powershell-mcp
This server gives AI agents hidden, structured, non-intrusive access to manage Windows and remote systems via PowerShell.
Run PowerShell scripts/commands locally in a hidden process, with cwd/timeout options and structured stdout/stderr/exit-code output.
Run native executables directly (e.g. git, gh, docker, node) without a shell, capturing clean output reliably.
Manage Windows services: list, inspect, start, stop, restart, or query status.
Get system information: OS, CPU, memory, and per-drive disk summary.
Execute commands on remote hosts over SSH in-process (no ssh.exe/WSL), with key/password auth and output caps.
Execute commands on remote Windows hosts via WinRM (PowerShell Remoting), using various auth mechanisms.
Transfer files over SFTP — upload and download securely, fully in-process without external scp/WSL binaries.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@powershell-mcprestart the print spooler service"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
powershell-mcp
A Model Context Protocol server that gives AI agents real, non-intrusive access to Windows PowerShell.
Most tools that let an agent run Windows commands spawn a visible console window for every call — which steals focus and interrupts whatever you're typing. powershell-mcp runs everything in a hidden process (windowsHide: true / no CreateWindow), captures structured output, enforces hard timeouts, and exposes purpose-built tools for service and system management. Built for running unattended next to a human at the keyboard.
Why
No popup windows. Commands run hidden; your foreground app keeps focus.
Structured + safe. Every call returns
{ stdout, stderr, exit_code, duration, timed_out }. Hard timeout with tree-kill. Output is capped so a runaway command can't flood the context.Real Windows management. First-class tools for services and system info, not just a raw shell — handy for managing Windows servers and backup systems.
Cross-shell. Prefers
pwsh(PowerShell 7+) and falls back topowershell.exe; override withPWSH_MCP_EXE.
Related MCP server: Windows-MCP
Tools
Tool | Description |
| Run any PowerShell script/command (hidden). |
| Run a native executable directly (no shell) and capture clean stdout/stderr + exit code - for |
| List services, optional |
| Detailed status of one service by name. |
|
|
| OS, CPU, memory, and per-drive disk summary. |
| Run a command on a remote host over SSH, fully in-process (no |
| Run a command on a remote Windows host via PowerShell Remoting (WinRM / |
| Upload a local file to a remote host over SFTP, in-process (ssh2 — no scp.exe/WSL, headless). |
| Download a remote file to this host over SFTP, in-process. Same params as |
Native programs: Windows PowerShell routes a native command's stdout to the console, so run hidden it is lost. Use
run_program(direct-exec) for console binaries likegh/git/docker; userun_powershellfor PowerShell/cmdlet logic.
See it work
Real calls, real output — headless, no console window, structured results:
# ssh_exec — run a command on a Linux box, in-process (no ssh.exe, no WSL)
> ssh_exec host=192.168.0.5 username=isak command="uptime; systemctl is-active app"
$ ssh isak@192.168.0.5 (exit=0, 818ms)
2 days, 23:53, load average: 0.00, 0.01, 0.04
active
# sftp_upload — deploy a file, in-process (no scp.exe)
> sftp_upload localPath=C:\deploy\app.py remotePath=/home/isak/app.py host=192.168.0.5 ...
sftp upload: C:\deploy\app.py → isak@192.168.0.5:/home/isak/app.py
OK (9129 bytes, 714ms)Remote operations
powershell-mcp manages more than the local box. Windows' own ssh.exe produces no capturable output when run from a windowless/background process, and shipping WSL to every server doesn't scale — so remote exec is built in:
ssh_execuses the pure-JSssh2client (no external binary), so it works headless and needs nothing on the target beyond an SSH server. Ideal for Linux hosts.winrm_execuses native PowerShell Remoting, so a Windows fleet needs only WinRM enabled — no per-server install.
Telemetry (anonymous, opt-out)
On startup the server sends a one-time ping (host id, version, OS, timestamp) and flushes per-tool call counts every 30 minutes (and on exit). This helps prioritise which tools matter. No command content, arguments, output, or paths are ever sent.
Disable entirely: set
POWERSHELL_MCP_NO_TELEMETRY=1.Override the endpoint: set
POWERSHELL_MCP_TELEMETRY_URL.
The collector under collector/ is a standalone Node.js service (JSONL append, systemd unit, nginx snippet, deploy.sh) deployed separately.
Install
The canonical npm package is @imrrd/powershell-mcp.
Run it directly from npm in an MCP client:
{
"mcpServers": {
"powershell": {
"command": "npx",
"args": ["-y", "@imrrd/powershell-mcp@latest"]
}
}
}Or install the CLI globally:
npm install -g @imrrd/powershell-mcpMigrating:
powershell-mcpis deprecated and will not receive a patched legacy release. Remove it and install@imrrd/powershell-mcp@0.5.3or later.
For development from source:
npm install
npm run buildSee examples/claude_desktop_config.json for the canonical package-based client configuration.
Develop
npm run dev # run from source (tsx)
npm test # unit + (where a shell is present) integration tests
npm run typecheckCI runs build + tests on both windows-latest and ubuntu-latest.
Security notes
winrm_execsends caller-controlled connection details to the local PowerShell child over stdin; credentials are not placed in process arguments or environment variables.control_serviceand many commands require the MCP host process to run with sufficient privileges.The server runs whatever script it's given — run it only in environments you trust, behind a host (like Claude) that you control. A future release will add an optional allow/deny policy and confirmation gating.
License
MIT © IMR Research & Development (UK)
Available Tools
10 toolscontrol_serviceB
Start, stop, or restart a Windows service (requires the MCP host process to have sufficient privileges).
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Exact service name. | |
| action | Yes | Action to perform. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description must disclose behavioral traits itself. It does mention the requirement for sufficient privileges, which is valuable context. However, it does not describe side effects (e.g., service downtime), return values, synchronous execution, or error behavior, leaving significant gaps in transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that front-loads the primary action and the resource. It is concise and free of filler, earning full marks for structure.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple and the schema is reasonably detailed, but no output schema exists and the description does not explain return values or outcome reporting. Additionally, the 'status' action present in the enum is omitted from the description, which is a completeness gap. The description is adequate for basic use but leaves room for clarification.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%—both parameters have clear descriptions ('Exact service name', 'Action to perform'). The description adds only minimal context (Windows-specific) beyond the schema, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with specific verbs ('Start, stop, or restart') and a specific resource ('a Windows service'). It distinguishes itself from sibling tools like list_services and get_service by focusing on control operations. Though it omits the 'status' action from the enum, the core purpose is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no explicit guidance on when to use this tool versus alternatives. It mentions the privilege requirement but does not frame it as a selection criterion. Sibling tools like get_service or list_services could be referenced for related tasks, but no such direction is given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_serviceA
Get detailed status of one Windows service by name.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Exact service name (not display name). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries full responsibility. It only states that it gets detailed status, but does not disclose whether this is a safe, non-mutating operation, what the output structure looks like, or how it handles non-existent services. This is a notable gap for a read operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence with no unnecessary words. It front-loads the action and resource, making it immediately clear what the tool does.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter tool, the description is adequate but leaves gaps. With no output schema, it fails to specify what 'detailed status' includes or what error behavior to expect. This is a moderate gap in an otherwise simple context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the single parameter, and the parameter description clarifies 'exact name (not display name)'. The main description does not add extra semantics beyond 'by name', so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Get'), the resource ('detailed status of one Windows service'), and the lookup method ('by name'). It distinguishes the tool from siblings like list_services and control_service by focusing on a single service's status.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when you need the status of a single Windows service by its exact name, which provides clear context. It does not explicitly mention exclusions or alternatives, but the clarity of the purpose makes the intended use obvious.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_servicesA
List Windows services, optionally filtered by a name pattern. Returns Name, DisplayName, Status.
| Name | Required | Description | Default |
|---|---|---|---|
| filter | No | Wildcard name filter, e.g. 'Sql*' or '*backup*'. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description carries the full burden. It discloses the return fields (Name, DisplayName, Status) and the optional filter, but does not explicitly state that the operation is read-only, nor does it mention permission requirements or error conditions. The behavior is mostly clear from the verb 'List'.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, each informative and necessary: the first states the purpose and the second states return fields. No redundant or irrelevant text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list tool with no output schema and no annotations, the description adequately covers purpose and return fields. It implies that omitting the filter lists all services, but it does not specify whether the filter applies to Name, DisplayName, or both. Overall, it is mostly complete but has minor ambiguity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description for the filter parameter already provides complete details about the wildcard format (e.g., 'Sql*'). The tool description only says 'name pattern' and repeats what the schema says, adding no new meaning. Given 100% schema coverage, the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'List' with a clear resource 'Windows services' and mentions an optional filter. This distinguishes it from siblings like get_service (likely single-service) and control_service (state changes).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for enumerating services but does not explicitly mention alternatives or exclusions. It lacks comparisons to get_service or control_service, so guidance is only implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
run_powershellA
Run a PowerShell script/command on this Windows host in a hidden process (no console window appears). Returns stdout, stderr and exit code. Use for any Windows command, file, or system task.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Working directory. | |
| script | Yes | PowerShell script or command to execute. | |
| timeoutMs | No | Hard timeout in ms (default 60000). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden. It discloses key behaviors: hidden process (no console window), returns stdout/stderr/exit code. However, it does not mention potential side effects, permissions, or security implications, which are relevant for an execution tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the core action, and every word adds value. No redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 3 params and no output schema, the description covers return values (stdout, stderr, exit code), the hidden-process behavior, and general use cases. It lacks details on error handling or execution policy, but is mostly complete for practical use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema already documents all parameters (script, cwd, timeoutMs). The description adds no extra parameter-specific meaning beyond what the schema descriptions provide, thus baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Run' and resource 'PowerShell script/command on this Windows host', with a specific detail about hidden process. It distinguishes from siblings like ssh_exec/winrm_exec by specifying 'this Windows host' and from run_program by focusing on PowerShell.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides clear context: 'Use for any Windows command, file, or system task.' This implies broad applicability on Windows, but does not explicitly state when NOT to use it or name alternative tools for other scenarios. Lacks explicit exclusion criteria but is helpful enough.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
run_programA
Run a native executable DIRECTLY (no shell) in a hidden process and capture clean stdout/stderr + exit code. Use this for console programs like gh, git, docker, node, python, etc. -- their output is captured reliably, unlike when the same program is run inside run_powershell (where a hidden PowerShell swallows native stdout). Provide the program and an args array (no shell quoting needed).
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Working directory. | |
| args | No | Arguments as an array; each element is passed verbatim (no shell quoting). | |
| program | Yes | Executable name on PATH or a full path, e.g. 'git' or 'C:\Program Files\GitHub CLI\gh.exe'. | |
| timeoutMs | No | Hard timeout in ms (default 60000). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses execution mode (direct, no shell, hidden process), output capture behavior, and lack of shell quoting. This is solid transparency, though it doesn't detail timeout/default behavior or error handling for non-zero exit codes, which would add further clarity.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is compact, front-loaded with purpose, and every sentence contributes: purpose, usage examples, differentiation from alternative, and a key parameter hint. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description effectively covers the tool's core behavior, usage context, and output capture. Since there is no output schema, it doesn't explicitly describe the exact return format, but it does state the captured fields (stdout/stderr/exit code). Combined with the parameter-rich schema, it's sufficiently complete for an agent to select and invoke the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3. The description adds value by emphasizing the args array is passed verbatim with no shell quoting, which reinforces the schema's 'passed verbatim' note and clarifies a common point of confusion.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Run'), specifies the resource ('native executable'), and clearly states the output captured ('clean stdout/stderr + exit code'). It also distinguishes itself from run_powershell by noting the reliability difference, which provides clear differentiation from sibling tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use this tool ('console programs like gh, git, docker, node, python') and contrasts with run_powershell, warning against using it for native stdout capture. This provides clear when-to-use and when-not-to-use guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sftp_downloadA
Download a file from a remote host to this Windows host over SFTP, in-process (ssh2 — no scp.exe, no WSL, headless).
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | Remote host or IP. | |
| port | No | SSH port (default 22). | |
| password | No | Password auth (used if no key). | |
| username | Yes | SSH username. | |
| localPath | Yes | Destination path on this Windows host. | |
| timeoutMs | No | Hard timeout in ms (default 120000). | |
| passphrase | No | Passphrase for the private key, if any. | |
| remotePath | Yes | Source path on the remote host. | |
| privateKeyPath | No | Path to a private key file on this Windows host. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of behavioral disclosure. It adds useful information about the execution environment ('in-process', 'no scp.exe, no WSL', 'headless') but does not mention side effects like file overwriting, error handling, or authentication precedence. The coverage is partial but not comprehensive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, efficient sentence that front-loads the action and destination, then adds a compact caveat about the in-process approach. Every word earns its place with no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 9 parameters, no output schema, and no annotations, the description could offer more context on authentication modes or path handling, but the schema covers parameters. The in-process detail is valuable, yet the overall picture is only moderately complete for an agent deciding whether and how to use it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description's mention of 'remote host' and 'this Windows host' loosely aligns with host and localPath, but it adds no additional parameter-level meaning beyond what the schema already provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Download' with a clear resource 'a file', and specifies source and destination ('remote host' to 'this Windows host'). It also distinguishes from siblings by mentioning 'in-process (ssh2 — no scp.exe, no WSL, headless)', which sets it apart from alternative transfer methods and tools like sftp_upload.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides clear context that this is an in-process, headless SFTP download without relying on external executables, implying it should be used when such dependencies are unavailable or undesirable. However, it does not explicitly name alternatives or state when not to use it, so it falls short of full exclusionary guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sftp_uploadA
Upload a local file to a remote host over SFTP, in-process (ssh2 — no scp.exe, no WSL, headless). Use to deploy scripts/configs to Linux hosts.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | Remote host or IP. | |
| port | No | SSH port (default 22). | |
| password | No | Password auth (used if no key). | |
| username | Yes | SSH username. | |
| localPath | Yes | Local file path on this Windows host. | |
| timeoutMs | No | Hard timeout in ms (default 120000). | |
| passphrase | No | Passphrase for the private key, if any. | |
| remotePath | Yes | Destination path on the remote host. | |
| privateKeyPath | No | Path to a private key file on this Windows host. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses that the operation is in-process using ssh2, does not rely on scp.exe or WSL, and is headless, which is useful context beyond the raw function. However, it does not mention whether existing remote files are overwritten, how authentication is selected (despite multiple auth params), or what the tool returns upon success/failure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences with no filler. The first sentence states the mechanism and constraints; the second gives a concrete use case. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 9 parameters and no output schema, the description gives the core purpose and a use case, but it lacks information about auth selection (password vs key), overwrite behavior, and expected return values. While the schema covers parameter meanings, the description doesn't fully contextualize the operation for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema provides a description for every parameter (100% coverage), so the baseline is 3. The description does not add any parameter-specific guidance beyond the generic upload action, so it stays at baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (Upload), the resource (local file to a remote host), and the protocol (SFTP). It distinguishes itself from siblings by noting in-process execution (ssh2, no scp.exe/WSL) and headless operation, and mentions a primary use case for deploying scripts/configs to Linux hosts.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides an explicit use case: 'Use to deploy scripts/configs to Linux hosts.' It also hints at when this tool is appropriate by contrasting with scp.exe/WSL (in-process, headless). However, it does not name alternative sibling tools or state when not to use it, so it's not as strong as a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_execA
Run a command on a remote host over SSH, fully in-process (no ssh.exe, no WSL — works headless). Use for Linux hosts or any OpenSSH target. Auth via privateKeyPath or password. Returns stdout, stderr, exit code.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | Remote host or IP. | |
| port | No | SSH port (default 22). | |
| tail | No | Keep the LAST maxOutputBytes instead of the first (tail) — useful for long logs. | |
| command | Yes | Command to run on the remote host. | |
| password | No | Password auth (used if no key). | |
| username | Yes | SSH username. | |
| timeoutMs | No | Hard timeout in ms (default 60000). Also bounds the connection handshake. | |
| passphrase | No | Passphrase for the private key, if any. | |
| maxOutputBytes | No | Cap captured stdout/stderr per stream (bytes, default 1 MiB). | |
| privateKeyPath | No | Path to a private key file on this Windows host, e.g. C:\\Users\\isak\\.ssh\\id_ed25519. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses the in-process/headless nature, auth methods, and return values (stdout, stderr, exit code). However, it does not mention potential destructive effects or output truncation behavior, though some of that is in the schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three sentences with no fluff: first sentence gives the core action and key differentiators, second gives usage context, third covers auth and returns. Every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex tool with 10 parameters and no output schema, the description covers the core purpose, usage context, auth options, and return values. It omits details like output caps and tail behavior, but those are well-covered in the schema. Overall sufficiently complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the schema fully documents all 10 parameters. The description adds minimal extra meaning beyond mentioning auth methods (privateKeyPath or password) and return values, which is redundant with schema descriptions. Baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's verb ('Run a command'), resource ('remote host over SSH'), and distinct characteristics ('fully in-process', 'no ssh.exe, no WSL'), distinguishing it from sibling tools like winrm_exec and run_powershell.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says 'Use for Linux hosts or any OpenSSH target', giving clear context for when to use this tool. It implies Windows alternatives exist through sibling tool names but does not explicitly name them, so it's not a perfect 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
system_infoA
Return OS, CPU, memory and disk summary for this Windows host.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. 'Return' implies a read operation, which is useful, but there is no mention of prerequisites, permissions, or edge cases. It is adequate for a simple informational tool but lacks deeper behavioral disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence that directly states the tool's purpose and scope with no filler or redundant information. Perfectly concise and front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity of the tool (no parameters, no output schema, no annotations), this description fully captures what the agent needs to know to select and invoke it appropriately. Nothing important is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, making schema coverage trivially 100%. With no parameters, a baseline of 4 applies; the description does not need to add parameter details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Return') and clearly names the resource ('OS, CPU, memory and disk summary') and scope ('for this Windows host'). It unequivocally distinguishes this from sibling tools like list_services or run_powershell by indicating a system-level overview.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context—this is for a read-only summary of the local Windows host. However, it does not explicitly name alternatives or state when not to use it, so it falls slightly short of the highest standard.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
winrm_execA
Run a command on a remote Windows host via PowerShell Remoting (WinRM / Invoke-Command). Native to Windows Server — no SSH server or agent needed on the target, only WinRM enabled. Output captured in-process (no console window).
| Name | Required | Description | Default |
|---|---|---|---|
| useSsl | No | Use HTTPS/5986 WinRM. | |
| command | Yes | PowerShell command/scriptblock body to run remotely. | |
| password | No | Credential password. | |
| username | No | Credential username (DOMAIN\\user or host\\user). Omit to use the host process identity. | |
| timeoutMs | No | Hard timeout in ms (default 120000). | |
| computerName | Yes | Remote Windows host name or IP. | |
| authentication | No | WinRM auth mechanism. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must carry the transparency burden. It discloses one important behavior ('Output captured in-process (no console window)') and notes the WinRM requirement, but it does not elaborate on authentication needs, potential side effects, or exit code handling. This is a moderate level of disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences that are tightly packed with essential info: action, method, target, key differentiator, and output behavior. Every clause earns its place, with no fluff or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (7 parameters, no output schema), the description covers the core essentials: what it does, how it connects, and a key behavioral detail. It lacks some operational nuance like return value format or explicit rest of the lifecycle, but it is largely complete for an agent to invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with well-described parameters, so the baseline is 3. The description does not add parameter-specific meaning beyond what the schema already provides, such as elaborating on the command field or authentication options. It remains at baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Run a command on a remote Windows host via PowerShell Remoting' and distinguishes it from SSH-based alternatives by explicitly noting 'no SSH server or agent needed.' This makes the purpose immediately apparent and differentiates it from siblings like ssh_exec.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides clear context on when to use the tool: when targeting Windows hosts with WinRM enabled. The explicit mention that SSH is not needed serves as an implicit alternative, but it does not explicitly state 'use this instead of ssh_exec' or address run_powershell, so it falls short of full exclusionary guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
10 tool updates
v0.5.0- First observed
control_service - First observed
get_service - First observed
list_services - First observed
run_powershell - First observed
run_program - First observed
sftp_download - First observed
sftp_upload - First observed
ssh_exec - First observed
system_info - First observed
winrm_exec
TDQS
Most tools have clear, distinct purposes. run_powershell and run_program are carefully differentiated, and ssh_exec vs winrm_exec are distinguished by target platform. However, the pairings still create some ambiguity for agents selecting quickly.
Mostly consistent snake_case verb_noun pattern, but system_info deviates from verb-first style, and remote tools use protocol_verb naming (sftp_upload, ssh_exec). Overall readable and predictable.
Ten tools is well-scoped for a systems administration server covering local execution, service management, remote execution, and file transfer without unnecessary bloat.
Covers core lifecycle: service query/control, local and remote command execution, and file transfer. Missing process/event log management, but run_powershell provides a general fallback, so agents can work around minor gaps.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Execute PowerShell commands securely with controlled timeouts and input validation. Retrieve syste…
Operate Linux, macOS and Windows from your LLM. Every action runs through an auditable allowlist.
- mcp-serverOAuthcom.make
Give your AI agents the tools to build, manage, and run automation workflows.
Provides capabilities that let LLM agents perform a range of infrastructure management tasks.
Related MCP Servers
- AlicenseNot gradedqualityCmaintenanceEnables AI agents to interact with Windows operating systems through native UI automation, file navigation, application control, and system commands. Provides seamless integration between LLMs and Windows environments for tasks like clicking, typing, launching apps, and capturing desktop state.MIT
- AlicenseNot gradedqualityDmaintenanceEnables AI agents to interact with Windows operating systems by providing tools for UI automation, file navigation, application control, and system operations. Works with any LLM to perform tasks like clicking, typing, launching applications, and executing PowerShell commands through native Windows integration.MIT
- AlicenseNot gradedqualityDmaintenanceEnables AI agents to securely manage and execute commands on remote Windows servers via WinRM, including PowerShell execution, system information retrieval, and service management.5MIT
- AlicenseAqualityCmaintenanceEnables AI assistants to manage remote servers via SSH with agentless command execution, file operations, and service management.9MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/IMRRD/powershell-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server