Agent Workstation
Provides Git repository operations as part of the developer workflow, including repository context discovery and version control tasks inherited from Coding Tools MCP.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Agent Workstationcall workspace_guide here, load the relevant rule, then review my staged changes"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Agent Workstation
简体中文 · Security · Architecture · Client setup
Bring an MCP client into your developer workflow. Prefer APIs and CLIs over clicking screens.
A small, opinionated adapter built on Coding Tools MCP. It adds explicit workstation trust, multi-repository context discovery, a lazy rules/skills/recipes entry point, and bounded command previews. It does not implement a new model, agent loop, SQL engine, browser driver, or secret vault.
What is actually new?
Inherited from Coding Tools MCP | Added here |
Files, patches, search, Git, process lifecycle, MCP transport | Explicit |
Output retention, references, pagination | 8 KiB default head/tail preview with stderr budgeting |
Root instruction loading | Bounded multi-repo discovery and target-path rule lookup |
Generic command execution |
|
The adapter pins upstream commit bedb632e1afd2e9ec9b268a50fe0b04695c22c64.
Its package metadata says 0.3.0; this is not a claimed upstream 0.5 release.
Upstream-private imports/hooks are isolated in agent_workstation/compat/coding_tools.py.
A mismatched upstream build fails at startup rather than silently running an untested adapter.
Related MCP server: CodexPro Runtime
Install and try
Requirements: Python 3.11+, Git; macOS or Linux. Your own MCP client supplies the model. No Codex installation or model API key is required by this server. The package is installed from GitHub; it is not published to PyPI in this release.
# An isolated environment; does not alter another MCP installation.
python3 -m venv .venv
. .venv/bin/activate
python -m pip install "git+https://github.com/zix-chen/agent-workstation.git@v0.1.1"
agent-workstation --workspace /path/to/repository --doctor
agent-workstation --workspace /path/to/repository --stdioGeneric stdio MCP configuration (use an absolute executable path):
{
"mcpServers": {
"agent-workstation": {
"command": "/absolute/path/to/.venv/bin/agent-workstation",
"args": ["--workspace", "/absolute/path/to/work", "--mode", "workspace", "--stdio"]
}
}
}Ask the client: “Call workspace_guide for this repository, read the relevant rules/skill, then review this change. Report evidence and what you did not verify.”
Explicit workstation access
agent-workstation --workspace "$HOME/work" --mode trusted-workstation --stdioThis gives commands your real HOME, local developer configuration, network access and access outside the workspace. Commands can read secrets, modify files and operate services with your user privileges. It is NOT secret isolation or protection from prompt injection. Use trusted code and a trusted agent, or a disposable account/VM with reduced credentials.
Default workspace mode retains upstream safe command gates, isolated HOME and structured
path validation. It is not a complete OS sandbox, especially on macOS. Repository rules
are workflow guidance, not permission enforcement. See SECURITY.md.
Rules, skills and recipes
work/
AGENTS.md
repo-a/
AGENTS.md
.agents/skills/review/SKILL.md
repo-b/
src/AGENTS.mdworkspace_guide(path="repo-a") returns applicable rule paths and skill name/description/hash.
It does not inject every skill's full body. The agent selects and fully reads the smallest
relevant skill. Same-name skills retain their source paths. Startup avoids recursive workspace
walks, skips generated/worktree directories and uses Git metadata at actual repository roots.
Target-path lookup can still find rules under a skipped tree when explicitly selected.
Recipes are explicitly loaded TOML, never auto-executed:
agent-workstation --workspace "$PWD/examples/demo-service" --config "$PWD/examples/demo-service/workstation.toml" --stdioSee the runnable example and configuration contract.
External skill roots require explicit config and trusted-workstation mode.
kubectl, mysql, redis-cli, cloud CLIs and their credentials are user-managed, not bundled integrations.
Reproduce the demo and benchmark
git clone https://github.com/zix-chen/agent-workstation.git
cd agent-workstation
python3 -m venv .venv
. .venv/bin/activate
python -m pip install -e '.[dev]'
python -m unittest discover -s tests -v
python scripts/demo.py
python scripts/benchmark_output.py
python scripts/check_release.pyThe demo uses a temporary copy of a fake backend, calls real MCP tools, checks a local HTTP health endpoint, diagnoses a missing demo configuration, and verifies the corrected process. It uses no private infrastructure or model credentials. It is a deterministic integration demo, not a claim of autonomous model task success.
The benchmark reports output bytes and serialized response bytes. It does not measure model
tokens, subscription quotas, speedups, or dollars saved. Explicit output arguments override
defaults. Follow read_output references when previews truncate; retained output can expire
or lose its middle segment. Save an authorized log file for durable/full logs.
HTTP and remote clients
An optional loopback HTTP listener requires a bearer token even on localhost:
# Supply a random 32+ character secret through your process supervisor/secret manager.
# Never put the real value in this repo, the README, or a model prompt.
agent-workstation --workspace /path/to/work --transport http --port 8765
# Reads AGENT_WORKSTATION_HTTP_TOKEN; startup refuses an absent/short token.Remote access requires your own authenticated HTTPS transport and a compatible client. OAuth registration and tunnels are not implemented by this V1. A generic stdio configuration is not a ChatGPT web connection. See client setup and verification boundaries. No public listener or tunnel is installed automatically.
A real run transcript is available in docs/demo-output.txt.
Scope and status
V0.1 is a small developer-tool release, not an enterprise platform. Computer/browser automation, GUI secret filling, company-specific integrations, production deployment automation and a plugin marketplace are intentionally excluded. See validation for actual test results.
Design decisions cover the adapter architecture, trust model, and verification boundaries.
License and attribution
Apache-2.0. Built on Coding Tools MCP, Copyright 2026 Coding Tools MCP Contributors. See NOTICE and THIRD_PARTY_NOTICES.md. No private repository history, employee accounts, business code or production configuration is distributed.
The pinned upstream read_file also caps a page at 2,000 lines. Raising max_bytes does not remove that cap; use next_start_line to read the remaining pages.
Available Tools
19 toolsapply_changesApply changesADestructive
Apply line-addressed file changes atomically. Prefer this over apply_patch when you know the line numbers: nothing has to match. Each change names an action (create, write, edit, delete, move, copy), and a path. write is an upsert: it needs the revision read_file reported when the path exists, but may omit it when creating a missing path. edit, delete, move, and copy always need that revision; create rejects it and asserts absence. edit takes line operations (replace, delete, insert_after, insert_before) whose numbers all refer to the file as read, not to the result of earlier edits in the same call. content is whole lines: "" is zero lines and a trailing newline adds a blank line. One path per call; use apply_patch to chain several edits onto one file. Example: {"changes":[{"action":"edit","path":"app.py","revision":"","edits":[{"op":"replace","start_line":10,"end_line":12,"content":"new line"}]}]}
| Name | Required | Description | Default |
|---|---|---|---|
| changes | Yes | One entry per file, at least one. A path may appear once per call; use apply_patch to chain several edits onto one file. The whole request must fit in 1 MiB, so keep it to roughly 20 files per call. | |
| dry_run | No | ||
| idempotency_key | No | Names this exact request so a retry after a lost response replays the recorded result (flagged idempotent_replay) instead of doing the work twice. Use a new key for new work: the key is bound to the arguments that first used it, and reusing it with any other argument — including a different dry_run — is refused with IDEMPOTENCY_KEY_REUSED. Only a successful non-dry-run result is recorded, and only the 64 most recently used keys are kept across all tools. |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes | |
| clean | No | |
| error | No | |
| dry_run | No | |
| summary | No | |
| removals | No | |
| warnings | No | |
| additions | No | |
| affected_files | No | |
| already_applied | No | |
| idempotent_replay | No | |
| revision_algorithm | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only supply destructiveHint/idempotentHint flags; the description goes well beyond them with atomicity, per-action revision requirements, the REVISION_MISMATCH refusal for stale files, the create-asserts-absence rule, and the fact that a path may appear only once per call. It correctly aligns with destructiveHint=true (write/edit/delete/move operations) and does not contradict idempotentHint=false (the idempotency_key is an opt-in replay mechanism, not inherent idempotence).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core purpose and the sibling routing decision, then dense per-action rules, and it closes with a concrete example. Efficient overall, though some sentences restate revision rules already carried in the schema property descriptions.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 3-parameter, nested, destructive multi-file mutation tool with annotations and an output schema, the description covers atomicity, revision/auth preconditions, error codes, per-action semantics, and the request-size envelope. An agent has everything needed to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is moderate (67%), and the description compensates by explaining which actions require vs. reject revision, that create asserts absence, and the whole-lines semantics of content ('' is zero lines, trailing newline adds a blank line). It also duplicates some schema text (line numbers refer to file as read) and provides a worked example, so it adds value but is partly redundant with the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource ('Apply line-addressed file changes atomically') and immediately distinguishes itself from the sibling apply_patch by naming the selection condition (when you know the line numbers). An agent can pick between the two without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit when-to-use ('prefer this over apply_patch when you know the line numbers') and when-not ('use apply_patch to chain several edits onto one file'), plus the constraint that paths appear once per call. Both the alternative and the switching condition are named.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
apply_patchApply patchADestructive
Stage, validate, and atomically apply a V4A patch envelope. Each hunk locates itself by its context, so the context must be unique in the file; when it is not, add a scope header (@@ def my_function) naming the enclosing block, or add '*** End of File' to anchor the hunk at the end. A blank context line may be written as "" or as a single space. Matching is graded exact, then ignoring trailing whitespace, then ignoring indentation width, and the grade actually used comes back as match_quality. Success returns each file's revision, total_lines, and changed_ranges. Several updates to one path in one envelope chain in order. Full format reference: docs/tools-and-schemas.md. Example: *** Begin Patch *** Update File: app.py @@ -old +new *** End Patch
| Name | Required | Description | Default |
|---|---|---|---|
| patch | Yes | ||
| dry_run | No | ||
| idempotency_key | No | Names this exact request so a retry after a lost response replays the recorded result (flagged idempotent_replay) instead of doing the work twice. Use a new key for new work: the key is bound to the arguments that first used it, and reusing it with any other argument — including a different dry_run — is refused with IDEMPOTENCY_KEY_REUSED. Only a successful non-dry-run result is recorded, and only the 64 most recently used keys are kept across all tools. |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes | |
| clean | No | |
| error | No | |
| dry_run | No | |
| summary | No | |
| removals | No | |
| warnings | No | |
| additions | No | |
| affected_files | No | |
| already_applied | No | |
| idempotent_replay | No | |
| revision_algorithm | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true, idempotentHint=false, and readOnlyHint=false, so the safety bar is lower. The description still adds real behavioral detail beyond the annotations: atomic application, the graded matching order (exact → trailing whitespace → indentation), that the used grade is returned as match_quality, that multiple updates to one path chain in order, and the returned fields. It never explicitly warns that hunks overwrite file content, which is the one gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core action, then progressively more specific constraints and a pointer to the full format reference. Dense but each sentence carries a distinct rule about patch authoring. The inline example is justified given the custom patch grammar, though it adds length.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so the mention of revision/total_lines/changed_ranges is surplus but harmless. The custom V4A format is documented well enough to author a valid patch, idempotency replay and the IDEMPOTENCY_KEY_REUSED error are covered by the schema param text, and a reference doc is cited for full grammar. Only the dry_run semantics and the destructive-overwrite warning are thin.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is only 33%, so the description must compensate for 'patch' and 'dry_run'. It does so substantively for 'patch': V4A envelope structure, unique-context requirement, scope headers, end-of-file anchoring, blank-line conventions, and an inline example. 'dry_run' is only implied by 'Stage, validate' and is not spelled out, which keeps this below a 5.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Opens with a specific verb triad and resource: 'Stage, validate, and atomically apply a V4A patch envelope.' An agent immediately knows this is the patch-application tool. It does not, however, distinguish itself from the sibling 'apply_changes', leaving the boundary between the two patch-oriented tools to inference.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage guidance is framed as format mechanics (add a scope header, use '*** End of File', how blank context lines are written) rather than when-to-use steering. There is no statement of when to reach for apply_patch instead of apply_changes, write_file, or exec_command. A reader can infer it handles multi-hunk patches, but the routing is implicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
check_exec_environmentCheck exec environmentARead-onlyIdempotent
Return lightweight exec_command sandbox and environment status known to the server.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes | |
| error | No | |
| warnings | No | |
| workspace | No | |
| landlock_abi | No | |
| permission_mode | No | |
| landlock_enabled | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint=false, so the safety profile is covered. The description adds modest value by signaling the response is 'lightweight' and reflects state 'known to the server' (i.e., a cached snapshot rather than a live probe), but says nothing about freshness, auth, or failure behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single compact sentence that front-loads the verb and the resource. Nothing is padded, though the phrase 'known to the server' is slightly opaque.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so the description need not document return values. For a zero-parameter diagnostic, the description supplies adequate context, with the only gap being when to reach for it versus exec_command.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, which is the baseline-4 case; there is no argument surface the description could or should explain. Schema coverage is 100% but trivially so, since the schema has no properties.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Return) and resource (exec_command sandbox and environment status), so an agent knows this is a read-only status probe rather than a command runner. It is clear but does not explicitly contrast itself with exec_command or read_output, leaving sibling differentiation to inference.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit when-to-use or when-not-to-use guidance is given. Usage is only implied by context — an agent would infer you call this before exec_command to learn the sandbox environment — but nothing states that or names an alternative.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
exec_commandExecute commandADestructive
Run a bounded command under runtime policy. Pass workdir explicitly for reconnect-safe paths. yield_time_ms is only how long this call waits (default 10s); timeout_ms is the total process lifetime (default 300s). A command still running when the call returns keeps running under its command_id; poll it with write_stdin or read_output. Example: {"cmd":"pytest -q","workdir":".","yield_time_ms":30000}. Retained output is bounded per stream; for very large output redirect to a file (cmd > out.log 2>&1) and page it with read_file or search_text.
| Name | Required | Description | Default |
|---|---|---|---|
| cmd | Yes | ||
| cwd | No | ||
| env | No | ||
| tty | No | ||
| stdin | No | ||
| workdir | No | . | |
| verbosity | No | preview | |
| timeout_ms | No | Total process lifetime in milliseconds. The command is killed when this elapses, whether or not the call has already returned. | |
| preview_bytes | No | ||
| yield_time_ms | No | How long this call waits before returning. A command still running at that point keeps running and returns a command_id; it is not killed. | |
| max_output_bytes | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes | |
| error | No | |
| signal | No | |
| status | No | |
| stderr | No | |
| stdout | No | |
| preview | No | |
| summary | No | |
| warnings | No | |
| exit_code | No | |
| timed_out | No | |
| truncated | No | |
| command_id | No | |
| elapsed_ms | No | |
| output_ref | No | |
| next_action | No | |
| output_refs | No | |
| next_actions | No | |
| output_stream | No | |
| output_truncated | No | |
| stderr_truncated | No | |
| stdout_truncated | No | |
| operation_outcome | No | |
| preview_truncated | No | |
| stderr_output_bytes | No | |
| stderr_output_lines | No | |
| stderr_truncated_by | No | |
| stdout_output_bytes | No | |
| stdout_output_lines | No | |
| stdout_truncated_by | No | |
| stderr_dropped_bytes | No | |
| stderr_omitted_bytes | No | |
| stdout_dropped_bytes | No | |
| stdout_omitted_bytes | No | |
| truncated_output_streams | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructive/openWorld/non-idempotent, and the description adds substantial context beyond them: the yield-vs-lifetime distinction, that a command keeps running under its command_id after the call returns (not killed), per-stream output bounding, and the reconnect-safe workdir convention. These are real operational traits an agent cannot infer from the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with purpose, then the timing semantics, an inline example, and the output-handling caveat. Every sentence carries information and none repeat the schema or annotations.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and annotations carry the safety profile. The description covers the critical async/timeout behavior well, but for an 11-parameter tool with 18% schema coverage the unresolved cwd vs workdir ambiguity and undocumented env/tty/verbosity params leave a gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 18%, so the description must compensate for the rest. It admirably clarifies the two most confusing params (yield_time_ms vs timeout_ms), the workdir rationale, and gives a concrete example, but it stays silent on nine others (cwd, env, tty, stdin, verbosity, preview_bytes, max_output_bytes) and never addresses the overlapping cwd/workdir pair. Partial compensation warrants a 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Run a bounded command under runtime policy') and immediately scopes it as bounded with a runtime policy. It also routes to siblings, telling the agent that a still-running command is continued via write_stdin or read_output and large output is paged via read_file or search_text.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Clearly explains the two timing knobs (yield_time_ms = how long this call waits; timeout_ms = total process lifetime) and when to use the async continuation path versus paging redirected output. It lacks an explicit 'when not to use' or a pointer to check_exec_environment for preflight, so it stops short of full when/when-not guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
git_blameGit blameCRead-onlyIdempotent
Return bounded git blame metadata for a workspace file.
| Name | Required | Description | Default |
|---|---|---|---|
| rev | No | ||
| path | Yes | ||
| end_line | No | ||
| max_lines | No | ||
| start_line | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes | |
| path | No | |
| error | No | |
| lines | No | |
| warnings | No | |
| truncated | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, destructiveHint=false, and openWorldHint=false, so the safety profile is covered. The word 'bounded' hints that output is truncated, but the description never explains the default cap (max_lines=200), the 1000 ceiling, or what happens when the range is exceeded.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler. It is efficient, though arguably too terse given the five-parameter surface it must support.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained. However, with five undocumented parameters and no usage context, the description leaves the agent guessing about line-range and revision semantics on a tool whose whole purpose is targeted line attribution.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across five parameters, so nothing documents rev, start_line, end_line, or max_lines. The description's only nod to parameters is the vague adjective 'bounded', which does not tell an agent that max_lines defaults to 200 or that start/end_line are 1-based.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (blame) and resource (workspace file) with a useful scope qualifier ('bounded'). It is distinguishable from git_log/git_show, though the description never names a sibling to sharpen the boundary.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to reach for blame versus git_log, git_show, or git_diff. An agent must infer the use case from the tool name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
git_diffGit diffBRead-onlyIdempotent
Return unified git diff for workspace changes. Untracked files are included as additions by default, so a newly created file is verifiable here.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | ||
| paths | No | ||
| staged | No | ||
| unstaged | No | ||
| max_bytes | No | ||
| context_lines | No | ||
| include_untracked | No | Diff untracked files against an empty file so newly created files appear as additions. Applies to the unstaged pass only. |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes | |
| diff | No | |
| error | No | |
| files | No | |
| warnings | No | |
| truncated | No | |
| include_untracked | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint=false, so the safety profile is covered. The description adds the genuinely useful behavior that untracked files are rendered as additions. However, it omits other behavioral traits such as max_bytes truncation, how staged and unstaged passes combine by default, and whether output can be truncated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the verb and resource, with no filler. The trailing rationale about newly created files is mildly redundant with the schema description but still earns its place as usage framing.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, but for a 7-parameter tool with 14% schema coverage the description is too thin. It leaves the agent without guidance on path vs paths, staged/unstaged interaction, or truncation behavior.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 14%, with 7 parameters and only include_untracked documented, so the description is expected to compensate but largely does not. It never clarifies the path vs paths distinction, the staged/unstaged defaults, max_bytes truncation limits, or context_lines. It only restates the untracked behavior already covered by the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Return unified git diff for workspace changes'), which is unambiguous and distinct from siblings like git_status, git_log, and git_show. It stops short of explicitly contrasting itself with those siblings, so it is clear but not fully self-differentiating.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The note that untracked files appear as additions and that a newly created file 'is verifiable here' implies a use case, but there is no explicit guidance on when to choose git_diff over git_status, git_show, or reading a file directly. Usage is inferable rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
git_logGit logCRead-onlyIdempotent
Return recent git commits with bounded structured metadata.
| Name | Required | Description | Default |
|---|---|---|---|
| ref | No | HEAD | |
| path | No | . | |
| skip | No | ||
| max_count | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes | |
| error | No | |
| commits | No | |
| is_repo | No | |
| warnings | No | |
| truncated | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, destructiveHint=false and a closed world, so the safety profile is fully covered without the description. The description adds only that results are 'bounded' (the max_count cap of 100) and structured, which is modest extra context beyond the structured fields.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no padding, which is appropriately sized for the tool. It loses a point only because 'bounded structured metadata' spends words without conveying real meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained. However, with four undocumented parameters at 0% schema coverage and no usage context against four sibling git tools, the description is too thin for a multi-parameter history query.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% for four parameters, so the description must carry the load, and it does not: ref, path, and skip are never mentioned or explained, and only 'recent'/'bounded' loosely gestures at max_count and skip. No format, default, or range semantics are added.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a verb ('Return') and resource ('git commits'), which distinguishes it at a high level from git_status/git_diff. But 'bounded structured metadata' is vague filler that does not say what a commit record actually contains, and nothing separates it from git_show (single commit) or git_blame.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance and no reference to alternatives, despite four closely related git siblings (git_show, git_blame, git_diff, git_status). An agent must infer from the name alone that this returns a history listing rather than a single commit or a diff.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
git_showGit showCRead-onlyIdempotent
Return bounded git show output for a revision.
| Name | Required | Description | Default |
|---|---|---|---|
| rev | No | HEAD | |
| path | No | ||
| paths | No | ||
| max_bytes | No | ||
| include_diff | No | ||
| context_lines | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes | |
| error | No | |
| files | No | |
| content | No | |
| warnings | No | |
| truncated | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, non-destructive, and closed-world behavior. The description adds that output is bounded, which is useful context beyond annotations, but it does not explain truncation behavior, default diff inclusion, or what happens when max_bytes is exceeded.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with no wasted words. However, for a six-parameter tool, it is arguably too terse to be considered fully well-structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained by the description. But with six parameters and 0% schema description coverage, the description is incomplete: it gives no parameter semantics, no usage guidance, and no behavioral detail beyond the single word 'bounded'.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across six parameters, so the description must carry the burden. It hints at a revision and bounded output, but leaves path, paths, include_diff, context_lines, and the max_bytes limits undocumented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description says it returns git show output for a revision, which is a specific operation but largely restates the tool name and title. It does not distinguish itself from siblings like git_diff, git_log, or git_blame, leaving the agent to infer when git_show is the right choice.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit guidance about when to use this tool versus alternatives such as git_diff, git_log, or git_blame. The description provides no context, exclusions, or workflow cues beyond the operation itself.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
git_statusGit statusBRead-onlyIdempotent
Return git working tree status for the workspace.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | . | |
| max_entries | No | ||
| include_untracked | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes | |
| error | No | |
| branch | No | |
| entries | No | |
| is_repo | No | |
| warnings | No | |
| truncated | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, destructiveHint=false and openWorldHint=false, so the safety profile is covered. The description adds only 'working tree status' scoping and nothing about pagination via max_entries or how untracked files appear, so it contributes modestly beyond structured data.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single concise sentence with the resource front-loaded and no filler. Nothing is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists so return format needn't be explained, and annotations carry the safety semantics. The remaining gap is behavioral detail on parameters (truncation limits, untracked-file inclusion) and lack of routing guidance, leaving the definition only just adequate for a 3-param tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the description mentions none of the three parameters (path, max_entries, include_untracked). The parameter names and defaults in the JSON schema hint at meaning, but the description does nothing to compensate for the coverage gap, notably the truncation behavior implied by max_entries.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Return') and resource ('git working tree status') scoped to the workspace. It is readily distinguishable from siblings like git_diff, git_log and git_show, though it does not name or contrast them explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this versus git_diff, git_log, or git_show, and no prerequisites (e.g., that the path must be a git repo). Usage is only implied by the name and subject matter.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
kill_commandKill commandCDestructive
Terminate a server-managed command by command_id. Example: {"command_id":"abc","signal":"KILL"}.
| Name | Required | Description | Default |
|---|---|---|---|
| signal | No | TERM | |
| wait_ms | No | ||
| verbosity | No | preview | |
| command_id | Yes | ||
| kill_wait_ms | No | ||
| preview_bytes | No | ||
| max_output_bytes | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes | |
| error | No | |
| killed | No | |
| signal | No | |
| status | No | |
| stderr | No | |
| stdout | No | |
| evicted | No | |
| preview | No | |
| summary | No | |
| warnings | No | |
| exit_code | No | |
| timed_out | No | |
| truncated | No | |
| command_id | No | |
| output_ref | No | |
| next_action | No | |
| output_refs | No | |
| signal_sent | No | |
| next_actions | No | |
| output_stream | No | |
| output_truncated | No | |
| stderr_truncated | No | |
| stdout_truncated | No | |
| operation_outcome | No | |
| preview_truncated | No | |
| stderr_output_bytes | No | |
| stderr_output_lines | No | |
| stderr_truncated_by | No | |
| stdout_output_bytes | No | |
| stdout_output_lines | No | |
| stdout_truncated_by | No | |
| stderr_dropped_bytes | No | |
| stderr_omitted_bytes | No | |
| stdout_dropped_bytes | No | |
| stdout_omitted_bytes | No | |
| truncated_output_streams | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true, readOnlyHint=false, and idempotentHint=false, so the safety profile is covered. The description adds that the command must be server-managed and shows a KILL example, but does not explain escalation semantics (TERM vs KILL vs INT), what happens to buffered output, or the relationship between wait_ms and kill_wait_ms.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, with the purpose front-loaded and the example placed after it. The JSON example partially restates the schema but is compact and does not pad the text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 7-parameter destructive mutation with an output schema and 0% schema coverage, the description covers only 2 parameters and omits the wait_ms vs kill_wait_ms distinction, signal escalation behavior, and output verbosity controls. An agent cannot invoke it fully correctly from this text alone.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across 7 parameters, and the description only touches command_id and signal (via example). The five remaining parameters (wait_ms, kill_wait_ms, verbosity, preview_bytes, max_output_bytes) are undocumented anywhere, leaving a significant compensation gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb (Terminate) plus a scoped resource (server-managed command) keyed by command_id, which distinguishes it from process-spawning siblings like exec_command and from write_stdin/read_output. It never names an alternative sibling explicitly, so it falls short of full differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied by 'Terminate a server-managed command.' There is no guidance on when to kill versus send input via write_stdin, no mention of prerequisites, and no conditions or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_dirList directoryCRead-onlyIdempotent
List directory entries inside the configured workspace.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | . | |
| sort | No | name | |
| max_depth | No | ||
| recursive | No | ||
| max_entries | No | ||
| include_hidden | No | ||
| include_ignored | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes | |
| path | No | |
| error | No | |
| entries | No | |
| warnings | No | |
| truncated | No | |
| output_bytes | No | |
| output_lines | No | |
| truncated_by | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare read-only, idempotent, non-destructive, and closed-world behavior. The description adds only the workspace confinement, while omitting traversal behavior, entry limits, hidden-file handling, and other operational details beyond what annotations cover.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is a single front-loaded sentence with no wasted words. The structure is clean, though the extreme brevity borders on under-specification for a 7-parameter tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 7 optional parameters, 0% schema descriptions, and an overlapping sibling (list_files), the description is incomplete. Output schema and annotations cover returns and safety, but invocation guidance and parameter meaning remain largely absent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 0% description coverage across 7 parameters, and the description mentions none of their meanings, defaults, or formats. It does not compensate for the schema documentation gap at all.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('List') and resource ('directory entries') and scope ('inside the configured workspace'). It is clear, but it does not distinguish this tool from the sibling list_files, so sibling differentiation is missing.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides no when-to-use guidance, no alternatives, and no exclusions. The agent must infer usage entirely from the tool name and the vague workspace scope.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_filesList filesCRead-onlyIdempotent
List workspace files using glob filters.
| Name | Required | Description | Default |
|---|---|---|---|
| glob | No | ||
| path | No | . | |
| sort | No | path | |
| patterns | No | ||
| max_results | No | ||
| include_hidden | No | ||
| include_ignored | No | ||
| exclude_patterns | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes | |
| path | No | |
| error | No | |
| files | No | |
| warnings | No | |
| truncated | No | |
| output_bytes | No | |
| output_lines | No | |
| truncated_by | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, destructiveHint=false and openWorldHint=false, so the safety profile is covered. The description adds no behavioral context beyond them — nothing about truncation via max_results, default exclusion of hidden/ignored files, or result ordering.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler and no repetition of the title. It is efficient, though the brevity reflects under-specification rather than disciplined editing.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists so return values need not be described, but with 8 undocumented parameters, zero schema coverage, and no alternatives named against list_dir/search_text, the definition is not complete enough for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across 8 parameters, so the description carries the full explanatory burden and fails it. 'Glob filters' gestures at glob/patterns/exclude_patterns but says nothing about path, sort, max_results, include_hidden, or include_ignored.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Specific verb+resource ('List workspace files') plus a mechanism hint ('using glob filters'), which is more than a tautology. However, it never distinguishes itself from closely related siblings such as list_dir or search_text, so an agent cannot route between them from the description alone.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use guidance, no prerequisites, and no mention of the obvious alternatives (list_dir for directory listing, search_text for content search). The agent must infer the use case entirely from the name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_fileRead fileBRead-onlyIdempotent
Read a UTF-8 text file slice inside the configured workspace.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| encoding | No | utf-8 | |
| end_line | No | ||
| max_bytes | No | ||
| max_lines | No | ||
| start_line | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes | |
| path | No | |
| error | No | |
| content | No | |
| encoding | No | |
| end_line | No | |
| revision | No | |
| warnings | No | |
| truncated | No | |
| bytes_read | No | |
| start_line | No | |
| total_bytes | No | |
| total_lines | No | |
| output_bytes | No | |
| output_lines | No | |
| truncated_by | No | |
| next_start_line | No | |
| revision_algorithm | No | |
| first_line_exceeds_limit | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description adds the constraint that reading occurs 'inside the configured workspace' and the file must be UTF-8 text, which is useful context beyond annotations, but it does not disclose error behavior, slice behavior, or performance characteristics.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single concise sentence that front-loads the action and resource. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, return values need not be explained, but the lack of parameter documentation and usage guidance leaves the definition incomplete for a tool with six parameters. It covers the core operation but misses operational details.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description should compensate but does not. It only mentions 'slice' suggesting line-range parameters, but provides no details on the six parameters (path, encoding, start_line, end_line, max_bytes, max_lines), leaving them semantically opaque despite clear names.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Read') and resource ('UTF-8 text file slice'), making the core operation unambiguous. However, it doesn't explicitly differentiate from sibling tools like read_output or view_image, which also involve reading content.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives such as list_files or search_text. The description only states what it does, leaving agents to infer appropriate contexts.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_outputRead outputARead-onlyIdempotent
Read retained command output using an output_ref returned by exec_command/write_stdin. Each stream retains the earliest output (head) plus the most recent output (rolling tail); bytes between them may be evicted and are reported via evicted_gap_bytes. Example: {"output_ref":"command:abc:stdout","offset":0,"limit":4096}.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | ||
| offset | No | ||
| stream | No | ||
| output_ref | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes | |
| error | No | |
| limit | No | |
| offset | No | |
| stream | No | |
| content | No | |
| warnings | No | |
| truncated | No | |
| command_id | No | |
| output_ref | No | |
| next_action | No | |
| next_offset | No | |
| omitted_bytes | No | |
| requested_offset | No | |
| evicted_gap_bytes | No | |
| operation_outcome | No | |
| stream_output_ref | No | |
| total_stream_bytes | No | |
| head_retained_bytes | No | |
| stderr_dropped_bytes | No | |
| stdout_dropped_bytes | No | |
| stream_dropped_bytes | No | |
| total_retained_bytes | No | |
| retained_start_offset | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint and destructiveHint=false, so the safety profile is covered. The description then adds genuinely useful behavior: the head-plus-rolling-tail retention model and the fact that middle bytes may be evicted and surfaced as evicted_gap_bytes. It stops short of describing pagination progression or error behavior for a stale ref.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three dense sentences with no filler: purpose and provenance first, retention semantics second, a concrete invocation example last. Everything is front-loaded and each sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values needn't be enumerated, and the description still flags the notable field evicted_gap_bytes. With 4 params at 0% schema coverage, a little more on the stream parameter and limit bounds would make it fully self-sufficient for invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description carries the burden, and it does reasonably: the example maps offset and limit to concrete values, output_ref is tied to exec_command/write_stdin, and the stdout/stderr stream distinction is implied. The `stream` enum and limit bounds (1..1048576) are still only discoverable from the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Read) plus the exact resource (retained command output) and pins the provenance to output_ref values produced by exec_command/write_stdin. That distinguishes it cleanly from siblings like read_file or git_show, which read different sources.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It tells the agent when this tool applies: retrieving retained output using a ref returned by exec_command or write_stdin. The trigger condition is explicit, though it never states when not to use it (e.g., versus re-running a command or reading a file on disk).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_textSearch textCRead-onlyIdempotent
Search UTF-8 workspace files for text or regex matches.
| Name | Required | Description | Default |
|---|---|---|---|
| glob | No | ||
| path | No | . | |
| query | Yes | ||
| regex | No | ||
| max_results | No | ||
| context_lines | No | ||
| exclude_globs | No | ||
| include_globs | No | ||
| case_sensitive | No | ||
| max_preview_bytes | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes | |
| error | No | |
| query | No | |
| engine | No | |
| matches | No | |
| warnings | No | |
| truncated | No | |
| output_bytes | No | |
| output_lines | No | |
| truncated_by | No | |
| total_matches | No | |
| total_matches_exact | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false and openWorldHint=false, so safety is covered. The description adds only the UTF-8 encoding constraint and regex capability; it says nothing about result truncation, preview byte limits, or ordering behavior that would be useful context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with zero filler, and the core verb and scope lead. It is efficient but arguably under-specified rather than tight, which is more a completeness issue than a structure flaw.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 10 parameters, 0% description coverage, and no annotation gaps on safety, the description should explain the filtering and output-shaping knobs, but it does not. An output schema exists so return shape needn't be described, yet the input contract remains largely opaque.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across 10 parameters, so the description carries the full burden and largely fails: it only loosely gestures at 'text or regex' (query/regex). Globs, path default, max_results, context_lines, and preview byte limits are undocumented anywhere.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Search) and resource (UTF-8 workspace files) plus the match modes (text or regex), so an agent immediately knows the operation. No sibling tool overlaps this capability, so explicit differentiation isn't needed, but the description doesn't note scope limits relative to read_file/list_files.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no mention of alternatives (e.g., read_file for a single file, list_files for names), and no prerequisites or exclusions. The agent must infer usage entirely from the one-line purpose.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
server_infoServer infoARead-onlyIdempotent
Return server, workspace, project-context, auth, policy, and fixed-tool metadata.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes | |
| error | No | |
| tools | No | |
| server | No | |
| version | No | |
| workspace | No | |
| tool_count | No | |
| permission_mode | No | |
| workspace_mutation_policy | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, destructiveHint=false and openWorldHint=false, so the safety and determinism profile is fully covered by structured data. The description adds the scope of returned metadata (that auth and policy details are included), which is useful but is content rather than behavior; it says nothing about freshness, caching, or auth requirements.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no preamble and no filler. The verb and the payload categories are stated immediately, which is the ideal shape for a zero-argument informational tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so the description is not obligated to describe return values, and the enumerated categories give a useful preview of the payload. Zero parameters means no argument documentation is required. The only real omission is guidance on when this tool should be preferred over 'workspace_guide'.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so per the rubric the baseline is 4. There are no arguments whose semantics need explaining, and the schema confirms an empty, additionalProperties=false object.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb ('Return') and enumerates the resource domains covered: server, workspace, project-context, auth, policy, and fixed-tool metadata. This is concrete enough that an agent knows exactly what class of information it retrieves. No sibling tool covers the same ground, so explicit differentiation isn't needed.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no indication of when to call this tool, in what situation it is useful, or how it relates to the sibling 'workspace_guide', which by name appears to touch overlapping workspace context. The agent receives no routing guidance at all, only a content list.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
view_imageView imageCRead-onlyIdempotent
Return a workspace image as MCP image content.
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | ||
| max_bytes | No | ||
| max_width | No | ||
| max_height | No | ||
| auto_resize | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes | |
| path | No | |
| bytes | No | |
| error | No | |
| width | No | |
| height | No | |
| resized | No | |
| warnings | No | |
| mime_type | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, destructiveHint=false, and closed-world behavior, so the safety profile is clear. The description adds useful context by stating the return type is MCP image content, but it does not disclose resizing behavior, size limits, or what happens when an image exceeds max_bytes. Given the strong annotation coverage, a 3 is appropriate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler. Every word earns its place, and the purpose is stated immediately.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The output schema exists, so return values need not be explained, and annotations cover the safety profile. However, for a tool with four optional parameters that control resizing and size limits, the description omits all parameter behavior and gives no usage guidance, leaving meaningful gaps for an agent trying to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% for 5 parameters, and the description does not mention any parameter by name or explain max_bytes, max_width, max_height, or auto_resize. The only implied semantics come from the phrase 'workspace image,' which minimally contextualizes path but leaves the four optional constraints completely undocumented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Return) and resource (workspace image) and names the output format (MCP image content), which distinguishes it from text-returning siblings like read_file. It does not explicitly name or rule out alternatives, so a perfect 5 is not warranted.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance on when to use this tool versus read_file or other siblings, nor does it mention any preconditions. Usage is only implied by the tool name and the word 'image'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
workspace_guideFind target rules, skills and recipesARead-onlyIdempotent
Find applicable repository instructions and skill metadata for a target path. Read the selected full files before acting; no execution or permission grant.
| Name | Required | Description | Default |
|---|---|---|---|
| path | No | Existing workspace-relative target repository, directory or file. | . |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes | |
| error | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover read-only, idempotent, non-destructive, closed-world semantics, so the bar is low. The description still adds real value: it warns that the tool grants no execution or permission, and that returned metadata must be followed by reading the full files before acting — behavior not derivable from the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences, zero filler, with the core action stated first and the caveat ('no execution or permission grant') front-loaded in the same breath. Every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return-value explanation is not required. The description covers what the tool produces (instructions/skill metadata), the required follow-up action, and its safety posture; only the relative ranking against sibling discovery tools (search_text, list_dir) is left unaddressed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Single optional 'path' parameter with 100% schema description coverage, so the schema already documents purpose, type, and default. The description's 'for a target path' merely restates it without adding format or path-resolution detail; baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Find') and a specific resource ('applicable repository instructions and skill metadata') scoped to a target path. It is distinguishable from read_file/list_dir/search_text by being about discovering rules/skills metadata rather than raw content, though it never names those siblings as alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Read the selected full files before acting' implies a two-step workflow (this tool locates, another read retrieves content), which is useful. However, there is no explicit statement of when to prefer this over search_text or list_dir, or what conditions make it inapplicable.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
write_stdinWrite stdinB
Poll or interact with a running command by command_id. Empty chars wait for output; non-empty chars writes to stdin. Example: {"command_id":"abc","chars":"","yield_time_ms":10000}.
| Name | Required | Description | Default |
|---|---|---|---|
| chars | No | ||
| verbosity | No | preview | |
| command_id | Yes | ||
| preview_bytes | No | ||
| yield_time_ms | No | ||
| max_output_bytes | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| ok | Yes | |
| error | No | |
| signal | No | |
| status | No | |
| stderr | No | |
| stdout | No | |
| preview | No | |
| summary | No | |
| warnings | No | |
| exit_code | No | |
| timed_out | No | |
| truncated | No | |
| command_id | No | |
| output_ref | No | |
| next_action | No | |
| output_refs | No | |
| next_actions | No | |
| output_stream | No | |
| output_truncated | No | |
| stderr_truncated | No | |
| stdout_truncated | No | |
| operation_outcome | No | |
| preview_truncated | No | |
| stderr_output_bytes | No | |
| stderr_output_lines | No | |
| stderr_truncated_by | No | |
| stdout_output_bytes | No | |
| stdout_output_lines | No | |
| stdout_truncated_by | No | |
| stderr_dropped_bytes | No | |
| stderr_omitted_bytes | No | |
| stdout_dropped_bytes | No | |
| stdout_omitted_bytes | No | |
| truncated_output_streams | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false, idempotentHint=false, destructiveHint=false. The description usefully adds the behavioral rule that empty chars waits and non-empty chars writes to stdin, plus a concrete call example, but omits blocking semantics of yield_time_ms and any note on side effects of writing.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, front-loaded with the core mechanism and followed by an immediately usable JSON example. Dense and waste-free, though the example parameter could be trimmed.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained. However, with 6 parameters at 0% schema coverage for a non-idempotent write tool, the description leaves too much of the parameter surface unexplained to be fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across 6 parameters, so the description carries the full burden. It explains chars (empty vs non-empty) and hints at yield_time_ms via the example, but leaves verbosity, preview_bytes, and max_output_bytes completely undocumented in both schema and description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: interact with or poll a running command identified by command_id. It conveys the dual purpose (waiting vs writing), but never names the sibling read_output, so an agent must infer which of the two retrieval tools to pick.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied by 'running command' and the empty-vs-non-empty chars rule, which tells the agent when to wait versus when to send input. It gives no explicit guidance on when to prefer this over read_output or how long 'wait' actually blocks.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
19 tool updates
v0.1.1- First observed
apply_changes - First observed
apply_patch - First observed
check_exec_environment - First observed
exec_command - First observed
git_blame - First observed
git_diff - First observed
git_log - First observed
git_show - First observed
git_status - First observed
kill_command - First observed
list_dir - First observed
list_files - First observed
read_file - First observed
read_output - First observed
search_text - First observed
server_info - First observed
view_image - First observed
workspace_guide - First observed
write_stdin
TDQS
Scored across 19 tools
Most tools have clearly distinct resource+action purposes, such as file reading/listing/searching versus command execution and Git inspection. The main overlap is between apply_patch and apply_changes, which both modify files and could require an agent to read descriptions carefully before choosing one.
Tool names consistently use snake_case and mostly follow predictable prefixes such as read_, list_, search_, apply_, git_, and exec_. Minor deviations exist (server_info and workspace_guide are noun-based rather than verb_noun), but the naming remains readable and coherent.
The 19 tools fit a broad workspace-agent scope covering file operations, patching, command execution, process management, Git inspection, image viewing, and guidance. It is slightly on the heavy side relative to a typical 3-15 tool server, but each cluster addresses a real capability.
The surface covers core workspace lifecycle operations: read/list/search, create/write/edit/delete via apply_changes, patching via apply_patch, command execution and management, and key Git read operations. Minor gaps such as dedicated Git commit/stage tools or simple directory metadata operations can be handled through exec_command, so the set is largely complete for its purpose.
Maintenance
Related MCP Connectors
Governed AI agent skills — one library, distributed to devs and exposed to remote agents over MCP.
Remote MCP for Android CLI agent build gate, structured receipts, audit logs, and reviewer-ready evi
Control plane for autonomous software labor. Agents claim objectives over MCP with audit trail.
Remote MCP for Copilot CLI switch gate MCP, structured receipts, audit logs, and reviewer-ready evid
Related MCP Servers
- FlicenseNot gradedqualityBmaintenanceEnables multi-step, opinionated workflows (skills) as MCP resources with lazy loading, encoding team knowledge like branch naming and test procedures alongside tool execution.2-
- AlicenseBqualityBmaintenanceA local, evidence-driven MCP runtime and control plane for open-source maintainers that provides workspace-bounded tools including controlled file operations, command execution, validation primitives, durable execution records, and human review workflows via stdio and Streamable HTTP transports.33MIT
- -licenseNot gradedqualityNot gradedmaintenanceEnables MCP clients to securely execute bounded coding tasks through registered backends, with idempotent job submission, status polling, and artifact retrieval. It isolates each job in Git worktrees and supports optional branch publishing and pull request creation under strict policy constraints.-
- AlicenseNot gradedqualityCmaintenanceTurns any AI coding agent or MCP client into a governed DevOps engineer by exposing policy-enforced tools for Kubernetes, Docker, Jira, Git/PR, CI/CD, AWS, Terraform, and incident response, with approvals, audit logging, secret redaction, and rollback enforced outside the model.1Apache 2.0