure → Add Extension → Command-line Extension, with the command uvx --from git+https://github.com/bigbatmanorg/winrm-mcp.git@v0.3.0 winrm-mcp. Or add this to ~/.config/goose/config.yaml:

extensions:
  winrm:
    type: stdio
    enabled: true
    cmd: uvx
    args: ["--from", "git+https://github.com/bigbatmanorg/winrm-mcp.git@v0.3.0", "winrm-mcp"]
    envs:
      WINRM_MCP_HOST: "192.168.1.50"
      WINRM_MCP_USERNAME: "Administrator"
      WINRM_MCP_PASSWORD: "your-password"

Most clients take the standard mcpServers JSON shown for Claude Desktop. Some use servers instead.

To install once instead of fetching on each start:

uv tool install git+https://github.com/bigbatmanorg/winrm-mcp.git@v0.3.0

then use "command": "winrm-mcp", "args": [].

From a checkout: "command": "uv", "args": ["run", "--directory", "/abs/path/winrm-mcp", "winrm-mcp"].

Related MCP server: Win MCP Server

Tools

  • winrm_test — verify authentication and connectivity; reports whether the account is a local administrator.

  • winrm_execute_powershell — execute PowerShell (output_format="json" for structured results).

  • winrm_execute_cmd — execute CMD; env sets real process environment variables.

  • winrm_execute_many — run one command on several saved hosts (by name or tag) in parallel, one result per host.

  • winrm_upload, winrm_download — copy files, confined to WINRM_MCP_LOCAL_ROOT (disabled unless set).

  • winrm_policy — show the version and the active security policy.

  • winrm_inventory_status, winrm_inventory_init, winrm_inventory_validate — manage inventory files.

  • winrm_host_list, winrm_host_get, winrm_host_save, winrm_host_update, winrm_host_delete — manage reusable hosts.

Each tool accepts an optional connection object. Values in it override the process environment:

{
  "host": "192.168.1.50",
  "username": "Administrator",
  "password_env": "MY_WINRM_PASSWORD",
  "auth": "ntlm",
  "ssl": true,
  "cert_validation": false
}

ssl chooses HTTPS (normally port 5986) versus HTTP (normally port 5985). cert_validation=false is needed for self-signed HTTPS listeners, but should only be used for trusted hosts.

Supported connection fields are host, username, password, password_env, port, ssl, auth (ntlm, negotiate, kerberos, basic, credssp, certificate), cert_validation, encryption, path, connect_timeout, read_timeout, operation_timeout, certificate_pem and certificate_key_pem (file paths for certificate auth over HTTPS), and tags (a list of labels for winrm_host_list(tag=...) and winrm_execute_many(tag=...)).

Security model

Commands run with the remote account's full rights, and tool arguments come from an AI agent that untrusted content (web pages, files, command output) can steer. The operator limits what the agent can reach:

Setting

Default

Effect

WINRM_MCP_ALLOWED_HOSTS

any

Comma-separated glob patterns (*.lab.example,10.0.110.*); other hosts are refused, saved or not.

WINRM_MCP_ALLOW_ADHOC

true

false allows only saved hosts; per-call connection may then only change timeouts.

WINRM_MCP_SECRET_ENV_PATTERNS

*PASSWORD*,*PASSWD*,*_PASS

password_env may only read matching variables, so an agent cannot send e.g. AWS_SECRET_ACCESS_KEY to a host it controls.

WINRM_MCP_ALLOW_INSECURE_BASIC

false

Basic auth over plain HTTP sends the password in cleartext and is refused unless enabled. NTLM/Kerberos over HTTP use message encryption and are allowed.

WINRM_MCP_LOCAL_ROOT

unset

Enables winrm_upload/winrm_download, confined to this directory.

Multi-host inventory

Hosts can be stored in either inventory scope:

  • user (default): ${XDG_CONFIG_HOME:-~/.config}/winrm-mcp/inventory.json on Linux/macOS, or the matching %APPDATA% location on Windows.

  • project: .winrm-mcp/inventory.json under the current working directory.

Choose the process default with WINRM_MCP_INVENTORY_SCOPE=user or WINRM_MCP_INVENTORY_SCOPE=project. Every inventory and host tool also accepts an explicit scope, and execution tools accept inventory_scope. Project scope uses WINRM_MCP_PROJECT_DIR, then the launcher's logical PWD, then the process working directory. It refuses temporary deepagents_server_* paths instead of silently saving disposable inventory data. Set WINRM_MCP_PROJECT_DIR when the launcher working directory is not the desired project root. A fully custom file is supported through WINRM_MCP_INVENTORY_FILE; it is used when a call does not explicitly select a scope.

Create a project inventory and save two hosts:

winrm_inventory_init(scope="project")

winrm_host_save(
  name="epv1",
  scope="project",
  settings={
    "host": "10.0.110.50",
    "username": "Administrator",
    "password_env": "EPV1_WINRM_PASSWORD",
    "auth": "ntlm",
    "ssl": true,
    "cert_validation": false
  }
)

winrm_host_save(
  name="epv2",
  scope="project",
  settings={
    "host": "10.0.110.51",
    "username": "Administrator",
    "password_env": "EPV2_WINRM_PASSWORD",
    "auth": "ntlm",
    "ssl": true,
    "cert_validation": false
  }
)

Use a saved host by name:

winrm_test(saved_host="epv1", inventory_scope="project")
winrm_execute_powershell(saved_host="epv1", inventory_scope="project", command="hostname")
winrm_execute_cmd(saved_host="epv2", inventory_scope="project", command="whoami")

The optional connection object overrides fields from the saved host for that call. Inventory writes are atomic, and the inventory file is restricted to the current user (0600) on Unix-like systems. Inline passwords are supported but stored as plaintext in that protected JSON file; prefer password_env.

Omit connection when no overrides are needed. For compatibility with agents that serialize an optional value as text, connection="None", connection="null", and an empty connection string are treated as JSON null.

Install and run

uv sync --extra dev
uv run pytest
uv run winrm-mcp

The default transport is stdio. A client configuration can supply stable connection defaults without putting credentials in every tool call:

{
  "servers": {
    "winrm": {
      "type": "stdio",
      "command": "uv",
      "args": ["--directory", "/absolute/path/to/winrm-mcp", "run", "winrm-mcp"],
      "env": {
        "WINRM_MCP_HOST": "192.168.1.50",
        "WINRM_MCP_USERNAME": "Administrator",
        "WINRM_MCP_PASSWORD_ENV": "MY_WINRM_PASSWORD",
        "MY_WINRM_PASSWORD": "replace-me",
        "WINRM_MCP_AUTH": "ntlm",
        "WINRM_MCP_SSL": "true",
        "WINRM_MCP_CERT_VALIDATION": "false"
      }
    }
  }
}

Available environment defaults correspond to the connection fields and use the WINRM_MCP_ prefix. Server settings are WINRM_MCP_TRANSPORT, WINRM_MCP_SERVER_HOST, and WINRM_MCP_SERVER_PORT. Inventory settings are WINRM_MCP_INVENTORY_SCOPE, WINRM_MCP_PROJECT_DIR, and WINRM_MCP_INVENTORY_FILE.

Testing

uv sync --extra dev
uv run pytest                                  # offline unit tests
WINRM_LIVE=1 uv run pytest tests/live -v       # live tests over MCP stdio against a Windows host

Live tests read WINRM_TEST_HOST, WINRM_TEST_ADMIN_USER/WINRM_TEST_ADMIN_PASSWORD (a local administrator) and WINRM_TEST_USER/WINRM_TEST_USER_PASSWORD (a member of Remote Management Users), for example from a gitignored .env.

For Kerberos or CredSSP support, install the matching optional extra:

uv sync --extra kerberos
uv sync --extra credssp

Available Tools

15 tools
winrm_downloadA
Destructive

Copy a file from the Windows host to WINRM_MCP_LOCAL_ROOT/local_path (file transfer is disabled unless the operator sets it). Existing local files are kept unless overwrite=true.

NameRequiredDescriptionDefault
overwriteNo
connectionNo
local_pathYes
saved_hostNo
remote_pathYes
inventory_scopeNo

Output Schema

NameRequiredDescription

No output parameters

TDQS

A4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations flag destructiveHint=true and openWorldHint=true, and the description meaningfully refines this: existing local files are preserved unless overwrite=true, so the destruction risk is conditional and opt-in. It also discloses the operator-controlled gate on file transfer, which no annotation conveys. Return behavior is not described, but an output schema exists to cover that.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences with zero filler; the destination constraint and the transfer-disabled caveat are front-loaded ahead of the overwrite default.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The output schema relieves it of explaining return values, and the overwrite/transfer-gating semantics are well covered. However, a six-parameter tool with a nested connection object and host-selection parameters leaves three or four inputs entirely undocumented, which is a meaningful completeness gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across six parameters, and the description only explains overwrite and constrains local_path to a fixed root. remote_path, connection, saved_host, and inventory_scope receive no explanation anywhere, so an agent has little basis for populating connection or saved_host.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Copy a file from the Windows host') and makes the direction explicit by naming the destination as WINRM_MCP_LOCAL_ROOT/local_path. That directional statement is what separates it from winrm_upload without naming the sibling.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a real precondition — file transfer is disabled unless the operator enables it — plus the default behavior when a local file already exists. It stops short of explicitly routing the agent to winrm_upload for the opposite direction or to winrm_execute_cmd as an alternative.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

winrm_execute_cmdA
Destructive

Execute a CMD command over WinRM and return stdout, stderr, and exit code. env sets real process environment variables (usable as %NAME%). On timeout the remote process is terminated.

NameRequiredDescriptionDefault
cwdNo
envNo
commandYes
timeoutNo
connectionNo
saved_hostNo
output_limitNo
inventory_scopeNo

Output Schema

NameRequiredDescription

No output parameters

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructive, non-idempotent, open-world behavior, so the bar is lower; the description still adds real value by disclosing that a timeout terminates the remote process and that env values become actual process environment variables. It does not say whether termination is graceful or how partial output is handled, but the key destructive side effect is surfaced.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short sentences, front-loaded with purpose, then the two non-obvious parameter behaviors, then the failure mode. Nothing is wasted or repeated from the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, and the description covers purpose and timeout behavior. However, for an 8-parameter remote-execution tool it never explains how the target host is selected (connection vs saved_host vs inventory_scope), which an agent needs to call it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across 8 parameters, so the description must compensate. It explains env concretely (%NAME% expansion) and clarifies timeout semantics, but leaves cwd, output_limit, connection, saved_host, and inventory_scope completely undocumented, which is a substantial residual gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Execute a CMD command over WinRM') and names the return artifacts (stdout, stderr, exit code). The word 'CMD' distinguishes it from the sibling winrm_execute_powershell without either schema being opened.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no statement of when to choose this over winrm_execute_powershell, winrm_execute_many, or winrm_test, and no prerequisites such as needing a saved_host or connection. The agent must infer routing from the tool name alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

winrm_execute_manyB
Destructive

Run one command on several saved hosts (listed by name and/or selected by tag) in parallel. Returns one result or error per host, so one unreachable host does not hide the others.

NameRequiredDescriptionDefault
tagNo
shellNopowershell
commandYes
timeoutNo
saved_hostsNo
max_parallelNo
output_limitNo
output_formatNotext
inventory_scopeNo

Output Schema

NameRequiredDescription

No output parameters

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already declare destructiveHint=true, openWorldHint=true and idempotentHint=false, so the agent knows this is an unsafe, non-repeatable write-class operation. The description adds genuinely useful behavioral context about error isolation ("one unreachable host does not hide the others"), but says nothing about what makes it destructive, whether auth/credentials are needed, or that all hosts are hit concurrently with real side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two tight sentences with the scope and selection mechanism front-loaded and the error-isolation guarantee second. Nothing is redundant or padded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be described, and the per-host result/error statement is a useful supplement. However, for a 9-parameter destructive open-world execution tool with zero schema description coverage, the definition omits too much about tuning parameters and safety posture to be considered complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across 9 parameters, so the description must carry the burden and largely does not. It clarifies host selection (saved_hosts vs tag) and the single command, but leaves shell, timeout, max_parallel, output_limit, output_format and inventory_scope completely unexplained in both schema and prose.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ("Run one command on several saved hosts") plus the parallelism model, which clearly separates it from the single-host siblings winrm_execute_powershell and winrm_execute_cmd. It stops short of naming those alternatives explicitly, so the differentiation is implied rather than stated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains how hosts are selected ("listed by name and/or selected by tag"), which implies when to reach for this tool over a single-host execute. There is no explicit when-not guidance, no mention of prerequisites (inventory init/validate, saved hosts existing), and no pointer to the single-host siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

winrm_execute_powershellA
Destructive

Execute PowerShell over WinRM and return stdout, stderr (error/warning/verbose streams) and the exit code, including exit N. On timeout the remote command is stopped. output_format='json' converts the output objects with ConvertTo-Json and returns them parsed in data.

NameRequiredDescriptionDefault
cwdNo
envNo
commandYes
timeoutNo
connectionNo
saved_hostNo
output_limitNo
output_formatNotext
inventory_scopeNo

Output Schema

NameRequiredDescription

No output parameters

TDQS

A3.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds real behavior beyond the annotations: timeout stops the remote command, which stderr streams are captured, exit-code propagation including `exit N`, and what output_format='json' does to the returned data. It does not repeat the destructive/openWorld hints, but those are already carried by annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three dense sentences with no filler, and the core behavior plus return contract is front-loaded before the output_format detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values do not need explaining, and the mutation/timeout semantics are covered. However, for a 9-parameter remote-execution tool with zero schema descriptions, the targeting and environment parameters that determine which host runs the command are left undefined.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across 9 parameters, so the description is the only source of parameter meaning, yet it only explains output_format and implicitly timeout. Host targeting (connection, saved_host, inventory_scope), cwd, env, and output_limit are completely unexplained, leaving most of the surface undocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

"Execute PowerShell over WinRM" names a specific verb and resource and returns a concrete payload (stdout, stderr streams, exit code). It is clearly distinguishable from the sibling winrm_execute_cmd (cmd shell) and winrm_execute_many without reading any schema.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no explicit when-to-use or when-not-to-use guidance and no mention of alternatives such as winrm_execute_cmd or winrm_execute_many. An agent must infer selection from the tool name alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

winrm_host_deleteC
DestructiveIdempotent

Delete a saved WinRM host.

NameRequiredDescriptionDefault
nameYes
scopeNo

Output Schema

NameRequiredDescription

No output parameters

TDQS

C2.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint=true, idempotentHint=true, readOnlyHint=false, and openWorldHint=false, so the safety profile is fully covered by structured data. The description adds nothing beyond that — it does not say what happens to a host that is missing the target, whether removal is reversible, or whether in-memory sessions are affected.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with zero filler; the action and target appear immediately. Brevity is appropriate, though it tips into under-specification rather than efficient density.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive mutation with an output schema and an undocumented optional "scope" parameter, the definition is too thin. It omits prerequisites, what identifies the target when "scope" is unset, and the failure behavior for unknown host names.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description would need to carry the parameter meaning, and it does not: neither the required "name" nor the optional "scope" (default null) is mentioned. "Saved WinRM host" hints that "name" identifies a stored entry, but the purpose and interaction of "scope" are entirely undocumented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb ("Delete") and resource ("a saved WinRM host"), which cleanly separates it from sibling read/write tools like winrm_host_list, winrm_host_get, winrm_host_save, and winrm_host_update. It stops short of explicitly naming those siblings, but the CRUD verb makes the operation unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance: nothing states that this permanently removes a stored host entry rather than modifying it, and no alternative (e.g., winrm_host_update for modifying settings) is offered. An agent must infer all routing decisions from the verb alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

winrm_host_getB
Read-only

Get one saved WinRM host with its password redacted.

NameRequiredDescriptionDefault
nameYes
scopeNo

Output Schema

NameRequiredDescription

No output parameters

TDQS

B3.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile is covered. The description adds one genuinely useful behavioral fact, that the password is redacted in the response, but says nothing about behavior when the host is missing or how 'scope' affects resolution.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no wasted words; the key qualifier (password redacted) is included rather than padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return shape needn't be described. However, for a two-parameter lookup tool, the undefined 'scope' parameter and the lack of any not-found or error behavior leave a real gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must carry parameter meaning, and it does not. 'name' is guessable as the host identifier, but 'scope' (nullable, default null) is completely undefined in both schema and description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb ('Get') and resource ('one saved WinRM host'), and the singular 'one' implicitly contrasts with the sibling winrm_host_list. It does not name that sibling explicitly, so differentiation is inferable rather than stated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to call this versus winrm_host_list or winrm_host_save/update, and no mention of prerequisites such as the host needing to exist or an inventory being initialized. Usage is only implied by the verb.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

winrm_host_listB
Read-only

List saved WinRM hosts with passwords redacted; optionally only hosts carrying a tag.

NameRequiredDescriptionDefault
tagNo
scopeNo

Output Schema

NameRequiredDescription

No output parameters

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, so safety is covered structurally. The description adds a genuinely useful behavioral fact — returned records have passwords redacted — but says nothing about ordering, pagination, or what an empty inventory looks like, and an output schema is present so return-shape detail is not required.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with no filler; the core operation comes first and the optional filter follows after the semicolon.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With a read-only annotation profile and an output schema, the description needs mainly to cover the two inputs and the filtering behavior. The redaction note is a valuable addition, but the undocumented scope parameter leaves a real hole for a tool an agent may call without arguments or with an ambiguous scope string.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must carry both parameters. It explains tag (filter to hosts carrying that tag) but leaves scope entirely undefined, meaning half the parameters have no semantic guidance anywhere.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description gives a specific verb and resource ("List saved WinRM hosts") plus a scope qualifier ("passwords redacted"), which is enough to separate it from winrm_host_get and the save/update/delete siblings. It stops short of naming an alternative explicitly, so it lands at clear-but-not-differentiating.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

"optionally only hosts carrying a tag" implies the filtering use case, so an agent can infer when to pass a tag. There is no explicit when-to-use versus winrm_host_get or winrm_inventory_status, and no statement about prerequisites such as an initialized inventory.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

winrm_host_saveB
Idempotent

Save a WinRM host in the project or user inventory. Prefer password_env over password; tags (a list of strings) group hosts for winrm_execute_many.

NameRequiredDescriptionDefault
nameYes
scopeNo
settingsYes
overwriteNo

Output Schema

NameRequiredDescription

No output parameters

TDQS

B3.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare non-read-only, idempotent, non-destructive, closed-world behavior, so the safety profile is covered. The description adds useful context – the password_env security preference and the tags/winrm_execute_many linkage – but leaves the overwrite flag's effect on existing hosts and the scope target-resolution rules unexplained.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences, front-loaded with the operation and immediately followed by actionable configuration advice. No wasted wording, though the terseness contributes to the documentation gaps elsewhere.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a mutating persistence tool with a fully undocumented nested settings object, an ambiguous overwrite flag, and an undefined scope parameter, the description is too thin. The presence of an output schema removes the need to document return values, but the input-side behavior remains substantially unexplained.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across 4 parameters including a free-form nested 'settings' object, so the schema supplies no meaning at all. The description only touches password_env and tags, both of which are keys inside settings rather than top-level parameters, and says nothing about name, scope semantics (project vs user inventory), or overwrite behavior.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: 'Save a WinRM host in the project or user inventory.' This clearly distinguishes a persistence operation from read siblings like winrm_host_get/winrm_host_list. It does not, however, differentiate 'save' from the sibling winrm_host_update, leaving the create-vs-update boundary implicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives two concrete usage hints – prefer password_env over password, and use tags to group hosts for winrm_execute_many – which imply the tool's role in the workflow. But it never says when to use this versus winrm_host_update, nor when to set overwrite=true, so the main selection decision is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

winrm_host_updateB
Idempotent

Update selected settings on a saved host; remove optional values with remove_fields.

NameRequiredDescriptionDefault
nameYes
scopeNo
changesYes
remove_fieldsNo

Output Schema

NameRequiredDescription

No output parameters

TDQS

B3.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare idempotent=true, destructiveHint=false, and readOnly=false, so the safety profile is covered. The description adds one behavioral trait the annotations do not: that field removal is a separate, explicit operation via remove_fields rather than implicit through `changes`. It still does not say whether `changes` merges into or replaces existing settings, nor what errors occur for an unknown host name.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with the mutation stated first and the removal escape hatch second; no filler or restatement of the tool name. It is tightly written, though the terseness contributes to the coverage gaps elsewhere rather than being optimal sizing for a four-parameter nested tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be described, but the input side is far too thin: a nested free-form `changes` object, an untyped `scope`, and 0% schema coverage mean the agent cannot construct a valid call from the definition alone. Missing are the accepted change keys, merge-vs-replace semantics, and the meaning of scope.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across four parameters, and `changes` is a free-form object with additionalProperties: true — the highest-risk shape possible with no documentation. The description only clarifies remove_fields (partially, as a list of field names), leaving `name`, `scope` (a nullable, untyped-purpose field), and every acceptable key in `changes` completely unexplained in both schema and description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

"Update selected settings on a saved host" gives a specific verb (update), a target (settings), and a precondition (host is already saved), which implicitly separates it from winrm_host_save and winrm_host_get. It never names a sibling explicitly and leaves "selected settings" unenumerated, so an agent still has to guess whether it overlaps with winrm_host_save.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The clause "remove optional values with remove_fields" is real usage guidance for one parameter, and "saved host" implies the host must already exist. There is no explicit when-to-use vs winrm_host_save, no when-not, and no alternatives listed, so routing between the two write-path tools is left to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

winrm_inventory_initB
Idempotent

Create an empty project or user inventory without replacing existing data by default.

NameRequiredDescriptionDefault
scopeNo
overwriteNo

Output Schema

NameRequiredDescription

No output parameters

TDQS

B3.4/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already declare readOnlyHint=false, destructiveHint=false, and idempotentHint=true, so the safety profile is structured. The description usefully reinforces the non-destructive default ("without replacing existing data by default") and implies the overwrite flag changes that, but it does not say what happens when an inventory already exists (error vs no-op) or whether any auth/permission prerequisites apply.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single front-loaded sentence with the key behavioral constraint attached to the action. Slightly ambiguous phrasing about "project or user" inventory could be tightened, but there is no padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With only two optional parameters and an output schema present, the description needn't explain return values. Still, for an initialization tool it omits two things an agent needs: the allowed scope values and the behavior when an inventory already exists without overwrite.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must carry the load. It does map loosely onto both parameters: "project or user inventory" signals the scope values, and "without replacing existing data by default" explains overwrite=false. However, it never states the accepted scope values literally or that scope is optional/nullable, leaving ambiguity that the schema cannot resolve.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb and resource ("Create an empty project or user inventory") and implicitly distinguishes initialization from sibling operations like winrm_inventory_status and winrm_inventory_validate by specifying it creates an empty inventory. It stops short of naming any sibling explicitly, so the differentiation is inferential rather than stated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase "without replacing existing data by default" hints at the safety contract and, indirectly, at when the overwrite flag matters, but there is no explicit when-to-use guidance, no exclusions, and no routing to winrm_inventory_status or winrm_inventory_validate for existing-inventory checks. Usage is only implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

winrm_inventory_statusB
Read-only

Show the project or user inventory path, existence, and saved host count.

NameRequiredDescriptionDefault
scopeNo

Output Schema

NameRequiredDescription

No output parameters

TDQS

B3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, so the safety profile is covered. The description adds that it reports path, existence, and saved host count, but says nothing about what happens if the inventory does not exist or how project vs user inventories are resolved.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One compact sentence with zero filler, front-loaded with the verb and the reported fields. Its brevity is appropriate, though it leaves the key `scope` parameter unexplained.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be re-explained, and the tool is a simple single-optional-param read. Still, the undefined `scope` parameter and the absence of any usage context leave meaningful gaps for an agent deciding how to call it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%: the single `scope` parameter has no description, no enum, and defaults to null. The phrase "project or user inventory" hints that `scope` may select between those, but the description never states the accepted values or the default behavior when omitted.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb ("Show") and a specific set of reported facts (inventory path, existence, saved host count), which lets it be told apart from the sibling init/validate/host_* tools. It stops short of explicitly naming a sibling it is not, but the purpose is clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no statement of when to use this versus winrm_inventory_init, winrm_inventory_validate, or the host_* tools. The agent must infer that this is a read-only status check that precedes init/validate, with no explicit guidance or exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

winrm_inventory_validateB
Read-only

Validate an inventory file and every saved WinRM host.

NameRequiredDescriptionDefault
scopeNo

Output Schema

NameRequiredDescription

No output parameters

TDQS

B3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=false, so safety and locality are covered. The description usefully adds that validation spans both the inventory file and all saved hosts, which is real scope information beyond the annotations, but it never says what an invalid result looks like or whether validation mutates/normalizes the file.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One front-loaded sentence with no filler; the operation and its targets land immediately. It is arguably too terse for the amount of information an agent actually needs, but nothing is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, and annotations cover the safety profile. Still, for a validation tool the description omits what is validated, what constitutes failure, and what "scope" controls, leaving meaningful gaps against the tool's complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single optional parameter "scope" has 0% schema description coverage and the description never mentions it, so its meaning (which hosts or which file subset is validated) is undocumented in both places. With no parameter count of zero to justify a free baseline, this is a clear gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb ("validate") and its two objects (the inventory file and every saved WinRM host), so an agent knows exactly what operation runs. It does not, however, distinguish itself from nearby siblings such as winrm_inventory_status or winrm_test, leaving the boundary implicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no statement of when to validate versus when to check status or run winrm_test, and no prerequisites or exclusions are given. The agent must infer the usage context from the tool name alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

winrm_policyA
Read-only

Show the server version and the operator's security policy: allowed hosts, whether ad-hoc connections are allowed, which environment variables password_env may read, and whether file transfer is enabled.

NameRequiredDescriptionDefault

No parameters

Output Schema

NameRequiredDescription

No output parameters

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The readOnlyHint=true and openWorldHint=false annotations already establish this is a local, side-effect-free read, and the description is consistent with that. It adds genuine value beyond the annotations by naming the specific policy dimensions exposed (ad-hoc connections, password_env variable scope, file transfer gate), which signals to the agent that this is a capability/permission probe rather than a status ping. It stops short of saying whether the policy is static or reflects live server state.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single sentence, front-loaded with the primary object ('server version and security policy') followed by a tightly scoped enumeration of the returned facets. No filler, no restatement of the tool name, and every clause carries information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter read-only tool with an output schema, the description supplies enough to know what it reports and roughly why it matters. The only residual gap is context about scope (whose server / which configured host this policy applies to), which matters given the large family of host-scoped siblings.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With zero parameters and 100% schema coverage there is nothing for the description to disambiguate, so the baseline of 4 applies. The mention of 'password_env' usefully ties the tool to a configuration concept the agent will see elsewhere, without implying any input is required.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb ('Show') and a concrete resource ('the server version and the operator's security policy'), then enumerates the policy facets returned: allowed hosts, ad-hoc connections, password_env-readable variables, and file transfer enablement. This clearly separates it from the action-oriented siblings (winrm_execute_*, winrm_host_save, winrm_test) which mutate or probe state rather than report configuration.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: an agent can infer this is the tool to call to discover what the server will permit before attempting a connection or transfer. However, the description never states when to prefer it, gives no preconditions (e.g. whether a host must be configured first), and does not explicitly contrast it with winrm_test or winrm_inventory_status.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

winrm_testB
Read-only

Test a WinRM connection with a harmless PowerShell marker command; reports whether the account is a local administrator.

NameRequiredDescriptionDefault
timeoutNo
connectionNo
saved_hostNo
inventory_scopeNo

Output Schema

NameRequiredDescription

No output parameters

TDQS

B3.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint and openWorldHint, yet the description adds real value by disclosing that a PowerShell marker command is actually executed remotely and that the response reveals local-administrator membership. It stops short of noting credential/permission requirements or that a failed test surfaces as an error rather than a flag.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One compact sentence with the action, mechanism, and result front-loaded; nothing is wasted or repeated.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The output schema and annotations cover return values and safety, but the definition leaves the single most important decision — how to point the tool at a target — entirely undocumented across three overlapping parameters. For a 4-parameter tool with 0% schema coverage, that is a substantial omission.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% across four parameters (timeout, connection, saved_host, inventory_scope) and the description says nothing about any of them. Critically, the agent gets no guidance on how to specify the target host — a bare connection object, a saved_host reference, or an inventory_scope — which are mutually exclusive-looking options with no explanation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource ("Test a WinRM connection") and adds the mechanism ("harmless PowerShell marker command") plus the reported outcome (local administrator status). This clearly separates it from the winrm_execute_* siblings, though it never names an alternative explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage is only implied: an agent can infer this is a pre-flight connectivity/permission check before running real commands. There is no statement about when to prefer it over winrm_inventory_validate or winrm_host_get, and no prerequisites or exclusions are given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

winrm_uploadA
Destructive

Copy a local file to the Windows host. local_path is relative to WINRM_MCP_LOCAL_ROOT (file transfer is disabled unless the operator sets it); remote_path is a full Windows path.

NameRequiredDescriptionDefault
connectionNo
local_pathYes
saved_hostNo
remote_pathYes
inventory_scopeNo

Output Schema

NameRequiredDescription

No output parameters

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint=true and openWorldHint=true, so the safety profile is covered. The description adds non-obvious operational context the annotations cannot convey: the feature is gated behind an operator-set root directory, and local paths are resolved relative to it. It stops short of stating overwrite behavior on the remote path, which matters for a destructive-labeled write.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no waste, with the primary action first and the path-semantics constraints following. Every clause carries information the agent needs.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need no explanation, and the destination/source path semantics are covered. For a destructive, open-world file transfer with no schema descriptions on five parameters, missing details on overwrite behavior and how to target a host leave it only adequate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the burden, and it does explain the two required parameters well (local relative to WINRM_MCP_LOCAL_ROOT, remote an absolute Windows path). But three optional parameters — connection, saved_host, inventory_scope — remain entirely undocumented in both schema and description, leaving a real gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Copy a local file to the Windows host'), which is unambiguous and implicitly opposite to the sibling winrm_download. It does not explicitly name the sibling or its inverse condition, so differentiation relies on the agent inferring direction from the name.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides one genuinely useful prerequisite: transfer is disabled unless the operator sets WINRM_MCP_LOCAL_ROOT. However, it gives no guidance on when to pick this over winrm_download, nor how the optional connection/saved_host/inventory_scope parameters should be chosen to reach a host.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 6 tool updates
    • Addedwinrm_download
    • Addedwinrm_execute_many
    • Changedwinrm_execute_powershell1 field changed
      • addedInput schema / properties / output_format
        Added value: +{
        +  "default": "text",
        +  "title": "Output Format",
        +  "type": "string"
        +}
    • Changedwinrm_host_list1 field changed
      • addedInput schema / properties / tag
        Added value: +{
        +  "anyOf": [
        +    {
        +      "type": "string"
        +    },
        +    {
        +      "type": "null"
        +    }
        +  ],
        +  "default": null,
        +  "title": "Tag"
        +}
    • Addedwinrm_policy
    • Addedwinrm_upload
  2. 11 tool updatesv0.2.2
    • First observedwinrm_execute_cmd
    • First observedwinrm_execute_powershell
    • First observedwinrm_host_delete
    • First observedwinrm_host_get
    • First observedwinrm_host_list
    • First observedwinrm_host_save
    • First observedwinrm_host_update
    • First observedwinrm_inventory_init
    • First observedwinrm_inventory_status
    • First observedwinrm_inventory_validate
    • First observedwinrm_test

TDQS

A3.5/5.0

Scored across 15 tools

Disambiguation5/5

Each tool has a clearly distinct resource and action: inventory management, host CRUD, connection testing, policy inspection, command execution, and file transfer are all separated. The only mild similarity is between winrm_test and winrm_inventory_validate, but their descriptions make the distinction clear: one tests a single connection, the other validates inventory and saved hosts.

Naming Consistency4/5

All tools use a consistent winrm_ prefix and snake_case, mostly following a resource_action pattern such as winrm_host_list or winrm_inventory_validate. A few names like winrm_test and winrm_policy are less structurally explicit, but they remain predictable and readable.

Tool Count5/5

Fifteen tools is well within a reasonable range for a WinRM management server and each tool appears to earn its place. Inventory, host lifecycle, execution, testing, policy, and transfer operations are all meaningfully separated without obvious filler.

Completeness4/5

The surface covers host CRUD, inventory initialization/status/validation, connection testing, policy inspection, PowerShell/CMD execution, multi-host execution, and file upload/download. Minor gaps remain, such as no explicit inventory deletion or richer inventory editing, but core workflows are well supported.

Maintenance

ActivityMaintained
ResponsivenessNo recent community issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    B
    quality
    A
    maintenance
    Enables AI agents to securely manage and execute commands on remote Windows servers via WinRM, including PowerShell execution, system information retrieval, and service management.
    6
    18 PyPI
    6
    MIT
  • A
    license
    A
    quality
    C
    maintenance
    Enables executing commands and transferring files over SSH on multiple hosts concurrently, with auto-discovery from SSH config and support for various authentication methods.
    3
    6 npm
    MIT