boxes-mcp
Provides tools for managing GNOME Boxes virtual machines, including lifecycle operations (start, stop, reboot, suspend), snapshots, screenshots, keyboard and mouse input, and optional SPICE clipboard/transfer features.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@boxes-mcplist all my virtual machines"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
boxes-mcp
A local Model Context Protocol (MCP) server that enables compatible agents and developer harnesses to manage GNOME Boxes and virt-manager virtual machines through libvirt/virsh. It provides safe, reversible VM operations, snapshots, screenshots, bounded keyboard and mouse input, and capability-gated SPICE features.
The project intentionally targets GNOME Boxes' Linux libvirt/QEMU stack. VMware and VirtualBox are not currently supported; their display, input, guest-agent, clipboard, and drag/drop APIs have different trust and capability contracts and should be added as separate, evidence-backed providers rather than inferred from the libvirt implementation.
Contents
Related MCP server: kwin-mcp
Features
š„ļø VM Lifecycle Management - Start, stop, reboot, suspend, and resume VMs
šø Snapshot Operations - Create, list, revert, and delete VM snapshots
š VM Discovery - List and inspect all VMs with detailed information
š Dual Connection Support - Manages both
qemu:///system(virt-manager) andqemu:///session(GNOME Boxes) simultaneously; per-domain operations automatically route to the owning connectionš Safe Operations - Storage preservation by default, no destructive actions
šÆ GNOME Boxes Compatible - Works seamlessly with GNOME Boxes VMs
š±ļø Controlled Interaction - Screenshot, allowlisted keyboard, and typed mouse tools
š Capability-Gated SPICE - Optional native helper protocol for SPICE input, clipboard, and transfer
ā” Fast & Lightweight - Minimal overhead, direct virsh integration
Installation
Host prerequisites
Ubuntu 22.04/24.04 (or compatible Linux distribution)
libvirt-daemon-system, qemu-kvm installed
Node.js 18+ and npm
User in
libvirtandkvmgroupsvirshavailable onPATHfor lifecycle, screenshot, keyboard, and QMP fallback operations
SPICE-backed tools additionally require a SPICE display, a guest virtio-serial agent
channel, and a running spice-vdagent (or equivalent guest agent). Clipboard support
also depends on the guest desktop integration supplied by that agent. The standard
spice-vdagent session component is X11-oriented; a Wayland/Hyprland guest may have
the package and service running while still reporting capability-missing for
clipboard. Build the optional
native helper only when the host provides spice-client-glib, json-glib, and GLib
development files. For libvirt domains whose graphics XML uses listen type='none',
the helper uses libvirt's local graphics-FD API; no remote-viewer, virt-viewer, or
public SPICE URI is required:
npm run build:spice-helper
BOXES_SPICE_HELPER="$PWD/native/boxes-spice-helper" npm testThe helper is not installed or selected automatically. Set BOXES_SPICE_HELPER only
to the reviewed executable built from this repository or another process implementing
the versioned protocol below.
# Install dependencies
sudo apt install -y libvirt-daemon-system qemu-kvm virt-manager
# Add your user to required groups
sudo usermod -aG libvirt,kvm "$USER"
newgrp libvirtInstall from npm
The npm package includes a guided installer for local MCP hosts. It installs the Node
server only; libvirt, virsh, QEMU, and optional SPICE development libraries remain
host prerequisites.
# Detect installed MCP hosts and configure them
npx -y boxes-mcp@2.0.0 setup
# Or install the command globally
npm install --global boxes-mcp@2.0.0
boxes-mcp setupPreview configuration without writing files:
npx -y boxes-mcp@2.0.0 setup --dry-runConfigure one host explicitly when it is not discoverable on PATH:
npx -y boxes-mcp@2.0.0 setup --client codex
npx -y boxes-mcp@2.0.0 setup --client claude
npx -y boxes-mcp@2.0.0 setup --client openclawThe installer detects or can explicitly configure Codex, Claude Code, OpenClaw,
Antigravity, Gemini CLI, OpenCode, Cursor, Windsurf, VS Code, Pi, Cline, Zed, and
Goose. Use --client generic to print a portable JSON configuration for another
stdio-capable agent:
npx -y boxes-mcp@2.0.0 setup --client genericThe setup command writes only the selected MCP entry, creates a one-time
.boxes-mcp.bak backup before changing an existing config, uses atomic replacement,
and never installs operating-system packages or changes VM definitions. Restart the
configured agent or harness after setup. Run boxes-mcp doctor to inspect Node,
virsh, and detected hosts.
Optional host settings can be persisted during setup (--libvirt-uri accepts a
single URI or a comma-separated list, e.g. qemu:///system,qemu:///session):
npx -y boxes-mcp@2.0.0 setup \
--libvirt-uri qemu:///system,qemu:///session \
--input-backend auto \
--spice-helper /absolute/path/to/native/boxes-spice-helper \
--transfer-root /absolute/path/to/approved/filesThe native SPICE helper is not bundled as a universal binary. Build it on a compatible
Linux host after installing the host's SPICE/libvirt development packages, then pass
its reviewed absolute path with --spice-helper or BOXES_SPICE_HELPER.
Install from source
# Clone the repository for unreleased changes or development
git clone https://github.com/EF-Code/boxes-mcp.git
cd boxes-mcp
# Install dependencies
npm install
# Build the project
npm run build
# Run tests
npm test
# Configure a local checkout with the same guided installer
npm run setup:guided -- --client codexConfiguration
For a manual setup, add the server to your Claude Code config (~/.claude.json):
{
"mcpServers": {
"boxes": {
"command": "node",
"args": ["/absolute/path/to/boxes-mcp/dist/src/index.js"],
"env": {
"LIBVIRT_URI": "qemu:///system,qemu:///session",
"BOXES_INPUT_BACKEND": "auto"
}
}
}
}Available Tools
VM Management
Tool | Description | Parameters |
| List all VMs | - |
| Get VM details |
|
| Start a VM |
|
| Shutdown VM (graceful) |
|
| Reboot a VM |
|
| Suspend a VM |
|
| Resume suspended VM |
|
| Remove VM (keeps storage) |
|
| Get SPICE/VNC address |
|
Snapshot Management
Tool | Description | Parameters |
| List VM snapshots |
|
| Create snapshot |
|
| Revert to snapshot |
|
| Delete snapshot |
|
Display and interaction
Tool | Description | Parameters |
| Capture a running domain display as MCP image content | `nameOrUuid, screen?: number, backend?: auto |
| Send a bounded allowlisted Linux key sequence through virsh |
|
| Send typed move/button/click/scroll input |
|
| Explicit UTF-8 clipboard read/write through the SPICE helper |
|
| Experimental confined transfer plus pointer sequence and separate evidence |
|
Interaction tools never accept shell fragments, raw QMP JSON, arbitrary virsh flags, guest commands, or arbitrary transfer destinations. New operations require a running domain and return a stable capability/error code when their backend is not available.
Optional environment variables
Variable | Default | Purpose |
|
| Comma-separated list of libvirt connections. Every URI is scanned by |
|
| Default mouse backend preference: |
| unset | Explicit executable implementing the versioned SPICE helper protocol |
|
| Maximum one helper request duration |
| process temp directory | Controlled parent directory for temporary screenshots |
|
| Screenshot payload limit |
| unset | Required canonical host root for drag/drop source files |
|
| Transfer source size limit |
|
| UTF-8 clipboard payload limit |
BOXES_TRANSFER_ROOT is deliberately required rather than inferred. Paths are
canonicalized and symlink escapes, directories, and special files are rejected.
boxes.capabilities reports observed states. Configuration alone is not treated as
connected: use probeQmp: true and/or probeSpice: true when an external status
probe is required. SPICE clipboard and transfer require a connected guest agent;
boxes.drag_drop reports applicationAccepted: "unknown" unless an external viewer
harness supplies application-level evidence.
Keyboard input uses one fixed Linux virsh codeset. Public key names are
case-insensitive and canonicalized to uppercase, but each key may occur only once
per bounded chord. The allowlist is: ALT, BACKSPACE, CAPSLOCK, CTRL,
DELETE, DIGIT_0 through DIGIT_9, DOWN, END, ENTER, ESC, ESCAPE,
F1 through F12, HOME, INSERT, LEFT, META, NUMLOCK, PAGEDOWN,
PAGEUP, PAUSE, PRINT, RIGHT, SHIFT, SPACE, SUPER, TAB, UP,
and A through Z. Guest keyboard layout determines the resulting character;
the key allowlist does not guarantee text independent of that layout.
Usage Examples
With Claude Code
User: "List all my VMs"
Claude: [Uses boxes.list tool]
User: "Start ubuntu-24.04"
Claude: [Uses boxes.start with nameOrUuid="ubuntu-24.04"]
User: "Create a snapshot called 'before-update' for my fedora VM"
Claude: [Uses boxes.snapshots.create]Direct Usage
# Run the MCP server
LIBVIRT_URI=qemu:///system node dist/src/index.jsDevelopment
Project Structure
boxes-mcp/
āāā src/
ā āāā index.ts # MCP server entry point
ā āāā tools.ts # Side-effect-free tool registry and handler boundary
ā āāā libvirt.ts # virsh operations & parsers
ā āāā virsh.ts # Shared executable and libvirt URI arguments
ā āāā exec.ts # Safe command execution
ā āāā screenshot.ts # Controlled libvirt screenshot capture
ā āāā keyboard.ts # Allowlisted virsh send-key adapter
ā āāā mouse.ts/qmp.ts # Typed mouse actions and QMP fallback
ā āāā spice.ts # Versioned companion-helper protocol client
ā āāā clipboard.ts # Explicit SPICE clipboard orchestration
ā āāā transfer.ts # Confined host-file validation
ā āāā drag-drop.ts # Experimental transfer/input coordination
ā āāā *.test.ts # Unit tests
āāā systemd/
ā āāā boxes-mcp.service # Systemd user service
āāā dist/ # Compiled JavaScript
āāā coverage/ # Test coverage reports
āāā package.json
āāā tsconfig.json
āāā vitest.config.tsTesting
# Run all tests
npm test
# Run tests in watch mode
npm run test:watch
# Generate coverage report
npm run test:coverageLocal test coverage: the current checkout runs 95 passing tests and 9 gated live tests skipped by default. The default suite is safe to run without libvirt access.
exec.ts: 100% statementslibvirt.ts: 81.3% statements, 92.85% branchesInteraction validation, command construction, QMP response mapping, artifact cleanup, helper framing, capability discovery, and path-confinement tests
Run the explicit local native-helper process checks with:
npm run test:spice-helperRun the disposable-VM suite only with all three safety variables set:
BOXES_INTEGRATION=1 \
BOXES_TEST_VM=an-explicit-disposable-domain \
BOXES_TEST_VM_DISPOSABLE=1 \
npm run test:integrationThe live suite never selects a listed VM, changes VM definitions, or stops a guest
service itself. Guest-agent disconnect coverage requires the operator to manually
disconnect spice-vdagent in the explicitly disposable guest and add
BOXES_TEST_AGENT_DISCONNECTED=1; never do this to a non-disposable guest.
The default suite is mocked/local: it does not prove that QMP, SPICE, clipboard, or drag-and-drop works against a real VM. Live tests must be opt-in and target a specifically named disposable VM with snapshots; no arbitrary first-listed domain is ever selected by the interaction tools.
Building
# Build TypeScript
npm run build
# Watch mode for development
npm run devOptional systemd user service
The checked-in unit is intended for a source checkout. It is not needed when the server is launched by an agent's MCP configuration or installed globally with npm. Install it as a user service for automatic startup after building the checkout:
BOXES_MCP_DIR="$(pwd)"
NODE_BIN="$(command -v node)"
mkdir -p ~/.config/systemd/user
cp systemd/boxes-mcp.service ~/.config/systemd/user/
sed -i \
-e "s|/usr/bin/node|$NODE_BIN|g" \
-e "s|%h/projects/boxes-mcp|$BOXES_MCP_DIR|g" \
~/.config/systemd/user/boxes-mcp.service
systemctl --user daemon-reload
systemctl --user enable --now boxes-mcp
journalctl --user -fu boxes-mcpSecurity Considerations
ā Sandboxed Execution: Uses Node.js
execFilewith timeout and buffer limitsā No Arbitrary Commands: Only predefined virsh operations allowed
ā Typed Input Boundary: QMP commands and SPICE operations are internal enums with validated arguments
ā Bounded Payloads: Key counts, hold durations, coordinates, scroll deltas, screenshots, clipboard, and transfers are capped
ā Path Confinement: Drag/drop sources must remain beneath
BOXES_TRANSFER_ROOTafter canonicalizationā Storage Preservation: VM storage not deleted by default
ā LIBVIRT_URI Isolation: Respects environment-specified libvirt connections; per-domain operations resolve the owning connection before acting, so a same-named domain on another connection is never targeted by mistake
ā ļø Permissions Required: User must have libvirt group membership
ā ļø Network Exposure: Not designed for remote access without additional security
ā ļø Expanded Control Surface: Screenshots and guest clipboard data are untrusted; keep the MCP server on local stdio
ā ļø SPICE Helper Trust: The helper executable is an explicit host dependency and must not log credentials, clipboard contents, or file contents
SPICE helper protocol
The TypeScript server starts one persistent helper child and sends newline-delimited version-1 JSON requests over stdin, correlating responses by request ID. The helper is called with an explicit executable path and no caller-controlled arguments. The request envelope is shaped like:
{
"version": 1,
"id": "request-123",
"operation": "clipboard.read",
"domain": "guest-name",
"display": { "uri": "spice://127.0.0.1:5900" },
"arguments": { "selection": "clipboard", "maxBytes": 1048576 },
"libvirtUri": "qemu:///session"
}libvirtUri is optional and carries the resolved libvirt connection for the target
domain; when present, the helper prefers it over its own LIBVIRT_URI environment
value. This keeps libvirt-fd transport working when the server is configured with
multiple comma-separated connections.
Supported operation names are internal (status, mouse, clipboard.read,
clipboard.write, file.transfer, and drag-drop). A helper error is mapped to a
stable MCP error such as SPICE_AGENT_DISCONNECTED, SPICE_CAPABILITY_MISSING, or
SPICE_UNAVAILABLE. Payloads, lines, pending requests, transfer sizes, clipboard
bytes, and operation time are bounded. Progress events never complete a request.
The helper does not log clipboard contents, file contents, SPICE tickets, or
credentials.
Capability matrix
Capability | Libvirt/virsh | QMP fallback | SPICE helper |
Screenshot | Implemented via | Not used | Adapter reserved, unavailable without helper |
Keyboard | Implemented via allowlisted | Not used | Not used |
Mouse | Not used | Typed | Selected by |
Clipboard | Not available | Not available | Real agent protocol in native helper; Wayland/Hyprland guests may report |
File transfer | Not available | Not available | Real SPICE async file-copy path in native helper; live transport completion observed when the guest agent advertises it |
Drag-and-drop | Not available | Not available | Experimental transfer + pointer evidence; application acceptance remains unknown |
Clipboard support depends on guest desktop integration. The current SPICE guest
agent is X11-oriented, so Wayland guests such as Hyprland/Omarchy may report
SPICE_CAPABILITY_MISSING even when spice-vdagent is installed and running. Mouse
and file transfer can still work independently.
Troubleshooting
No VMs Listed
# Check libvirt URI
virsh -c qemu:///system list --all
virsh -c qemu:///session list --all
# Verify permissions
groups # Should include 'libvirt' and 'kvm'Permission Denied
# Re-add to groups and re-login
sudo usermod -aG libvirt,kvm "$USER"
# Then logout/login or:
newgrp libvirtVMs Not Showing in Boxes
By default the server scans both the system connection (virt-manager) and the user
session connection (GNOME Boxes), and boxes.list reports which connection each
domain was found on. Verify what each connection sees:
virsh -c qemu:///system list --all
virsh -c qemu:///session list --allTo restrict the server to specific connections, set LIBVIRT_URI to one URI or a
comma-separated list:
LIBVIRT_URI=qemu:///session node dist/src/index.js # GNOME Boxes only
LIBVIRT_URI=qemu:///system,qemu:///session node dist/src/index.js # both (default)Domain names may contain spaces (for example Kali Live); they are parsed and
resolved correctly.
SPICE capability errors
If virsh domdisplay reports No graphical display found and the domain XML has
<graphics type='spice'><listen type='none'/></graphics>, that is an intentional
libvirt configuration with no public listener. Do not invent a port or change the VM
definition just to obtain a viewer URI. With the native helper configured, boxes-mcp
uses the internal spice+libvirt-fd://local transport and asks libvirt for a graphics
FD for each SPICE channel. The helper must use the same libvirt connection as the MCP
process:
LIBVIRT_URI=qemu:///session npm run build:spice-helper
BOXES_SPICE_HELPER="$PWD/native/boxes-spice-helper" \
LIBVIRT_URI=qemu:///session node dist/src/index.jsThe domain must be running, the helper must be linked against libvirt and
spice-client-glib, and the guest must expose the virtio SPICE agent channel. A
connected agent may still lack clipboard capability; inspect boxes.capabilities with
probeSpice: true instead of inferring support from the XML alone.
Use boxes.capabilities with probeSpice: true and inspect the returned state:
configured: a reviewed helper and SPICE endpoint are configured, but connection proof has not been requested;connecting: the helper observed an incomplete channel set;connected: the required channels are connected;agent-disconnected: the guest agent is not connected;capability-missing: the backend, channel, helper, or guest capability is absent.
For example, a connected guest agent that supports file transfer but does not announce
clipboard is capability-missing, not agent-disconnected. To enable clipboard, the
guest must have its distribution's spice-vdagent service installed, running in the
desktop session, and connected through the virtio SPICE agent channel. On a
Wayland/Hyprland desktop, verify that the distro's agent actually supports that
compositor; an active service alone is not proof. The live Omarchy guest had
spice-vdagent 0.23.0-1 and an active user service, but logged xrandr output ID NOT FOUND and no owner for org.gnome.Mutter.DisplayConfig, so boxes-mcp correctly
returned SPICE_CAPABILITY_MISSING. Use an X11 guest session for the current
upstream agent, or provide a separately validated Wayland clipboard bridge. The
server does not install guest packages or start guest services automatically.
The persistent SPICE client also accepts an abort signal. Cancellation terminates the
current helper process, fails all pending operations deterministically, and allows the
next request to create a clean session; this is reported as OPERATION_CANCELLED.
Check the host dependencies and helper directly without sending input to a VM:
pkg-config --modversion spice-client-glib-2.0 json-glib-1.0 gio-unix-2.0
npm run build:spice-helperThe helper's local protocol test intentionally connects to 127.0.0.1:1 and
expects a typed unavailable/disconnected result. That is not live SPICE proof.
Roadmap
VM creation via
virt-installintegrationNetwork management (
virsh net-list, port forwarding)Storage pool information (
virsh vol-list)VM import from OVA/QCOW2
Remote libvirt connection support
Performance metrics and monitoring
Contributing
Contributions welcome! Please read CONTRIBUTING.md for guidelines.
Fork the repository
Create a feature branch (
git checkout -b feature/amazing-feature)Run tests (
npm test)Commit changes (
git commit -m 'Add amazing feature')Push to branch (
git push origin feature/amazing-feature)Open a Pull Request
License
This project is licensed under the MIT License - see the LICENSE file for details.
Acknowledgments
Built for Claude Code
Integrates with libvirt virtualization API
Support
Issues: GitHub Issues
Discussions: GitHub Discussions
Documentation: Project Wiki
Made with ā¤ļø for the Claude Code community
Available Tools
19 toolsboxes.capabilitiesC
Report observed display and interaction capability state for a running VM
| Name | Required | Description | Default |
|---|---|---|---|
| probeQmp | No | ||
| nameOrUuid | Yes | Domain name or UUID | |
| probeSpice | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description alone must reveal behavioral traits. 'Report' implies a read-only observation, but the optional probeQmp and probeSpice flags suggest active probing behavior that is never disclosed. The description does not say whether probing causes side effects, requires guest cooperation, or changes the result set.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no filler or repetition. It conveys the core operation efficiently, though it omits detail that would make it more informative.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no output schema, no annotations, and two undocumented probe parameters, one sentence is not enough context. It does not clarify what capabilities are reported, what probing does, what the output looks like, or what happens if the VM is not running.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 33%, and the description adds no information about probeQmp, probeSpice, or how they affect the reported capabilities. The two probe parameters remain semantically unexplained, so the description fails to compensate for the low schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description says 'Report observed display and interaction capability state for a running VM', which names a specific verb, resource, and scope. It is clearly distinct from sibling tools like boxes.keyboard or boxes.display, though it does not explicitly name an alternative.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'for a running VM' implies this tool is used to inspect capabilities of an active VM, and the purpose is reasonably inferable. However, it gives no explicit guidance about when not to use it or how it compares to siblings such as boxes.info or boxes.display.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
boxes.clipboardC
Read or write UTF-8 text through the SPICE guest agent clipboard
| Name | Required | Description | Default |
|---|---|---|---|
| text | No | ||
| operation | Yes | ||
| selection | No | clipboard | |
| nameOrUuid | Yes | Domain name or UUID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden. It discloses the read/write nature but does not mention requirements like the guest agent must be running, potential side effects of writing, error scenarios, or return format. The mention of 'SPICE guest agent' hints at a dependency but is not elaborated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence with no redundant words. It front-loads the core function (read/write) and the resource (clipboard). Though more detail could be added, the current length is appropriate for the tool's simplicity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 4 parameters, no output schema, and no annotations, this description is incomplete. Missing are prerequisites (e.g., guest agent running), error handling, return values, and clarification on how operation and text interact. An agent would have to rely on external knowledge or the schema to call it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 25% (only nameOrUuid has a description). The description adds no detail about the text, operation, or selection parameters. While 'UTF-8 text' hints at the text parameter's encoding, it doesn't clarify operation enum values or selection constraints, leaving the agent to infer semantics from the schema alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Read or write UTF-8 text through the SPICE guest agent clipboard' clearly states the verb (read/write), the resource (clipboard), and the mechanism (SPICE guest agent). It distinguishes from sibling tools like boxes.keyboard or boxes.display by focusing solely on clipboard access, though it doesn't explicitly name any alternative.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives like boxes.keyboard or boxes.drag_drop. The description implies clipboard access but does not give explicit conditions, exclusions, or comparisons with sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
boxes.displayA
Get SPICE/VNC display address for VM (useful to open viewer)
| Name | Required | Description | Default |
|---|---|---|---|
| nameOrUuid | Yes | Domain name or UUID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It reveals that the tool retrieves a display address in SPICE or VNC form and is intended for opening a viewer, which is meaningful. However, it does not mention whether the VM must be running, what the exact return format is, or whether any connection is initiated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that states the action, the target resource, and the practical use case. There is no redundant information and it is immediately useful.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a simple one-parameter tool with no output schema, and the description conveys the essential purpose and output type (SPICE/VNC address). It is complete enough for an agent to know what to call, though a note on return format or preconditions would make it fully comprehensive.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already covers the only parameter (nameOrUuid) with 100% description coverage. The tool description does not add extra parameter semantics beyond 'Domain name or UUID', but since the schema is fully sufficient, a baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Get') and a concrete resource ('SPICE/VNC display address for VM'), clearly distinguishing the tool's output from sibling tools like boxes.screenshot (which captures screen pixels) and boxes.info (which returns general VM info). The phrase 'useful to open viewer' further clarifies why an agent would use this tool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use it ('useful to open viewer') but does not explicitly contrast it with alternatives such as boxes.screenshot or boxes.info. There is no when-not-to-use guidance or named sibling for comparison, so the agent must infer the intended use case.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
boxes.drag_dropC
Experimental SPICE file transfer and mouse drag-and-drop operation
| Name | Required | Description | Default |
|---|---|---|---|
| x | Yes | ||
| y | Yes | ||
| width | No | ||
| height | No | ||
| timeoutMs | No | ||
| nameOrUuid | Yes | Domain name or UUID | |
| sourcePath | Yes | File beneath BOXES_TRANSFER_ROOT | |
| coordinateSpace | No | normalized |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description bears full responsibility for disclosing behavior. It only says 'Experimental', which hints at instability but gives no detail on side effects, mutability, permission requirements, or consequences of the drag-and-drop (e.g., whether files are copied/moved/deleted). This is insufficient for a tool that likely performs file system operations on a guest VM.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very brief (one sentence) and gets to the point. However, the word 'Experimental' is a placeholder that conveys no actionable information. It is not overly verbose but lacks structural organization (e.g., no usage hints or parameter context).
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no annotations, no output schema, and eight input parameters, this description is severely incomplete. It does not explain the meaning of width/height/timeout, coordinateSpace semantics, or preconditions (e.g., the BOXES_TRANSFER_ROOT directory). The 'Experimental' label is vague and does not clarify reliability or failure modes. The tool likely has significant side effects (file transfer, mouse manipulation) that are undisclosed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema descriptions only cover nameOrUuid and sourcePath (25% coverage). The description mentions 'SPICE file transfer' and 'mouse drag-and-drop', which implies x,y are coordinates and width/height likely define a target area, but it does not explicitly explain these or coordinateSpace, timeoutMs, or their relationships. The description adds minimal interpretive value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb+resource (
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool over alternatives (e.g., boxes.upload, boxes.display). It does not mention prerequisites, typical interaction flows, or when this tool would be inappropriate (e.g., headless environments). Sibling tools like boxes.mouse and boxes.clipboard are not referenced at all, so the agent must infer usage context from the schema.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
boxes.infoB
Get detailed domain info
| Name | Required | Description | Default |
|---|---|---|---|
| nameOrUuid | Yes | Domain name or UUID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
There are no annotations, so the description carries the behavioral burden. 'Get' implies a read-only operation and no destructive side effects are suggested, but it does not disclose error behavior, required domain state, or the scope of information returned.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence with the verb and resource front-loaded. There is no filler, and the qualifier 'detailed' earns its place by distinguishing it from the list tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and no annotations, the description is under-specified. 'Detailed domain info' does not say what fields or state are returned, nor what preconditions exist for a valid nameOrUuid.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already documents the only parameter as 'Domain name or UUID' with 100% coverage. The description adds no additional parameter meaning, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Get') and resource ('domain info'), and the qualifier 'detailed' separates it from the list sibling. It does not explicitly name sibling tools or state the one-domain scope, so it is clear but not fully differentiated.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use or alternative conditions are provided. The description only restates the operation and gives no guidance for choosing between boxes.info and related siblings like boxes.list or boxes.capabilities.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
boxes.keyboardA
Send a bounded allowlisted key sequence to a running VM
| Name | Required | Description | Default |
|---|---|---|---|
| keys | Yes | ||
| holdMs | No | ||
| nameOrUuid | Yes | Domain name or UUID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must carry the behavioral disclosure burden. It does disclose that the key sequence is bounded and allowlisted, which are meaningful constraints beyond the tool name, and it states the running-VM precondition. However, it does not describe behavior on invalid keys, whether holdMs controls key hold duration, or whether the call blocks until input is delivered.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with no filler or repetition. Every word contributes meaning, and the key constraints are placed directly after the verb.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with no annotations and no output schema, the description leaves important invocation details underspecified: the meaning of holdMs, the contents of the allowlist, and the exact key naming convention expected in the keys array. The core purpose is clear, but the description is not complete enough for an agent to confidently call the tool in all cases.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 33%, so the description must compensate for undocumented parameters. 'Key sequence' and 'allowlisted' add useful meaning to the keys parameter, and 'bounded' aligns with the maxItems constraint. However, holdMs is not explained in either the schema or the description, leaving its semantics ambiguous.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Send') and resource ('a bounded allowlisted key sequence to a running VM'), making the tool's purpose immediately clear. It is also implicitly differentiated from siblings like boxes.mouse and boxes.clipboard by focusing on key sequences rather than pointer or clipboard input.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'to a running VM' implies the precondition that the VM must be running and suggests this tool is for keyboard input, but it does not explicitly explain when to prefer this over sibling input tools like mouse, clipboard, or drag_drop. No alternatives or exclusions are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
boxes.listA
List all libvirt domains (VMs) managed by GNOME Boxes/libvirt
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description alone must communicate the operation type. 'List' implicitly indicates a read-only, non-destructive operation, so an agent can reasonably infer safety. However, it does not disclose what the returned list contains (e.g., domain names, UUIDs, status) or the output format, which is relevant when there is no output schema. For a simple listing tool this is acceptable, but it falls short of full transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, compact sentence that gets straight to the point, front-loading the verb and the resource. There is no redundant phrasing or filler. Every word contributes to the tool's definition. This is an ideal example of conciseness without under-specification.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a parameter-less listing tool with no output schema, the description is largely sufficient: it tells the agent exactly what is being listed. However, it leaves room for clarification about the return structure (e.g., does it return domain names, objects, or a list of IDs?). Given the sibling tool boxes.info exists, a brief note on the output shape would have made it complete. Nevertheless, the core functionality is fully specified, so this is slightly above average in completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the description does not need to elaborate on parameter meaning. The schema is empty and coverage is 100%, meaning there is nothing to document. The baseline for zero params is 4, and the description does not add any parameter-specific information because there are none to describe. This score appropriately reflects that the parameter burden is void.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('List') and a precise resource ('all libvirt domains (VMs) managed by GNOME Boxes/libvirt'). It unambiguously identifies the tool's purpose and clearly distinguishes it from sibling tools like boxes.info (which would provide details on a specific domain) and state-changing tools like boxes.start. There is no ambiguity about what this tool does.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description makes it obvious that this tool is the enumeration/list command among the siblings. However, it does not explicitly state when to prefer this over boxes.info or mention that it returns all domains, which could be a useful precursor to calling boxes.info on a specific domain. The lack of explicit when/alternatives guidance is minor given the tool's self-explanatory nature, but a note about being a read-only enumeration step would have made it a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
boxes.mouseC
Send a typed mouse action through SPICE or QMP
| Name | Required | Description | Default |
|---|---|---|---|
| x | Yes | ||
| y | Yes | ||
| width | No | ||
| action | Yes | ||
| button | No | ||
| deltaX | No | ||
| deltaY | No | ||
| height | No | ||
| backend | No | auto | |
| nameOrUuid | Yes | Domain name or UUID | |
| coordinateSpace | No | normalized |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure, but it only states the transport and that a mouse action is sent. It does not describe side effects, the meaning of 'auto' backend selection, coordinate-space semantics, or the constraints around deltas and dimensions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is one short sentence with no filler, and the transport mechanism is front-loaded. It is concise rather than bloated, though it is terse enough to omit important context.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a complex tool with 11 parameters, multiple oneOf action shapes, and no annotations or output schema, yet the description supplies almost no contextual information. Even with the schema, the roles of width/height, normalized versus pixel coordinates, and backend 'auto' behavior remain unclear.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds minimal hints about the backend ('SPICE or QMP') and the action concept, but it provides no meaning for x/y, width/height, coordinateSpace, button, or deltaX/deltaY. Since schema description coverage is only 9%, the description does not compensate for the parameter semantics gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Send') and identifies the resource ('mouse action') and transport ('through SPICE or QMP'), which distinguishes it from sibling input tools like boxes.keyboard or boxes.clipboard. The word 'typed' is slightly ambiguous, and the description does not explicitly say the target is a domain/VM, but the overall meaning is clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance about when to use this tool versus alternatives, nor when not to use it. It does not mention the backend options, coordinate-space choices, or any exclusions, so an agent must infer usage from the schema alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
boxes.rebootB
Reboot a running domain
| Name | Required | Description | Default |
|---|---|---|---|
| nameOrUuid | Yes | Domain name or UUID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It states the action but does not reveal side effects, such as whether the reboot is graceful, potential state loss, required permissions, or behavior when the domain is not running.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with no redundant language. It efficiently conveys the action and the condition in minimal words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a state-changing operation with no annotations and no output schema, this description is insufficiently complete. It does not explain what happens during reboot, what prerequisites are needed beyond an implied running state, or what errors might occur, leaving an agent under-informed for a destructive-ish operation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already fully documents the single parameter nameOrUuid with a clear description ('Domain name or UUID') and 100% coverage. The tool description adds no additional parameter context, so a baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'reboot' and identifies the resource as 'a running domain'. This is a distinct action not covered by sibling tools like start, shutdown, suspend, or resume, so it is self-differentiating.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'a running domain' implies the tool is intended for active domains, but it gives no explicit guidance on when to use reboot compared to start/shutdown/suspend/resume. There is no mention of what to do if the domain is stopped or when not to use the tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
boxes.resumeC
Resume a suspended domain
| Name | Required | Description | Default |
|---|---|---|---|
| nameOrUuid | Yes | Domain name or UUID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, and the description offers no information about side effects, permissions required, or consequences of resuming. As a mutation operation, this leaves the agent blind to behavioral expectations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, clear sentence with no fluff. While it is brief, it does not waste words, and the essential action is conveyed. Structure is minimal but acceptable for such a simple operation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description omits critical context such as the expected state of the domain (must be suspended), any side effects on running processes, or the format of the response. It only states the action without surrounding context, leaving gaps for an agent making decisions.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already fully documents the single parameter 'nameOrUuid' with its description. The tool description adds no additional meaning or constraints beyond what the schema provides, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Resume') and resource ('suspended domain'), clearly indicating the action. Differentiates from siblings like 'suspend' and 'start' by implying the domain is in a suspended state, though not explicit about the distinction from 'start'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when a domain is suspended and needs to be resumed, but does not explicitly state when to use this tool over 'start' (e.g., for stopped vs. suspended domains). Lacks clear guidance on prerequisites or scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
boxes.screenshotC
Capture a running VM display screenshot as MCP image content
| Name | Required | Description | Default |
|---|---|---|---|
| screen | No | ||
| backend | No | auto | |
| nameOrUuid | Yes | Domain name or UUID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It does add a key constraint: the VM must be 'running' to capture a screenshot. It also states the output format ('as MCP image content'), which is useful. However, it omits details like whether the operation is read-only, any resolution limits, or side effects. Given the minimal but relevant information, a score of 3 is appropriate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-formed sentence that delivers the core purpose without any fluff. It is appropriately concise and front-loaded, with no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 3 parameters, no output schema, and no annotations, the description is too sparse. It does not explain the 'screen' parameter (which screen index), the 'backend' parameter (what options mean, when to choose one), or the nature of the returned image content beyond a generic 'MCP image content'. An agent would struggle to use screen/backend correctly, and the lack of any output detail further limits completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 33% (only nameOrUuid has a description in the schema). The description does not explain the meaning or usage of 'screen' or 'backend' at all, nor does it clarify the expected values or defaults. Since the description fails to compensate for the low schema coverage, this dimension scores low ā the tool cannot be invoked correctly without additional knowledge of these parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb ('Capture') and resource ('running VM display screenshot') and specifies the output type ('as MCP image content'). It is specific enough for an agent to understand the tool's function, though it does not explicitly differentiate from the sibling boxes.display, which could also capture display-related data. This slight ambiguity prevents a perfect score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives like boxes.display. There is no mention of preconditions beyond 'running VM' (which is more a behavioral requirement than usage guidance). The description does not state when not to use it or what makes it the right choice among siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
boxes.shutdownA
Shutdown/Power off a domain (graceful by default)
| Name | Required | Description | Default |
|---|---|---|---|
| force | No | If true, force off (destroy) | |
| nameOrUuid | Yes | Domain name or UUID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
There are no annotations, so the description is the only source of behavioral info. It discloses 'graceful by default', which adds context beyond the schema, but it does not mention other behavioral aspects such as error handling or consequences of force (which are covered in the schema's force parameter description). The description is minimal but not misleading.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no filler, front-loading the purpose and the key default. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with only two parameters and no output schema, the description covers the essential purpose and the default behavior. The schema covers the parameters, so the description is sufficient. It does not discuss edge cases, but for this simple operation it is adequately complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already documents both parameters with 100% coverage. The description adds the default behavior of graceful shutdown, clarifying that force is optional and non-default, which gives extra meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb (shutdown/power off) and the resource (a domain), and the default behavior is noted. It distinguishes from siblings like start, reboot, and suspend.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description is clear about what the tool does, providing the context of shutting down a domain. It does not explicitly mention alternatives or when not to use it, but the sibling names (start, reboot) make the distinction obvious. However, it lacks explicit guidance on when to choose shutdown over reboot or suspend.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
boxes.snapshots.createB
Create a snapshot for a domain
| Name | Required | Description | Default |
|---|---|---|---|
| snapshot | Yes | Snapshot name | |
| nameOrUuid | Yes | Domain name or UUID | |
| description | No | Snapshot description |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It only states that a snapshot is created; it does not mention overwrite behavior, whether the domain must be running or shut off, side effects, return values, or failure conditions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single short sentence with no wasted words and is appropriately front-loaded. It is concise, though it achieves brevity at the cost of useful behavioral or usage context.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no annotations and no output schema, the description should carry more context about prerequisites, side effects, and invocation behavior. It only states the action, which is insufficient for a mutation tool, even though the schema fully documents the parameters.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with the three parameters already documented as snapshot name, domain name or UUID, and snapshot description. The tool description adds no additional parameter meaning beyond what the schema provides, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Create') and resource ('snapshot for a domain'), and the create verb clearly separates it from sibling snapshot tools like list, revert, and delete. The resource scope is clear enough for an agent to identify what the tool operates on.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies this is the tool to use when creating a snapshot, but it never explicitly states when to use it versus alternatives or when not to use it. No prerequisites, conflicts, or exclusions are mentioned, leaving usage context to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
boxes.snapshots.deleteB
Delete a snapshot
| Name | Required | Description | Default |
|---|---|---|---|
| snapshot | Yes | Snapshot name | |
| nameOrUuid | Yes | Domain name or UUID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Since no annotations are provided, the description carries the full burden of behavioral disclosure. It merely states 'Delete a snapshot' but does not reveal that the operation is permanent and irreversible, nor does it mention potential failure conditions (e.g., snapshot not found, domain in use). This is a significant omission for a destructive action.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, direct sentence that is appropriately concise. It is front-loaded and wastes no words, achieving maximum efficiency. Every word contributes to the meaning without redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive operation with no annotations and no output schema, the description is too minimal. It lacks information about required conditions, side effects, error handling, or results. An agent would not know whether the deletion is idempotent, what happens if the snapshot is in use, or how the operation might fail. This incompleteness is unwarranted given the tool's simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% coverage, meaning both parameters (snapshot and nameOrUuid) already have descriptive definitions. The description adds no extra information about the parameters, so the baseline score of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Delete a snapshot' is a specific verb-resource pair that unambiguously identifies the action. It clearly distinguishes this tool from sibling snapshot tools like list, create, and revert, all of which have different verbs. There is no ambiguity about what it does.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It does not mention prerequisites such as the snapshot existing or the domain being stopped, nor does it indicate when one should prefer revert or create over delete. An agent must infer usage from the tool name and parameters alone, with no explicit direction.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
boxes.snapshots.listA
List snapshots for a domain
| Name | Required | Description | Default |
|---|---|---|---|
| nameOrUuid | Yes | Domain name or UUID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full responsibility for behavioral transparency. It does not explicitly state that the operation is read-only, non-destructive, or describe any side effects. The term 'list' hints at safety, but no explicit disclosure is provided.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence, starts with the verb, and contains no unnecessary words. It is perfectly front-loaded and efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list operation with one parameter and no output schema, the description adequately conveys the core purpose. It does not cover potential error scenarios or details about the returned list, but given the simplicity, this is acceptable.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema fully covers the one parameter with a description. The tool description adds no additional meaning beyond repeating 'domain', so it matches the baseline for full schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('List') and the resource ('snapshots') scoped to a domain. It is easily distinguished from sibling tools like create, revert, and delete, which have explicit different actions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use it (to view existing snapshots) but does not explicitly contrast it with alternatives or mention scenarios like checking before creating or reverting. The sibling list provides context, but the description itself is minimal.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
boxes.snapshots.revertB
Revert a domain to a snapshot
| Name | Required | Description | Default |
|---|---|---|---|
| snapshot | Yes | Snapshot name | |
| nameOrUuid | Yes | Domain name or UUID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of disclosing behavioral traits. Reverting is a destructive action that likely overwrites the current domain state and may be irreversible, but the description does not mention this, nor does it note any impact like a reboot or data loss.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence with the action front-loaded. It has no fluff or redundancy, making it efficient. However, it sacrifices important contextual detail, which prevents a perfect score.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with no annotations and no output schema, the description is incomplete. It fails to explain the consequences of reverting (e.g., potential data loss, need for domain to be stopped or rebooted), nor does it clarify any behavioral side effects. An agent calling this tool lacks critical information to use it safely.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already documents both parameters with descriptions ('Domain name or UUID' and 'Snapshot name'), achieving 100% coverage. The description adds no additional meaning, nuance, or constraints beyond what the schema provides, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Revert') and resource ('a domain to a snapshot'), clearly indicating the action and distinguishing it from siblings like create, delete, and list. An agent can immediately understand what this tool does.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. There is no mention of prerequisites, common scenarios, or conditions that would make this the correct choice over other snapshot operations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
boxes.startC
Start a domain (VM)
| Name | Required | Description | Default |
|---|---|---|---|
| nameOrUuid | Yes | Domain name or UUID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided (readOnlyHint, destructiveHint absent), so the description carries the full behavioral burden. The single sentence discloses no side effects, no requirement that the VM be in a stopped state, no mention of whether this is non-blocking (queues the boot) or blocking, and no idempotency semantics. For a state-changing operation with zero annotation coverage, this is a notable gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One short, wasteful sentence that communicates the verb, object, and domain context efficiently. It is not padded with filler, though the brevity is as much a product of under-specification as it is of restraint.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is trivial (one fully-documented parameter, no nested objects, no output schema, no enums), so there is little metadata for the description to duplicate or supplement. The main hole is the lack of guidance about VM state (stopped vs. running vs. suspended) and the absence of any side-effect or prerequisite details. It is acceptable but leaves the most useful contextual information on the table.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% ā the single parameter nameOrUuid is fully self-documenting with the description 'Domain name or UUID'. The description adds nothing beyond the schema, but with full coverage the baseline of 3 applies; the parameter meaning is entirely contained in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific, active verb ('Start') with a clear resource ('a domain (VM)'), and the parenthetical disambiguates 'domain' as a libvirt VM rather than a DNS domain. It distinguishes itself from siblings by being the power-on counterpart to shutdown/resume, though it doesn't explicitly disambiguate when to use 'start' vs 'resume' ā a distinction an agent would have to infer.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No usage guidance is provided whatsoever. The description neither states when this tool is appropriate nor differentiates it from the semantically overlapping sibling 'boxes.resume' (both power-on-like operations) or from 'boxes.reboot'. An agent cannot tell from the text whether to call this on a stopped VM, a suspended VM, or both.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
boxes.suspendC
Suspend a running domain
| Name | Required | Description | Default |
|---|---|---|---|
| nameOrUuid | Yes | Domain name or UUID |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It states only that the tool suspends a running domain but does not explain effects (e.g., state preservation, reversibility via 'resume', or resource implications). This is a significant transparency gap for a state-changing operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, unambiguous sentence with no fluff, and the action is front-loaded. It is appropriately concise for a simple operation, though it borders on under-specification, which is captured in other dimensions.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the lack of annotations and output schema, the description is incomplete. It fails to mention when to use suspend, what happens to the domain, or any side effects. An agent would lack essential context to decide between suspend and shutdown, making the tool risky to invoke without further research.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already documents the sole parameter as 'Domain name or UUID' with 100% coverage. The description adds no additional meaning about the parameter, such as format requirements or how it relates to the operation, so the baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'suspend' and the resource 'domain', which distinguishes it from sibling operations like 'start', 'shutdown', 'reboot', and 'resume'. However, it does not explicitly contrast with alternatives, so it stops short of the strongest clarity score.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use 'suspend' versus other lifecycle operations such as 'shutdown' or 'reboot'. It also fails to mention prerequisites like the domain needing to be in a running state, leaving the agent to infer usage from the name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
boxes.undefineA
Undefine a domain (remove from libvirt). Storage is NOT deleted.
| Name | Required | Description | Default |
|---|---|---|---|
| nameOrUuid | Yes | Domain name or UUID | |
| keepStorage | No | Keep storage (default: true) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the burden of behavioral disclosure. It explicitly states that storage is not deleted, which is critical. However, it omits other behavioral aspects such as whether the domain must be inactive, what happens to snapshots, or if the operation is reversible. Not fully transparent, but the storage caveat is valuable.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence conveys the essential purpose and a critical caveat with zero waste. It is highly concise while retaining clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (2 parameters, no output schema, no annotations), the description covers the primary purpose and storage behavior but misses important contextual details like preconditions (e.g., domain state), side effects on other metadata, and any error scenarios. It is minimally adequate but not fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both parameters are already documented. The description's note about storage not being deleted reinforces the default of keepStorage=true, adding slight clarity beyond the schema's 'Keep storage (default: true)' but not introducing new information. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific verb ('Undefine'), resource ('a domain'), and the precise effect ('remove from libvirt'), plus a key qualifier ('Storage is NOT deleted'). This distinguishes it from sibling tools like start, shutdown, or snapshots without ambiguity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not specify when to use this tool versus alternatives, nor any prerequisites (e.g., domain must be shut down). It simply states what it does, leaving the agent to infer appropriate context from the name and sibling list.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
19 tool updates
v2.0.0- First observed
boxes.capabilities - First observed
boxes.clipboard - First observed
boxes.display - First observed
boxes.drag_drop - First observed
boxes.info - First observed
boxes.keyboard - First observed
boxes.list - First observed
boxes.mouse - First observed
boxes.reboot - First observed
boxes.resume - First observed
boxes.screenshot - First observed
boxes.shutdown - First observed
boxes.snapshots.create - First observed
boxes.snapshots.delete - First observed
boxes.snapshots.list - First observed
boxes.snapshots.revert - First observed
boxes.start - First observed
boxes.suspend - First observed
boxes.undefine
TDQS
Most tools map cleanly to a distinct resource+action (e.g., snapshots.list, snapshots.revert). The only potential confusion is `boxes.capabilities`, which could overlap with `boxes.info` (state info) and `boxes.display` (screen state) for an agent. The input/interaction tools (keyboard, mouse, clipboard, screenshot) are clearly separated by modality.
Top-level lifecycle tools use consistent single verbs (start, shutdown, reboot, suspend, resume, undefine), but interaction tools shift to bare nouns (keyboard, mouse, clipboard, screenshot, capabilities). Snapshot nesting is consistent and clear. Mixing namespace prefixes (boxes.* and boxes.snapshots.*) with singular noun tools creates minor inconsistency in expected verb-phrase form.
19 tools is slightly above the typical sweet spot but justified given the breadth: 5 lifecycle, 4 snapshot, 2 info, and 8 interaction/display tools. The interaction sub-surface is granular (keyboard, mouse, clipboard, drag_drop, capabilities) and could be consolidated, but each maps to a real distinct operation. It never feels bloated enough to warrant a 3.
Lifecycle operations are well-covered for read/start/stop, snapshots have full CRUD with revert, and interaction features (screenshot, input, clipboard) are thorough. Missing pieces include VM creation/clone, device/storage management, and define/undefine pairing is lopsided (only undefine). Snapshot and interaction workflows feel complete for the stated GNOME Boxes/libvirt scope.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Manage Sprites: sandboxed compute environments with exec, services, and checkpoints.
Provides capabilities that let LLM agents perform a range of infrastructure management tasks.
Read GPU instances, types, images, filesystems and firewall rules; launch and terminate instances.
Operate Linux, macOS and Windows from your LLM. Every action runs through an auditable allowlist.
Related MCP Servers
- AlicenseBqualityAmaintenanceEnables AI assistants to manage virtual machines, sandboxes, and dev environments through VirtualBox, Hyper-V, and Windows Sandbox, supporting VM lifecycle, ISO downloads, networking, and unattended installs.914MIT
- AlicenseNot gradedqualityDmaintenanceEnables AI agents to automate Linux desktop GUI by launching and interacting with Wayland applications in isolated virtual KWin sessions, or connecting to live desktops for collaborative automation.41MIT
- AlicenseNot gradedqualityDmaintenanceEnables AI models to securely query and manage virtual machines and virtualized resources via the libvirt API through the Model Context Protocol.1MIT
- AlicenseNot gradedqualityDmaintenanceEnables management of KVM/QEMU virtual machines on remote libvirt hosts via SSH, with tools for inspection, lifecycle management, snapshots, and cloning.1AGPL 3.0
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/EF-Code/boxes-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server