Skip to main content
Glama

docker-mcp-server

docker-mcp MCP server

More than just a fully featured MCP server that lets AI agents manage Docker - containers, images, networks, volumes, swarm services, secrets, configs, nodes, plugins, etc., it helps you create workflows to easily manage your Docker environments.

It gives you much more control and flexibility than calling the Docker CLI directly: each operation is exposed as its own typed tool, marked read-only or not, with destructive actions separately flagged. This means a client can auto-approve reads while always confirming anything destructive, and the whole server can also be switched into a read-only or no-destructive mode as a blanket safeguard. Output is bounded rather than left to grow unboundedly - capped with a truncated flag instead of silently overflowing the agent's context.

For simple cases, you can just install and go with no configuration required - once loaded it will discover your local Docker socket and expose the full command surface to your AI agent. For more advanced users it can manage multiple Docker daemons, e.g. both your local dev environment and also a remote production environment over TCP, TLS or SSH in a single session. It can also be configured to mark some daemons as read-only, so you can monitor them without the risk of making accidental changes.

It can even be run on a machine without Docker installed and manage remote daemons over SSH, TLS or TCP (some features require SSH). The AI itself does not require shell or SSH access.

The MCP server also exposes things like logs and stats as resources so that you can monitor and triage, enabling you to answer questions like 'why did my container crash?', 'what is the state of my swarm?', 'am I suffering memory pressure?', 'what is the disk usage of my volumes?', 'what differences are there between my test and production systems?', and more...

Documentation is built for the agent, not just the person configuring it: an MCP resource exposes the Docker SDK reference in-session (with a tool-callable fallback for clients that can't read resources), and a live tool-catalog resource reports exactly what's registered under the current configuration. Each tool's own description names its nearest siblings and when to prefer each, states preconditions and side effects in plain language, and is honest about when it can still fail - so an agent can pick the right tool on the first try among 150+ options, not guess.

docker-mcp-server is optimized to work efficiently with the new generation of MCP clients that support lazy tool loading. For clients that still eagerly load all tools, the server can optionally be configured to exclude tools from a subset of domains (e.g. exclude 'swarm' and 'scout' tools) to reduce the tool list size. It's also possible to put the MCP server into 'read-only' or 'no-destructive' modes that prevent any tools with write or destructive capabilities from being registered, which again reduces the footprint.

The server runs entirely on your machine, either natively, as an mcpb bundle, or containerized, and sends no telemetry. You are entirely in control - see the Privacy Policy.

Requirements

Note: If you're using the containerized MCP server or MCPB bundle, the Python and uv requirements are taken care of for you.

  • A running Docker daemon reachable from the host that runs the server (the standard DOCKER_HOST / unix socket conventions apply)

  • Python ≥ 3.14

  • uv for dependency management

  • Intel (x86_64) macOS only: installing natively (via uvx/pip, or the .mcpb bundle, both of which resolve dependencies locally) requires Rust and OpenSSL 3.x, because cryptography - a transitive dependency, via mcp -> pyjwt[crypto] - has shipped no x86_64 macOS wheel since version 49.0.0 and must be built from source there. If you'd rather not install a build toolchain, use the container image instead - it runs the same prebuilt Linux binary regardless of your Mac's CPU architecture, so this doesn't apply to it. See Security considerations for more.

Related MCP server: Docker MCP Server

Using the server

The server is published to PyPI as docker-mcp-server. Add an entry to your AI tool's MCP configuration (commonly mcp.json or the equivalent in your client) pointing uvx at it - uv will fetch and cache the package on first use:

{
  "mcpServers": {
    "docker-mcp-server": {
      "command": "uvx",
      "args": ["docker-mcp-server"],
      "env": {}
    }
  }
}

To pin a specific version, append ==<version> to the package name (e.g. docker-mcp-server==1.5.0). If you'd rather install it onto your PATH, pipx install docker-mcp-server gives you the docker-mcp-server console script (a docker-mcp alias is also installed).

Installing from git instead. To run an unreleased revision straight from this repository:

{
  "mcpServers": {
    "docker-mcp-server": {
      "command": "uvx",
      "args": [
        "--from",
        "git+https://github.com/L337-org/docker-mcp.git",
        "docker-mcp-server"
      ],
      "env": {}
    }
  }
}

To pin a specific revision, append @<tag-or-commit> to the git URL.

Install as a Desktop Extension (.mcpb)

For Claude Desktop, a one-click bundle is attached to each GitHub Release as docker-mcp-server-<version>.mcpb (with a matching .sha256). Download it and drag it into Settings > Extensions, or use Settings > Extensions > Advanced settings > Install extension... and pick the file. The install dialog surfaces a Docker host(s) field and the read-only / no-destructive / disabled-domain switches, so no manual JSON editing is needed.

It's a uv-type bundle: Claude Desktop's managed uv resolves the dependencies and runs the server, so the only host prerequisite is Docker itself - no separate Python, uv, or git. Leave the Docker host(s) field blank to use your default Docker context; set one endpoint (ssh://user@host) for a remote daemon, or list several (see Managing several daemons).

Run as a container

Running the server as a container removes the Python / uv / git prerequisites entirely - the only thing the host needs is Docker, which you already have. Prebuilt multi-arch images (linux/amd64 + linux/arm64) are published on each release to Docker Hub (gavinlucas/docker-mcp-server) and GHCR (ghcr.io/l337-org/docker-mcp-server) - the two are identical. Point your MCP client at docker run:

{
  "mcpServers": {
    "docker-mcp-server": {
      "command": "docker",
      "args": [
        "run", "--rm", "-i",
        "-v", "/var/run/docker.sock:/var/run/docker.sock",
        "gavinlucas/docker-mcp-server:latest"
      ],
      "env": {}
    }
  }
}

-i is required (the server speaks MCP over stdio); --rm cleans up when the client disconnects. To pin a version, replace :latest with a release tag (e.g. :1.5.1). To pull from GHCR instead, use ghcr.io/l337-org/docker-mcp-server:latest.

Image renamed. As of 1.5.0 the image is published as docker-mcp-server (matching the PyPI name). The old ghcr.io/gavinlucas/docker-mcp image is frozen at 1.4.0 and no longer updated - point new pulls at ghcr.io/l337-org/docker-mcp-server.

Image variants. Two variants are published to both registries (gavinlucas/docker-mcp-server on Docker Hub and ghcr.io/l337-org/docker-mcp-server on GHCR), both built from one Dockerfile. The CLI-backed domains (Compose, Stack, Buildx, Scout, Context) shell out to the docker CLI and its plugins.

Variant

Tags

Approx. size

Includes

full (default)

:latest, :<version>

~510 MB

docker CLI + compose + buildx + scout

no-scout

:no-scout, :<version>-no-scout

~315 MB

docker CLI + compose + buildx

Scout's plugin binary alone accounts for the ~195 MB jump from no-scout to full. The no-scout image also defaults DOCKER_MCP_SERVER_DISABLE=scout, so the scout tools don't register - the agent is never offered tools whose CLI plugin isn't present (it sees a smaller, fully-working tool list rather than scout tools that error on every call). Override at runtime with -e DOCKER_MCP_SERVER_DISABLE=... if you ever need to change the disabled set (note it replaces, not appends).

Building it yourself. All variants build from the repo's Dockerfile via build args:

docker build -t docker-mcp-server:full .                                    # full (default)
docker build --build-arg INSTALL_SCOUT=0 --build-arg DISABLE_DOMAINS=scout \
  -t docker-mcp-server:no-scout .                                           # no-scout
docker build --build-arg INSTALL_CLI=0 -t docker-mcp-server:lite .          # lite (SDK-only, ~165 MB)

The lite image (docker-py SDK tools only - Compose/Buildx/Scout/Context degrade to "plugin unavailable") is buildable but not published.

Reaching the daemon from inside the container. The image defaults DOCKER_HOST to unix:///var/run/docker.sock, so mounting your host's socket onto that path is all that's needed. Where the host socket is, however, varies - and the server prints a platform-aware hint to stderr if it can't connect at startup:

  • Linux: -v /var/run/docker.sock:/var/run/docker.sock (rootless: -v $XDG_RUNTIME_DIR/docker.sock:/var/run/docker.sock).

  • macOS (Docker Desktop): the real socket is usually ~/.docker/run/docker.sock - mount it onto the in-container path: -v $HOME/.docker/run/docker.sock:/var/run/docker.sock (or enable Settings > Advanced > Allow the default Docker socket and use /var/run/docker.sock).

  • Windows (Docker Desktop / WSL2): the engine uses a named pipe, not a Unix socket - prefer -e DOCKER_HOST=tcp://host.docker.internal:2375 (enable the TCP endpoint in Docker Desktop). That endpoint is unauthenticated and unencrypted - keep it bound to localhost, disable it when you're not using it, and use TLS or DOCKER_HOST=ssh://... for any remote daemon.

  • Remote / TLS / SSH daemon: skip the socket mount and pass -e DOCKER_HOST=... (plus the TLS vars below) - see Talking to a remote daemon.

Host filesystem access. Inside a container, the file-path tools (image_save / container_export with dest_path, image_load / container_archive_put with from_file, container_archive_get_to_file, and compose project_dir / files) resolve paths inside the container, not on your host. Bind-mount any directory you want to exchange files through - using the same path inside and out keeps host and container paths identical:

-v $HOME/docker-work:$HOME/docker-work

If you call one of these tools with a path that isn't on a bind mount, the server refuses up front with a message telling you exactly which -v to add - a write to an unmapped path would otherwise be silently discarded when the container exits. (The in-band byte tools, capped at 32 MiB, need no mount.) Configuration env vars (DOCKER_MCP_SERVER_READONLY, DOCKER_HOST, etc.) go in the client's env block exactly as for the uvx install.

Talking to a remote daemon

When DOCKER_HOST is set the server uses it directly (via docker.from_env(), so DOCKER_TLS_VERIFY / DOCKER_CERT_PATH are honoured too). Common overrides via env:

"env": {
  "DOCKER_HOST": "tcp://remote-host:2375",
  "DOCKER_TLS_VERIFY": "1",
  "DOCKER_CERT_PATH": "/path/to/certs"
}

Default daemon (no DOCKER_HOST). With DOCKER_HOST unset, the server resolves the daemon the way the docker CLI does, rather than assuming /var/run/docker.sock: it follows the active Docker context (DOCKER_CONTEXT, else currentContext from ~/.docker/config.json, reading the endpoint from that context's meta.json), and if that yields nothing it probes the well-known socket locations (~/.docker/run/docker.sock for Docker Desktop 4.13+, $XDG_RUNTIME_DIR/docker.sock for rootless, then /var/run/docker.sock). This matters because docker.from_env() alone ignores contexts and would fall back to /var/run/docker.sock - which Docker Desktop 4.13+ no longer creates by default (it uses the desktop-linux context unless you enable Settings > Advanced > Allow the default Docker socket), so a stock Desktop install reachable by your CLI would otherwise fail here. Precedence: a non-empty DOCKER_HOST always wins and goes straight through docker.from_env() (which ignores contexts); DOCKER_CONTEXT / currentContext is consulted only when DOCKER_HOST is unset, and the socket probe only when neither resolves. TLS material attached to a remote context is not applied automatically - a tcp:// + TLS context still needs DOCKER_HOST / DOCKER_CERT_PATH.

Over SSH

DOCKER_HOST=ssh://user@remote-host is supported via a pure-Python transport (paramiko, pulled in by the docker[ssh] dependency) - there is no system ssh binary requirement, so it works the same on the host install and inside the container images. It authenticates with your normal SSH setup:

  • Keys / agent. Use key-based auth; load the key into your agent (ssh-add) and make sure SSH_AUTH_SOCK is set in the server's environment (or place the key at the default ~/.ssh/id_* path).

  • Known hosts. paramiko verifies the host key against ~/.ssh/known_hosts and rejects an unknown host. Add the host key only after verifying its fingerprint through a trusted channel - connect once interactively with ssh user@remote-host and confirm the prompt, or compare ssh-keyscan remote-host | ssh-keygen -lf - against a known-good fingerprint before appending it. Avoid blindly piping ssh-keyscan straight into known_hosts, which trusts whatever key is returned (including a MITM's).

  • In a container. Mount your SSH material read-only - -v $HOME/.ssh:/root/.ssh:ro (key + known_hosts) - or forward your agent socket; no socket mount and no ssh package needed.

CLI-backed tools (Compose, Stack, Buildx, Scout, Context) shell out to the docker CLI, which would otherwise use the system ssh binary over an ssh:// endpoint. Instead, run_docker() detects DOCKER_HOST=ssh://... and transparently starts a per-call local TCP proxy (docker_mcp/tools/_ssh_proxy.py) that opens the same paramiko connection docker-py would, runs docker system dial-stdio over it, and points the CLI subprocess at tcp://127.0.0.1:<ephemeral port> for the duration of that one call. So the CLI-backed tools authenticate with the exact same credentials and host-key policy as the docker-py-backed tools above - no system ssh binary for the direct connection, identical on the host install and inside the container images. The one exception is a ProxyCommand in ~/.ssh/config (bastion/jump-host setups): paramiko runs that command as-given, and it's commonly ssh -W %h:%p ..., so a jump-host hop still shells out to the system ssh client even though the direct connection does not.

That ephemeral 127.0.0.1 listener bridges to the remote (root-equivalent) daemon with your SSH credentials for the duration of a single CLI call, so any process sharing the same loopback could reach it during that brief window. The exposure is narrow - localhost-only and torn down when the call returns - and inside a container it's narrower still, reachable only by processes within that container's network namespace. The daemon remains the trust boundary either way (see Security considerations).

No local Docker

If Docker is not installed locally - or the plugin a call needs is missing - most tools will still operate on a remote host exactly as before. A few tool families (Compose, Stack, Buildx, Scout) will be run on the target host itself, over SSH. For these commands TCP and TLS connections will not work without a local Docker install.

Worth knowing:

  • It's a fallback, never a preference. A local CLI that can serve the call - binary plus the plugin that call needs - is always used instead, so nothing changes for a normal install.

  • Local files a command reads are copied onto the remote first - a Compose project directory, a bake file, a build context (honouring .dockerignore) - into a private 0700 temp directory that is removed when the call returns - best-effort, since a dropped SSH connection leaves nothing able to run the cleanup. A survivor is named docker-mcp-server.stage.* and the failure is logged.

  • The remote host's credentials apply. Registry logins come from its ~/.docker/config.json, so a private-registry compose_pull, a stack deploy --with-registry-auth, or most Scout operations may need docker login there. system_login talks to the daemon and does not write the remote CLI's config.

  • The whole working directory is copied, because nothing can tell which files a Compose file references (build:, env_file:, include: all name arbitrary paths). Point tools at a project directory rather than a large parent, or the call is refused with a size-limit error (200 MiB / 50 000 entries).

  • compose_cp relays whichever side of the copy is local, over the same SSH connection: a host source is staged like any other input, and a container result is fetched back to the real destination once the copy succeeds - the actual copy still runs through the real docker compose cp on the far host, so every parameter behaves as it does locally. The one difference: a container-to-host copy is refused if the local destination already exists, since only this host knows that.

  • A few things are refused rather than half-done: for buildx_build a filesystem dest= in output/cache_to, a local src= in cache_from, or any ssh= - each would resolve on the remote machine.

  • The remote must present a POSIX shell. Any Linux/macOS/BSD host qualifies, and sshd running inside a WSL distro is supported (it is a Linux target - and with Docker Desktop's WSL2 backend the daemon lives there anyway). A Windows-side cmd/PowerShell sshd is refused with an explanatory error, as is a uname from MSYS/MinGW/Cygwin; a Windows dialect is architected but not implemented. A Windows sshd whose shell is wsl.exe runs commands in WSL while its SFTP subsystem stays on the Windows side, so file-copying tools are refused there - the ones that only run a command still work.

  • context_* tools never fall back. They manage this host's CLI context registry, which a remote host knows nothing about.

Managing several daemons

Everything above targets one daemon. To manage several in a single session - e.g. local dev plus a remote production daemon - set DOCKER_MCP_SERVER_HOSTS to a comma-separated list of name=endpoint pairs:

"env": {
  "DOCKER_MCP_SERVER_HOSTS": "local=auto, prod=ssh://ops@prod.example.com(ro)"
}
  • endpoint is auto (your default context/socket, as above), local (the platform-local socket, ignoring contexts), or a unix:// / tcp:// / ssh:// / npipe:// URL. ssh:// is the recommended remote transport (per-host auth via your SSH keys, no TLS cert plumbing). A tcp:// daemon over TLS takes a (tls=<dir>) marker pointing at a cert directory, e.g. prod=tcp://prod:2376(tls=/etc/docker/prod). That directory must hold ca.pem (the daemon is always verified against it - so a self-signed daemon works, you just pin its cert here); add cert.pem and key.pem only if the daemon requires a client certificate (mutual TLS). There is no unverified-TLS mode - a TLS connection always authenticates the daemon, so encryption never comes without verification.

  • (ro) after an endpoint marks that host read-only: mutating and destructive tools refuse to act on it. This is a per-host guard enforced at call time, independent of the server-wide DOCKER_MCP_SERVER_READONLY switch - mark production (ro) and the agent can inspect it all day but can't change it, while local stays read-write.

  • (nd) marks a host non-destructive: only destructive tools (removals, prunes, kills) refuse to act on it - reads and ordinary mutations (start/stop/create) still work. This mirrors the server-wide DOCKER_MCP_SERVER_NO_DESTRUCTIVE switch, per host. (ro) already implies it, so (ro)(nd) combines without error but is redundant.

  • Single daemon, simpler form. A bare value with no name= is shorthand for one host - DOCKER_MCP_SERVER_HOSTS=ssh://ops@prod (or auto, or blank). So this one field also covers the single-remote case. DOCKER_HOST keeps working when DOCKER_MCP_SERVER_HOSTS is unset, but DOCKER_MCP_SERVER_HOSTS takes over when set (DOCKER_HOST is then ignored, with a one-time notice to stderr).

How the agent drives it. With two or more hosts, every daemon-targeting tool gains an optional host argument constrained to your configured names: read-only tools default to the first host when you omit it, while mutating and destructive tools require an explicit host (so the agent can't change the wrong daemon by accident). host_list (and the docker-mcp://hosts resource) report the configured hosts and which is the default; the container/service/node observability resources become host-aware - the default host's index is docker:///containers (note the empty authority) and a named host's is docker://{host}/containers (likewise docker-logs:///{id} vs docker-logs://{host}/{id}, and the same pattern for docker://services/service-logs:///service-tasks:// and docker://nodes); the single-host bare forms (docker://containers, docker://services, docker://nodes, ...) are not registered once several hosts are configured. The survey_hosts prompt sweeps every host read-only. The auto/local endpoints are resolved to concrete URLs and pinned at startup, so the SDK and CLI always agree on which daemon a name means - restart to re-resolve after changing a Docker context.

What the agent can do

Once loaded, the agent gets MCP tools grouped by Docker domain. A few examples:

  • Containers - container_run, container_list (managed_only=True to list only what this server created - see Provenance labels), container_exec, container_logs, container_stop, container_commit, container_wait (block until exit, until="healthy" to poll a healthcheck, or until="log-match" to poll for a log line containing pattern), container_export / container_archive_get_to_file / container_archive_put (stream tar archives to/from a host path)

  • Images - image_build, image_pull, image_push, image_tag, image_prune, image_prune_builds (clear the daemon's build cache - a separate resource from dangling images), image_save / image_load (stream image tarballs to/from a host path via dest_path / from_file), image_import (build a single-layer image from a flat rootfs tarball, URL, or existing image - docker import, not to be confused with image_load)

  • Plugins - plugin_install (pull from a registry), plugin_privileges (read what host access a plugin demands before installing it - the daemon grants them non-interactively), plugin_create (build one from a local config.json + rootfs), plugin_push (publish it back), plugin_enable / plugin_disable, plugin_configure, plugin_upgrade, plugin_list / plugin_inspect, plugin_remove (managed engine plugins - volume/network/logging drivers - not the CLI plugins that extend the docker command itself)

  • Networks / Volumes - network_create, network_connect, volume_create, volume_prune

  • Swarm - swarm_init, swarm_join_tokens (close the init-to-join loop), swarm_update (rotate join tokens / unlock key), service_create, service_scale, service_rollback (re-apply the previous service spec), service_wait (block until tasks converge, or a rolling update completes), swarm_task_list / swarm_task_inspect (every task in the cluster, filterable by node or desired state - no single CLI command does this), node_list, node_wait (block until a node reaches a target state - e.g. ready after joining), node_remove, secret_create, config_create

  • System - system_ping, system_info, system_version, system_df, system_events, host_list (the configured daemons and which is the default - see Managing several daemons), system_login / system_logout (cache or clear registry credentials), system_reconnect (rebuild a host's SDK client to recover a wedged connection)

  • Compose - compose_up, compose_down, compose_stop, compose_start, compose_restart, compose_pause / compose_unpause, compose_kill, compose_ps, compose_list, compose_images, compose_top, compose_port, compose_logs, compose_config, compose_build, compose_pull, compose_run, compose_exec, compose_cp, compose_wait (wraps the docker compose CLI plugin)

  • Stacks - stack_deploy, stack_list, stack_ps, stack_services, stack_remove (deploy a Compose file to a swarm as a stack; wraps the docker stack CLI - requires a swarm manager)

  • Contexts - context_list, context_inspect, context_create, context_use, context_remove (wraps the docker context CLI)

  • Registry / Hub - registry_tags, registry_tag_wait (block until a specific tag lands - e.g. waiting on a CI push), registry_manifest, registry_image_config (read an image's env/entrypoint/labels without pulling), hub_tags, hub_repo_info, hub_rate_limit (remaining pull budget) (HTTPS to OCI v2 registries and the Docker Hub API - no daemon required; transparent retry on a brief 429)

  • Buildx - buildx_build, buildx_bake, buildx_imagetools_inspect, buildx_imagetools_create, buildx_list, buildx_inspect, buildx_du, buildx_history_list / buildx_history_inspect (drill into past build records), buildx_prune, buildx_create, buildx_use, buildx_remove (wraps the docker buildx CLI plugin). Use buildx_imagetools_* in place of docker manifest - that command is in maintenance mode and lacks support for OCI image indexes and attestations.

  • Scout - scout_cves, scout_quickview, scout_recommendations, scout_compare, scout_sbom (wraps the docker scout CLI plugin; most features benefit from docker login on the host running this server).

The SDK-backed surface mirrors the Docker SDK reference - if it's documented there, it's available here. The Compose and Context surfaces follow the Compose CLI and docker context references.

The server also publishes the Docker SDK for Python reference and selected Docker CLI / registry references as MCP resources so the agent can consult them at runtime: read docker-docs://contents for the section index, then docker-docs://<section> (e.g. docker-docs://containers, docker-docs://compose, docker-docs://oci-distribution-spec, docker-docs://dockerfile, docker-docs://build-best-practices, docker-docs://engine-security, docker-docs://engine-api) for the rendered page. For MCP clients that can't read resources (e.g. Claude Desktop, Cursor), the docs_lookup tool mirrors the same content - call it with no arguments for the section index, or docs_lookup(section=...) for a page; it's always available regardless of DOCKER_MCP_SERVER_DISABLE. A further resource, docker-mcp://tool-catalog, lists every tool this server knows about with its domain, mutation category, and whether the active configuration registered it - useful for confirming the blast radius of a tool, or why one is absent from the live list. The tool_list tool mirrors it for clients that can't read resources, and adds filtering: tool_list(domain="buildx") for a one-line-per-tool briefing on an area, tool_list(category="destructive") to see what can destroy data, or tool_list(keyword="logs") to search names, summaries and parameter names. It lists only what the current configuration registered, and returns an explicit empty result when nothing matches. Like docs_lookup it is always available regardless of DOCKER_MCP_SERVER_DISABLE.

Container, service, and node observability are also exposed as resources, so a client can attach live state as context without a tool call: read docker://containers for an index of every container (running and stopped) with its status and per-container resource URIs, then docker-logs://<id-or-name> for a bounded tail of a container's logs (readable even after it exits - handy for diagnosing why) and docker-stats://<id-or-name> for a computed resource-usage summary (CPU %, memory, network and block I/O) of a running container. docker://services is the same pattern for swarm services - service-logs://<id-or-name> for a bounded log tail and service-tasks://<id-or-name> for a computed task/rollout summary (running vs. desired task counts, failing tasks, and the current rolling-update state). docker://nodes is index-only (state, availability, role, and manager reachability per node) - useful for noticing a node flapping between ready/down without re-querying node_list. These complement the equivalent tools (container_logs/container_stats, service_logs, node_list) and are hidden when their domain (containers/services/nodes) is disabled.

Example prompts

Many AI clients let you invoke registered MCP prompts directly (in Claude Code, type / to see them). The server ships a small library of templates in docker_mcp/tools/prompts.py that scaffold multi-step workflows - they emit a structured plan that the agent then carries out using the docker tools.

Looking things up in the SDK docs

/lookup_docker_docs section=services
/verify_docker_method method=containers.run section=containers

...or just ask in plain English:

Read docker-docs://networks and tell me the difference between create and connect. Before changing any code, check docker-docs://containers and confirm run accepts a restart_policy argument.

Creating and managing containers

/deploy_container image=nginx:1.27 name=web
/monitor_container_fleet
/triage_incident window_minutes=30
/troubleshoot_container container=api-1
/migrate_container container=api-1 new_image=myorg/api:v2
/inspect_stack label=com.example.app=web
/clean_environment scope=stopped
/plan_compose_stack description="wordpress + mysql sharing a named volume"

Compose, contexts, and registries

/deploy_compose_project project_dir=/srv/myapp
/troubleshoot_compose_project project_dir=/srv/myapp
/deploy_swarm_stack stack_name=web compose_file=/srv/myapp/docker-stack.yml
/audit_docker_contexts
/find_latest_image_tag image=ghcr.io/org/repo

Auditing, security, and host operations

/review_dockerfile dockerfile_path=/srv/myapp/Dockerfile
/audit_container_security
/debug_container_networking source=web target=db
/investigate_disk_usage
/backup_volume volume=pgdata dest_path=/backups/pgdata.tar
/restore_volume volume=pgdata source_path=/backups/pgdata.tar
/audit_swarm_health

Buildx, Scout, and multi-arch manifests

/plan_multiarch_build image=ghcr.io/org/app:v1 platforms=linux/amd64,linux/arm64
/audit_image_cves image=alpine:3.19
/compare_image_versions old_image=org/app:v1 new_image=org/app:v2
/recommend_base_image image=org/app:v1
/inspect_multiarch_manifest image=alpine:3.19
/create_multiarch_manifest target_tag=org/app:v1 source_tags=org/app:v1-amd64,org/app:v1-arm64
/migrate_from_docker_manifest

...or in plain English:

Pull redis:7-alpine and run it as a container called cache on a new app-net network, exposing port 6379 only inside that network. Container api-1 keeps restarting - grab the last 200 log lines, inspect its state and exit code, and tell me what's wrong before changing anything. Replace the running web container with nginx:1.27 while keeping its current ports, mounts, and restart policy. Plan a wordpress + mysql stack on a private network with a named volume for the database. Show me the plan before creating anything. Show every container, network, and volume tagged com.example.app=web as one table. Don't change anything. We're tight on disk - show system_df, prune stopped containers and dangling images, then show system_df again. Skip volumes. Bring up the compose project in /srv/myapp, but show me the rendered config and pull the images before starting anything. List my Docker contexts and tell me which daemon this MCP server is currently talking to. Find the most recent stable tag for ghcr.io/org/repo without pulling it, and tell me which platforms it supports.

Configuration

Env var naming. The server's environment variables are namespaced DOCKER_MCP_SERVER_* to match the published package name. The pre-2.0 DOCKER_MCP_* alias spellings are no longer honoured - see MIGRATION-2.0.md for the full 1.x -> 2.0 change list.

To choose which daemon(s) the server talks to, see Talking to a remote daemon and Managing several daemons (DOCKER_MCP_SERVER_HOSTS / DOCKER_HOST). The variables below instead restrict which tools are registered.

Three environment variables restrict which tools are registered when the server starts. Because they drop tools at registration time, a disabled tool never appears in the client's tool list - this is a server-side guarantee, not a client-side prompt. Set the two boolean switches to 1 / true / yes / on:

  • DOCKER_MCP_SERVER_READONLY - register only read-only tools (queries, log/data reads, scans). Every tool that changes state is omitted. Use this for monitoring or inspection agents that must not be able to modify anything.

  • DOCKER_MCP_SERVER_NO_DESTRUCTIVE - register everything except destructive tools (remove_*, prune_*, container_kill, compose_down, swarm_leave, context_remove, buildx_prune, buildx_remove). A "no data loss" mode that still allows creating and starting resources. DOCKER_MCP_SERVER_READONLY is stricter and wins if both are set.

  • DOCKER_MCP_SERVER_DISABLE - a comma-separated list of domains (feature areas) to drop wholesale, regardless of category: e.g. DOCKER_MCP_SERVER_DISABLE=swarm,services,nodes,configs,secrets removes the entire swarm surface from a single-host server, and DOCKER_MCP_SERVER_DISABLE=scout,buildx trims build/scan tooling an agent will never use. A domain is a tool module's name - containers, images, networks, volumes, compose, stack, context, buildx, scout, registry, swarm, services, nodes, plugins, configs, secrets, system. Names are case-insensitive; an unrecognized name is ignored (and surfaced as unknown_disabled_domains in the tool catalog, see below). This stacks with the category switches - a tool registers only if its category survives and its domain is enabled. Disabling a domain drops more than its tools: the matching workflow prompts are skipped (so the agent isn't handed a prompt that drives a feature area this server no longer exposes - e.g. disabling scout removes the audit_image_cves prompt that would otherwise tell the agent to call a tool that isn't registered) and the matching documentation resources are hidden from docker-docs://contents (e.g. the scout / scout-cli sections). The tool catalog's prompts list and disabled_doc_sections field make both auditable. Trimming domains an agent doesn't need also cuts the tool-list size the client has to reason about, which matters at this server's ~150-tool scale.

None of the three is a network control. DOCKER_MCP_SERVER_READONLY restricts what the agent can change, not what the server can reach: the registry and Hub tools are read-only, so a read-only server still makes outbound HTTPS requests to whichever registry host a tool argument names - from wherever the server runs, which may be a machine with more network reach than the daemon it manages. Those requests carry no credentials unless the registry answers with a token challenge, and a credential-bearing token endpoint is validated first (scheme, no plaintext to a public host, and no public registry pointing its realm at a private or loopback address), but the request itself is still made and its response is returned to the agent. docs_lookup and the docker-docs:// resources likewise fetch from a fixed list of documentation hosts. If outbound requests are what you need to stop, DOCKER_MCP_SERVER_DISABLE=registry removes that domain entirely, and network policy on the host is the control for the rest - see PRIVACY.md for the full list of what this server contacts.

Independently, every registered tool carries MCP ToolAnnotations - readOnlyHint on queries and destructiveHint on destructive operations (plus idempotentHint on the prune family) - so a client like Claude Code can auto-allow safe reads and gate destructive calls. The classification lives in TOOL_CATEGORIES in docker_mcp/server.py. To see the full picture at runtime - every tool with its domain, category, and whether the active switches registered it - read the docker-mcp://tool-catalog MCP resource.

For private registries, the HTTPS-backed registry_* tools fall back to DOCKER_MCP_SERVER_REGISTRY_USERNAME / DOCKER_MCP_SERVER_REGISTRY_PASSWORD from the server's environment when no explicit username/password arguments are passed (explicit arguments win; the env pair is only used when both arguments are unset). Setting credentials in the environment keeps them out of tool arguments, which many MCP clients log verbatim - the password may be a personal-access token.

Provenance labels

Every Docker object the agent creates through this server - containers, networks, volumes, swarm services, configs, and secrets - is stamped with a small set of docker-mcp-server.* labels recording that this server made it (docker-mcp-server.managed=true), the server version, the originating tool, and a creation timestamp. This lets you (or a cleanup job) later enumerate exactly the footprint the agent created with a single docker ... --filter label=docker-mcp-server.managed=true; the managed_only=True argument on container_list, network_list, volume_list, and service_list is the in-tool shortcut (it combines with any other filters you pass). The stamping is additive (a label you pass yourself always wins on a key collision) and uniquely namespaced, so it's safe by default; DOCKER_MCP_SERVER_NO_LABELS=1 turns it off entirely. Image builds are deliberately not stamped, because a build label changes the resulting image digest.

To tear down only what the server created - and nothing else - use the prune_managed workflow prompt, which scopes every removal step to the docker-mcp-server.managed=true label (volumes only when you pass include_volumes=True, and only after confirmation).

Example: a read-only monitoring server

All of these go in the env block of the server entry in your MCP client config (the same place as DOCKER_HOST above). For example, a read-only inspection server against a remote daemon:

{
  "mcpServers": {
    "docker-mcp-server-readonly": {
      "command": "uvx",
      "args": [
        "--from",
        "git+https://github.com/L337-org/docker-mcp.git",
        "docker-mcp-server"
      ],
      "env": {
        "DOCKER_HOST": "tcp://staging-host:2376",
        "DOCKER_TLS_VERIFY": "1",
        "DOCKER_MCP_SERVER_READONLY": "1"
      }
    }
  }
}

Swap DOCKER_MCP_SERVER_READONLY for DOCKER_MCP_SERVER_NO_DESTRUCTIVE to allow create/start/deploy while still making remove_* / prune_* / container_kill impossible. You can also register the same server twice under different names - a full-access entry you enable when needed and a read-only entry for everyday use. With claude mcp (Claude Code), the equivalent is:

claude mcp add docker-mcp-server-readonly \
  --env DOCKER_MCP_SERVER_READONLY=1 \
  -- uvx --from git+https://github.com/L337-org/docker-mcp.git docker-mcp-server

Or don't use a server at all: the l337-docker agent skill

A fair question about any MCP server is whether it needs to be one. This repo answers it in the open: skills/l337-docker/ is a Claude Code agent skill that drives Docker purely through the docker CLI - no server process, no Python, nothing beyond a docker binary (plus jq and curl for a few registry recipes).

It exists to mark the ceiling of the skill approach honestly, so you can judge the trade rather than take our word for it. It is written to be as good as that approach gets: a router plus per-domain references and workflows, every command verified against a real daemon, and its shell snippets executed by CI so they cannot drift. For a single local daemon and everyday work, it may well be all you need - if so, use it.

Where it stops is not coverage but enforcement. The skill's safety rules are instructions in a prompt; the server's are refusals in code:

MCP server

l337-docker skill

Read-only / no-destructive modes

Enforced - the tools are never registered

A written rule the agent is asked to follow

Per-daemon write protection ((ro)/(nd))

Enforced at the call boundary

Not available

Self-termination guard

Enforced

A written rule

Output bounding

Enforced, with a truncated flag

A written rule (--tail, --no-stream)

Multi-daemon targeting

Resolved and pinned at startup

Ambient Docker contexts, which can move mid-session

Requirements

Python ≥3.14, or a container

A docker binary

The distinction matters most where it is easiest to overlook: a rule in a prompt can be skipped under pressure, or talked around by a prompt injection sitting in a container log the agent just read. A tool that was never registered cannot be called at all. So prefer the server for anything pointed at production, or wherever you need a guarantee rather than an instruction - and prefer the skill when the stakes are low and the simplicity is worth more.

MCP_VS_SKILLS.md is the full, honest comparison: measured token cost for both - the skill is far cheaper on an eager-loading client (~140 tokens idle against the server's ~48,500 at full surface, or ~19,200 trimmed to the domains you actually use), while the server is ~2-3x cheaper per task on a lazy-loading one - plus what each genuinely does better and a tool-by-tool coverage map of all 159 tools, 31 prompts and the resources.

To install, download the archive from a release and extract it into your skills directory. It is rooted at l337-docker/, so it lands correctly as-is:

# personal (all projects)
tar -xzf l337-docker-skill-<version>.tar.gz -C ~/.claude/skills
# or per-project, checked into version control
tar -xzf l337-docker-skill-<version>.tar.gz -C .claude/skills

Verify it with the accompanying checksum (sha256sum -c l337-docker-skill-<version>.tar.gz.sha256); the archive is byte-reproducible, so rebuilding from the tag gives the same hash. The skill and the server can coexist - they label the resources they create differently and neither reads the other's.

Security considerations

Connecting this server to an AI agent grants it the same level of access as a local Docker CLI session against the configured daemon. That is broad: the daemon's socket is effectively root-equivalent on the host running it. Treat the agent as a privileged user and weigh the risks below before enabling the server.

  • Use a scoped daemon. Prefer pointing DOCKER_HOST at a daemon dedicated to workloads the agent is allowed to touch (a development VM, a remote sandbox, Docker Desktop, a rootless install) rather than your production socket. The daemon is the trust boundary - there is no per-tool authorization layer.

  • Running as a container. Mounting /var/run/docker.sock into the container grants it the same root-equivalent access to that daemon as the uvx install has - no more, no less, but now explicit in the docker run line. The same scoped-daemon advice applies: prefer mounting a socket for, or pointing DOCKER_HOST at, a daemon the agent is allowed to control. Note that when containerized the file-path tools read and write the container's filesystem, so they can only reach host directories you bind-mount in (see Run as a container). As an accident guard, the destructive container-lifecycle tools (container_remove, container_kill, container_stop, container_restart, container_pause) refuse to act on the server's own container so the agent can't end its own session mid-call; this is convenience, not a security boundary (it's bypassable with DOCKER_MCP_SERVER_ALLOW_SELF_TERMINATE=1, and a human can always recover the container from the host shell), and it does not constrain the many other ways a daemon-privileged agent can affect the host.

  • Privileged containers and host mounts. container_run accepts privileged=True and arbitrary volumes. A privileged container, or one that bind-mounts / from the host, can trivially escape to the host filesystem. Avoid letting the agent set these unless you have reviewed the request. Compose files can declare the same - review the rendered compose_config output before approving compose_up on an unfamiliar project.

  • Pass-through extra_kwargs / updates bypass the visible schema. container_run, container_create, service_create (extra_kwargs) and container_update, service_update (updates) forward an arbitrary dict straight into the Docker SDK. A client that gates on, say, privileged=False in the tool's declared parameters can still be bypassed via extra_kwargs={"privileged": True, "pid_mode": "host"}. These escape hatches are consistent with the "daemon is the trust boundary" model, but any allow/deny policy you build at the MCP-client layer must account for them rather than trusting the named parameters alone.

  • Registry credentials. Many MCP clients log tool calls verbatim, so treat any password or auth_config you pass through a tool as exposed.

    • SDK-backed tools (system_login, image_push, image_registry_data) accept credentials directly and can reuse credentials cached by docker login in ~/.docker/config.json. Prefer running docker login once on the host running this MCP server and leaving the credential parameters unset. (Note: this is the host running the server, not the daemon - relevant when DOCKER_HOST points at a remote daemon.) A credential passed to system_login is cached in the server's memory for the life of the client; system_logout clears that in-memory cache (all registries, or one) without touching ~/.docker/config.json, and system_close / system_reconnect clear it by discarding the client. There is no daemon-side session to end - the Engine's /auth endpoint only validates.

    • HTTPS-backed registry tools (registry_tags, registry_tag_wait, registry_manifest, registry_image_config, hub_tags, hub_repo_info, hub_rate_limit) talk to the registry directly over HTTPS and do NOT read ~/.docker/config.json. The registry_* tools accept username / password for private registries - or, better, read DOCKER_MCP_SERVER_REGISTRY_USERNAME / DOCKER_MCP_SERVER_REGISTRY_PASSWORD from the server's environment so credentials never transit tool arguments (see Configuration); the hub_* tools currently support public Hub repositories only. If passing credentials as arguments, use a per-invocation token with the minimum required scope rather than a long-lived password. When a registry answers with a Bearer auth challenge, the server validates the token realm it points at before sending anything: the scheme must be http/https, plaintext http to a non-local host is rejected, and a public registry is not allowed to redirect the credentialed token request at a private/loopback address (an SSRF guard). A genuinely local dev registry (e.g. localhost:5000) may still use a local realm. Pagination is pinned the same way: a Docker Hub next URL must stay on Hub's own origin, and an OCI Link header's host is discarded in favour of the registry already being queried, so a response body can never redirect this server at a host of its choosing. Redirects themselves are followed across hosts, deliberately - registries answer blob fetches with a redirect to a CDN on another host as normal operation - but the HTTP client strips the Authorization header on any cross-origin redirect, so credentials cannot follow one.

  • Swarm secret material transits tool calls too. Beyond registry credentials, several swarm tools carry secret material through arguments or return values that MCP clients may log: secret_create(data=...) and config_create(data=...) take the payload as an argument, secret_inspect / config_inspect return the stored object, swarm_join(join_token=...) and swarm_unlock(key=...) take cluster join/unlock secrets, and swarm_unlock_key and swarm_join_tokens return cluster credentials (rotation via swarm_update invalidates old tokens) - a manager join token lets its holder join the swarm as a manager (root-equivalent on the cluster). Treat all of these as exposed in any client that records tool traffic, and prefer provisioning swarm secrets and reading join tokens out-of-band on the host rather than through the agent. If an agent never needs to admit nodes, drop the whole surface with DOCKER_MCP_SERVER_DISABLE=swarm (see Configuration).

  • container_exec, compose_exec, and compose_run run arbitrary commands. When any part of the command is derived from agent-controlled input, use an exec-form argv list that does not invoke a shell (e.g. ["python", "-V"]). A list like ["sh", "-c", template] that invokes a shell will interpret shell metacharacters in the untrusted substrings.

  • Container archive paths. container_archive_get and container_archive_put forward the supplied path verbatim to the daemon. The container is the trust boundary - if you do not trust its filesystem, do not assume .. traversal will be rejected.

  • File-path payload tools read and write the server host's filesystem. image_save, container_export (with dest_path), and container_archive_get_to_file write to a dest_path on the host running this MCP server (refusing to overwrite an existing file unless overwrite=True); image_load, image_import, and container_archive_put (with from_file) read a host path; compose_cp copies between a service container and a host path in either direction. image_import(from_url=...) is the one that leaves the host entirely: the daemon fetches the URL the caller named, in the daemon's own network namespace, so it can reach anything that daemon can reach (the same caller-chooses-the-destination footing as image_pull's registry argument). These run as the server's user, so the agent can write any file that user can write and read any file it can read. Prefer the in-band byte tools (capped at 32 MiB) when you don't trust the agent with host filesystem access. DOCKER_MCP_SERVER_READONLY also drops the host-writing tools - but note it is not targeted at them: it registers only read-only tools, so image_load and container_archive_put (and every other mutating/destructive tool) go too. There is no switch that drops just the file-writers.

  • Destructive operations have no built-in confirmation. prune_*, remove_*, container_kill, swarm_leave, compose_down(volumes=True), compose_kill, stack_remove (tears down every service in a stack), buildx_prune (always runs with --force), and buildx_remove execute immediately. These tools carry the destructiveHint annotation, so a client like Claude Code can gate them, and the shipped clean_environment prompt asks the agent to confirm before pruning volumes - but tool calls themselves are not gated by the server. For a hard guarantee, run with DOCKER_MCP_SERVER_NO_DESTRUCTIVE=1 (drops them entirely) or DOCKER_MCP_SERVER_READONLY=1 (see Configuration); for an approval step, configure it at the MCP client.

  • CLI shell-out attack surface. Compose, Stack, Buildx, Scout, and Context tools spawn docker subprocesses on the host running this MCP server. Every invocation passes arguments as a list (no shell, no metacharacter interpretation), resolves the binary via shutil.which, and runs against a scrubbed environment (DOCKER_HOST and related vars only). Positional values (image refs, service / context / builder names, build contexts, bake targets) are additionally rejected if they start with -, so an argument can't be smuggled in as a CLI flag (e.g. a service named --output=...); the one deliberate exception is the trailing command in compose_exec / compose_run, which is meant to be an arbitrary argv. Filesystem paths supplied to compose_* (project_dir, files) are read by the docker CLI on the server host - passing an unfamiliar path can expose any compose file the server's user can read. With no local docker CLI and an ssh:// target those subprocesses run on the remote host instead (above), which shifts two things: the command executes as the remote SSH user with its registry credentials, and the files a command reads are copied to that host's temp directory first - so a buildx_build --secret src= file, or anything else in a staged directory, exists briefly on the remote disk (mode 0700, removed when the call returns; only a dropped connection can leave it behind). Point staging-backed tools at directories you would be content to copy.

  • The daemon set is fixed at startup; pick it deliberately. When DOCKER_HOST / DOCKER_MCP_SERVER_HOSTS are unset, the server's initial SDK connection follows your active Docker context (DOCKER_CONTEXT / currentContext) - the same daemon your docker CLI targets - so if that context points at a remote or production daemon, the agent connects there too. Set DOCKER_MCP_SERVER_HOSTS (or DOCKER_HOST, or select a scoped context) before starting the server to pin the target(s) deliberately; with DOCKER_MCP_SERVER_HOSTS the auto/local endpoints are resolved and pinned at startup, so they can't drift if a context changes later. After startup, context_use only changes the CLI default for subsequent CLI-backed tools; SDK-backed tools keep using the daemon their pooled client connected to. There is no runtime way to introduce or retarget a daemon at an arbitrary endpoint - system_reconnect only rebuilds an already-configured host's client (to recover a wedged connection), it can't point it elsewhere; to add or change a daemon, edit DOCKER_MCP_SERVER_HOSTS and restart. This deliberately closes a trust-expansion vector (an agent can't move the root-equivalent boundary to an unvetted endpoint mid-session). context_create(skip_tls_verify=True) disables TLS verification for a context; use only against trusted local daemons.

  • Per-host read-only is an accident guard, not a security boundary. A host marked (ro) in DOCKER_MCP_SERVER_HOSTS makes mutating/destructive tools refuse to act on it at call time (and, with several hosts, writes require naming the target host explicitly - so the agent can't change the wrong daemon by omission). Like guard_not_self, this is in-process convenience: it constrains the agent through this server's tools, but the daemon itself is still the trust boundary, so for a host the agent must never modify, prefer pointing it at a genuinely read-only or scoped daemon over relying on the marker alone.

  • Per-host non-destructive is the same accident guard, scoped narrower. A host marked (nd) refuses only destructive tool calls (kills, removals, prunes) while reads and ordinary mutations still go through. Like (ro), this is in-process convenience enforced by this server's guard, not a daemon-level boundary.

  • cryptography (a transitive dependency, via mcp -> pyjwt[crypto]) has shipped no x86_64/universal2 macOS wheel since 49.0.0 - confirmed permanent, not transient - so a native install there (uvx, pip, or the .mcpb bundle) resolves to a current version and builds it from source, needing Rust and OpenSSL 3.x. This project briefly tried to avoid that build step with its own cryptography<49 cap scoped to Intel macOS - that cap turned out to hold back every platform, not just the one it named (a platform-scoped upper bound alone doesn't make uv lock fork the resolution), so it silently left everyone on a version within a later high-severity CVE's range (a PKCS#7 EnvelopedData decryption Bleichenbacher oracle). The cap was removed rather than replaced: this project doesn't decrypt PKCS#7 envelopes itself, but a dependency carrying a known-exploitable flaw is not something to ship knowingly just to keep one platform wheel-only. If you'd rather not install a build toolchain, use the container image instead (built centrally on Linux, so it never hits this).

Packages and listings

Channel

Link

PyPI

docker-mcp-server

GHCR (container)

ghcr.io/l337-org/docker-mcp-server

Docker Hub (container)

gavinlucas/docker-mcp-server

Desktop Extension (.mcpb)

GitHub Releases

l337-docker agent skill (.tar.gz)

GitHub Releases

Official MCP Registry

io.github.L337-org/docker-mcp-server

Glama

docker-mcp-server

mcp.so

docker-mcp-server

awesome-mcp-servers

punkpeye/awesome-mcp-servers

Privacy Policy

docker-mcp-server collects no data, sends no telemetry, and has no author-operated backend. It runs locally and talks only to the Docker daemon and container registries you point it at, as part of the operations you request. The full statement is in PRIVACY.md.

Contributing

Contributions are welcome. The project values a tight mapping between the Docker SDK's public surface and the MCP tools we expose. See CONTRIBUTING.md for the project layout, tool conventions, the checklist for adding a new tool module, and local development setup.

Available Tools

164 tools
buildx_bakeA

Build multiple targets defined in a bake file (HCL, JSON, or compose).

Use it for multi-target builds declared in docker-bake.hcl/compose files; for a single Dockerfile target use buildx_build. Does not raise on a non-zero CLI exit — inspect returncode/stderr in the result.

args: targets - Bake targets to build (default: the default group) files - Bake file paths (-f, repeatable) set_overrides - Per-target overrides, e.g. ["app.platform=linux/amd64"] push - Push results to the registry load - Load results into the local image store no_cache - Do not use cache when building pull - Always pull a newer base image builder - Override the active builder cwd - Working directory containing the bake file (defaults to the server's cwd; copied to the target host if no local plugin) timeout_seconds - Subprocess timeout (default 1800s) returns: dict - {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
cwdNo
loadNo
pullNo
pushNo
filesNo
builderNo
targetsNo
no_cacheNo
set_overridesNo
timeout_secondsNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond annotations (readOnlyHint: false, destructiveHint: false), the description discloses non-raising behavior and the subprocess nature via returncode. The cwd parameter description adds context about file copying when no local plugin. This adds significant context beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and front-loaded with the purpose, followed by a structured args list. Each sentence earns its place, and the parameter details are organized clearly without unnecessary verbosity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description includes the return dict format ('returncode', 'stdout', 'stderr', 'truncated'), covers all parameters, and provides usage guidance. With no output schema, this is complete for a multi-parameter build tool with potential side effects (push, load).

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With schema description coverage at 0%, the description fully compensates by listing all 10 parameters with meaningful explanations, including an example for set_overrides ('app.platform=linux/amd64'), CLI flags for files ('-f'), and default values for cwd and timeout_seconds. This adds substantial meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States the verb 'Build' with a specific resource: 'multiple targets defined in a bake file (HCL, JSON, or compose)' and differentiates from sibling buildx_build by mentioning 'for a single Dockerfile target use buildx_build'. This is a specific verb+resource+scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use ('Use it for multi-target builds declared in docker-bake.hcl/compose files') and provides an alternative ('for a single Dockerfile target use buildx_build'). Also notes a key behavior: 'Does not raise on a non-zero CLI exit — inspect returncode/stderr in the result.'

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

buildx_buildA

Build an image with BuildKit via docker buildx build.

Replaces the legacy image_build tool when you need any of: multi-platform output (platforms), modern cache export (cache_from/cache_to), SBOM or provenance attestations, build secrets, or multi-stage builds with target. Always runs with --progress=plain so output is captured rather than redrawn on a TTY. With no local buildx plugin and an ssh:// target, the build runs on that host: a local context directory is copied there honouring .dockerignore, as are file, build_contexts and secret paths. Raises RuntimeError in that case for output/cache_to with a filesystem dest=, cache_from with a local src=, or any ssh= — each would resolve on the remote machine, losing the output or silently changing the build.

args: context - Build context: a filesystem path or Git/HTTP URL (verbatim; no ~/glob expansion). The - stdin-tarball form is NOT supported (stdin isn't forwarded — it'd block on the server's own stdin); serve a pre-packed tarball over HTTP instead. Copied to the target host when it names a local directory and there is no local plugin. tags - Image references to apply (-t, repeatable) platforms - Target platforms, e.g. ["linux/amd64", "linux/arm64"] file - Dockerfile path. A relative path resolves against this server's working directory (buildx's own rule), NOT against context — pass e.g. "ctx/Dockerfile" for a Dockerfile inside the context directory "ctx". build_args - Build-time variables (each becomes --build-arg KEY=VALUE) build_contexts - Additional named build contexts (e.g. {"deps": "./vendor"}) labels - Labels to set on the resulting image (each becomes --label KEY=VALUE) annotations - OCI manifest annotations (passed verbatim, repeatable) target - Target build stage to stop at push - Push the result to the registry (mutually exclusive with load) load - Load the result into the local image store (single-platform builds only) output - Custom --output specs (e.g. ["type=tar,dest=out.tar"]). A filesystem dest= is refused when the build has to run on a remote host; dest=- (stdout) is fine. no_cache - Do not use cache when building no_cache_filter - Stage names to exclude from caching pull - Always attempt to pull a newer version of each base image cache_from - Cache import specs, e.g. ["type=registry,ref=user/img:cache"] cache_to - Cache export specs builder - Override the active builder sbom - Shorthand for --attest=type=sbom; pass "true" or a config string provenance - Shorthand for --attest=type=provenance; pass "true", "false", or a config string attest - Custom attestation specs (repeatable) secret - Secret specs (e.g. ["id=npmrc,src=/home/user/.npmrc"] or ["id=npmrc,env=NPM_TOKEN"]). ~ in src= is NOT expanded (by this tool or the CLI) — use an absolute path. ssh - SSH agent socket/key specs (e.g. ["default"], using $SSH_AUTH_SOCK). Refused when the build has to run on a remote host: the socket read would be that host's. timeout_seconds - Subprocess timeout (default 1800s) returns: dict - {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
sshNo
fileNo
loadNo
pullNo
pushNo
sbomNo
tagsNo
attestNo
labelsNo
outputNo
secretNo
targetNo
builderNo
contextYes
cache_toNo
no_cacheNo
platformsNo
build_argsNo
cache_fromNo
provenanceNo
annotationsNo
build_contextsNo
no_cache_filterNo
timeout_secondsNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the sparse annotations (readOnlyHint=false, destructiveHint=false), the description discloses substantial behavioral traits: output capture with `--progress=plain`, remote build behavior (context copying via `.dockerignore`), rejects for certain `output`/`cache_to`/`cache_from`/`ssh` combinations that would resolve on the remote machine, and the fact that stdin is not forwarded. These specifics far exceed the annotations and are crucial for safe invocation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but every sentence adds value. It starts with a one-line purpose, then a usage paragraph, then a per-parameter breakdown with examples and restrictions. For 24 parameters, this level of detail is appropriate and well-organized into a readable list. No filler or redundant content exists.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description explicitly states the return shape as `{"returncode": int, "stdout": str, "stderr": str, "truncated": bool}`. It covers remote-host fallback behavior, unsupported stdin, file path resolution rules, and timeout default. For a tool with 24 parameters and no structured output definition, this description is exceptionally complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Even though schema description coverage is technically 0% (no descriptions inside the schema), the tool description itself provides rich semantics for every parameter. It gives examples (e.g., `platforms` as `["linux/amd64", "linux/arm64"]`), constraints (e.g., `file` relative to server working directory, not `context`), and edge cases (e.g., `~` not expanded in `secret` `src=`). This far surpasses what the bare schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description begins with a specific verb and resource: 'Build an image with BuildKit via `docker buildx build`.' It clearly distinguishes itself from the legacy `image_build` tool by enumerating the advanced capabilities (multi-platform, cache export, attestations, secrets, multi-stage targets), leaving no ambiguity about its scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use this tool: 'Replaces the legacy `image_build` tool when you need any of...' and also provides a when-not-to-use example (stdin tarball unsupported). It also documents that it always runs with `--progress=plain` and warns about remote-host restrictions, giving the agent clear decision-making context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

buildx_createA

Create a new BuildKit builder instance.

Needed when the default docker driver falls short: multi-platform builds and cache export require a docker-container (or kubernetes/remote) builder. Pass use=True to make it the default for later buildx_build calls (else switch with buildx_use); bootstrap=True starts the builder now rather than on first build. Does not raise on a non-zero CLI exit — inspect returncode/stderr in the result.

args: name - Name for the new builder (defaults to a generated name) driver - BuildKit driver (e.g. "docker-container", "kubernetes", "remote") driver_opts - Driver-specific options (each becomes --driver-opt KEY=VALUE) use - Set the new builder as the current one bootstrap - Boot the builder immediately platforms - Platforms the builder advertises config - Path to a buildkitd config file (copied to the target host if no local plugin); passed as --buildkitd-config, so this argument needs buildx >= 0.17 node_name - Node name within the builder (for multi-node builders) append - Append a node to an existing builder named name returns: dict - {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
useNo
nameNo
appendNo
configNo
driverNo
bootstrapNo
node_nameNo
platformsNo
driver_optsNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Despite annotations only providing readOnlyHint=false and destructiveHint=false, the description adds substantial behavioral context: non-zero CLI exits do not raise but are surfaced via returncode/stderr, config file handling and a buildx version requirement, and the side effect of `use=True` on subsequent buildx_build calls. This goes well beyond the annotations and schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but every sentence adds value: a one-line purpose, a crisp usage justification, behavioral caveats, and a compact parameter list. The return format is included since there is no output schema. It is appropriately dense, with no filler or repetition of annotation data.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity—9 parameters, nested objects, no output schema, and multiple behavioral caveats—the description is remarkably complete. It covers all parameters, return shape, error behavior, version constraint, and even related tool switching. An agent has nearly everything needed to invoke this correctly and understand the consequences.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must carry all parameter meaning. It does: all 9 parameters (name, driver, driver_opts, use, bootstrap, platforms, config, node_name, append) receive brief but meaningful explanations, including transformations like driver_opts becoming `--driver-opt KEY=VALUE` and the buildx >= 0.17 requirement for config. This fully compensates for the missing schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Create a new BuildKit builder instance.' It then clarifies the purpose and distinguishes this tool from siblings like buildx_use and buildx_build by explaining when a new builder is needed (multi-platform builds, cache export). This is a textbook clear purpose statement.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use this tool—'Needed when the default `docker` driver falls short'—and gives concrete use cases. It also explains the `use=True` workflow versus switching with `buildx_use`, and discusses the `bootstrap` behavior. This is strong when-to-use and alternative guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

buildx_duA
Read-only

Report BuildKit cache disk usage as a list of records.

A large cache can easily generate more output than MAX_CLI_OUTPUT_BYTES; if that happens the captured stdout is truncated and this tool drops the final (partial) record before parsing. For an exhaustive accounting on a busy builder, run docker buildx du --format '{{json .}}' on the host directly. Reclaim the cache with buildx_prune (system_df covers daemon-side disk, not builder cache). Raises RuntimeError if the CLI call fails.

args: builder - Override the active builder returns: list - One dict per cache record (parsed from --format '{{json .}}')

ParametersJSON Schema
NameRequiredDescriptionDefault
builderNo

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, and the description adds substantial behavioral context without contradicting annotations. It discloses truncation behavior, partial-record dropping, error raising (RuntimeError), and the workaround for exhaustive output. This goes well beyond the structured annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is appropriately sized for a tool with notable caveats. It front-loads the core purpose, then provides practical warnings and finally structured arg/return notes. Every sentence adds value, and the layout is easy to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given one optional parameter, no output schema, and moderate complexity, the description covers the essential aspects: what it reports, how it might fail, how to get complete results, error behavior, parameter semantics, and return format. No significant gaps remain.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema provides no description for the builder parameter, so the description's 'args: builder - Override the active builder' is essential and adds meaning. It also documents the return type as 'list - One dict per cache record'. With only one parameter, this is sufficient compensation for the 0% schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific action and resource: 'Report BuildKit cache disk usage as a list of records.' It clearly differentiates from siblings by contrasting with system_df ('covers daemon-side disk, not builder cache') and buildx_prune ('Reclaim the cache').

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear usage context, explicitly noting when the tool may be insufficient (large caches exceeding MAX_CLI_OUTPUT_BYTES) and suggesting a host-side command for exhaustive reporting. It also directs to buildx_prune for reclaiming cache and clarifies that system_df is not a substitute. However, it does not explicitly enumerate alternative tools for the same job.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

buildx_history_inspectA
Read-only

Inspect a single build record by ref, parsed from --format json.

Returns the full record for one build — duration, materials, attestations, error (if any) — for debugging a failed or slow build found via buildx_history_list. Requires buildx >= v0.13. Raises RuntimeError if the CLI call fails.

args: ref - Build record ref. Pass the ref field from buildx_history_list directly — it reports a qualified "//", but history inspect only accepts the bare id, so this reduces it to the id and (unless builder is given) targets the builder named in the ref. Empty/omitted inspects the most recent build; the ^N syntax (e.g. "^0" = latest) is also valid. builder - Builder instance the build ran on (defaults to the one in ref, else active) returns: dict - The parsed build record (or {"raw": } if the output isn't a JSON object)

ParametersJSON Schema
NameRequiredDescriptionDefault
refNo
builderNo

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate read-only and non-destructive behavior, but the description adds substantial behavioral detail: it parses JSON output, returns a raw fallback when output isn't a JSON object, raises RuntimeError on CLI failure, and explains how ref is normalized. This goes well beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a concise purpose sentence, a return summary, and a clearly labeled args/returns section. All sentences add necessary information, and the detailed ref explanation is warranted due to the subtle behavior.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with minimal schema and no output schema, the description covers entry point, return shape, error behavior, version requirement, and parameter semantics. It is fully sufficient for an agent to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has zero descriptions, but the description fully compensates with detailed param docs: ref explains the qualified vs bare id transformation, the empty/omitted case, and the ^N syntax; builder explains its default and interaction with ref. This is exemplary parameter documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Inspect a single build record by ref', clearly distinguishing this from buildx_history_list (listing) and other buildx tools. It further clarifies the exact scope (single record) and the debugging use case.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly frames the tool as for debugging failed or slow builds found via buildx_history_list, giving concrete context for when to use it. It also mentions the version requirement and error condition, but does not explicitly name alternative tools or state when not to use this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

buildx_history_listA
Read-only

List recent build records (BuildKit build history), parsed from --format '{{json .}}'.

Each record is a past build with its ref, name, status, step counts, and timestamps — useful for finding a build to drill into with buildx_history_inspect. Requires buildx >= v0.13 (older versions have no history subcommand and this raises with the CLI's "unknown command" error).

args: builder - Builder instance to read history from (defaults to the active builder) returns: list - One dict per build record (ref, name, status, total/completed/cached steps, times)

ParametersJSON Schema
NameRequiredDescriptionDefault
builderNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint and destructiveHint annotations, the description discloses the exact output parsing method (`--format '{{json .}}'`), the fields returned, the version requirement, and the error behavior on unsupported versions. This is valuable context that annotations do not convey.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact but information-dense: it opens with a clear purpose, then provides necessary detail on fields, usage context, version prerequisite, and parameter semantics. No extraneous content, and each sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list tool with one optional parameter and no output schema, the description covers every important aspect: what it does, what it returns, how it behaves with older versions, and what the parameter does. It is fully self-contained for an agent to decide when to call it and how to use the results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has one optional parameter `builder` with no description. The description compensates fully with 'builder - Builder instance to read history from (defaults to the active builder)', clearly explaining the parameter's meaning and default behavior.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description begins with a specific verb+resource: 'List recent build records (BuildKit build history)' and clarifies that it parses the output from `--format '{{json .}}'`. It also references the sibling tool `buildx_history_inspect` for drilling into a specific build, making its role distinct.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when this tool is useful: 'finding a build to drill into with buildx_history_inspect', which reveals the intended workflow and alternative. It also provides a clear prerequisite (buildx >= v0.13) and warns about the failure mode on older versions, acting as a when-to-use/check guideline.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

buildx_imagetools_createA

Create a manifest list / OCI image index from existing per-platform tags.

Replaces docker manifest create + docker manifest push — builds the index and pushes it in one operation. Source tags must already be pushed; this only stitches them together. Verify the result with buildx_imagetools_inspect. Does not raise on a non-zero CLI exit — inspect returncode/stderr in the result.

args: target - Tag for the new manifest list (-t) sources - Source image references to combine append - Append to the existing manifest at target rather than replacing dry_run - Print the resulting manifest without pushing annotations - OCI annotations (repeatable; passed verbatim) platforms - Filter source platforms when combining descriptor_files - Files to read source descriptors from, instead of refs (copied to the target host if no local plugin) builder - Override the active builder timeout_seconds - Subprocess timeout (default 600s) returns: dict - {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
appendNo
targetYes
builderNo
dry_runNo
sourcesYes
platformsNo
annotationsNo
timeout_secondsNo
descriptor_filesNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the basic readOnlyHint/destructiveHint annotations, the description discloses critical non-obvious behavior: 'Does not raise on a non-zero CLI exit — inspect returncode/stderr in the result.' It also clarifies the prerequisite that source tags must already be pushed and that append modifies an existing manifest. This adds substantial behavioral context not captured by annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured and front-loaded with the core purpose, followed by key behavioral notes, then a neatly organized args list, and finally the return type. Every sentence adds value; the text is dense but not verbose, covering all necessary details without repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the 9-parameter complexity and absence of an output schema, the description is remarkably complete. It includes prerequisites, side-effects, failure behavior, default timeout, return format, and pointers to related tools. No important aspect is left undocumented.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has no parameter descriptions (0% schema coverage), but the description's 'args' section explains every one of the 9 parameters with meaningful details, such as `target` being 'Tag for the new manifest list (-t)', `dry_run` printing without pushing, and `descriptor_files` reading from files instead of refs. This fully compensates for the schema's lack of descriptions, even providing CLI flag mappings and usage nuances.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Create a manifest list / OCI image index from existing per-platform tags.' It clearly distinguishes from siblings like buildx_imagetools_inspect by explicitly naming the verification tool and contrasting with docker manifest create/push.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states when to use: 'Source tags must already be pushed; this only stitches them together' and provides an alternative: 'Replaces docker manifest create + docker manifest push.' It also recommends the next step: 'Verify the result with buildx_imagetools_inspect,' giving clear context on usage and alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

buildx_imagetools_inspectA
Read-only

Inspect a manifest in a registry without pulling.

Replaces docker manifest inspect. The standalone docker manifest command is in maintenance mode and lacks support for OCI image indexes, attestations, and annotations — buildx imagetools inspect is the path forward and handles both single-platform manifests and multi-platform manifest lists / OCI indexes. Uses the docker CLI's credential store; registry_manifest answers the same question over direct HTTPS with no daemon or plugin.

args: image - Image reference, e.g. "alpine:3.19" or "ghcr.io/org/repo@sha256:..." raw - Return the raw manifest bytes (a JSON document) instead of the human-rendered tree format - Go template format string (mutually exclusive with raw) builder - Override the active builder returns: dict - {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}. When raw=True or format="{{json .}}", stdout is a JSON document the caller can parse.

ParametersJSON Schema
NameRequiredDescriptionDefault
rawNo
imageYes
formatNo
builderNo

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark it read-only and non-destructive. The description adds important behavioral context: it uses the docker CLI's credential store, supports OCI indexes/attestations, and explains how `raw`/`format` change the output. It could mention whether a daemon is required, but the added value is substantial.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured: a one-sentence purpose, a comparative context paragraph, a concise args list, and a return contract. No redundant sentences; each part earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the read-only nature, 4 parameters, and no output schema, the description covers the essentials: purpose, parameter meanings, return dict, and raw/format behavior. It lacks explicit error conditions or prerequisites like buildx installation, but is still fairly complete for an inspect tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has 0% coverage, but the description documents all four parameters: image with concrete examples, raw and format with their semantics and mutual exclusivity, and builder as an override. This fully compensates for the schema's silence.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Explicitly states the action and resource: 'Inspect a manifest in a registry without pulling.' It also distinguishes from siblings by referencing `docker manifest inspect` and `registry_manifest`, making its niche clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides direct alternatives: 'Replaces `docker manifest inspect`' and '`registry_manifest` answers the same question over direct HTTPS with no daemon or plugin.' This gives clear when-to-use guidance and context for choosing between tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

buildx_inspectA
Read-only

Inspect a builder instance.

Human-readable detail (driver, status, supported platforms) for one builder; buildx_list returns machine-parsed JSON for all builders. Does not raise on a non-zero CLI exit — inspect returncode/stderr in the result.

args: name - Builder name (defaults to the active builder) bootstrap - Boot the builder if it isn't already running returns: dict - {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}. stdout is human-readable; parse with the agent or call buildx_list for JSON.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameNo
bootstrapNo

TDQS

A4.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false. The description adds valuable behavioral context: 'Does not raise on a non-zero CLI exit — inspect returncode/stderr in the result' and clarifies that stdout is human-readable. This goes beyond basic safety hints, though it could further detail error scenarios for missing builders.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and well-structured, with clear sections for args and returns. Each sentence adds value: purpose, differentiation, exit code behavior, parameter explanations, and return format. No redundant content is present.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 2-parameter tool with no output schema, the description is self-sufficient. It specifies the return dict structure, parameter defaults, and non-zero exit behavior, and even points to an alternative for JSON output. This covers all essential context an agent needs.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, so the description carries the full burden. It documents both parameters: 'name' (defaults to the active builder) and 'bootstrap' (boot if not running), adding semantics that the schema omits. This fully compensates for the schema's lack of descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Inspect a builder instance,' a specific verb+resource statement. It also differentiates from sibling buildx_list by noting it provides human-readable detail for one builder while buildx_list returns machine-parsed JSON for all builders. This leaves no ambiguity about the tool's purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly contrasts with buildx_list for JSON output, effectively guiding the agent on when to use which tool. It also explains the bootstrap parameter's role ('Boot the builder if it isn't already running'). This provides clear context for selecting the tool and using its options.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

buildx_listA
Read-only

List builder instances.

Machine-parsed view of every builder; use buildx_inspect for one builder's human-readable detail and buildx_use to switch the default. Raises RuntimeError if the CLI call fails.

returns: list - One dict per builder (parsed from --format '{{json .}}'). If the captured stdout was truncated by MAX_CLI_OUTPUT_BYTES the last (likely partial) record is dropped before parsing.

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds behavioral context beyond annotations: raises RuntimeError on CLI failure, parses from JSON format, and drops a truncated final record. This complements the readOnlyHint/destructiveHint annotations with factual execution details.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is short and front-loaded with the core action. It uses two sentences plus a returns bullet, with no redundant or filler content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simplicity (0 params, list operation), the description covers all essential aspects: return type, error behavior, truncation handling, and relationship to sibling tools. Annotations provide safety profile, completing the picture.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Tool has zero parameters, so there are no parameter semantics to clarify. The description does explain the return format and handling of truncation, but that's not parameter-related. Baseline 4 for 0 params is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description opens with 'List builder instances,' a specific verb+resource statement. It also distinguishes from siblings by naming buildx_inspect for one builder's human-readable detail and buildx_use for switching the default.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use this tool (machine-parsed view of every builder) and points to alternatives (buildx_inspect for detail, buildx_use to switch default), giving clear when-to-use and when-not-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

buildx_pruneA
DestructiveIdempotent

Remove BuildKit cache entries.

Destructive: this tool always passes --force because no interactive prompt is available under MCP. Pair with buildx_du first to inventory what would be removed.

args: all - Include internal/frontend images filters - Filter by attributes (e.g. {"until": "24h", "type": "exec.cachemount"}) reserved_space - Amount of disk to always keep (e.g. "10GB") max_used_space - Maximum disk space the cache may use (e.g. "20GB") min_free_space - Target amount of free disk after pruning (e.g. "5GB") builder - Override the active builder timeout_seconds - Subprocess timeout (default 600s) returns: dict - {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
allNo
builderNo
filtersNo
max_used_spaceNo
min_free_spaceNo
reserved_spaceNo
timeout_secondsNo

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses critical behavioral traits beyond the annotations: it always passes `--force` because MCP lacks an interactive prompt, directly addressing the destructive nature. It also explains the return format. This adds significant value beyond the destructiveHint and idempotentHint annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured and front-loaded: a one-line purpose, a prominent destructive warning, then a clean parameter list. Every sentence adds essential information, with no fluff or repetition of schema defaults.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (7 parameters, nested objects, no output schema), the description is remarkably complete. It covers the return structure, warns about forced behavior, provides parameter examples, and mentions the companion tool buildx_du. Nothing critical is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has no parameter descriptions (0% coverage), but the description compensates fully by documenting every parameter with concise explanations and concrete examples (e.g., filters as JSON, space values as strings like '10GB'). This gives the agent the semantic context needed to populate parameters correctly.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Remove BuildKit cache entries.' This clearly states the tool's purpose with a specific verb (Remove), a specific resource (BuildKit cache entries), and differentiates it from sibling tools like buildx_du (which inventories disk usage) and buildx_remove (which removes builders).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides a clear usage guideline by recommending 'Pair with buildx_du first to inventory what would be removed.' This tells the agent when to use this tool relative to a sibling. However, it does not explicitly discuss when NOT to use it or mention alternatives, so it stops short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

buildx_removeA
Destructive

Remove a builder instance.

Deletes a builder made by buildx_create, including its build cache unless keep_state=True; use buildx_prune to reclaim cache while keeping the builder. Does not raise on a non-zero CLI exit — inspect returncode/stderr in the result.

args: name - Builder name to remove (mutually exclusive with all_inactive) all_inactive - Remove every inactive builder keep_state - Keep the BuildKit state volume keep_daemon - Keep the BuildKit daemon process running force - Force removal even if the builder is in use returns: dict - {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
nameNo
forceNo
keep_stateNo
keep_daemonNo
all_inactiveNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark destructiveHint=true, but the description adds crucial nuance: it deletes build cache unless keep_state=True, and it does not raise on non-zero CLI exit, requiring inspection of returncode/stderr. These are significant behavioral traits beyond the annotation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured: a clear one-line summary, brief behavioral notes, an args list, and a returns format. Every sentence adds value, with no repetition or fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description includes a precise return dict format. It covers side effects (cache deletion), error behavior (non-zero exit handling), and alternative tools, making it fully adequate for an agent to invoke the tool confidently.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, but the description compensates fully with an 'args' section explaining all 5 parameters, including the mutual exclusivity between name and all_inactive. Each parameter's meaning is clearly stated, adding value beyond the schema's type/default definitions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function ('Remove a builder instance') with a specific verb and resource. It distinguishes from related tools by referencing buildx_create and explicitly pointing out the alternative buildx_prune for cache reclamation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit guidance on when to use this tool versus alternatives: 'use buildx_prune to reclaim cache while keeping the builder.' It also notes the tool deletes builders made by buildx_create, giving clear contextual usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

buildx_useA

Select the active builder for subsequent buildx operations.

Without default or global_default the switch applies only to the current CLI session. default persists the choice for the current Docker context; global_default persists across all Docker contexts. Use buildx_list to see available builders and their current status. To avoid switching the global default, pass a specific builder name directly via buildx_build's builder parameter instead.

args: name - Builder name to activate (from buildx_list) default - Persist as default builder for the current Docker context global_default - Persist as default builder across all Docker contexts returns: dict - {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes
defaultNo
global_defaultNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description reveals important behavioral nuances beyond the annotations: without flags the change is limited to the CLI session, 'default' persists for the current context, and 'global_default' persists across all contexts. It also warns about the impact of switching the global default and offers a non-switching alternative, giving the agent full understanding of side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured and front-loaded with the core purpose. The scoping details, usage tips, and parameter explanations each add value without redundancy. The format is clear, and the returns section neatly summarizes the output regardless of the absence of an output schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With only three parameters, minimal annotations, and no output schema, the description covers everything an agent needs: purpose, scoping behavior, parameter meanings, return format, and explicit pointers to related tools. It is fully sufficient for correct invocation and decision-making.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema provides no descriptions for parameters (coverage 0%), but the description's 'args' section explains each parameter in detail: 'name' is the builder to activate (from buildx_list), 'default' persists for the current context, and 'global_default' persists across all contexts. This fully compensates for the schema gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Select the active builder for subsequent buildx operations,' a specific verb and resource that clearly distinguishes this from siblings like buildx_list (which lists) and buildx_build (which builds). The scope is explicit: it changes the active builder for subsequent operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains when to use this tool versus alternatives with concrete guidance: use buildx_list to see available builders, and avoid switching the global default by passing a specific builder name to buildx_build's builder parameter. It also clarifies the scoping semantics (session, context, global), providing clear conditions for each mode.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compose_buildA

Build images for a compose project.

Builds the images declared by the project's build: sections without starting anything — compose_up(build=True) builds and starts in one step. Does not raise on a non-zero CLI exit — inspect returncode/stderr in the result.

args: project_dir - Dir with the compose file (default: server cwd; copied to the target host if no local plugin) files - Explicit compose file paths (repeatable, -f) project_name - Compose project name override services - Specific services to build (default: all) pull - Always attempt to pull a newer base image no_cache - Do not use cache when building timeout_seconds - Subprocess timeout (default 1800s) returns: dict - {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
pullNo
filesNo
no_cacheNo
servicesNo
project_dirNo
project_nameNo
timeout_secondsNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses key behavior beyond annotations: it does not raise on non-zero CLI exit, requires inspecting returncode/stderr, and notes that project_dir is copied to the target host if no local plugin. These are valuable operational details not covered by annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is organized with an intro sentence, usage distinction, behavioral note, parameter list, and return type. Each section adds necessary information without redundancy, and the length is justified by the parameter documentation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 7 parameters, no output schema, and minimal annotations, the description covers all necessary aspects: what it does, how it differs from siblings, error handling, parameter meanings, and return format. It is fully complete for the tool's complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Even though the schema has 0% description coverage, the 'args' section provides detailed semantics for all 7 parameters, including defaults, interpretation ('repeatable, -f', 'default: all'), and special behavior like project_dir copying. This fully compensates for the schema gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool builds images for a compose project, specifically those declared in `build:` sections, and distinguishes itself from `compose_up(build=True)` by noting it does not start anything.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides an explicit alternative (`compose_up(build=True)`) for build-and-start workflow, and clarifies the tool's purpose as build-only. The mention of non-zero CLI exit behavior also informs usage expectations.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compose_configA
Read-only

Render the canonical compose configuration after merges, profiles, and variable substitution.

Use it to validate compose files and see exactly what the CLI will run before compose_up. Does not raise on a non-zero CLI exit: on a failed render config may be None — inspect raw.stderr.

args: project_dir - Dir with the compose file (default: server cwd; copied to the target host if no local plugin) files - Explicit compose file paths (repeatable, -f) project_name - Compose project name override profiles - Profiles to activate before rendering services_only - List service names only (--services) format - Render as YAML (default) or JSON returns: dict - {"config": str|dict|None, "raw": }; config is a parsed dict when format="json" and parsing succeeds, otherwise the rendered text from stdout.

ParametersJSON Schema
NameRequiredDescriptionDefault
filesNo
formatNoyaml
profilesNo
project_dirNo
project_nameNo
services_onlyNo

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, and the description adds valuable failure semantics: 'Does not raise on a non-zero CLI exit: on a failed render config may be None — inspect raw.stderr.' This goes beyond the structured annotations by explaining error behavior and return state.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured: a focused purpose sentence, usage guidance, failure behavior, then an args list and return specification. Every section earns its place and there is no filler or redundant restatement of the tool name.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has no output schema, the description fully specifies the return dict shape: config as str/dict/None, raw as CliResult dict, and the parsing behavior for format='json'. Combined with parameter coverage and annotations, this is sufficiently complete for an agent to invoke and interpret results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description's args section compensates fully with concise one-liners for all six parameters, including useful details like project_dir default/copy behavior, files repeatability, services_only mapping to --services, and format behavior. This adds meaning beyond the raw schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Render the canonical compose configuration after merges, profiles, and variable substitution.' This clearly distinguishes compose_config as a read-oriented rendering/validation tool, not an operational Compose action like compose_up or compose_down.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides clear guidance: 'Use it to validate compose files and see exactly what the CLI will run before compose_up.' This gives a concrete when-to-use scenario, though it does not explicitly mention when not to use it or name alternatives to exclude.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compose_cpA

Copy files/folders between a service container and the server host's filesystem.

Exactly one of source/dest is SERVICE:PATH; the other is a path on the host running this MCP server, read/written as the server's user (same host exposure as the file-path archive tools — see SECURITY.md). Copying to stdout (dest="-") is unsupported; use container_archive_get. Does not raise on a non-zero CLI exit — inspect returncode/stderr in the result. With no local compose plugin and an ssh:// target, runs the real docker compose cp on that host instead and relays whichever side of the copy is local over the same SSH connection — every parameter above behaves the same either way, since the actual copy always runs through the real CLI. The one difference: a container->host copy is refused with FileExistsError if the local destination already exists, since only this host (not the remote one) knows that. unix:///tcp://+TLS hosts with no local plugin are not covered by this fallback (no shell to run the CLI on) and still raise RuntimeError — use container_archive_put (host to container) or container_archive_get_to_file (container to host) there instead; both talk to the daemon directly and need no local CLI (compose_ps gives you the container name).

args: source - SERVICE:SRC_PATH or a host path dest - SERVICE:DEST_PATH or a host path (not "-") index - Container index when the service has multiple replicas (default 1) all_containers - Copy to/from all containers of the service (--all) project_dir - Dir with the compose file (default: server cwd; copied to the target host if no local plugin) files - Explicit compose file paths (repeatable, -f) project_name - Compose project name override timeout_seconds - Subprocess timeout (default 300s) returns: dict - {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
destYes
filesNo
indexNo
sourceYes
project_dirNo
project_nameNo
all_containersNo
timeout_secondsNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses key behavioral traits beyond the minimal annotations, including error handling (no raise on non-zero exit, inspect returncode/stderr), the FileExistsError refusal for container-to-host copies, and RuntimeError for unsupported hosts. These are valuable details not available in annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but information-dense, covering all essential caveats and alternatives without redundancy. The clear structure (summary, caveats, fallback behavior, args list) justifies the length, and every sentence serves a purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers return values, error modes, fallback behavior, and parameter semantics thoroughly. Even without an output schema, the returns dict is specified, making the tool's behavior fully understandable.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema coverage, the description compensates by documenting each parameter's semantics in the args list (e.g., 'source - SERVICE:SRC_PATH or a host path', 'index - Container index when the service has multiple replicas'). This adds meaning beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening sentence clearly states the tool's function ('Copy files/folders between a service container and the server host's filesystem') and the description distinguishes it from related archive tools by explicitly naming alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit guidance on when not to use this tool (e.g., copying to stdout) and recommends alternatives (`container_archive_get`, `container_archive_put`, `container_archive_get_to_file`). It also explains the fallback to real CLI for ssh:// targets, making usage context clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compose_downA
Destructive

Stop and remove containers, networks (and optionally volumes) for a compose project.

Inverse of compose_up. Images are kept; named volumes go only with volumes=True (destructive). Use compose_stop to stop without removing anything. Does not raise on a non-zero CLI exit — inspect returncode/stderr in the result.

args: project_dir - Dir with the compose file (default: server cwd; copied to the target host if no local plugin) files - Explicit compose file paths (repeatable, -f) project_name - Compose project name override profiles - Profiles to consider volumes - Also remove named volumes declared by the project (destructive) remove_orphans - Remove containers not declared in the compose file timeout_seconds - Subprocess timeout (default 300s) returns: dict - {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
filesNo
volumesNo
profilesNo
project_dirNo
project_nameNo
remove_orphansNo
timeout_secondsNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the destructiveHint annotation by specifying that images are kept, named volumes are only removed with the volumes flag, and that the tool does not raise on non-zero CLI exit (requiring inspection of returncode/stderr). These are non-obvious behavioral traits that an agent needs to know.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured: a clear opening line, a usage comparison, a key behavioral note, and a compact bulleted parameter list. Every sentence adds value and there is no redundancy; the length is justified by the number of parameters and the need to clarify destructive behavior.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having no output schema, the description explicitly documents the return format as a dict with returncode, stdout, stderr, and truncated. It covers all 7 parameters, the destructive semantics, and the error behavior, making the tool fully self-contained for an agent to use safely.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, but the description compensates fully by explaining every parameter: project_dir, files, project_name, profiles, volumes, remove_orphans, and timeout_seconds. Each parameter gets a concise one-line semantic explanation, which is critical for correct invocation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Stop and remove containers, networks (and optionally volumes) for a compose project' and identifies it as the inverse of compose_up. It names the exact resource (compose project) and actions, making it easy to distinguish from sibling tools like compose_stop and compose_restart.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit guidance: 'Use compose_stop to stop without removing anything' and notes that volumes are only removed with volumes=True. This clearly tells the agent when to choose this tool versus alternatives, which is exactly what usage guidelines should do.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compose_execA

Run a command inside an already-running compose service container (see also container_exec).

Always passes -T (no TTY). Pass an exec-form argv (e.g. ["python", "-V"]); a ["sh", "-c", "..."] form interprets shell metacharacters in untrusted substrings.

args: service - Service name from the compose file command - Argv to execute inside the container project_dir - Dir with the compose file (default: server cwd; copied to the target host if no local plugin) files - Explicit compose file paths (repeatable, -f) project_name - Compose project name override index - Container index when the service has multiple replicas (default 1) workdir - Working directory inside the container user - User to run as inside the container (uid or name) env - Environment variables to set for the exec session timeout_seconds - Subprocess timeout (default 60s) returns: dict - {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
envNo
userNo
filesNo
indexNo
commandYes
serviceYes
workdirNo
project_dirNo
project_nameNo
timeout_secondsNo

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only include readOnlyHint=false and destructiveHint=false, so the description carries the transparency burden. It discloses that `-T` is always passed (no TTY) and warns that `sh -c` interprets shell metacharacters in untrusted substrings. It also documents the return dict and timeout default, adding useful behavioral context beyond the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is efficiently structured: a one-sentence purpose, two behavioral caveats, then a tidy parameter list. No wasted words, and all content is relevant to selecting and invoking the tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 10 parameters, a nested env object, and no output schema, the description covers return values, default behavior, multi-replica indexing, and shell-safety guidance. It provides a complete operational picture for an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, but the tool description fully compensates by listing all 10 parameters with clear explanations, defaults, and special semantics such as `project_dir` copying and `index` for replicas. This is exactly the information an agent needs to fill parameters correctly.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Run a command inside an already-running compose service container', which names a specific verb and resource scope. It also references `container_exec` as a related tool, helping to position this tool relative to a sibling.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description makes clear this tool targets compose-managed service containers and mentions `container_exec` as an alternative, but it does not explicitly state when to prefer one over the other. It does give concrete execution guidance about using exec-form argv versus `sh -c` forms to handle shell metacharacters.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compose_imagesA
Read-only

List the images used by a compose project's services, parsed from --format json.

Answers "what image and tag does each service container actually run?" — the containers must exist (compose_up/compose_create first). Use compose_ps for container state and image_list for daemon-wide images. Raises RuntimeError if the CLI call fails.

args: project_dir - Dir with the compose file (default: server cwd; copied to the target host if no local plugin) files - Explicit compose file paths (repeatable, -f) project_name - Compose project name override services - Restrict to these services (default: all) returns: list - One dict per container image (service, container, repository, tag, id, size)

ParametersJSON Schema
NameRequiredDescriptionDefault
filesNo
servicesNo
project_dirNo
project_nameNo

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare `readOnlyHint: true` and `destructiveHint: false`, so the safety profile is covered. The description adds valuable behavioral details like raising RuntimeError on CLI failure and the nuance that `project_dir` may be copied to the target host if no local plugin. It does not contradict annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections (purpose, usage, args, returns). Every sentence adds value, though the 'Answers...' sentence slightly overlaps with the first line. It remains compact given the parameter details and contextual notes.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema and 0% schema param coverage, the description fully specifies parameters, return values, error behavior, and prerequisites. It also references related tools and edge cases (e.g., container existence, plugin copy behavior), making it complete for a read-only tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description compensates by documenting all four parameters with meaningful explanations: `project_dir` (default and copy behavior), `files` (repeatable `-f`), `project_name` (override), and `services` (restrict/default). It also explains the return format, making the parameters and output fully understandable.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists compose project service images, parsed via `--format json`. It distinguishes from sibling tools by specifying the exact question it answers ('what image and tag does each service container actually run?') and contrasts with `compose_ps` and `image_list`.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit usage guidance is provided: when to use (to get actual image/tag per container), prerequisites (containers must exist via `compose_up`/`compose_create`), and alternatives (`compose_ps` for state, `image_list` for daemon-wide). This covers both when and when-not.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compose_killA
Destructive

Send a signal to a compose project's containers (default SIGKILL).

Immediate, with no grace period — prefer compose_stop for a clean shutdown (stop signal, then kill after a timeout). Does not raise on a non-zero CLI exit — inspect returncode/stderr in the result.

args: services - Restrict to these services (default: all) signal - Signal to send (default "SIGKILL"; e.g. "SIGTERM", "SIGHUP") remove_orphans - Also remove containers for services not in the compose file project_dir - Dir with the compose file (default: server cwd; copied to the target host if no local plugin) files - Explicit compose file paths (repeatable, -f) project_name - Compose project name override returns: dict - {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
filesNo
signalNoSIGKILL
servicesNo
project_dirNo
project_nameNo
remove_orphansNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (destructiveHint=true, readOnlyHint=false), the description adds critical behavioral details: immediate execution with no grace period, non-raising behavior on CLI errors, and the exact return shape (returncode/stdout/stderr/truncated). This significantly enriches the agent's understanding beyond what annotations provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured: a one-line summary, a usage alternative note, a failure-handling note, a compact args list, and a returns line. Every sentence carries necessary information, and the most critical usage guidance is front-loaded. No waste or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With 6 optional parameters and no output schema, the description covers all bases: parameter meanings and defaults, return format, error behavior, and when to prefer an alternative. It provides a self-contained guide for invoking this tool correctly, making it fully contextually complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has zero descriptions (schema_description_coverage=0%), but the description's 'args' section thoroughly explains all six parameters, including defaults (e.g., services default all, signal default SIGKILL) and examples (SIGTERM, SIGHUP). It even notes the behavior of project_dir when no local plugin is present. This fully compensates for the missing schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('Send a signal') and resource ('compose project's containers'), clarifies the default signal (SIGKILL), and distinguishes itself from compose_stop by explicitly recommending the latter for clean shutdown. This makes the purpose unambiguous and distinct from siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit guidance on when to use this tool versus compose_stop ('prefer compose_stop for a clean shutdown'), and provides handling instructions for non-zero CLI exits (inspect returncode/stderr). This is strong, actionable usage guidance that covers both selection and error handling.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compose_listA
Read-only

List compose projects known to the daemon (across all directories).

Project-level view (one entry per project); compose_ps lists the containers of a single project. Raises RuntimeError if the CLI call fails.

args: all - Include stopped projects returns: list - One dict per project (parsed from --format json)

ParametersJSON Schema
NameRequiredDescriptionDefault
allNo

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, and the description adds valuable behavioral details such as raising RuntimeError on CLI failure and returning parsed JSON dicts per project. It also clarifies the 'all' parameter includes stopped projects, going beyond the bare schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, well-structured, and front-loaded with the core purpose. Each line adds necessary information: purpose, scope, alternative, error behavior, parameter meaning, and return format, with no wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list tool with one optional parameter, the description is complete. It covers what the tool returns, how the output is parsed, the effect of the only parameter, error behavior, and how it relates to sibling tools, leaving no significant gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, but the description fully explains the only parameter 'all' as 'Include stopped projects.' It also documents the return format ('list - One dict per project'), which compensates for the lack of schema descriptions and output schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists compose projects known to the daemon across all directories, specifying a project-level view with one entry per project. It distinguishes itself from compose_ps, which lists containers of a single project.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context for when to use this tool (listing projects at the project level) and explicitly references compose_ps as the alternative for viewing containers of a single project. It does not list extensive exclusions, but the guidance is sufficient for a simple listing tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compose_logsA
Read-only

Fetch a bounded slice of logs from a compose project (never follows).

Bounded and non-following by design, so it always returns promptly. For one container's logs use container_logs; for a swarm service use service_logs. Log text arrives on stdout. Does not raise on a non-zero CLI exit — inspect returncode/stderr in the result.

args: project_dir - Dir with the compose file (default: server cwd; copied to the target host if no local plugin) files - Explicit compose file paths (repeatable, -f) project_name - Compose project name override services - Restrict to these services (default: all) tail - Lines per container (default 200), or the literal "all" (still capped at MAX_CLI_OUTPUT_BYTES) since - Show logs since this timestamp/duration (e.g. "10m", "2024-01-01T00:00:00") until - Show logs before this timestamp/duration timestamps - Include per-line timestamps returns: dict - {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
tailNo
filesNo
sinceNo
untilNo
servicesNo
timestampsNo
project_dirNo
project_nameNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare readOnlyHint=true and destructiveHint=false. The description adds crucial behavior: 'never follows', 'always returns promptly', 'Log text arrives on stdout', and especially 'Does not raise on a non-zero CLI exit — inspect returncode/stderr in the result.' This goes well beyond annotation hints and helps the agent interpret results correctly.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured: a leading summary paragraph front-loads the core behavior, followed by a compact arg list. Every sentence adds value—no filler. The parameter explanations are grouped logically and remain scannable despite covering 8 parameters.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has 8 parameters, no output schema, and 0% schema description coverage, so the description must carry full weight. It does: it covers all params, return values (dict with returncode/stdout/stderr/truncated), failure behavior (non-zero exit not raising), and placement among siblings. This is fully adequate for an agent to select and invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Although schema description coverage is 0%, the description includes an 'args' block that explains every parameter with concrete meaning: 'project_dir - Dir with the compose file...', 'services - Restrict to these services...', 'tail - Lines per container (default 200), or the literal "all"...', etc. This fully compensates for the bare schema and supplies format hints for `since`/`until`.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource: 'Fetch a bounded slice of logs from a compose project (never follows).' It clearly distinguishes from sibling tools by name-checking `container_logs` and `service_logs` for other log sources, and the 'never follows' qualifier adds precision.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit usage guidance is provided: 'For one container's logs use `container_logs`; for a swarm service use `service_logs`.' It also explains when this tool is appropriate ('bounded and non-following by design, so it always returns promptly'), giving the agent clear decision criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compose_pauseA

Pause the containers of a compose project (freezes their processes in place).

Paused containers stop consuming CPU but keep memory, network endpoints, and state; resume with compose_unpause. To actually stop containers (each one's configured stop signal, freeing resources) use compose_stop; to stop and delete them use compose_down. Does not raise on a non-zero CLI exit — inspect returncode/stderr in the result.

args: services - Restrict to these services (default: all) project_dir - Dir with the compose file (default: server cwd; copied to the target host if no local plugin) files - Explicit compose file paths (repeatable, -f) project_name - Compose project name override returns: dict - {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
filesNo
servicesNo
project_dirNo
project_nameNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only indicate readOnlyHint=false and destructiveHint=false. Description adds substantial behavioral context: what happens to processes (frozen), what resources are retained (memory, network endpoints, state), and crucially the non-raising CLI behavior requiring returncode/stderr inspection. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

First sentence states the core action. Second provides key trade-offs and alternatives. Third covers error behavior. Args list is concise and directly follows. Every sentence earns its place; no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers purpose, usage distinctions, behavioral nuances (process freezing, resource retention), error handling, parameters with defaults, and return format (dict with returncode, stdout, stderr, truncated). No output schema exists, so the return description is sufficient. Complete for a compose control tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has 0% coverage, but description includes an args section with clear semantics and defaults for all 4 parameters: services (restrict, default all), project_dir (default server cwd, remote copy note), files (explicit -f paths), project_name (override). This fully compensates for missing schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the tool pauses compose project containers ('Pause the containers of a compose project') and explicitly differentiates from siblings: resume with compose_unpause, stop with compose_stop, and stop+delete with compose_down. The verb and resource are specific.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit guidance on when to use this tool versus alternatives, including semantic differences ('Paused containers stop consuming CPU but keep memory, network endpoints, and state') and direct references to compose_unpause, compose_stop, and compose_down. Also notes error behavior (does not raise on non-zero CLI exit) and how to inspect results.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compose_portA
Read-only

Resolve the host binding for a service's container port.

The compose equivalent of docker port: which host address/port a service's private port is published on. published is None when the port isn't published. For non-compose containers read container_inspect's NetworkSettings.Ports instead. Raises RuntimeError if the CLI call fails.

args: service - Service name from the compose file private_port - The container-internal port to look up protocol - "tcp" (default) or "udp" index - Container index when the service has multiple replicas (default 1) project_dir - Dir with the compose file (default: server cwd; copied to the target host if no local plugin) files - Explicit compose file paths (repeatable, -f) project_name - Compose project name override returns: dict - {"service", "private_port", "protocol", "published": "host:port"|None, "host": str|None, "port": int|None, "bindings": list[str]}. published/host/port describe the first binding; bindings lists every line (a port can be published on more than one address, e.g. IPv4 and IPv6).

ParametersJSON Schema
NameRequiredDescriptionDefault
filesNo
indexNo
serviceYes
protocolNotcp
project_dirNo
private_portYes
project_nameNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, but the description adds valuable behavioral context: it explains the published=None case, the RuntimeError on CLI failure, and the exact return schema. It also notes project_dir is copied to the target host when no local plugin exists, which goes beyond annotation data.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with purpose, then organized into args and returns sections. Every line earns its place: parameter meanings, defaults, exceptions, and return semantics. It is detailed but not redundant with the schema.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 7 params, no output schema, and no enum constraints, the description provides everything an agent needs to select and invoke correctly: purpose, alternatives, failure behavior, param semantics, and return structure. It is complete for safe, correct use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must carry the full parameter burden. It does so thoroughly: each of the 7 parameters is named with meaning and defaults (protocol, index, project_dir, files repeatable, project_name override). The return dict is also fully documented.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb 'Resolve' and resource 'host binding for a service's container port', clearly distinguishing it from container-level tools. It also frames it as 'The compose equivalent of `docker port`', which disambiguates it from sibling compose commands.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly states when not to use this tool: 'For non-compose containers read `container_inspect`'s NetworkSettings.Ports instead.' This gives a clear alternative and contextual boundary, which is exactly the kind of guidance needed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compose_psA
Read-only

List containers in a compose project, parsed from --format json.

Container-level view of one project (state, health, publishers); compose_list enumerates projects, and container_list covers non-compose containers. Does not raise on a non-zero CLI exit: services comes back empty — inspect raw.stderr.

args: project_dir - Dir with the compose file (default: server cwd; copied to the target host if no local plugin) files - Explicit compose file paths (repeatable, -f) project_name - Compose project name override services - Restrict output to these services all - Include stopped containers as well returns: dict - {"services": list[dict], "raw": }; on non-zero exit services is an empty list and the caller should inspect raw.stderr.

ParametersJSON Schema
NameRequiredDescriptionDefault
allNo
filesNo
servicesNo
project_dirNo
project_nameNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, and the description adds critical behavior beyond that: 'Does not raise on a non-zero CLI exit: services comes back empty — inspect raw.stderr.' It also explains the return format and that output is parsed from `--format json`, giving the agent a full picture of what to expect.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is highly efficient: one sentence for purpose, one for differentiation, one for error behavior, then a concise args list and return type. Nothing is redundant; it front-loads the essential purpose and immediately distinguishes from siblings, making it easy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only list tool with no output schema, the description is complete: it explains the return dict, the error behavior (empty services, inspect raw.stderr), and parameter defaults. It covers all necessary context for an agent to invoke it correctly and interpret results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description compensates fully with an 'args' section that explains every parameter (project_dir, files, project_name, services, all). Each has a clear meaning and default, e.g., 'project_dir - Dir with the compose file (default: server cwd; copied to the target host if no local plugin)'. This provides complete semantic coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'List containers in a compose project, parsed from `--format json`.' It clearly distinguishes from siblings by stating 'compose_list enumerates projects, and container_list covers non-compose containers.' This is a precise, unambiguous purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly names alternatives and when they apply: 'compose_list enumerates projects, and container_list covers non-compose containers.' It also provides behavioral guidance for error handling ('Does not raise on a non-zero CLI exit... inspect raw.stderr'), which helps the agent know when and how to use the tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compose_pullA

Pre-fetch images for a compose project's services without starting them.

Use this to stage images before an outage window, to refresh cached images before compose_up, or to verify images are accessible without starting containers. For registry-authenticated pulls ensure the daemon is logged in first with system_login. compose_up --pull always does the same as part of startup; use this tool when you want to separate the pull step.

args: project_dir - Dir with the compose file (default: server cwd; copied to the target host if no local plugin) files - Explicit compose file paths (repeatable, -f; overrides auto-discovery) project_name - Override the compose project name services - Pull only these services; omit to pull all ignore_pull_failures - Continue if an individual image pull fails timeout_seconds - Subprocess timeout (default 1800s for large image pulls) returns: dict - {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
filesNo
servicesNo
project_dirNo
project_nameNo
timeout_secondsNo
ignore_pull_failuresNo

TDQS

A4.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With annotations only providing readOnlyHint=false and destructiveHint=false, the description carries the burden of behavioral detail. It states that containers are not started, explains the project_dir copying behavior for remote hosts, and mentions ignore_pull_failures semantics and timeout default. It does not contradict annotations and adds useful context, though it could elaborate on failure modes beyond the return dict.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured: a one-sentence purpose, then usage guidance, then a parameter list, then return value. Every sentence adds value—no filler. It is longer than average, but the added length is justified by the density of useful information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite no output schema, the description includes the return dict format, which covers expected results. It also provides parameter details, alternatives, and prerequisites. For a tool with 6 parameters and no schema coverage, this description is remarkably complete and leaves no major gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must fully explain the 6 parameters. It does so: project_dir, files, project_name, services, ignore_pull_failures, and timeout_seconds each get a clear, schema-enriching explanation. This more than compensates for the lack of schema-level documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific action: 'Pre-fetch images for a compose project's services without starting them.' This clearly states the verb, resource, and scope, and distinguishes it from siblings like compose_up and image_pull by emphasizing the separation of pulling from startup.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit use cases ('stage images before an outage window', 'refresh cached images before compose_up', 'verify images are accessible without starting containers') and directly contrasts with compose_up --pull always, telling the agent when to prefer this tool. It also notes the prerequisite for registry-authenticated pulls (system_login).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compose_restartA

Stop then start services without recreating containers or applying config changes.

Use this to bounce a service (e.g. to pick up a runtime file change or clear an in-memory state). If the compose file has changed (new image, environment, volumes, ports) use compose_up instead — it recreates affected containers to apply the diff. stop_timeout_seconds controls the SIGTERM grace period before Docker sends SIGKILL.

args: project_dir - Dir with the compose file (default: server cwd; copied to the target host if no local plugin) files - Explicit compose file paths (repeatable, -f) project_name - Override the compose project name services - Restart only these services; omit to restart all stop_timeout_seconds - Seconds to wait for graceful stop before SIGKILL timeout_seconds - Subprocess timeout (default 300s) returns: dict - {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
filesNo
servicesNo
project_dirNo
project_nameNo
timeout_secondsNo
stop_timeout_secondsNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses key behavioral traits beyond the annotations: it does not recreate containers or apply config changes, it stops then starts services, and it describes the SIGTERM/SIGKILL grace period controlled by stop_timeout_seconds. It also explains the project_dir behavior when no local plugin is present. The return dict is specified, which is valuable since there is no output schema. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is appropriately sized and well-structured. It starts with a clear one-sentence summary, then usage guidance, then an alternative, followed by a compact parameter list. Every sentence earns its place with no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has six optional parameters and no output schema, the description is remarkably complete. It covers the exact operation, when to use it, alternatives, all parameter semantics, the return format, and important behavior like SIGKILL and file copying. It is sufficient for an agent to select and invoke the tool correctly without further documentation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has zero descriptions for parameters, but the description provides a complete arg list with meaningful explanations for all six parameters: project_dir, files, project_name, services, stop_timeout_seconds, and timeout_seconds. This fully compensates for the absent schema descriptions and adds context like defaults and repeatability.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource: 'Stop then start services without recreating containers or applying config changes.' This clearly distinguishes compose_restart from compose_up, which handles config changes, by explicitly naming the alternative. The purpose is unambiguous and strongly scoped.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides explicit usage guidance: 'Use this to bounce a service (e.g. to pick up a runtime file change or clear an in-memory state).' It also gives a clear when-not-to-use direction: 'If the compose file has changed (new image, environment, volumes, ports) use compose_up instead.' This directly addresses alternatives and exclusion criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compose_runA

Run a one-off command against a compose service.

Always passes -T (no TTY under MCP). Defaults to detached with --rm so the call returns promptly. Unlike compose_exec, this starts a NEW container for the service rather than running inside the existing one.

args: service - Service name from the compose file command - Command + args to run (exec-form; no shell unless you invoke one) project_dir - Dir with the compose file (default: server cwd; copied to the target host if no local plugin) files - Explicit compose file paths (repeatable, -f) project_name - Compose project name override detach - Run detached (default True) rm - Remove the container after the run (default True) no_deps - Don't start linked services workdir - Working directory inside the container user - User to run as inside the container (uid or name) env - Environment variables to set inside the container name - Optional container name timeout_seconds - Subprocess timeout (default 600s) returns: dict - {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
rmNo
envNo
nameNo
userNo
filesNo
detachNo
commandNo
no_depsNo
serviceYes
workdirNo
project_dirNo
project_nameNo
timeout_secondsNo

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations indicate readOnlyHint=false and destructiveHint=false. The description adds valuable behavioral details beyond this: it always disables TTY, defaults to detached mode with container removal, and creates a new container for each run. It does not mention auth/error behavior, but the disclosure of the --rm default and the new-container semantics is significant and non-contradictory.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-organized: a one-sentence purpose, two sentences of behavioral context, a complete args list, and a return type. Every sentence adds value and there is no redundant or fluff content. The structure is front-loaded with the most important information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description specifies the return dict with fields (returncode, stdout, stderr, truncated). It covers all parameters, key behavioral defaults, and the MCP-specific TTY constraint. Minor gaps include not elaborating on what 'truncated' means or how detached mode affects stdout/stderr, but these are acceptable given the overall richness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Despite 0% schema description coverage, the description contains a complete 'args:' section explaining all 13 parameters in meaningful terms. Examples include noting that command runs in exec-form unless a shell is invoked, project_dir is copied if no local plugin, and timeout_seconds defaults to 600. This fully compensates for the schema's lack of descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource: 'Run a one-off command against a compose service.' It also explicitly differentiates from compose_exec by stating that it starts a NEW container rather than running inside an existing one, making its purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear behavioral context: always passes -T, defaults to detached with --rm, and explicitly contrasts with compose_exec. It implies the intended use case (one-off commands in a new container) but does not explicitly list alternative tools or say when not to use it, falling just short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compose_startA

Start existing (stopped) containers of a compose project.

Counterpart to compose_stop: starts existing containers without recreating them. Use compose_up to (re)create containers from the compose file.

args: project_dir - Dir with the compose file (default: server cwd; copied to the target host if no local plugin) files - Explicit compose file paths (repeatable, -f) project_name - Compose project name override services - Specific services to start (default: all) timeout_seconds - Subprocess timeout (default 600s) returns: dict - {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
filesNo
servicesNo
project_dirNo
project_nameNo
timeout_secondsNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already signal readOnlyHint=false and destructiveHint=false. The description adds crucial behavioral context by noting it starts containers 'without recreating them' and that project_dir is 'copied to the target host if no local plugin.' It also documents the return dict, providing transparency beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and well-structured: one sentence for purpose, one for usage boundaries, and a terse arg/returns list. Every sentence earns its place, and the format is easy to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's moderate complexity, the description covers purpose, alternatives, all parameter semantics, and the return structure. It provides enough context for an agent to invoke compose_start correctly without needing external docs.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description fully compensates by explaining all five parameters with defaults and semantics, e.g., 'project_dir (default: server cwd; copied to the target host if no local plugin)' and 'timeout_seconds (default 600s).' This adds meaning far beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a clear statement of action and object: 'Start existing (stopped) containers of a compose project.' It explicitly contrasts with compose_stop and compose_up, making its unique scope immediately apparent and distinguishing it from siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly states when to use this tool versus alternatives: 'Counterpart to compose_stop' and 'Use compose_up to (re)create containers from the compose file.' This gives direct, actionable guidance on tool selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compose_stopA

Stop services in a compose project without removing their containers.

Unlike compose_down, containers/networks/volumes survive — use compose_start to bring them back.

args: project_dir - Dir with the compose file (default: server cwd; copied to the target host if no local plugin) files - Explicit compose file paths (repeatable, -f) project_name - Compose project name override services - Specific services to stop (default: all) stop_timeout_seconds - Grace period before SIGKILL (passed as --timeout) timeout_seconds - Subprocess timeout (default 300s) returns: dict - {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
filesNo
servicesNo
project_dirNo
project_nameNo
timeout_secondsNo
stop_timeout_secondsNo

TDQS

A4.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=false and destructiveHint=false, but the description adds value by specifying exactly what happens: containers are not removed, and state survives so compose_start can restore them. It also notes that stop_timeout_seconds is passed as `--timeout`, disclosing a key behavior. It does not mention side effects like process termination inside containers, but that is implied by 'stop services' and the non-destructive guarantee.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the main purpose and the key differentiator from compose_down. The args section is structured and includes defaults/explanations. Every sentence provides useful information with no redundancy or fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the six parameters, zero schema coverage, and no output schema, the description provides everything needed to invoke the tool: it lists all parameters, their defaults, and the return dict shape (returncode, stdout, stderr, truncated). This is sufficient for an agent to select and call compose_stop correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description fully carries parameter semantics. It explains all six parameters: project_dir (default and host copying if no local plugin), files (repeatable -f), project_name (override), services (default all), stop_timeout_seconds (grace period), and timeout_seconds (subprocess default 300s). This is complete and actionable.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Stop services in a compose project without removing their containers.' This precisely distinguishes compose_stop from its siblings, particularly compose_down and compose_start. The scope is clear: it stops services but preserves containers/networks/volumes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly contrasts with compose_down: 'Unlike compose_down, containers/networks/volumes survive — use compose_start to bring them back.' This tells the agent when to choose this tool (when persistence of infrastructure is desired) and points to the sibling for the reverse operation. The parameter defaults and the fact that services defaults to 'all' further clarify usage context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compose_topA
Read-only

Show the running processes of a compose project's containers.

Output is the ps-style process table per service (not JSON); read it from stdout. The per-container equivalent is container_top. Does not raise on a non-zero CLI exit — inspect returncode/stderr in the result.

args: services - Restrict to these services (default: all) project_dir - Dir with the compose file (default: server cwd; copied to the target host if no local plugin) files - Explicit compose file paths (repeatable, -f) project_name - Compose project name override returns: dict - {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
filesNo
servicesNo
project_dirNo
project_nameNo

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds valuable behavioral details beyond the readOnlyHint and destructiveHint annotations: output is ps-style text (not JSON) read from stdout, and the tool does not raise on non-zero CLI exit (inspect returncode/stderr). This fully discloses the tool's observable behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured: main purpose first, then output format, error behavior, parameter list, and return value. Every sentence contributes necessary information without restating schema defaults or annotations. Length is appropriate for the tool's complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only tool with 4 parameters and no output schema, the description covers purpose, output format, error handling, parameter semantics, and return structure. It is self-sufficient for an agent to select and invoke the tool correctly, and it even mentions the alternative 'container_top'.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With schema description coverage at 0%, the description compensates by listing all four parameters with readable explanations. It adds meaningful semantics such as 'project_dir' being copied to the target host if no local plugin, and 'files' being repeatable via '-f', which are not evident from the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description begins with a specific verb+resource: 'Show the running processes of a compose project's containers.' It clearly distinguishes from related tools by noting the per-container equivalent is 'container_top' and by emphasizing compose project scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides context for use (compose project containers) and explicitly names 'container_top' as the per-container alternative. However, it does not explicitly contrast with the sibling 'compose_ps' or state clear when-not-to-use conditions, so it falls slightly short of full guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compose_unpauseA

Unpause the containers of a compose project (resumes paused processes).

Reverse of compose_pause: processes continue from where they were frozen (no restart). compose_start is the counterpart for stopped containers. Does not raise on a non-zero CLI exit — inspect returncode/stderr in the result.

args: services - Restrict to these services (default: all) project_dir - Dir with the compose file (default: server cwd; copied to the target host if no local plugin) files - Explicit compose file paths (repeatable, -f) project_name - Compose project name override returns: dict - {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
filesNo
servicesNo
project_dirNo
project_nameNo

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With annotations already indicating a mutating but non-destructive operation, the description adds valuable context: it clarifies the resume-from-frozen behavior and the non-raising exit strategy. This goes beyond the annotations without contradicting them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is efficiently structured: purpose first, then comparisons, then error behavior, then parameters, then return value. No fluff, though the args list could be slightly more concise; each sentence contributes useful information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a state-changing compose tool with 4 optional parameters and no output schema, the description covers the operation, alternatives, error behavior, parameter semantics, and return format. It leaves out prerequisites like project existence but that's inferable from context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has 0% description coverage, but the description compensates by explaining each parameter's purpose (services, project_dir, files, project_name) with defaults and special notes (e.g., project_dir copied to target host if no local plugin). This adds meaning beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb+resource structure: 'Unpause the containers of a compose project'. It clearly distinguishes from compose_pause (reverse) and compose_start (counterpart for stopped containers), making the purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use this tool versus alternatives: 'Reverse of compose_pause' and 'compose_start is the counterpart for stopped containers'. Also provides guidance on error handling (does not raise on non-zero exit) which informs proper invocation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compose_upA

Bring up a Docker Compose project, detached.

Always runs detached (-d) so it can't block the server. Use compose_ps to confirm services are running, or wait=True to block until they're healthy.

args: project_dir - Dir with the compose file (default: server cwd, copied to the target host if no local plugin; paths verbatim, no shell expansion) files - Explicit compose file paths (repeatable, -f) project_name - Compose project name override profiles - Profiles to activate services - Specific services to bring up (default: all) build - Build images before starting pull - Pull strategy; omit to use each service's own pull_policy remove_orphans - Remove containers for services not in the compose file wait - Block until services are healthy (adds --wait) timeout_seconds - Subprocess timeout (default 600s) returns: dict - {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
pullNo
waitNo
buildNo
filesNo
profilesNo
servicesNo
project_dirNo
project_nameNo
remove_orphansNo
timeout_secondsNo

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses important behavior: it always runs detached to avoid blocking the server, and explains the optional wait behavior. Annotations (readOnlyHint=false) align with the mutating nature of starting containers. The description adds transparency beyond the annotations by clarifying the detach behavior and how to ensure readiness.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is succinct and well-structured. It starts with a clear one-liner, then lists parameters in a consistent format without unnecessary verbosity. Every sentence adds value, making it easy to scan and understand quickly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's moderate complexity (10 optional parameters), the description covers all parameters and provides sufficient behavioral context. It also specifies the return format (dict with returncode, stdout, stderr, truncated). However, it does not elaborate on error handling or edge cases, but this is not essential for basic usage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has no descriptions (0% coverage), but the description compensates by explaining each parameter concisely. For example, 'pull' is explained as 'Pull strategy; omit to use each service's own pull_policy', and 'wait' is defined as 'Block until services are healthy'. This provides meaningful semantics for all parameters without relying on the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Bring up a Docker Compose project, detached.' It distinguishes itself from sibling tools like compose_start by focusing on bringing up the project and explicitly mentioning the detached mode, which is a key behavioral difference.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides practical usage guidance: it notes that the command always runs detached, suggests using 'compose_ps' to confirm services are running, and mentions the 'wait' parameter to block until healthy. This gives clear context on when and how to use the tool, though it could explicitly contrast with compose_start or compose_run for stronger differentiation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

compose_waitA
Read-only

Block until the named service containers stop, then return their exit codes.

For one-shot / batch services. A long-running service that never exits blocks until timeout_seconds, then the subprocess is killed (TimeoutExpired) — bound it sensibly. Exit codes are on stdout. For a single container use container_wait; for swarm services use service_wait.

args: services - One or more services to wait on. At least one is required. project_dir - Dir with the compose file (default: server cwd; copied to the target host if no local plugin) files - Explicit compose file paths (repeatable, -f) project_name - Compose project name override timeout_seconds - Subprocess timeout (default 300s) returns: dict - {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
filesNo
servicesYes
project_dirNo
project_nameNo
timeout_secondsNo

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds valuable behavioral context: it blocks until timeout, kills the subprocess on timeout (TimeoutExpired), returns exit codes on stdout, and notes the project_dir copy behavior. This goes beyond the annotations without contradicting them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with a clear one-sentence purpose, followed by usage notes and a structured args block. It's a bit long but every section earns its place—especially given the lack of schema descriptions. The formatting is clear and scannable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a medium-complexity tool with 5 parameters and no output schema, the description covers everything needed: purpose, usage context, parameter semantics, timeout behavior, and return value format. It even distinguishes from related tools. No critical information is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description fully compensates with an args section explaining each parameter: services (required), project_dir (default server cwd, copied to target if no plugin), files (repeatable), project_name (override), timeout_seconds (default 300). This adds meaning that the schema alone lacks, and even covers nuance like the plugin copy behavior.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states precisely what the tool does: blocks until named service containers stop and returns their exit codes. It clearly identifies the resource (compose services) and the action (wait), and explicitly differentiates from sibling tools like container_wait and service_wait.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit guidance on when to use this tool: for one-shot/batch services, and warns about long-running services with timeout_seconds. It even names alternatives: 'For a single container use container_wait; for swarm services use service_wait.' This is exemplary usage guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

config_createA

Create an immutable Swarm config object; requires a swarm manager.

Configs store non-sensitive configuration files (nginx.conf, app.yaml, etc.) and mount them into service containers at a specified path. Unlike secrets, config data is not encrypted at rest — use secret_create for credentials or keys. data is raw bytes; encode strings first (e.g. "my config".encode()). Once created, a config is immutable: to update it, create a new config with a new name and update the service to reference it, then remove the old config with config_remove.

args: name - Unique config name within the swarm data - Raw bytes content of the config file labels - Labels to set on the config templating - Templating driver config (e.g. {"Name": "golang"} for Go template syntax) returns: dict - The created config's attrs ({"ID", "Version", "CreatedAt", "Spec", ...})

ParametersJSON Schema
NameRequiredDescriptionDefault
dataYes
nameYes
labelsNo
templatingNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only provide readOnlyHint=false and destructiveHint=false, but the description adds critical behavioral context: requires a swarm manager, configs are not encrypted at rest, data must be raw bytes with encoding advice, and configs are immutable with a prescribed update process. It also describes the return dict structure, going well beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a concise opening, purposeful explanatory sentences, a clear args section, and a returns line. Every sentence adds value—no fluff. Despite being detailed, it remains focused and scannable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 4-param tool with no output schema, the description is complete: all parameters are explained, the return value is specified, usage context and constraints are covered, and the immutability workflow is fully described. It leaves no critical gaps for an agent to invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description fully compensates by documenting all four parameters: name (unique within swarm), data (raw bytes, encode strings), labels, and templating with an example format. This adds meaning far beyond the bare schema types.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Create an immutable Swarm config object', and immediately distinguishes itself from secret_create and config_remove by explaining configs are for non-sensitive files. This clearly states what the tool does and differentiates it from relevant siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly says when to use this tool (non-sensitive config files) and when to use secret_create instead (credentials/keys). It also provides an update workflow: create a new config, update the service, then remove the old config with config_remove. This is explicit usage guidance with alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

config_inspectA
Read-only

Get a swarm config's full inspect payload by id or name.

Requires a swarm manager. Unlike a secret, a config's payload IS readable after creation: Spec.Data in the result holds the base64-encoded contents. Use config_list to enumerate configs; use this to read one config's contents and metadata.

args: id_or_name - The config id or name returns: dict - The config's attrs (ID, CreatedAt, UpdatedAt, Spec{Name, Labels, Data base64})

ParametersJSON Schema
NameRequiredDescriptionDefault
id_or_nameYes

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already state readOnlyHint=true and destructiveHint=false, but the description adds valuable context: swarm manager requirement, post-creation readability, and base64 encoding of Spec.Data. No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose is front-loaded in the first sentence. Every subsequent sentence adds essential context: preconditions, comparison to secrets, usage guidance, and return format. No fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter, no-output-schema tool, the description covers prerequisites, usage, return value structure, and behavioral nuance. Fully sufficient for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description carries full weight. It defines id_or_name as accepting 'id or name' and documents the return dict's structure (ID, CreatedAt, UpdatedAt, Spec fields). Adds clear meaning beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Get a swarm config's full inspect payload by id or name', which is a specific verb+resource+scope. It also distinguishes from config_list by noting 'use this to read one config's contents and metadata'.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says 'Requires a swarm manager' and contrasts with secrets: 'Unlike a secret, a config's payload IS readable after creation'. It also directs users to config_list for enumeration, providing clear when-to-use vs alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

config_listA
Read-only

List swarm configs; requires a swarm manager.

Unlike secrets, config attrs include the actual config data (Spec.Data, base64-encoded) since configs are not treated as sensitive. Valid filter keys: id, name, names, label (key or key=value). Fetch a single config by id/name with config_inspect.

args: filters - Narrow the list; omit to return every config returns: list - One full config document ({"ID", "Spec", ...}) per config

ParametersJSON Schema
NameRequiredDescriptionDefault
filtersNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate a safe read operation, but the description adds important behavioral context: configs include base64-encoded Spec.Data unlike secrets, and a swarm manager is required. This goes beyond annotations and warns about data volume, improving transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three short, focused paragraphs front-load the core action. Every sentence delivers value—usage context, filter keys, return shape—with no fluff or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the single parameter and no output schema, the description provides all necessary operational details: prerequisite, filter syntax, and return document structure. The agent can confidently invoke this tool without additional lookup.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has zero description coverage for the 'filters' parameter. The description fully compensates by explaining the parameter's purpose, valid filter keys, and the default behavior when omitted.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'List swarm configs,' using a specific verb and resource. It distinguishes itself from config_inspect and config_remove, and notes the difference from secrets, making its purpose unambiguous among many sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly states the prerequisite ('requires a swarm manager'), provides valid filter keys, and directs users to config_inspect for single-config lookup. This gives clear when-to-use and when-not-to-use guidance, including an alternative tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

config_removeA
Destructive

Remove a swarm config.

Requires a swarm manager, and fails while any service still references the config — update or remove those services first. The last step of the rotation flow described in config_create.

args: id_or_name - The config id or name returns: bool - True after removal

ParametersJSON Schema
NameRequiredDescriptionDefault
id_or_nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (destructiveHint=true), the description discloses that a swarm manager is required, the tool fails if services reference the config, and it is the final step in a config rotation flow. It also clarifies the return type (bool) and the condition for success, providing significant behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and front-loaded with a single primary purpose sentence. It then provides essential prerequisite and flow context, followed by a clear args/returns section. No wasted words; every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter destructive tool, the description covers the key aspects: what it does, prerequisites, failure conditions, and the argument meaning. It references config_create for the broader workflow, making it complete within the tool family context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema provides only a string parameter named id_or_name with no description. The description adds semantic value by specifying that this is 'The config id or name,' clarifying that either identifier can be used. It also documents the return value, which is useful despite the output schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Remove a swarm config,' a specific verb+resource that clearly distinguishes this tool from its siblings config_create, config_inspect, and config_list. It also adds context about being the last step of a rotation flow, reinforcing its unique role.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states the requirement for a swarm manager and explicitly warns that removal fails while services still reference the config, advising to update or remove those services first. This provides clear when-to-use and when-not-to-use guidance, though it does not explicitly name alternative tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_archive_getA
Read-only

Retrieve a file or directory from a container as a tar archive, returned in band.

For large paths prefer container_archive_get_to_file, which streams to a host path; the in-band bytes here are capped (default 32 MiB) because MCP base64-encodes them.

args: id_or_name - The container id or name path - Path inside the container max_bytes - Abort with ValueError if the archive exceeds this many bytes (defaults to 32 MiB) returns: dict - Mapping with archive (bytes) and stat (dict) keys

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes
max_bytesNo
id_or_nameYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond annotations (readOnlyHint, destructiveHint), the description discloses that bytes are returned in-band, that MCP base64-encoding creates a 32 MiB default cap, that exceeding it aborts with ValueError, and that the return is a dict with `archive` and `stat` keys. This is richer behavioral context than typical.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured and front-loaded: one sentence for purpose, one for usage guidance, then a compact argument list. Every sentence earns its place, and the format aids readability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 3-parameter read-only tool without an output schema, the description covers purpose, usage, parameters, and return format. It also names the alternative for large paths, making the tool self-contained and sufficiently complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description compensates completely by explaining each parameter: `id_or_name` (container id/name), `path` (inside container), and `max_bytes` (abort if exceeded, default 32 MiB). It adds meaning far beyond the raw schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description begins with a specific verb and resource: 'Retrieve a file or directory from a container as a tar archive, returned in band.' It clearly distinguishes this tool from the sibling `container_archive_get_to_file` by explicitly contrasting in-band vs. streaming to host path.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit guidance: 'For large paths prefer `container_archive_get_to_file`' and explains why (in-band bytes capped because MCP base64-encodes them). This provides a clear when-to-use and when-not-to-use directive with a named alternative.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_archive_get_to_fileA

Retrieve a file or directory from a container as a tar archive written to a file on the server host.

File-writing variant of container_archive_get — prefer it for anything large, since in-band bytes are base64-encoded by MCP. For the whole filesystem use container_export. Streams straight to disk (no in-band byte cap). The file is written by the server's user; ~ is expanded and an existing file is refused unless overwrite=True.

args: id_or_name - The container id or name path - Path inside the container dest_path - Destination path on the server host for the tarball overwrite - Replace dest_path if it already exists (default False) returns: dict - {"path": , "bytes_written": int, "stat": dict}

ParametersJSON Schema
NameRequiredDescriptionDefault
pathYes
dest_pathYes
overwriteNo
id_or_nameYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (readOnlyHint=false, destructiveHint=false), the description discloses important behavioral details: streams straight to disk with no in-band byte cap, file written by the server's user, '~' expansion, and refusal of existing files unless overwrite=True. This adds meaningful context not present in structured data.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured: it starts with a direct purpose statement, then gives rationale for use, then lists parameters in an organized block. Every sentence adds value—no filler or redundancy—striking an excellent balance between completeness and efficiency.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's moderate complexity and lack of output schema, the description covers all critical aspects: what it does, when to use it, behavior around file overwrites and path expansion, and the return value structure. It is self-sufficient for an agent to invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With schema description coverage at 0%, the description fully compensates by providing clear one-line meanings for each parameter: id_or_name, path, dest_path, and overwrite (including default behavior). This gives the agent complete understanding of expected inputs beyond bare schema types.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description begins with a clear verb ('Retrieve') and specific resource ('file or directory from a container as a tar archive written to a file on the server host'). It immediately distinguishes itself from sibling tools by noting it is the 'File-writing variant of container_archive_get' and contrasts with 'container_export' for whole filesystem use.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use this tool: 'prefer it for anything large, since in-band bytes are base64-encoded by MCP'. It also provides a clear alternative for a different use case: 'For the whole filesystem use container_export'. This gives decisive guidance on selection among related tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_archive_putA

Upload a tar archive to a path inside a container, from in-band bytes or a file on the server host.

Inverse of container_archive_get: the archive is extracted at path inside the container. Pass exactly one of data (tar bytes in band) or from_file (a path on the server host, streamed straight to the daemon — preferred for large archives, since in-band bytes are base64-encoded by MCP). from_file is read by the server's user; ~ is expanded.

args: id_or_name - The container id or name path - Destination path inside the container (must already exist) data - Tar archive bytes; exactly one of data/from_file from_file - Path on the server host to the tar archive to upload; exactly one of data/from_file returns: bool - True if the upload succeeded

ParametersJSON Schema
NameRequiredDescriptionDefault
dataNo
pathYes
from_fileNo
id_or_nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only convey readOnlyHint=false and destructiveHint=false, so the description carries the burden. It adds valuable behavioral details: from_file is read by server's user, ~ expansion, streaming to daemon, base64 encoding of in-band data, and the path must already exist. It does not mention overwrite semantics or error cases, but overall is transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured: a concise summary, then additional context, then a clear args block. Each sentence adds value, and the formatting aids readability without unnecessary verbosity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the tool's core behavior, parameter constraints, and return type, and references the inverse operation. It lacks explicit explanation of error handling when both/neither of data/from_file is provided, but overall it is sufficiently complete given the output schema and annotations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The 'args' section explains every parameter beyond the schema, describing id_or_name as container id/name, path as requiring existence, data as tar bytes, and from_file as a server host path. It also clarifies the 'exactly one' constraint, fully compensating for the 0% schema description coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'Upload a tar archive to a path inside a container' with specific verb and resource. It also distinguishes itself as the 'Inverse of container_archive_get', differentiating it from sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides concrete guidance on when to use each input mode ('preferred for large archives' for from_file) and enforces the mutual exclusivity of data/from_file. It implicitly contrasts with container_archive_get but does not explicitly list exclusion scenarios or alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_commitA

Snapshot a container's current filesystem state as a new image.

Useful for capturing a debugging state or saving manual changes made inside a container. For repeatable builds use image_build with a Dockerfile instead; publish the result with image_tag + image_push. The container is paused by default during the snapshot to ensure filesystem consistency — set pause=False only if the container cannot be paused. changes accepts Dockerfile instructions to apply on top of the snapshot, e.g. ["CMD ["python", "app.py"]", "ENV FOO=bar"].

args: id_or_name - Container id or name to snapshot repository - Repository name for the new image, e.g. "myorg/myimage" tag - Tag for the new image (default: "latest") message - Commit message stored in the image metadata author - Author string stored in the image metadata pause - Pause the container during commit for consistency (default True) changes - Dockerfile instructions (CMD, ENV, EXPOSE, etc.) to apply to the image conf - Additional image configuration overrides as a dict returns: dict - The new image's full inspect payload (Id is the new image id)

ParametersJSON Schema
NameRequiredDescriptionDefault
tagNo
confNo
pauseNo
authorNo
changesNo
messageNo
id_or_nameYes
repositoryNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (readOnlyHint=false, destructiveHint=false), the description discloses important runtime behavior: 'The container is paused by default during the snapshot to ensure filesystem consistency — set `pause=False` only if the container cannot be paused.' It also explains the `changes` semantics and states the return value is the full inspect payload containing the new image id. No annotation contradiction exists.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded with the core purpose. The first sentence defines the action, the second gives use cases and alternatives, and the third explains pause behavior. The args list is terse but informative, with each parameter receiving a short meaningful phrase. No filler or redundant content is present.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

This is a complex 8-parameter tool with no output schema. The description covers all parameters, explains the pause default and exception, describes the `changes` input format, and states the return type ('dict - The new image's full inspect payload'). It provides enough context for an agent to invoke the tool correctly without additional documentation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Although the input schema has no parameter descriptions (0% coverage), the description's dedicated args list explains every single parameter: id_or_name, repository, tag, message, author, pause, changes, and conf. It even gives an example Dockerfile instruction format for `changes`. This fully compensates for the schema's lack of descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific, unambiguous verb phrase: 'Snapshot a container's current filesystem state as a new image.' It clearly identifies the resource (container) and the outcome (image). The description also differentiates from sibling tools by explicitly recommending `image_build` for repeatable builds, which distinguishes this ad-hoc snapshot workflow from declarative image creation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit guidance on when to use the tool: 'Useful for capturing a debugging state or saving manual changes made inside a container.' It also gives concrete alternative guidance: 'For repeatable builds use `image_build` with a Dockerfile instead; publish the result with `image_tag` + `image_push`.' It additionally explains when to disable pause, giving a clear if-then usage rule.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_createA

Create a container from an image without starting it.

Use this when you need to configure a container (with extra_kwargs) before its first start, or want creation and start as separate observable steps. For the common case of create-then-start-immediately use container_run instead — it does both in one call. Start the created container with container_start. Common extra_kwargs keys: name (str), environment (list of "KEY=VAL" or dict), ports (dict, e.g. {"80/tcp": 8080}), volumes (dict, e.g. {"/host/path": {"bind": "/container/path", "mode": "rw"}}), labels (dict). For anything else docker-py's ContainerCollection.create accepts, call docs_lookup(section="containers") rather than guessing a key name.

args: image - Image to create the container from, e.g. "nginx:alpine" command - Override the image's default command; string or list of strings extra_kwargs - Additional docker-py ContainerCollection.create keyword arguments returns: dict - The created container's attrs (not yet running)

ParametersJSON Schema
NameRequiredDescriptionDefault
imageYes
commandNo
extra_kwargsNo

TDQS

A4.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate this is not read-only and not destructive, and the description aligns by stating it creates a container. It adds key behavioral context: the container is not started, and the return value is 'the created container's attrs (not yet running).' It does not describe lifecycle persistence or cleanup implications, but the annotation coverage plus explicit creation/not-running behavior make this sufficient.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured: a one-sentence purpose, a usage paragraph, an args section, and a returns line. Every sentence adds value—examples and alternatives are concrete rather than filler. Though slightly long, the density of actionable information justifies the length.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 3-parameter tool with no output schema, the description covers purpose, usage context, alternatives, parameter details, common kwargs, and return type. It also explains when not to use it (common case should use container_run) and how to discover additional options. This is complete enough for an agent to invoke correctly without prior knowledge.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description fully compensates by documenting every parameter: image with example, command with allowed types (string or list), and extra_kwargs with common keys, value formats, and examples (name, environment, ports, volumes, labels). It even warns against guessing unknown keys and points to docs_lookup, which is excellent semantical guidance.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'Create a container from an image without starting it.' It explicitly distinguishes this from container_run (create-and-start immediately) and container_start (starting an existing container), making the resource and scope unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit when-to-use guidance: configure a container with extra_kwargs before first start, or want separate observable steps. It names alternatives directly: use container_run for create-then-start-immediately and container_start to start the created container. It also tells users to call docs_lookup for unsupported extra_kwargs, preventing guesswork.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_diffA
Read-only

List filesystem changes a container has made relative to its image.

Use it to audit what a container wrote before container_commit or container_archive_get, or to debug unexpected writes. Only the writable container layer is compared — files in volumes and bind mounts never show up.

args: id_or_name - The container id or name returns: list - Dicts of {"Path", "Kind"}; Kind 0=modified, 1=added, 2=deleted

ParametersJSON Schema
NameRequiredDescriptionDefault
id_or_nameYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false. The description adds valuable behavioral context beyond that: it compares only the writable container layer and excludes volumes/bind mounts. This is exactly the kind of nuance an agent needs to interpret results correctly. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded. The first sentence states the core purpose, followed by usage context, a key limitation, and structured args/returns. Every sentence adds information without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only tool with one parameter and no output schema, this description is complete. It covers purpose, when to use, a crucial limitation, parameter semantics, and return format. An agent has everything needed to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must compensate. It does thoroughly: 'args: id_or_name - The container id or name' fully explains the only parameter. It also documents the return format with the Kind meaning, filling the gap left by the missing output schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description starts with a specific verb+resource: 'List filesystem changes a container has made relative to its image.' This clearly distinguishes it from sibling tools like container_inspect or container_logs. It's unambiguous and immediately actionable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use: 'Use it to audit what a container wrote before container_commit or container_archive_get, or to debug unexpected writes.' It also provides a key exclusion: 'files in volumes and bind mounts never show up,' which helps an agent decide against using it when such paths are relevant.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_execA

Run a command inside a running container (for a compose service, prefer compose_exec).

Security: when any element of cmd is agent-controlled, use an exec-form argv list that does not invoke a shell (e.g. ["python", "-V"], ["ls", path]). A string cmd, or a shell form like ["sh", "-c", template], interprets shell metacharacters in the untrusted parts.

args: id_or_name - The container id or name cmd - Command to execute (prefer exec-form argv, no shell, when any element is agent-controlled) stdout - Attach to stdout stderr - Attach to stderr stdin - Attach to stdin tty - Allocate a pseudo-TTY privileged - Run with extended privileges user - User to run the command as detach - Detach from the exec environment - Environment variables workdir - Working directory inside the container demux - Return stdout and stderr separately returns: dict - {"exit_code", "output"}; output is combined stdout+stderr, or a [stdout, stderr] pair with demux=True

ParametersJSON Schema
NameRequiredDescriptionDefault
cmdYes
ttyNo
userNo
demuxNo
stdinNo
detachNo
stderrNo
stdoutNo
workdirNo
id_or_nameYes
privilegedNo
environmentNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the minimal readOnly/destructive annotations, the description discloses important behavioral context: shell metacharacter risks, the exact return structure ({exit_code, output}), and how demux alters the return format. This goes well beyond what annotations alone offer.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured: a one-line purpose, a compact security note, and a clear args list followed by return semantics. Every sentence is informative, with no filler or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 12-parameter tool with no output schema and no parameter descriptions in the schema, this description is self-sufficient. It covers all parameters, return behavior, and a key security caveat, leaving no major gap in the agent's ability to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description compensates fully by listing all 12 parameters with concise, meaningful explanations. It also adds crucial per-parameter guidance for `cmd` (prefer exec-form argv) and `demux` (separate stdout/stderr), making the schema much more usable.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Run a command inside a running container', which names the specific verb, resource, and scope. It also explicitly directs compose-service users to `compose_exec`, distinguishing this tool from a close sibling.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives explicit guidance to prefer `compose_exec` for compose services, and provides security-driven instructions on using exec-form argv when cmd elements are agent-controlled. This clearly communicates when and how to use the tool versus alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_exportA

Export a container's filesystem as a tar archive: to a file on the server host, or in band.

The tar is a flat filesystem snapshot with no image metadata or layers — use image_save for an archive that image_load can restore, and container_archive_get for a single file or directory. With dest_path the archive streams straight to disk (no byte cap), so it handles large containers — the file is written by the server's user, ~ is expanded, and an existing file is refused unless overwrite=True. Without dest_path the tar bytes are returned in band, capped at max_bytes (default 32 MiB) because MCP base64-encodes them — a fallback for when no writable host path exists (e.g. a containerized server without a bind mount).

args: id_or_name - The container id or name dest_path - Destination path on the server host; omit to return the bytes in band overwrite - Replace dest_path if it already exists (default False) max_bytes - In-band mode: abort with ValueError beyond this many bytes (default 32 MiB) returns: bytes | dict - the tar bytes (in band), or {"path": , "bytes_written": int}

ParametersJSON Schema
NameRequiredDescriptionDefault
dest_pathNo
max_bytesNo
overwriteNo
id_or_nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (readOnlyHint=false, destructiveHint=false), the description discloses many behavioral details: the tar is a flat filesystem snapshot with no image metadata, the file write behavior (server user, ~ expansion, refusal of existing files without overwrite), the byte cap in in-band mode with ValueError aborts, and the return format. This significantly aids the agent in anticipating side effects and limitations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but organized: a high-level summary, explicit sibling alternatives, mode-specific behavior, and a parameter list. Every sentence adds value, and the structure makes it easy to parse. It is not bloated despite its length.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (two output modes, overwrite logic, byte caps), the description fully covers selection criteria, behavior, parameter semantics, and return values. The absence of an external output schema is compensated by an explicit 'returns' description. No important context is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, so the description must compensate. It does so thoroughly with an 'args' section explaining each parameter's meaning, default, and behavior (e.g., dest_path omission for in-band mode, overwrite default False, max_bytes cap and abort). This adds essential semantic value beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states that the tool exports a container's filesystem as a tar archive, with two modes: to a file on the server host or in band. It explicitly distinguishes from sibling tools by naming image_save and container_archive_get and explaining their different purposes, making the tool's specific role unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit when-to-use guidance: it recommends image_save for restorable archives, container_archive_get for single files/directories, and explains when to use dest_path vs. in-band mode. It also mentions the fallback justification for in-band mode (containerized server without a writable host path).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_inspectA
Read-only

Return the full inspect detail for a single container.

Use this when you need complete information about one container — config, state, network settings, mounts, environment variables, and resource limits. To enumerate many containers use container_list instead (same payload per container by default; abridged with sparse=True). For just logs or stats use container_logs / container_stats.

args: id_or_name - Container id (full or short) or name returns: dict - Full container inspect attrs (equivalent to docker inspect)

ParametersJSON Schema
NameRequiredDescriptionDefault
id_or_nameYes

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the bar is lower. The description adds value by enumerating the exact categories of data returned (config, state, network settings, mounts, env vars, resource limits) and noting equivalence to `docker inspect`, which gives useful behavioral context beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a purpose sentence, usage paragraph, and args/returns sections. It is slightly wordy—e.g., 'full inspect detail' and 'complete information about one container' are redundant—but every sentence otherwise serves a purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simple scope (one parameter), good annotations, and absence of an output schema, the description is complete. It tells what the return value is ('dict - Full container inspect attrs'), how to invoke it, and how it relates to siblings, leaving little ambiguity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With schema description coverage at 0%, the description fully compensates by explaining the sole parameter: 'id_or_name - Container id (full or short) or name'. This adds meaning beyond the bare schema type (string) and gives clear format expectations.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool 'Return the full inspect detail for a single container', specifying the resource and scope. It explicitly differentiates from siblings by naming `container_list`, `container_logs`, and `container_stats`, making the purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides explicit when-to-use guidance: 'Use this when you need complete information about one container' and directly names alternatives for other cases ('To enumerate many containers use `container_list`', 'For just logs or stats use `container_logs` / `container_stats`'). This is excellent usage direction.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_killA
Destructive

Send a signal to a running container (default SIGKILL — immediate, no graceful shutdown).

Use it to force-kill a container that ignores container_stop, or with signal to poke a process without stopping it (e.g. SIGHUP for a config reload). For a normal shutdown prefer container_stop, which sends the container's configured stop signal first. Fails with a conflict error if the container is not running. When the server runs containerized it refuses to signal its own container.

args: id_or_name - The container id or name signal - Signal name or number as a string (e.g. "SIGHUP", "9"); default SIGKILL returns: dict - The container's full inspect payload after the signal

ParametersJSON Schema
NameRequiredDescriptionDefault
signalNo
id_or_nameYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes well beyond the annotations (readOnlyHint=false, destructiveHint=true) by explaining the destructive nature: 'default SIGKILL — immediate, no graceful shutdown', and documenting edge-case behaviors like failing with a conflict error and refusing to signal its own container in containerized servers. This gives the agent a rich behavioral model without needing to infer from annotations alone.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured: it leads with the core action, then moves to usage guidance, then lists args and returns. Every sentence earns its place—no fluff, no repetition. The args block is formatted cleanly and is immediately scannable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has moderate complexity (signals, error cases, containerized caveat) and no output schema, yet the description covers all critical aspects: purpose, default behavior, usage alternatives, error conditions, return value, and parameter semantics. There is no gap that would leave an agent uncertain.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Even though schema coverage is 0%, the description fully documents both parameters. It defines id_or_name as 'The container id or name' and signal with examples ('SIGHUP', '9') and its default (SIGKILL). This adds crucial semantic detail that the bare schema (signal: string, default null) does not convey.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Send a signal to a running container', and immediately clarifies the default behavior (SIGKILL, no graceful shutdown). It actively differentiates from sibling tools like container_stop by framing this as the force-kill/non-graceful alternative, making the purpose unmistakably distinct.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Usage guidance is explicit and actionable: 'Use it to force-kill a container that ignores container_stop, or with signal to poke a process without stopping it... For a normal shutdown prefer container_stop.' It also covers failure modes (conflict error if not running, refusal to signal own container), providing complete when-to-use and when-not-to-use context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_listA
Read-only

List containers on the daemon (running only by default).

Pass all=True to include stopped containers. For a compose project compose_ps groups containers by service; for swarm services use service_ps (tasks may live on other nodes).

args: all - Show all containers, including stopped ones (default False: running only) since - Only show containers created after this id or name before - Only show containers created before this id or name limit - Maximum number of results filters - Filter by attributes (e.g. status, label) sparse - Skip inspect calls and return less detail ignore_removed - Ignore containers removed during listing managed_only - Only return containers created by this MCP server (filters on the docker-mcp-server.managed label); combines with any filters given returns: list - One dict per container: full inspect payloads by default (each match is inspected, like container_inspect); sparse=True skips the per-container inspect calls and returns the daemon's abridged list entries instead

ParametersJSON Schema
NameRequiredDescriptionDefault
allNo
limitNo
sinceNo
beforeNo
sparseNo
filtersNo
managed_onlyNo
ignore_removedNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds rich behavior beyond the readOnlyHint annotation: it explains default running-only behavior, how sparse affects output, the meaning of ignore_removed, and the managed_only label filter. This fully discloses the tool's behavioral traits and return semantics.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections: basic behavior, alternative tool guidance, parameter list, and return value explanation. Every sentence adds value, and the length is justified by the complexity of the tool (8 params, multiple behaviors).

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description thoroughly explains return values ('full inspect payloads by default' vs. 'abridged list entries' with sparse). It also covers edge cases like removed containers and managed-only filtering, making it complete for a container listing tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has zero description coverage, but the description provides a detailed 'args:' block explaining all 8 parameters, including semantics like 'since'/'before' being id/name based and 'filters' being attribute filters. This fully compensates for the schema's lack of descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses the specific verb 'List' with a clear resource ('containers on the daemon') and explicitly notes the default running-only scope. It also distinguishes itself from sibling tools by pointing to 'compose_ps' and 'service_ps' for alternative grouping/use cases.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit usage guidance: 'Pass all=True to include stopped containers' and directs users to 'compose_ps' for compose projects and 'service_ps' for swarm services. This clearly states when to use this tool versus alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_logsA
Read-only

Get the logs of a container: a one-shot snapshot by default, or a bounded live tail with follow=True.

Follow mode returns when limit_lines lines are collected, timeout_seconds elapses, or the container exits, whichever comes first — so the agent can watch live output without blocking forever. limit_lines/timeout_seconds apply only in follow mode; until only in snapshot mode.

Snapshot mode is capped at 32 MiB and raises ValueError past it, so a noisy container can't exhaust the server's memory; service_logs caps the same way and lets the caller raise it. Prefer an integer tail, or since, over tail="all" on a long-running container: "all" is safe but will abort on the cap rather than returning a partial answer, and a large result can still exceed the agent's context.

Caveat for ssh:// daemons: docker-py can't cancel an SSH stream, so in follow mode the timeout_seconds watchdog can't interrupt a fully silent container — use the snapshot mode there if you need a hard time bound.

args: id_or_name - The container id or name stdout - Include stdout stderr - Include stderr timestamps - Include timestamps tail - Number of lines from the end (default 200), or the literal "all" for everything since - Only return logs created after this unix timestamp until - Only return logs created before this unix timestamp (snapshot mode only) follow - Follow the live log stream instead of returning a snapshot limit_lines - Follow mode: max lines to collect before returning (default 200) timeout_seconds - Follow mode: max wall-clock seconds before returning what was collected (default 30) returns: str - Decoded log output (up to limit_lines lines in follow mode). Raises ValueError in snapshot mode if the logs exceed 32 MiB.

ParametersJSON Schema
NameRequiredDescriptionDefault
tailNo
sinceNo
untilNo
followNo
stderrNo
stdoutNo
id_or_nameYes
timestampsNo
limit_linesNo
timeout_secondsNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare this as a read-only, non-destructive operation. The description adds substantial behavioral context beyond that: the 32 MiB cap and ValueError, follow-mode termination conditions (limit_lines, timeout_seconds, container exit), and the SSH stream caveat. It discloses failure modes and limits, which is exactly what an agent needs to trust the tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured: a clear one-sentence overview, then focused paragraphs on behavior, limits, and caveats, followed by a clean parameter list. Every sentence delivers actionable information without redundancy. It is dense but not verbose, and front-loads the core purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 10 parameters and two modes, the description covers all critical aspects: mode differences, limits, edge cases (SSH daemon, context size), and return type. It also notes the output schema exists, so the agent knows additional return details are available. No gaps are apparent for an agent to safely invoke this tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description is the sole source of parameter meaning. It explains each parameter's role and interaction (e.g., 'limit_lines/timeout_seconds apply only in follow mode', 'until only in snapshot mode'). It also defines 'tail' values (integer or 'all') and defaults, effectively compensating for the lack of schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Get the logs of a container' and immediately distinguishes two modes (snapshot vs. follow). It also contrasts with sibling tools like service_logs, making its scope clear. This goes beyond a generic statement and gives an agent precise understanding of what the tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly tells when to use alternative tools (service_logs) and provides practical guidance on parameter choices ('Prefer an integer tail... over tail="all"'). It also warns about the SSH caveat and recommends snapshot mode for hard time bounds, giving clear exclusions and context for decision-making.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_pauseA

Suspend all processes in a container using the kernel freezer cgroup.

Unlike sending SIGSTOP, the freezer cgroup suspends processes without their being able to observe or intercept the suspension. A paused container keeps its resources (memory, open file descriptors) but consumes no CPU. Resume with container_unpausecontainer_exec fails against a paused container until it is unpaused.

args: id_or_name - The container id or name returns: dict - The container's full inspect payload after pause (State.Paused true)

ParametersJSON Schema
NameRequiredDescriptionDefault
id_or_nameYes

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only indicate non-read-only and non-destructive, but the description reveals key behavioral traits: the freezer cgroup mechanism, invisibility of the suspension to processes, resource retention, zero CPU usage, and the interaction with exec. This goes far beyond the minimal annotations and provides deep insight into what happens when pausing.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well-structured: a clear purpose sentence, a brief behavioral explanation, and an args/returns section. Every sentence adds value without bloat, and the structure makes key information easy to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter state-changing operation, the description covers the core behavior, resource impact, recovery path, and a critical limitation (exec fails). It also specifies the return value (inspect payload with State.Paused). This is a complete picture for a tool of this complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description compensates by defining the sole parameter: 'id_or_name - The container id or name'. This adds meaning beyond the raw string type, clarifying that either a container ID or name can be provided. While simple, it fully covers the parameter's semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action: 'Suspend all processes in a container using the kernel freezer cgroup.' It uses a specific verb (suspend), resource (container), and mechanism (freezer cgroup), and distinguishes it from SIGSTOP and sibling tools like container_stop/container_kill. The purpose is unambiguous and differentiated.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explains when to use this tool by contrasting with SIGSTOP (suspension cannot be observed/intercepted) and notes that a paused container keeps resources but uses no CPU. It also provides clear direction to resume with container_unpause and warns that container_exec will fail until unpaused. This gives explicit context and related-tool alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_pruneA
DestructiveIdempotent

Remove all stopped containers to reclaim disk space.

Only removes containers that are not running — running containers are never affected. Use container_list(all=True) to preview what would be removed before calling this. Valid filter keys: until (RFC3339 timestamp or duration like "24h" — removes containers stopped before that point), label (key or key=value). For a broader cleanup of containers plus unused images, networks, and volumes see the prune_managed prompt.

args: filters - Narrow which stopped containers to remove; omit to remove all stopped returns: dict - {"ContainersDeleted": [...], "SpaceReclaimed": }

ParametersJSON Schema
NameRequiredDescriptionDefault
filtersNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate destructive behavior, but the description adds valuable context: running containers are never affected, filter key semantics are explained, and a preview workflow is recommended. This goes well beyond the structured annotations and aligns with the destructiveHint.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose, and every subsequent sentence adds distinct value—scope, preview recommendation, filter details, alternative cleanup path, and return format. It is detailed without being verbose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's destructive nature and lack of output schema, the description fully covers behavior, safety, parameter semantics, return value, and alternative tools. The agent has everything needed to invoke it correctly and avoid unintended deletions.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema only lists 'filters' with no description, while the tool description fully explains the parameter: 'Narrow which stopped containers to remove; omit to remove all stopped' and documents valid filter keys ('until' with RFC3339/duration format, 'label'). This significantly compensates for the 0% schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Remove all stopped containers to reclaim disk space.' This clearly states what the tool does and its outcome, distinguishing it from related tools like container_remove, image_prune, and network_prune.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use the tool ('Only removes containers that are not running'), how to preview before running ('Use container_list(all=True)'), and points to an alternative for broader cleanup ('prune_managed prompt'). This gives the agent clear decision guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_removeA
Destructive

Remove a container, deleting its writable layer.

The image is untouched (image_remove deletes images); named volumes are never removed — volumes=True only covers anonymous ones. A running container is refused unless force=True, which kills it first. When the server runs containerized it refuses to remove its own container.

args: id_or_name - The container id or name volumes - Also remove anonymous volumes (the CLI's --volumes); named volumes persist link - Remove the specified link force - Kill a running container before removing it (default False: running is an error) returns: bool - True after removal completes

ParametersJSON Schema
NameRequiredDescriptionDefault
linkNo
forceNo
volumesNo
id_or_nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Despite annotations already marking destructiveHint=true, the description adds substantial context: deletion of the writable layer, refusal to remove running containers without force, and refusal to remove the server's own container when containerized. It also explains volume behavior and force semantics, which are not inferable from annotations alone.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well-structured: a one-sentence summary, a focused paragraph on key behaviors and edge cases, then a clean arg list and return type. No redundancy or fluff; every sentence provides distinct value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers the tool's purpose, side effects, edge cases (running containers, own container), parameter semantics, and return value. Given the tool's complexity and 4 parameters, this is complete and self-sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description compensates fully with an 'args' section explaining every parameter: id_or_name, volumes (anonymous only), link, and force (with default). This adds meaning beyond raw schema types and defaults.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Remove a container, deleting its writable layer.' It clearly distinguishes from image_remove and clarifies that named volumes are not removed, setting it apart from related tools like volume_remove.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit alternatives and limitations: 'the image is untouched (`image_remove` deletes images); named volumes are never removed — volumes=True only covers anonymous ones.' Also states running containers are refused unless force=True, giving concrete usage conditions. This goes beyond vague 'use for removal' guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_renameA

Rename a container in place; its id, state, and configuration are unchanged.

Use it to free up or claim a container name (names are unique per daemon) — e.g. before starting a replacement under the old name. Fails with a conflict error if the new name is already taken. Not related to image_tag, which names images.

args: id_or_name - The container id or name name - The new name; must not be in use by any other container returns: dict - The container's full inspect payload after the rename

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes
id_or_nameYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (readOnlyHint=false, destructiveHint=false), the description discloses key behavior: the container's id, state, and configuration remain unchanged; it fails with a conflict if the name is taken; and it returns the full inspect payload. This is far more informative than the bare annotations and sets clear expectations for side effects and outcomes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact yet complete, with a clear opening statement, a usage rationale, a clarification about a related tool, and a well-organized args/returns section. Every sentence contributes valuable information without fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple two-parameter rename operation, the description covers purpose, usage context, parameter semantics, an error condition, and the return value. With no output schema, this is fully sufficient for an agent to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Although the input schema has no property descriptions (0% coverage), the description includes an 'args' section that clearly explains each parameter: `id_or_name` is the container id or name, and `name` is the new name with the constraint that it must not be in use. This fully compensates for the lack of schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Rename a container in place' with the specific resource and verb, and distinguishes itself from `image_tag` by noting it's about images, not container names. This fully clarifies what the tool does and sets it apart from sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly advises when to use it ('free up or claim a container name', e.g., before starting a replacement) and mentions the conflict error for taken names. It also explicitly compares to `image_tag`, providing an exclusionary alternative. This gives clear guidance on when to use this tool vs. others.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_restartA

Restart a container: stop then start again in one call.

The container receives its configured stop signal (STOPSIGNAL, default SIGTERM), SIGKILL after stop_timeout_seconds, and is then started. Use container_stop/container_start to do the halves separately. When the server runs containerized it refuses to restart its own container.

args: id_or_name - The container id or name stop_timeout_seconds - Seconds between the stop signal and SIGKILL (default 10) returns: dict - The container's full inspect payload after the restart

ParametersJSON Schema
NameRequiredDescriptionDefault
id_or_nameYes
stop_timeout_secondsNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnly/destructive hints, the description discloses the STOPSIGNAL behavior, the SIGKILL timeout, the subsequent restart, and the refusal to restart the server's own container. It also states the return value (full inspect payload), adding substantial behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured: a one-sentence summary, a behavior paragraph, and an args/returns section. Every sentence provides essential information without redundancy, making it both concise and comprehensive.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has only two parameters and no output schema, and the description covers both parameters, explains the return type, and describes edge cases. It is complete for an agent to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has no descriptions (0% coverage), but the description lists both parameters with clear meanings: 'id_or_name - The container id or name' and 'stop_timeout_seconds - Seconds between the stop signal and SIGKILL (default 10)'. This fully compensates for the missing schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Restart a container: stop then start again in one call,' clearly identifying the verb and resource while distinguishing from separate stop/start operations. It also mentions the self-restart refusal, further clarifying the tool's exact scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly says 'Use container_stop/container_start to do the halves separately,' naming the alternative tools. It also includes a when-not scenario: the server refuses to restart its own container when containerized, providing clear usage boundaries.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_runA

Run a container from an image (create and start in one call, like docker run).

Use container_create to prepare a container without starting it, or container_exec to run a command in a container that already exists. With detach=False the call blocks until the container exits and returns its output, so long-running images need detach=True. Created containers are stamped with provenance labels.

args: image - The image to run command - The command to run in the container name - Name to assign to the container detach - Run in the background and return container info environment - Environment variables to set ports - Port mappings, e.g. {'2222/tcp': 3333} volumes - Volumes to mount network - Name of the network to attach hostname - Optional hostname for the container user - Username or UID to run as working_dir - Working directory inside the container entrypoint - Entrypoint to override the image default restart_policy - Restart policy, e.g. {'Name': 'on-failure', 'MaximumRetryCount': 3} labels - Labels to set on the container remove - Remove the container when it exits (only with detach=False) auto_remove - Enable auto-removal of the container on daemon side privileged - Give extended privileges to the container tty - Allocate a pseudo-TTY stdin_open - Keep STDIN open mem_limit - Memory limit cpu_count - Number of CPUs extra_kwargs - Additional keyword arguments forwarded to ContainerCollection.run (call docs_lookup(section="containers") for the full accepted set) returns: dict | str - Container attrs when detach=True, otherwise stdout/stderr as a string

ParametersJSON Schema
NameRequiredDescriptionDefault
ttyNo
nameNo
userNo
imageYes
portsNo
detachNo
labelsNo
removeNo
commandNo
networkNo
volumesNo
hostnameNo
cpu_countNo
mem_limitNo
entrypointNo
privilegedNo
stdin_openNo
auto_removeNo
environmentNo
working_dirNo
extra_kwargsNo
restart_policyNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (which only state readOnlyHint=false and destructiveHint=false), the description discloses that detach=False blocks until exit and returns output, that long-running images need detach=True, and that created containers get provenance labels. It also clarifies the `remove` option only applies with detach=False, adding meaningful behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with a one-line summary and key usage distinctions before the structured arg list. Each parameter line is short and information-dense; despite length, no redundant sentences appear.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers what the tool does, when to use alternatives, blocking vs detach behavior, side effects, return format, and a pointer for the full `extra_kwargs` set. Given the output schema exists and the large parameter count, no major gaps remain.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description's args section compensates by listing all 22 parameters with plain-language meanings. It includes concrete examples for `ports` and `restart_policy`, and notes important constraints like `remove` only with detach=False and `extra_kwargs` pointing to `docs_lookup`.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening line clearly identifies the action (run a container from an image) and the resource (container), with the `docker run` analogy. It explicitly distinguishes from `container_create` and `container_exec`, which are the most relevant siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly directs users to `container_create` for prepare-only and `container_exec` for running commands in an existing container. It also gives concrete guidance on `detach` for long-running images, helping choose between blocking and background invocation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_startA

Start an existing stopped container.

Use this to restart a container that was previously created or stopped without removing it. To create and start a new container in one step use container_run instead. Calling on an already-running container has no effect (the daemon returns 304 and no error is raised). To stop then start a running container use container_restart.

args: id_or_name - Container id (full or short) or name returns: dict - The container's full inspect payload after starting

ParametersJSON Schema
NameRequiredDescriptionDefault
id_or_nameYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond minimal annotations (readOnlyHint=false, destructiveHint=false), the description discloses that calling on an already-running container is a no-op (daemon returns 304, no error) and states the return payload is the container's full inspect result.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well-structured with front-loaded summary, explicit guidance, and a clear args/returns section. Every sentence adds value without waste.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one param, no output schema), the description covers purpose, usage, edge-case behavior, and return format. Nothing important is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has zero description coverage, but the description fully defines the only parameter: 'id_or_name - Container id (full or short) or name'. This compensates completely for the schema's lack of detail.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States exactly what it does: 'Start an existing stopped container.' Differentiates from container_run and container_restart, making its specific role clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-to-use guidance: use for containers previously created or stopped, use container_run to create+start, use container_restart to stop+start. Also explains behavior for already-running containers.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_statsA
Read-only

Get one point-in-time resource-usage snapshot for a container (non-streaming).

Returns the raw engine stats payload; CPU percent must be computed from the delta between cpu_stats and precpu_stats. For a pre-computed human-readable summary prefer the docker-stats://{id_or_name} resource; for a process listing use container_top.

args: id_or_name - The container id or name returns: dict - Engine stats payload (read, cpu_stats, precpu_stats, memory_stats, networks, pids_stats, ...)

ParametersJSON Schema
NameRequiredDescriptionDefault
id_or_nameYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Despite readOnlyHint=true annotations, the description adds crucial context by explaining that CPU percent must be computed from cpu_stats and precpu_stats deltas. This is non-obvious behavioral information beyond the annotations and clearly benefits the user.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and structured, with a clear purpose statement, usage guidance, and typical args/returns sections. Every sentence adds value without redundancy, making it easy to parse quickly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only tool with one parameter and no output schema, the description covers the operation, return payload expectations, and key computation caveats. It also references alternatives, making it fully self-contained for agent decision-making.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

While the input schema only shows a required string id_or_name, the description's args section explicitly defines it as 'The container id or name', fully compensating for the 0% schema description coverage. This leaves no ambiguity about the parameter's meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it gets a one-point-in-time resource-usage snapshot for a container, with the specific distinction of being non-streaming. This verb+resource combination distinguishes it well from container_top (process listing) and other container tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly directs users to prefer the docker-stats:// resource for a pre-computed summary and container_top for process listing, offering clear alternatives and when to use them. The non-streaming note also sets expectations for behavior.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_stopA

Gracefully stop a running container (its configured stop signal, then SIGKILL after a timeout).

Prefer this over container_kill for a clean shutdown: the main process receives the container's stop signal (STOPSIGNAL, default SIGTERM) and has stop_timeout_seconds to exit before the daemon force-kills it. Use container_restart to stop and start again in one call, or container_pause to freeze processes without stopping. When the server runs containerized it refuses to stop its own container.

args: id_or_name - The container id or name stop_timeout_seconds - Seconds between the stop signal and SIGKILL (default 10) returns: dict - The container's attrs after the stop (exit code under State.ExitCode)

ParametersJSON Schema
NameRequiredDescriptionDefault
id_or_nameYes
stop_timeout_secondsNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description exposes behavioral details beyond the minimal annotations: the stop signal sequence (STOPSIGNAL then SIGKILL after timeout), the default SIGTERM, and the refusal to stop its own container when running containerized. This adds significant context and no contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and well-structured, using short paragraphs and an args/returns section. Every sentence adds value, and there is no unnecessary repetition or fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite lacking an output schema, the description specifies the return type (dict) and points to State.ExitCode for exit code. It also covers a key edge case (self-container refusal). The description is thorough for the tool's complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description fully compensates by explaining both parameters: id_or_name as container id or name, and stop_timeout_seconds as seconds between stop signal and SIGKILL, including the default value 10. This adds real semantic meaning beyond the schema's bare type declarations.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Gracefully stop a running container', clearly stating the verb and resource. It also distinguishes itself from container_kill, container_restart, and container_pause, so the agent can immediately tell what this tool does uniquely.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit guidance is provided: 'Prefer this over container_kill for a clean shutdown' and 'Use container_restart to stop and start again in one call, or container_pause to freeze processes without stopping.' Also mentions the self-container refusal edge case, giving clear when-to-use context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_topA
Read-only

List the processes running inside a container (the daemon runs ps on the host).

Works on any running container without executing anything in it, so it needs no shell or ps binary in the image — unlike container_exec with ps. Use container_stats for resource usage rather than process lists. Fails if the container is not running.

args: id_or_name - The container id or name ps_args - Extra ps arguments (e.g. "aux"); default is the daemon's standard ps invocation returns: dict - {"Titles": [ps column names], "Processes": [[one row of values per process]]}

ParametersJSON Schema
NameRequiredDescriptionDefault
ps_argsNo
id_or_nameYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Discloses that the daemon runs ps on the host, meaning no shell or ps binary is needed in the image—a key behavioral trait not evident from schema or annotations. Also specifies the failure condition. Annotations already indicate read-only, and the description adds valuable implementation context without contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured and front-loaded with the core purpose, followed by usage guidance, parameters, and return format. Each sentence adds value; no filler or redundancy. The length is appropriate for the tool's complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers all necessary context: the exact operation, prerequisites, alternatives, parameter meanings, return structure, and failure modes. Despite having no output schema, the description explains the return dict format explicitly. It is entirely complete for selection and invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has zero parameter descriptions (coverage 0%), but the description fully compensates by explaining id_or_name as container id/name and ps_args as extra ps arguments with an example 'aux' and default behavior. This is more than sufficient for correct invocation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'List the processes running inside a container' with a specific verb and resource. It differentiates from siblings by explicitly contrasting with container_exec and container_stats, making the tool's unique purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit guidance on when to use it ('Works on any running container without executing anything in it'), when not to use it ('Use container_stats for resource usage rather than process lists'), and contrasts with alternative container_exec. Also notes a failure condition ('Fails if the container is not running').

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_unpauseA

Resume all processes in a paused container (the reverse of container_pause).

Only valid on a paused container — it fails if the container is merely stopped; use container_start for stopped containers. Processes continue from where they were frozen.

args: id_or_name - The container id or name returns: dict - The container's attrs after unpause (State.Paused becomes false)

ParametersJSON Schema
NameRequiredDescriptionDefault
id_or_nameYes

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare readOnlyHint=false and destructiveHint=false, but the description adds meaningful behavior: it resumes processes, notes that processes continue from where they were frozen, and explains the return value (State.Paused becomes false). This goes well beyond the annotations and gives the agent a clear model of the operation's effect.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three short sentences, each serving a distinct purpose: purpose, usage guidance, and parameter/return details. No filler or repetition, and it is front-loaded with the most important information. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with one parameter and no output schema, the description covers all essential aspects: what it does, when to use it, what happens in the failure case, and what the return value contains. There is no missing information that would cause an agent to misuse the tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage and a parameter named `id_or_name` with no description. The description compensates with 'args: id_or_name - The container id or name', which clarifies the parameter's purpose. However, this is a minimal rephrasing of the parameter name and could add more detail (e.g., accepts ID or name, not both). Still, it is enough to make the parameter understandable.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description starts with a specific verb+resource: 'Resume all processes in a paused container', clearly stating the tool's function. It further distinguishes itself from the sibling tool `container_pause` by calling itself the reverse, and from `container_start` by specifying the paused vs stopped distinction.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use the tool (only on a paused container), when it fails (if merely stopped), and directs the user to the alternative (`container_start` for stopped containers). This is exactly the kind of clear usage guidance expected.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_updateA

Update resource limits on a container without recreating it.

Changes take effect immediately on Linux (cgroups); not all fields are updatable on every platform. Common updates keys: mem_limit (bytes, e.g. 134217728 for 128 MB), memswap_limit (memory+swap in bytes; -1 = unlimited), cpu_shares (relative weight, default 1024), cpu_period / cpu_quota (microseconds for CFS throttling), cpuset_cpus (e.g. "0-1"), restart_policy (dict with Name such as "on-failure"/"always"/"unless-stopped" and optional MaximumRetryCount). To change image, env, or volumes the container must be recreated (container_remove + container_run).

args: id_or_name - Container id or name to update updates - Resource fields to update; see description for valid keys returns: dict - The container's full inspect payload after the update

ParametersJSON Schema
NameRequiredDescriptionDefault
updatesYes
id_or_nameYes

TDQS

A4.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds behavior beyond annotations: changes take effect immediately on Linux (cgroups), not all fields are updatable on every platform, and the container is not recreated. Annotations only indicate readOnlyHint=false and destructiveHint=false; the description enriches this with timing and platform constraints. A minor gap is lack of mention of error cases or permissions, but it earns a 4.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is structured with a purpose sentence, a caveat paragraph, a detailed list of keys, and an args/returns block. Every sentence adds value, and formatting with code spans and line breaks improves scannability. It is long but appropriately so for a tool with a complex `updates` object.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the minimal schema (no descriptions, no output schema) and basic annotations, the description provides essential context: valid keys, platform behavior, return value type, and when to use alternative tools. It covers the tool's core semantics thoroughly, leaving little ambiguity for agent invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% (no property descriptions), so the description carries the full burden. It lists common `updates` keys with concrete examples (e.g., mem_limit, cpu_shares, restart_policy) and explains the `restart_policy` dict structure. The args section also clarifies both parameters, fully compensating for the sparse schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description begins with 'Update resource limits on a container without recreating it', using a specific verb ('update'), a clear resource ('container'), and a meaningful qualifier ('resource limits', 'without recreating it'). This distinguishes it from sibling tools like container_rename, container_restart, and container_remove.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit guidance is given: 'To change image, env, or volumes the container must be recreated (`container_remove` + `container_run`)' names specific alternatives. It also notes platform differences for updatable fields, helping the agent choose when this tool is appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

container_waitA
Read-only

Block until a container reaches a condition: stopped, "healthy", or its logs contain a pattern.

One contract for every mode: never raises on timeout — the result always carries met (condition reached) and timed_out. The stop conditions ("not-running"/"next-exit"/"removed") use the daemon's blocking wait and fill status_code/error (the container's exit info); "healthy" polls the container's HEALTHCHECK every poll_intervals and fills health/status; "log-match" polls recent logs every poll_intervals for pattern and fills matched_line. For a compose project use compose_wait; for swarm services use service_wait.

Health semantics: with no HEALTHCHECK defined, once the container is running the tool returns promptly with health: null and met: false (false = "not confirmed healthy", not "unhealthy" — check health to tell them apart). A container that exits before becoming healthy returns its terminal status and met: false.

Log-match semantics: pattern is matched as a plain substring by default — safe against any input, including adversarial ones. Pass regex=True to match pattern as a regular expression (via re.search) instead; only do this with patterns you trust, since a regex with catastrophic backtracking run against attacker-influenced log content can exhaust CPU (ReDoS). Checks stdout and stderr, most recent lines first within each poll. If the container exits/dies before the pattern ever appears, returns promptly with met=false (not timed_out) — no further logs can arrive, so there's nothing to keep polling for.

args: id_or_name - The container id or name until - Condition to wait for: "not-running" (default), "next-exit", "removed", "healthy", or "log-match" (requires pattern) timeout_seconds - Max seconds to wait before returning with timed_out=true (default 600) poll_interval - "healthy"/"log-match" only: seconds between re-checks (default 2, > 0); capped by the time left so a large value can't push the total wait past the timeout pattern - "log-match" only: substring (or, with regex=True, a regular expression) to look for in the container's logs regex - "log-match" only: treat pattern as a regular expression instead of a plain substring returns: dict - {"container", "until", "met", "timed_out", "status_code", "error", "health", "status", "matched_line", "waited_seconds"}; stop modes fill status_code/error, "healthy" fills health ("starting"/"healthy"/"unhealthy", or null with no healthcheck) and status, "log-match" fills matched_line when met and status if the container exited without matching.

ParametersJSON Schema
NameRequiredDescriptionDefault
regexNo
untilNonot-running
patternNo
id_or_nameYes
poll_intervalNo
timeout_secondsNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnly/destructive annotations, the description discloses non-obvious behaviors: never raises on timeout, always returns `met` and `timed_out`, different condition modes fill different result fields, health semantics when no HEALTHCHECK exists, and log-match substring/regex behavior including a ReDoS warning. This is rich, context-adding transparency with no contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Though lengthy, the description is efficiently organized into clear sections: the core purpose, a shared contract, mode-specific details, health and log-match semantics, and an args/returns reference. Every section earns its place and is front-loaded with the most critical information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is exceptionally complete for a complex multi-mode tool with no output schema. It explains the return dict, which fields each mode populates, how edge cases resolve (e.g., exit before health, exit before log match), and how poll_interval caps against timeout. No significant context is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has no descriptions, but the description's args section thoroughly explains each parameter: id_or_name, the until enum with defaults, timeout_seconds, poll_interval with capping behavior, pattern semantics, and regex. This adds full meaning beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a clear, specific verb and resource: 'Block until a container reaches a condition: stopped, "healthy", or its logs contain a pattern.' It enumerates the distinct condition modes and explicitly distinguishes from siblings by pointing to compose_wait for compose projects and service_wait for swarm services.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit guidance on when to use this tool versus alternatives: 'For a compose project use compose_wait; for swarm services use service_wait.' It also gives mode-specific behavior, timeout semantics, and edge cases, making appropriate usage clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

context_createA

Create a new Docker CLI context pointing at a daemon endpoint.

Registers a named endpoint for the CLI; switch with context_use, enumerate with context_list. It does not retarget this server's docker-py client (pinned at startup). Does not raise on a non-zero CLI exit — inspect returncode/stderr in the result. It does raise ValueError before running anything if docker_host or a TLS path contains a comma, which would inject extra keys (including skip-tls-verify) into the endpoint spec.

args: name - Name for the new context (must not already exist) docker_host - Daemon URL, e.g. "tcp://10.0.0.5:2376" or "unix:///var/run/docker.sock"; no commas description - Optional human description shown in context ls tls_ca - Path on the local host to the CA cert (for TLS daemons); no commas tls_cert - Path on the local host to the client cert; no commas tls_key - Path on the local host to the client key; no commas skip_tls_verify - Disable TLS verification (insecure; for testing only). The only way to set it: it cannot be smuggled through docker_host returns: dict - {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes
tls_caNo
tls_keyNo
tls_certNo
descriptionNo
docker_hostYes
skip_tls_verifyNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses important behaviors beyond annotations: it notes that the tool does not retarget the docker-py client, does not raise on non-zero CLI exit (returns result dict instead), and raises ValueError on commas to prevent injection. All this enriches the agent's understanding of what actually happens during invocation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured: an initial concise purpose paragraph, followed by a bulleted argument list, and a return structure. Every sentence adds value, covering purpose, caveats, parameter requirements, and output format without extraneous filler. Despite being detailed, it remains front-loaded and efficiently organized.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (7 parameters, no schema coverage, no output schema), the description is comprehensive. It explains the return dict fields, error behavior, connection to sibling tools, and critical injection protection, leaving no gaps that would hinder correct invocation. This is complete for all practical use.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema coverage, the description fully explains all 7 parameters: each argument gets a clear description, including constraints like 'may not already exist' or 'no commas', and an example for the docker_host parameter. It also clarifies that skip_tls_verify must be set directly and cannot be smuggled through the command, providing all necessary info for correct parameter usage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Create a new Docker CLI context pointing at a daemon endpoint' and further explains it 'Registers a named endpoint for the CLI; switch with context_use, enumerate with context_list.' This distinct verb and resource, plus explicit differentiation from sibling tools (context_use, context_list), makes the purpose unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit context on when to use the tool: it registers a named endpoint for the CLI, clarifies it does not retarget the server's docker-py client, and warns about non-zero exit handling (inspect returncode/stderr). It also states constraints like 'must not already exist' and the comma injection risk, effectively explaining both appropriate usage and caveats.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

context_inspectA
Read-only

Return the full configuration for a single Docker context.

Full endpoint/TLS detail for one context; context_list gives the one-line summary of all. Raises RuntimeError if the CLI call fails.

args: name - Context name (use the Name field from context_list) returns: dict - The parsed docker context inspect entry (keys include "Name" and "Endpoints" with the daemon URL)

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnly and non-destructive behavior. The description adds that RuntimeError is raised on CLI failure and describes the return dict structure (Name, Endpoints with daemon URL), which goes beyond annotations to set expectations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and well-structured with separate args/returns sections. Every sentence contributes value, and the main purpose is front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter read-only tool with no output schema, the description covers purpose, sibling differentiation, error behavior, parameter sourcing, and return keys. It is complete enough for an agent to select and invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema coverage, the description fully compensates by explaining the 'name' parameter and instructing to source it from context_list's Name field. This adds meaningful semantic context beyond the raw string type.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific action (return full configuration) on a specific resource (single Docker context), and explicitly contrasts with context_list to distinguish scope. This provides unambiguous purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It points to context_list as the alternative for one-line summaries and instructs to use the Name field from context_list, which gives practical guidance. However, it doesn't enumerate other possible alternatives (e.g., context inspect vs other inspect tools) but the differentiation is strong.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

context_listA
Read-only

List Docker CLI contexts known to the host running this MCP server.

Contexts are a CLI concept (stored in the docker config dir) letting one CLI target multiple daemons. This server uses whatever DOCKER_HOST / current-context resolved to at startup, so changing contexts only affects future subprocess-based tools, not the docker-py SDK client. Use context_inspect for one context's full config and context_use to switch. Raises RuntimeError if the CLI call fails.

returns: list - One dict per context with at least name, description, dockerEndpoint, and current

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond annotations (readOnlyHint=true, destructiveHint=false), the description discloses that the server uses the startup-resolved DOCKER_HOST/current-context, so changing contexts only affects subprocess-based tools, not the docker-py SDK client. It also mentions RuntimeError on CLI failure. These add meaningful behavioral context without contradicting annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the main purpose, then provides essential context about CLI behavior, sibling tool guidance, error handling, and return format. Each sentence adds value, and the structure is logical and brief enough for an agent to parse quickly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite the absence of an output schema, the description specifies the return value ('list - One dict per context with at least name, description, dockerEndpoint, and current'). It also covers error behavior, context semantics, and usage guidance, making it fully complete for an agent to select and invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the input schema is empty. Per the rubric, a baseline of 4 applies when there are no params. The description doesn't need to explain parameters, and it correctly omits any.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the function as 'List Docker CLI contexts known to the host running this MCP server.' It distinguishes itself from siblings by explicitly naming context_inspect (full config of one context) and context_use (switching), making the tool's scope and relationship to alternatives unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit when-to-use guidance is provided: 'Use context_inspect for one context's full config and context_use to switch.' It also explains the server's context resolution behavior, helping the agent understand when the tool is relevant and what side effects might exist.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

context_removeA
Destructive

Remove a Docker CLI context.

Deletes only the CLI's connection metadata — the daemon it pointed at is untouched. The current context needs force=True (or context_use another first). Does not raise on a non-zero CLI exit — inspect returncode/stderr in the result.

args: name - Context name to remove force - Force removal even if the context is the current one returns: dict - {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes
forceNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the destructiveHint=true annotation, the description discloses critical behavior: it deletes only CLI connection metadata while leaving the daemon untouched, and it does not raise on non-zero CLI exits, requiring inspection of returncode/stderr. These details are valuable and not present in the annotations or schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured and compact. It opens with a clear one-line purpose, uses a concise paragraph for behavioral nuances, and lists parameters/returns in a readable format. Every sentence contributes meaningful information without repetition or fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity, the description covers all essential aspects: purpose, side effects (deletion scope), edge case (current context), error handling (non-zero exit), parameters, and return value shape. No output schema exists, so documenting the return dict is especially valuable.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With schema description coverage at 0%, the description fully compensates by explaining each parameter: 'name - Context name to remove' and 'force - Force removal even if the context is the current one'. This adds meaning beyond the raw schema types and defaults.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description begins with 'Remove a Docker CLI context', using a specific verb and resource that clearly differentiates it from sibling tools like context_create, context_list, context_inspect, and context_use. It also clarifies that it only affects CLI metadata, not the daemon, further pinning down its purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides concrete guidance on when this tool is appropriate and how to handle the current context: 'The current context needs force=True (or `context_use` another first)'. This explicitly offers an alternative approach via a sibling tool, satisfying the when-to-use vs alternatives criterion.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

context_useA

Set the active Docker context for the CLI on the host running this MCP server.

Note: this does not retarget the long-lived docker-py client — SDK-backed tools keep using the endpoint they connected to at startup. To retarget those, restart the server with a different DOCKER_HOST / DOCKER_CONTEXT. Create contexts with context_create; list them with context_list.

args: name - Existing context name to set as default returns: dict - {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses a key behavioral trait beyond the annotations: it does not retarget the long-lived docker-py client, so SDK-backed tools retain their startup endpoint. This is critical for an agent to understand the tool's real impact. The annotations (readOnlyHint=false, destructiveHint=false) are consistent with a mutation that is not destructive, and the description adds important context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well-structured. It leads with the core purpose, includes a critical caveat, and then provides args/returns. Every sentence adds value without redundancy. The format is easy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with one parameter and no output schema, the description is complete. It covers the purpose, the limitation, parameter semantics, and return format. It also cross-references related tools. No essential information is missing for an agent to select and use this tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Although schema description coverage is 0%, the description fully explains the single parameter: 'name - Existing context name to set as default.' This conveys both the parameter's purpose and a constraint (it must exist), which is sufficient for a simple string parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Set the active Docker context for the CLI on the host running this MCP server.' This specifies a verb (set), resource (active Docker context), and scope (CLI on host), distinguishing it from related context management tools like context_create and context_list, which are explicitly referenced.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit guidance on when to use this tool versus alternatives. It notes that SDK-backed tools are not retargeted and suggests restarting with DOCKER_HOST/DOCKER_CONTEXT instead. It also points to context_create for creation and context_list for listing, giving clear alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

docs_lookupA
Read-only

Look up Docker SDK/CLI/registry reference documentation by section.

A tool-callable mirror of the docker-docs:// resources, for clients that can't read MCP resources (e.g. Claude Desktop, Cursor). Always registered regardless of DOCKER_MCP_SERVER_DISABLE — looking something up costs nothing and isn't tied to any single Docker feature area — but an individual section still refuses if the domain it documents is disabled, matching the equivalent docker-docs://{section} resource exactly.

Omit section to list every available section with its source URL (same as docker-docs://contents); pass a section name to fetch that page's content (same as docker-docs://{section}). Most useful before constructing an extra_kwargs-style passthrough dict for a tool like container_run/container_create/service_create (their docstrings only list common keys, not every key docker-py accepts), or before writing Compose/Dockerfile/buildx bake-file syntax, which no tool generates.

args: section - Section name (from a no-argument call's index); omit to list all sections instead returns: str - JSON section index (no section) or that section's raw HTML/Markdown content

ParametersJSON Schema
NameRequiredDescriptionDefault
sectionNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate readOnlyHint and destructiveHint, but the description adds substantial behavior: always registered regardless of DOCKER_MCP_SERVER_DISABLE, per-section refusal if the domain is disabled, the listing-vs-fetch behavior, and the return type (JSON index or raw HTML/Markdown). This is rich behavioral context beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is somewhat long but each sentence earns its place: purpose, registration behavior, parameter behavior, use cases, and return format. It is front-loaded with the core purpose and structured logically, though it could be slightly tightened without losing value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with one optional parameter and an output schema, the description is comprehensive. It covers what the tool does, when to use it, edge cases (disabled domains), and return formats, leaving no significant gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema only has 'section' with a default null and no description (0% schema coverage), so the description must compensate. It fully explains the parameter: 'section - Section name (from a no-argument call's index); omit to list all sections instead,' and also describes the return values for both cases, making the semantics clear.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses the specific verb 'Look up' with the resource 'Docker SDK/CLI/registry reference documentation by section,' clearly distinguishing it from all sibling tools, which are operational commands. It also explains it's a mirror of docker-docs:// resources, adding specificity.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides explicit when-to-use guidance: 'Most useful before constructing an extra_kwargs-style passthrough dict... or before writing Compose/Dockerfile/buildx bake-file syntax, which no tool generates.' It also notes that it serves as an alternative for clients that can't read MCP resources, and explains when sections refuse, giving clear exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

host_listA
Read-only

List the Docker hosts configured via DOCKER_MCP_SERVER_HOSTS.

With a single host (or the var unset) this is the one resolved daemon; with several it is the set that the host argument selects from. The default entry is the one used when host is omitted; pass a name as the host argument of daemon-backed tools (system_ping(host=...) checks one entry). The docker-mcp://hosts resource mirrors this tool.

returns: list[dict] - one per host: name; url (resolved daemon URL, null = docker-py platform default); read_only; non_destructive (blocks destructive calls only); tls (whether a per-host cert dir is configured); default (the omitted-host fallback)

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, and the description adds substantial behavioral detail: the resolved daemon URL semantics, the meaning of `read_only`, `non_destructive`, `tls`, and `default` fields, and the mirror resource. It also discloses the `null` URL behavior for docker-py platform default, going well beyond the annotation hints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is information-dense with no filler. It front-loads the primary purpose in the first sentence, then uses a compact paragraph plus a bulleted return format. Every sentence adds value—behavioral nuances, integration with other tools, and return field meanings—without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter tool with an output schema, the description covers all necessary context: source of hosts, single vs multiple resolution, default fallback, and how to use the result with other tools. It even explains the return dict fields and the mirror resource, making it self-sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so there are no parameter schemas to clarify. The description compensates by explaining the concept of the `host` argument used by other tools, which gives context for the list. It doesn't need to describe parameter syntax because none exist, but it effectively explains the relevant selection semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'List the Docker hosts configured via DOCKER_MCP_SERVER_HOSTS', a specific verb+resource combo that clearly states the tool's function. It further distinguishes itself from daemon-backed tools by explaining how the `host` argument selects from the listed hosts, setting it apart from siblings like `system_ping`.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear context by explaining the single-host vs multi-host behavior and how the `default` entry is used when `host` is omitted. It also tells the user how to use the output with other tools ('pass a name as the `host` argument of daemon-backed tools'). It lacks explicit 'when not to use' exclusions, but provides strong situational guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

hub_rate_limitA
Read-only

Report the caller's remaining Docker Hub pull-rate-limit budget.

Sends a HEAD to the ratelimitpreview/test manifest (a HEAD isn't metered as a pull, so the check costs no budget) and reads the RateLimit-Limit / RateLimit-Remaining headers. Call it before a large compose_pull / image_pull to avoid hitting the cap mid-deploy. Credentials raise the limit and switch metering from per-IP to per-account; falls back to DOCKER_MCP_SERVER_REGISTRY_USERNAME / DOCKER_MCP_SERVER_REGISTRY_PASSWORD, does NOT read ~/.docker/config.json. Plans with no limit return no headers — reported as "unlimited": true.

args: username - Optional Hub username (overrides DOCKER_MCP_SERVER_REGISTRY_USERNAME) password - Optional Hub password/token (overrides DOCKER_MCP_SERVER_REGISTRY_PASSWORD) returns: dict - {"authenticated", "limit", "remaining", "window_seconds", "unlimited"}

ParametersJSON Schema
NameRequiredDescriptionDefault
passwordNo
usernameNo

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare readOnlyHint=true and destructiveHint=false. The description goes far beyond this by explaining the HEAD request mechanism, that it costs no pull budget, how credentials affect metering, the environment variable fallback, and that unlimited plans return no headers (reported as 'unlimited': true). This is rich behavioral disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the purpose and uses each sentence to convey essential behavioral details. The args and returns sections are clearly formatted and concise, with no filler or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Even without an output schema, the description lists the exact return keys, explains edge cases (unlimited plans, missing headers), and covers authentication behavior. Given the tool's moderate complexity, this is complete enough for an agent to select and invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema provides only parameter names and defaults, with zero descriptions. The description compensates fully by explaining that username/password are optional, override the corresponding environment variables, and that passwords/tokens are accepted. This adds critical semantic meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a precise statement: 'Report the caller's remaining Docker Hub pull-rate-limit budget.' This names a specific verb ('report'), a specific resource (pull-rate-limit budget), and immediately distinguishes this tool from sibling hub tools like hub_tags and hub_repo_info.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says 'Call it before a large compose_pull / image_pull to avoid hitting the cap mid-deploy,' giving a clear when-to-use scenario. It does not provide explicit when-not-to-use guidance or name alternatives, but the context is unmistakable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

hub_repo_infoA
Read-only

Fetch Docker Hub metadata for a repository.

Public repos only: sends no auth and does NOT read the local Docker credential store; private repos return 404/401. Hub-only metadata (stars, pulls, description) — use registry_tags for tag lists on any OCI registry and hub_tags for Hub tag details.

args: repository - Hub repository, e.g. "library/alpine" or "myorg/myimage" returns: dict - The Hub /v2/repositories// response (description, star_count, pull_count, last_updated, is_private, etc.)

ParametersJSON Schema
NameRequiredDescriptionDefault
repositoryYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond annotations by disclosing auth behavior ('sends no auth and does NOT read the local Docker credential store') and failure modes for private repos. ReadOnlyHint annotation is consistent with the read-only nature described, with no contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Every sentence earns its place: a one-line summary, a concise behavioral note with alternatives, and a structured args/returns block. No fluff, well-organized, and scannable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite no output schema, the description lists typical return fields ('description, star_count, pull_count, last_updated, is_private, etc.'), covers auth/error behavior, and contextualizes alternatives. Fully sufficient for a simple metadata-fetch tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description fully compensates by explaining the `repository` parameter with examples ('library/alpine' or 'myorg/myimage'), adding format and naming conventions beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description opens with a specific verb+resource pair: 'Fetch Docker Hub metadata for a repository.' It distinguishes from siblings by explicitly redirecting tag-related queries to `registry_tags` and `hub_tags`, making the tool's unique scope clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit usage constraints ('Public repos only', 'private repos return 404/401') and explicitly names alternatives for different needs ('use registry_tags for tag lists... hub_tags for Hub tag details'). This is clear when-to-use and when-not-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

hub_tagsA
Read-only

List tags on a Docker Hub repository with Hub-specific metadata.

Hits the Hub UI API (hub.docker.com) for richer per-tag data than registry_tags — last pushed date, per-platform sizes, digest. Public repos only: sends no auth and does NOT read ~/.docker/config.json; private repos return 404/401 (use registry_tags against registry-1.docker.io with credentials).

args: repository - Hub repository, e.g. "library/alpine" or "myorg/myimage" limit - Max tags to return (default 100, >= 1); pagination capped at 50 pages returns: dict - {"name": , "tags": [{name, full_size, last_updated, digest, images}, ...], "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
repositoryYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint/destructiveHint annotations, the description discloses key behaviors: it hits a specific API (hub.docker.com), sends no auth, does NOT read ~/.docker/config.json, and private repos return 404/401. It also mentions pagination capped at 50 pages. These are non-obvious traits that add significant value.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise but information-dense. It front-loads the purpose, then covers usage, parameters, and return format in a clear structure. Every sentence contributes new information—no filler or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple (2 params, no output schema), but the description covers all necessary context: purpose, usage alternatives, auth behavior, parameter semantics, and return format. Even without a formal output schema, the return structure is explicitly described, making this complete for an agent to invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description fully compensates. It explains `repository` with examples ('library/alpine' or 'myorg/myimage') and `limit` with default (100), minimum (>=1), and pagination cap (50 pages). This is more detail than a typical schema would provide.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb+resource: 'List tags on a Docker Hub repository with Hub-specific metadata.' It clearly distinguishes itself from the sibling tool `registry_tags` by stating it provides richer per-tag data via the Hub UI API. This leaves no ambiguity about the tool's purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use this tool vs alternatives: it is for richer data than `registry_tags`, and for private repos it explicitly says to use `registry_tags` against registry-1.docker.io with credentials. It also notes 'Public repos only' and behavior for private repos (404/401). This is excellent guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

image_buildA

Build an image from a Dockerfile using the daemon's classic builder.

Use this for simple single-platform builds from a local context. For multi-platform builds, BuildKit cache export/import, or advanced build features prefer buildx_build. path must be a directory accessible on the host running this server (it is the build context sent to the daemon). dockerfile is normally relative to path; omit to use the default Dockerfile.

dockerfile is not confined to the context, despite the usual relative form: docker-py detects an absolute path, or a relative one escaping via .., reads that file from the server host's filesystem and injects its contents into the build. So it can read any file the server user can, like the other host-filesystem parameters (dest_path, from_file), and unlike them it is easy to mistake for a context-relative name. buildx_build's --file resolves differently again (against the CLI's working directory) - see its docstring.

args: path - Build context directory path on the server host tag - Name and optional tag in "name:tag" format to apply to the built image quiet - Suppress verbose build output (final image id still returned) nocache - Ignore the layer cache and rebuild all layers rm - Remove intermediate containers on success (default True) pull - Always pull a newer version of each FROM base image before building forcerm - Remove intermediate containers even on build failure dockerfile - Dockerfile filename relative to path (default: "Dockerfile"); an absolute path or one containing ".." reads that file from the server host instead of the context buildargs - Build-time variables passed as --build-arg; dict of str→str container_limits - Resource limits for the build container, e.g. {"memory": 134217728} shmsize - Size of /dev/shm in bytes for build steps that need shared memory labels - Labels to set on the resulting image (dict of str→str) cache_from - List of image references to use as layer cache sources target - Stop at this named build stage (multi-stage Dockerfiles) network_mode - Network mode for RUN instructions during build (e.g. "host", "none") squash - Squash all new layers into one (experimental; requires daemon flag) extra_hosts - Additional /etc/hosts entries during build; dict of hostname→ip platform - Target platform, e.g. "linux/amd64" (single platform only; use buildx for multi) isolation - Isolation technology, passed to the daemon as given; platform-dependent, so not validated here (Windows documents "default", "process", "hyperv") use_config_proxy - Forward proxy env vars from Docker client config to build returns: dict - The built image's full inspect payload (as docker inspect)

ParametersJSON Schema
NameRequiredDescriptionDefault
rmNo
tagNo
pathNo
pullNo
quietNo
labelsNo
squashNo
targetNo
forcermNo
nocacheNo
shmsizeNo
platformNo
buildargsNo
isolationNo
cache_fromNo
dockerfileNo
extra_hostsNo
network_modeNo
container_limitsNo
use_config_proxyNo

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description surfaces the non-obvious, security-relevant fact that `dockerfile` can read arbitrary host files when given an absolute path or `..` traversal — critical risk disclosure that no annotation or schema field could convey. Also clearly documents the return value ('full inspect payload'), matching the expectation that a build is a write operation (consistent with readOnlyHint: false).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The structure is logical: purpose → when to use → critical path-semantics warning → parameter glossary → return type. While long, the length is justified by the tool's 20 parameters and the description never rambles; each sentence adds information. The initial prose is front-loaded with the single most important 'when to use this vs. other' guidance.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with 20 parameters, zero required, no enums, and no output schema, this description is exceptionally complete. It covers the full use case matrix, explains edge cases (path traversal, host-file reads), documents every parameter with semantics beyond their names, and specifies the return shape.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description carries the full burden of documenting all 20 parameters. It delivers: every param is explained with types ('dict of str→str'), concrete examples ('{"memory": 134217728}'), defaults ('default True'), and platform caveats (isolation on Windows). This is exactly the kind of compensation a rich description must provide.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

First sentence is precise: 'Build an image from a Dockerfile using the daemon's classic builder' — clear verb + resource + engine variant. Explicitly differentiates from the buildx_build sibling by naming the alternative for multi-platform/advanced features.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives explicit when-to-use ('simple single-platform builds from a local context') and names the exact alternative ('prefer `buildx_build`') for other cases. Goes further by contrasting how the `dockerfile` parameter resolves in this tool vs. buildx_build's `--file`, giving agents critical context not discoverable from the schema.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

image_historyA
Read-only

Return the layer history of an image.

Useful for auditing what commands built each layer and diagnosing image size. Each entry includes Id (layer digest or "" for imported layers), Created (unix timestamp), CreatedBy (the Dockerfile command that produced the layer, e.g. a RUN or COPY), Size (bytes added by that layer), and Comment. For full image metadata use image_inspect instead.

args: id_or_name - Image name (with optional tag/digest) or id returns: list - Layer history entries, newest first

ParametersJSON Schema
NameRequiredDescriptionDefault
id_or_nameYes

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the safe read nature is covered. The description adds behavioral details beyond that: it lists the exact fields returned (`Id`, `Created`, `CreatedBy`, `Size`, `Comment`), explains the meaning of `<missing>` Ids, and notes the result is ordered newest first. This gives the agent a clear picture of the output without overstating.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded with the core purpose. Each sentence adds value: use-case justification, field details, an alternative tool pointer, and a terse args/returns summary. There is minimal redundancy and no filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with a single parameter and no output schema, the description provides complete contextual information: what the parameter accepts, what the return type is, the fields included, ordering, and edge-case behavior (`<missing>` for imported layers). It also positions itself against `image_inspect`, making its role within the toolset clear.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema only provides a bare string parameter with no description (coverage 0%). The description compensates by explaining 'id_or_name - Image name (with optional tag/digest) or id', which defines the acceptable input format. This is sufficient for one parameter and clearly aids correct invocation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description starts with 'Return the layer history of an image', using a specific verb and resource that clearly states the tool's function. It also distinguishes from siblings by explicitly directing users to `image_inspect` for full metadata, making its unique scope apparent.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides clear usage context ('Useful for auditing what commands built each layer and diagnosing image size') and explicitly names an alternative ('For full image metadata use `image_inspect` instead'), making it obvious when to use this tool versus a sibling.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

image_importA

Create an image from a flat root-filesystem tarball, like docker import.

Imports a filesystem archive as a new single-layer image with no build history — not the same thing as image_load, which restores a docker save archive complete with its layers, tags and history, so prefer image_load for anything image_save produced. Use this for a rootfs that came from somewhere else: a container_export archive, a distro base tarball, a VM image dump. The result has an empty config — no CMD/ENTRYPOINT/ENV — unless you supply changes, so an imported image is usually not runnable until you set at least a command. Pass exactly one source (from_file, data, from_url or from_image); ValueError otherwise. from_url and from_image are fetched by the daemon, from_file/data are read here and uploaded; a from_file path that is not a readable file raises rather than being retried as a URL. Unlike the other image-creating tools this stamps no provenance labels: the Engine's import call accepts no labels field, and changes does not cover LABEL.

args: repository - Repository name to give the new image, e.g. "myorg/rootfs"; may include a tag (myorg/rootfs:v1), and defaults to :latest when it does not. Omit to import untagged, addressable only by the id in the returned progress (omit it entirely -- a blank string is a ValueError, not a shorthand for untagged). A digest reference is refused by the daemon. Required if tag is given tag - Tag to apply, e.g. "v1". Overrides a tag already in repository rather than being ignored, so passing repository="myorg/rootfs:v1" with tag="v2" yields :v2. Requires repository (ValueError without it — the daemon would otherwise silently drop the tag and import untagged). Blank is also a ValueError, not a shorthand for the default: the daemon would substitute latest without saying so from_file - Path to a rootfs tarball on the server host (~ expanded), read by the server's user; FileNotFoundError if it is not an existing regular file; exactly one source data - Rootfs tarball contents in band (base64-encoded by MCP, so prefer from_file for anything but small archives); exactly one source from_url - URL the daemon fetches the tarball from; exactly one source from_image - Name of an existing image to import from, like a Dockerfile FROM; exactly one source changes - Dockerfile instructions applied to the new image, e.g. ['CMD ["/bin/sh"]']; only CMD, ENTRYPOINT, ENV, EXPOSE, ONBUILD, USER, VOLUME and WORKDIR are supported. Parsed as real Dockerfile syntax, so shell form is wrapped exactly as a Dockerfile would wrap it (CMD /bin/sh is stored as ["/bin/sh","-c","/bin/sh"]) — use the exec form CMD ["/bin/sh"] to store a bare argv returns: str - The daemon's raw newline-delimited JSON progress records; the final record carries the new image id as its status

ParametersJSON Schema
NameRequiredDescriptionDefault
tagNo
dataNo
changesNo
from_urlNo
from_fileNo
from_imageNo
repositoryNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description is a treasure trove of behavioral details beyond the minimal annotations: it reveals that `from_url`/`from_image` are fetched by the daemon while `from_file`/`data` are local, details error conditions (ValueError, FileNotFoundError, daemon refusing digest refs), and explains the resulting image's empty config and lack of provenance labels. It also clarifies the shell form vs exec form behavior for `changes`. Annotations only state readOnlyHint:false and destructiveHint:false, which the description aligns with and enriches.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Every sentence earns its place. The description leads with a clear summary, then layers in critical caveats (distinction from image_load, empty config, single source requirement). It uses a clear 'args:' structure, bullet-like formatting for parameters, and a 'returns' line, making dense technical content scannable. Despite its length, it wastes no words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex tool with 7 parameters, no required fields, multiple source options, and subtle error semantics, this description is remarkably complete. It covers parameter validation, client-vs-daemon execution, return format, and even common pitfalls (the daemon silently substituting 'latest' for blank tags). The output schema exists, but the description still explains the return format, ensuring nothing is left to guesswork.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema provides only names and types (0% description coverage), so the description must do all the semantic work. It delivers with a dedicated 'args:' block covering all 7 parameters, including examples, defaults, error cases, and mutual exclusions. For instance, it explains that `repository` can include a tag, that `tag` overrides a tag in `repository`, and that `data` is base64-encoded by MCP. This far exceeds compensating for the schema's silence.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a precise verb-resource pair ('Create an image from a flat root-filesystem tarball, like `docker import`') and immediately differentiates from the sibling `image_load` by contrasting the archive types and use cases. Distinct from the name alone and highly specific.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly outlines when to use this tool vs. `image_load`: 'prefer `image_load` for anything `image_save` produced. Use this for a rootfs that came from somewhere else'. Provides clear scenarios (container_export archive, distro base tarball, VM image dump) and even mentions the `changes` parameter for setting a default command. This is exemplary guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

image_inspectA
Read-only

Return the full inspect detail for a single local image.

Includes config (env, entrypoint, exposed ports), size, layer digests (RootFS.Layers), and all tags/digests referencing it (RepoTags/RepoDigests). For a quick overview of many images use image_list instead. For the per-layer build history (which command produced each layer) use image_history. Only inspects images already present locally — for a remote image's manifest without pulling it use image_registry_data or registry_manifest.

args: id_or_name - Image name (with optional tag/digest) or id returns: dict - Full image inspect attrs (equivalent to docker inspect on an image)

ParametersJSON Schema
NameRequiredDescriptionDefault
id_or_nameYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes well beyond annotations (readOnlyHint/destructiveHint) by detailing exact output fields (config, size, RootFS.Layers, RepoTags/RepoDigests), the local-only constraint, and equivalence to docker inspect. This is valuable context for safe invocation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured, front-loading the purpose, followed by details and usage alternatives, ending with args/returns. Every sentence adds value; no fluff or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description appropriately explains the return value as a dict equivalent to docker inspect and lists the key fields. It also covers all necessary usage context, making it complete for a single-parameter read-only tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema provides only a string parameter with zero description coverage, but the description fully compensates by explaining id_or_name as an image name (with optional tag/digest) or an id. This is clear and complete despite the sparse schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool returns the full inspect detail for a single local image. It explicitly distinguishes itself from siblings like image_list (quick overview), image_history (build history), and image_registry_data/registry_manifest (remote manifests).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit usage guidance is provided: use image_list for quick overviews, image_history for build history, and registry tools for remote manifests. It also clarifies the tool only works on local images, giving clear when-to-use vs when-not-to-use context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

image_listA
Read-only

List images in the daemon's local store.

Local only — for a registry's contents use registry_tags / hub_tags, and image_search to find images on Docker Hub. Dangling (untagged) build leftovers show with filters={"dangling": True}.

args: repository - Only show images of this repository all - Show intermediate image layers filters - Filter by attributes (label, dangling, before, since, etc.) returns: list - One summary dict per image ({"Id", "RepoTags", "RepoDigests", "Created", "Size", "Labels", ...}); use image_inspect for a full inspect payload

ParametersJSON Schema
NameRequiredDescriptionDefault
allNo
filtersNo
repositoryNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so safety is covered. The description adds valuable behavioral context: it mentions dangling build leftovers, the return payload structure, and that image_inspect is the way to get full details, going beyond the schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well-structured with a clear purpose statement, usage alternatives, an args section, and a returns section. Every sentence is informative and no words are wasted, making it easy to parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity, lack of output schema, and presence of annotations, this description covers all necessary aspects: purpose, scope, alternatives, parameters, and return value. It is fully sufficient for an agent to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has zero description coverage, so the description fully compensates by documenting each parameter: repository, all, and filters, including what they do and the expected type of filters. It also explains the return value format.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists images in the daemon's local store, with a specific verb and resource. It distinguishes itself from sibling tools by noting that registry contents are handled by registry_tags/hub_tags and image_search.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use this tool vs alternatives: 'Local only — for a registry's contents use registry_tags / hub_tags, and image_search to find images on Docker Hub.' Also provides a specific filter example for dangling images.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

image_loadA

Load an image from a tarball produced by image_save, from in-band bytes or a file on the server host.

Counterpart of image_save; when the image lives in a registry, image_pull is the normal route, and for a flat rootfs archive that is not a docker save bundle use image_import. Pass exactly one of data (tarball bytes in band) or from_file (a path on the server host, streamed straight to the daemon — preferred for anything but small images, since in-band bytes are base64-encoded by MCP). from_file is read by the server's user; ~ is expanded.

args: data - Tarball contents; exactly one of data/from_file from_file - Path to a tarball produced by docker save / image_save; exactly one of data/from_file returns: list - One full inspect payload per loaded image

ParametersJSON Schema
NameRequiredDescriptionDefault
dataNo
from_fileNo

TDQS

A4.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds useful behavioral context beyond the annotations: in-band bytes are base64-encoded, `from_file` streams directly to the daemon, `~` is expanded, and file access is under the server user's permissions. It does not explicitly describe the local image-store mutation semantics, but annotations already mark readOnlyHint=false and destructiveHint=false, and loading implies writing to the daemon's image store.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is thorough yet every sentence earns its place. It starts with the core purpose, follows with clear usage guidance and alternatives, then covers parameter mechanics and return shape in a readable format. No filler or tautology is present.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having no output schema, the description specifies the return type as a list of full inspect payloads per loaded image. It also covers the main usage distinctions, parameter options, file path semantics, and transfer trade-offs, making it complete enough for reliable tool selection and invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema provides no parameter descriptions, but the tool description fully compensates by explaining `data` as tarball contents in-band, `from_file` as a server-host path from a `docker save`/`image_save` bundle, and the mutual exclusivity constraint. It also adds practical context about streaming and base64 encoding that is absent from the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Load an image from a tarball produced by `image_save`'. It also clearly distinguishes itself from `image_pull` and `image_import`, which are the closest sibling alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use this tool versus alternatives: registry images should use `image_pull`, flat rootfs archives should use `image_import`. It also recommends `from_file` for anything but small images and clarifies the 'exactly one of' constraint, giving an agent actionable selection criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

image_pruneA
DestructiveIdempotent

Remove unused local images to reclaim disk space.

Without filters removes only "dangling" images — untagged layers not referenced by any tag or container. To remove all images not used by any container (including tagged ones) pass filters={"dangling": False}. Valid filter keys: dangling (bool as string "true"/"false"), until (RFC3339 timestamp or duration like "24h"), label (key or key=value). Use system_df first to see how much space is reclaimable.

args: filters - Narrow which images to remove; omit to remove dangling images only returns: dict - {"ImagesDeleted": [...], "SpaceReclaimed": }

ParametersJSON Schema
NameRequiredDescriptionDefault
filtersNo

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate destructive=true, but the description adds essential behavioral context: default removes only dangling images, filters can expand to all unused images, valid filter keys are enumerated, and return information includes space reclaimed. This goes well beyond the annotation baseline.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured: a one-sentence purpose, a focused paragraph on behavior and filters, and a concise args/returns breakdown. Each sentence contributes necessary information for a destructive prune operation without waste.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Even though no output schema exists, the description states the return dict structure. It covers purpose, filter usage, default behavior, and references system_df. For a one-parameter tool with strong annotations, this is complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema provides no descriptions for the `filters` object, but the description fully compensates by explaining valid filter keys (`dangling`, `until`, `label`) with value formats and the effect of omitting filters. This is high-value semantic information that is otherwise absent.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Remove unused local images to reclaim disk space.' It distinguishes from sibling prune tools by explicitly targeting 'local images' and explains the default dangling-only scope, which differentiates it from image_remove and other prune variants.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides clear context: recommends 'Use system_df first to see how much space is reclaimable' and explains how to choose between dangling-only and all-unused images using filters. However, it does not explicitly name alternative tools or state when not to use it, so it lacks explicit exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

image_prune_buildsA
DestructiveIdempotent

Delete the daemon's build cache to reclaim disk space.

Prunes the build cache — a separate Engine resource from the images image_prune removes, so run both to reclaim everything a build leaves behind. Prefer buildx_prune when the build ran on a non-default buildx builder (that builder keeps its own cache, invisible here) or when you need buildx's disk-ceiling flags; this tool needs no CLI plugin and works over any transport, including a daemon with no local docker binary. Inventory first with system_df (its BuildCache entry) or buildx_du. Destructive and immediate: later builds must re-run the steps whose cache was removed. Needs Docker API v1.31+; passing any of filters, keep_storage, or all needs v1.39+ and raises InvalidVersion on an older daemon — omit all three to prune with the daemon's own defaults.

args: filters - Narrow which cache records to remove, e.g. {"until": "24h"} (a duration or timestamp relative to the daemon's clock); also accepts id, parent, type, description, inuse, shared, private; omit to let the daemon prune unused cache keep_storage - Bytes of cache to keep, e.g. 5368709120 for 5 GiB; omit for no floor. The Engine renamed this reserved-space at API v1.48 and still honors the old name; the newer max-used-space/min-free-space ceilings are reachable only via buildx_prune all - Remove all types of build cache, not just the unused records returns: dict - {"CachesDeleted": [...], "SpaceReclaimed": }

ParametersJSON Schema
NameRequiredDescriptionDefault
allNo
filtersNo
keep_storageNo

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds substantial context beyond annotations: the destructive and immediate nature explicitly stated, API version requirements for each parameter, the `InvalidVersion` error case, and the transport flexibility. No contradictions with the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but well-structured, front-loading the action, then grouping context, alternatives, side effects, API notes, and parameter detail. While longer than the minimal necessary, every section earns its place; a slight trim in the `filters` enumeration would tighten it further.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given no output schema, the description covers all the essential context: what the tool does, what resource it affects, when to prefer alternatives, what to run before, what side effects to expect, API version constraints, parameter details, and the return value shape. Complete for an agent to select and invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, but the description fully compensates: explains `filters` with an example and comprehensive key list, `keep_storage` with byte example and the API v1.48 rename, and `all` with its behavior relative to unused records. This exceeds the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb + resource ('Delete the daemon's build cache to reclaim disk space') and immediately distinguishes it from `image_prune` and `buildx_prune`, making the tool's scope unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-to-use and when-not-to-use guidance, naming `buildx_prune` as the preferred alternative for non-default builders, recommending running both this and `image_prune`, and suggesting `system_df` or `buildx_du` for inventorying before pruning.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

image_pullA

Pull an image from a registry to the daemon's local store.

Private repositories need credentials — system_login (or docker login on the host) first. Use image_load for tarballs, and registry_manifest / image_registry_data to inspect a remote image without pulling it.

args: repository - The image repository tag - The image tag (ignored when all_tags=True) all_tags - Pull all tags from the repository platform - Platform in os/arch format returns: dict | list - Pulled image attrs (or a list of attrs if all_tags=True)

ParametersJSON Schema
NameRequiredDescriptionDefault
tagNo
all_tagsNo
platformNo
repositoryYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations indicate readOnlyHint=false and destructiveHint=false, so the mutation is already known. The description adds valuable context about credential requirements for private repos and the return format (dict or list), going beyond the annotations. It does not go into side effects like overwriting existing images, but for this tool the provided context is adequate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well-structured: a clear opening statement, a credential note, alternatives, parameter list, and returns. Every sentence adds value with no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with four parameters and an output schema, the description covers purpose, usage conditions, alternatives, parameter semantics, and return values. It provides all necessary operational context without requiring additional information.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has 0% description coverage, so the description fully compensates by explaining each parameter (repository, tag, all_tags, platform) and the interaction between tag and all_tags (tag is ignored when all_tags=True). The returns section also clarifies the output shape.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Pull' and the resource 'an image from a registry to the daemon's local store', which is specific and distinguishes it from sibling tools like image_load (tarballs) and registry_manifest (remote inspection).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly notes that private repositories need credentials via system_login or docker login, and explicitly recommends image_load for tarballs and registry_manifest/image_registry_data for remote inspection, providing clear when-to-use and alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

image_pushA

Push an image or repository to a registry.

The local image must already bear the target name — image_tag it with the registry-qualified repository[:tag] first; a bare name pushes to Docker Hub. Private registries need credentials (system_login, or docker login on the host).

Security: auth_config carries registry credentials, which many MCP clients log verbatim. Prefer docker login on the host so the docker module reuses credentials cached in ~/.docker/config.json, and leave auth_config unset.

args: repository - The image repository tag - The tag to push auth_config - Optional registry authentication config returns: str - Push output as a string

ParametersJSON Schema
NameRequiredDescriptionDefault
tagNo
repositoryYes
auth_configNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds significant behavioral context beyond the annotations, which only indicate non-read-only and non-destructive. It discloses a security risk: `auth_config` may be logged verbatim by MCP clients, and recommends using host `docker login` to reuse cached credentials. It also explains the behavior of bare repository names (pushing to Docker Hub) and the need for pre-tagging. This is crucial for safe and correct use.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is moderately sized but every sentence contributes value: action, prerequisite, auth, security warning, and parameter list. It is front-loaded with the core purpose and structured logically. Not overly verbose, but the args section could be more integrated; still, it earns its place by clarifying parameters.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a push operation with authentication requirements, the description covers the necessary steps, security considerations, and return type. It mentions the return value ('Push output as a string') and provides prerequisites. Despite not describing error cases, it gives enough context for an agent to invoke the tool correctly, especially with the existing annotations and output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, so the description's args section is essential. It provides one-line meanings for each parameter: repository (image repository), tag (tag to push), auth_config (optional registry auth). While it doesn't delve into formats or edge cases, the earlier prose clarifies that repository should be registry-qualified and tag is optional. This compensates for the schema's lack of descriptions, though it could be more detailed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'Push an image or repository to a registry.' It uses a specific verb and resource, and distinguishes itself from sibling tools like image_pull and image_tag by clarifying that it uploads an already-tagged image to a remote registry. The prerequisite about tagging first reinforces the specific purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides concrete usage context: the local image must be pre-tagged with the target name, bare names push to Docker Hub, and private registries require credentials. It also recommends using `docker login` over `auth_config` for security, but does not explicitly contrast this tool with alternatives (e.g., when to use `image_pull` or `registry_tags`). The guidance is clear and actionable, but lacks explicit exclusions or comparative scenarios.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

image_registry_dataA
Read-only

Get registry data for an image without pulling it, via the daemon's distribution endpoint.

Uses the daemon (and its cached credentials) to resolve the remote descriptor and platform list. For direct registry access without a daemon use registry_manifest.

Security: auth_config carries registry credentials, which many MCP clients log verbatim. Prefer docker login on the host so the docker module reuses credentials cached in ~/.docker/config.json, and leave auth_config unset.

args: repository - Image reference auth_config - Optional registry authentication config returns: dict - {"Descriptor", "Platforms"} — the OCI descriptor and the platforms available for the reference

ParametersJSON Schema
NameRequiredDescriptionDefault
repositoryYes
auth_configNo

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate read-only and non-destructive behavior, and the description adds substantial context beyond that: the tool does not pull the image, it relies on the daemon's cached credentials, and it warns that `auth_config` may be logged verbatim. This disclosure of internal mechanism and security implications exceeds what annotations provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with separate paragraphs for purpose, usage, security, and argument documentation. Every sentence adds value, but the multi-paragraph format is slightly more verbose than necessary. The front-loaded first sentence conveys the core purpose immediately.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (2 params, read-only, no output schema), the description is complete: it explains the operation, the return dict structure, the dependency on the daemon, the alternative tool, and security considerations. No critical aspects are missing for an agent to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description compensates with brief but meaningful explanations: 'repository - Image reference' and 'auth_config - Optional registry authentication config.' It also adds a security note that clarifies how to treat auth_config. While the parameters are not deeply detailed, the description provides adequate meaning for the agent to use them correctly.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Get registry data for an image without pulling it, via the daemon's distribution endpoint.' It identifies the specific resource (image registry data), the operation (get), and the method (daemon distribution endpoint). It also distinguishes itself from sibling tools like `registry_manifest` by specifying the daemon-dependent approach.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly provides usage context and an alternative: 'For direct registry access without a daemon use `registry_manifest`.' It also gives security guidance on when to use `auth_config` and recommends leaving it unset in favor of `docker login`, which helps the agent decide how to invoke the tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

image_removeA
Destructive

Remove a local image by name or id.

Fails without force if the image is tagged by multiple names (untag first with image_tag) or if stopped containers reference it. Running containers always block removal regardless of force. noprune keeps untagged parent layers that would otherwise be removed as a side-effect; leave False unless you need to preserve the parent layers for another purpose.

args: id_or_name - Image name (with optional tag/digest) or id to remove force - Remove even if referenced by stopped containers or multiple tags noprune - Do not delete untagged intermediate parent layers returns: bool - True after removal completes

ParametersJSON Schema
NameRequiredDescriptionDefault
forceNo
nopruneNo
id_or_nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (destructiveHint=true), the description details failure modes (multiple tags, stopped containers, running containers always block), force behavior, and noprune side-effects. This is extensive behavioral context that helps prevent misuse.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is efficiently structured: a one-sentence purpose, followed by specific behavioral nuances, then an args block. Every sentence adds value, and the format is easy to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a destructive image removal tool, the description covers all necessary context: parameters, failure conditions, side-effects, and return value. Despite no output schema details, the return type is stated. The description is complete for safe and correct usage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema coverage, the description fully compensates by explaining each parameter: id_or_name, force, and noprune. It adds meaning beyond names, including the effect of force and noprune, and even states the return type.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Remove a local image by name or id' with a specific verb and resource. It distinguishes from siblings like image_prune and image_tag by focusing on removing a single named image and addressing tagging/container references.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context on when removal succeeds/fails, including prerequisites like untagging with image_tag when multiple tags exist. It doesn't explicitly compare against alternative removal tools like image_prune, but the usage conditions are well explained.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

image_saveA

Save an image as a tar archive: to a file on the server host, or in band.

The archive keeps layers, tags, and metadata so image_load can restore it — different from container_export, which flattens one container's filesystem. With dest_path the archive streams straight to disk (no byte cap), so it handles large images — the file is written by the server's user, ~ is expanded, and an existing file is refused unless overwrite=True. Without dest_path the tar bytes are returned in band, capped at max_bytes (default 32 MiB) because MCP base64-encodes them — a fallback for when no writable host path exists (e.g. a containerized server without a bind mount).

args: id_or_name - Image name or id dest_path - Destination path on the server host; omit to return the bytes in band named - Whether to retain repository/tag names in the saved archive overwrite - Replace dest_path if it already exists (default False) max_bytes - In-band mode: abort with ValueError beyond this many bytes (default 32 MiB) returns: bytes | dict - the tarball bytes (in band), or {"path": , "bytes_written": int}

ParametersJSON Schema
NameRequiredDescriptionDefault
namedNo
dest_pathNo
max_bytesNo
overwriteNo
id_or_nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes far beyond annotations by disclosing that archives retain layers/tags/metadata, file writes are done by the server's user, `~` expansion, refusal to overwrite unless `overwrite=True`, in-band byte cap due to MCP base64 encoding, and the fallback rationale. Annotations are consistent (readOnlyHint=false, destructiveHint=false) with no contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is efficiently structured with an overview, then mode-specific details, then a parameter list. Every sentence adds meaningful information, and the content is front-loaded with the core purpose before diving into technical nuances.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with two modes, five parameters, and a compound return type, the description is complete. It explains both output shapes (bytes or dict), the byte cap, permissions, overwrite behavior, and the rationale for in-band mode. The existence of an output schema and this description together leave no gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Even though the input schema has no descriptions (0% coverage), the description's 'args' section clearly explains all five parameters: id_or_name, dest_path, named, overwrite, and max_bytes, including defaults and behavior. This fully compensates for the schema's lack of descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('Save') and resource ('image as a tar archive'), and explicitly distinguishes from the sibling tool `container_export` which flattens a container's filesystem. This makes the purpose unambiguous and differentiates it from alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description clearly explains when to use `dest_path` (streaming to disk) vs in-band (fallback when no writable host path), and explicitly contrasts itself with `container_export`. It also notes the purpose (`image_load` restore), giving clear usage context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

image_tagA

Tag an image into a repository (add a name to an existing local image).

The image id stays the same and no data is copied — a tag is an alias. Typical flow: tag with the registry-qualified name, then image_push. image_remove on a tag merely untags while other names remain.

args: id_or_name - The source image name or id repository - Target repository name (registry-qualified for pushing, e.g. "ghcr.io/o/r") tag - Optional tag for the new image (default "latest") force - Force the tag returns: bool - True if the image was tagged

ParametersJSON Schema
NameRequiredDescriptionDefault
tagNo
forceNo
id_or_nameYes
repositoryYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Even with annotations (readOnlyHint=false, destructiveHint=false), the description adds meaningful behavioral detail: 'The image id stays the same and no data is copied — a tag is an alias,' and 'image_remove on a tag merely untags while other names remain.' It also discloses the return value, going well beyond the annotation hints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and well organized: a one-line definition, a short explanatory paragraph, and a clear args/returns list. Every sentence contributes useful information with no filler or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tagging tool with 4 params and 2 required, the description covers purpose, behavior, parameter semantics, return value, and relationship to push/remove. It provides enough context to select and invoke the tool correctly without needing the output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description compensates by explaining id_or_name as source, repository with a registry-qualified example, and tag default. However, 'force - Force the tag' is tautological, and the stated default 'latest' conflicts with the schema's default null, creating ambiguity.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence precisely states the action: 'Tag an image into a repository (add a name to an existing local image).' It distinguishes tagging from copying/pushing and clearly differentiates from sibling tools like image_push and image_remove by clarifying it only creates an alias.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear usage context: 'Typical flow: tag with the registry-qualified name, then image_push,' and notes that image_remove on a tag merely untags. It establishes when to use tagging relative to push/remove, though it does not explicitly list alternative tools for retagging or state exclusions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

network_connectA

Attach a running container to an additional network without restarting it.

Use this to give a container access to services on a network it was not started with. aliases sets extra DNS names for this container within the network (other containers can reach it by those names in addition to its container name). ipv4_address / ipv6_address assign a specific IP on the network; omit to let the driver assign one. links is a legacy feature (deprecated; prefer DNS aliases). Use network_disconnect to undo.

args: id_or_name - Network id or name to connect the container to container - Container id or name to attach aliases - Additional DNS names for this container within the network links - Legacy container links (deprecated) ipv4_address - Static IPv4 address to assign on this network ipv6_address - Static IPv6 address to assign on this network link_local_ips - Link-local IP addresses to assign driver_opt - Driver-specific endpoint options returns: bool - True after the container is connected

ParametersJSON Schema
NameRequiredDescriptionDefault
linksNo
aliasesNo
containerYes
driver_optNo
id_or_nameYes
ipv4_addressNo
ipv6_addressNo
link_local_ipsNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=false and destructiveHint=false, and the description adds complementary context: "without restarting it," the deprecation of links ("legacy feature... prefer DNS aliases"), and the reversibility via network_disconnect. It does not discuss error conditions or prerequisites like network existence, but adds solid value beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with purpose, then usage context, parameter behavior, and a formatted args list plus return type. There is minor redundancy (aliases, ipv4, links appear in both prose and args list), but each mention serves a distinct purpose: prose explains behavior, args list provides quick reference.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 8 parameters with 0% schema coverage, the description covers purpose, when-to-use, all parameter semantics, return value (bool), and the undo path. Gaps include explicit prerequisites (network must exist, container must be running) and error behavior, but overall it is highly complete for the tool's complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the full burden and succeeds: the args section documents all 8 parameters with meaningful one-liners. Prose adds deeper semantics for aliases (extra DNS names), ipv4/ipv6 (specific IP or driver-assigned), and links (deprecated), fully compensating for the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource: "Attach a running container to an additional network without restarting it." This clearly distinguishes the tool from siblings like network_create (creating networks), network_list/inspect, and network_disconnect, which is explicitly named as the undo operation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides clear usage context: "Use this to give a container access to services on a network it was not started with." It also directs users to network_disconnect for undoing. However, it does not state explicit when-not scenarios or alternatives such as connecting during container creation via container_run.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

network_createA

Create a network.

The daemon default driver is bridge (single-host); use overlay for swarm-wide networks. Creating a network attaches nothing — connect containers afterwards with network_connect or at start via container_run(network=...). Created networks are stamped with provenance labels (find them later via network_list(managed_only=True)).

args: name - The name of the network driver - Driver name (daemon default bridge; overlay for swarm scope) options - Driver-specific options dict ipam - IPAM configuration as a dict (engine shape: {"Driver", "Config": [{"Subnet", "Gateway", ...}]}) check_duplicate - Reject creation if a duplicate name exists (deprecated: recent daemons always check) internal - Restrict external access labels - Labels to set on the network enable_ipv6 - Enable IPv6 networking attachable - Allow standalone containers to attach (swarm overlay networks) scope - Network scope; the driver picks a sensible default when omitted ingress - Make this an ingress network for swarm routing-mesh returns: dict - The created network's attrs (Id, Name, Driver, Scope, IPAM)

ParametersJSON Schema
NameRequiredDescriptionDefault
ipamNo
nameYes
scopeNo
driverNo
labelsNo
ingressNo
optionsNo
internalNo
attachableNo
enable_ipv6No
check_duplicateNo

TDQS

A4.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the minimal annotations (readOnlyHint=false, destructiveHint=false), the description adds notable behavioral context: creation attaches nothing, provenance labels are stamped, and check_duplicate behavior is noted. It doesn't mention permissions or error cases but covers key traits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Well-structured with a one-line summary, key behavioral notes, and a clear arg list. Every sentence provides value, and the length is appropriate for the parameter count. No fluff or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite high complexity (11 params, nested objects, no output schema), the description covers usage, parameter meanings, return format (dict with attrs), and ties to related tools. It is sufficiently complete for an agent to invoke correctly without external documentation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has 0% description coverage, so the description fully compensates by explaining each of the 11 parameters, including IPAM shape, driver defaults, and special flags like ingress and attachable. This adds significant meaning beyond the raw schema types.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Create a network' with the resource and action. It differentiates from sibling tools like network_connect and network_disconnect by focusing on creation. The addition of daemon default driver and overlay usage clarifies scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly provides when to use (for swarm-wide networks use overlay), how to connect containers afterward via network_connect or container_run, and how to find created networks via network_list(managed_only=True). This distinguishes it from alternatives and gives clear usage context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

network_disconnectA

Disconnect a container from a network.

The container keeps running with its other network attachments; only this endpoint is removed (the reverse of network_connect). A network with connected containers cannot be deleted, so disconnect them before network_remove.

args: id_or_name - The network id or name container - The container id or name to disconnect force - Force the disconnect; use to clear a stale endpoint (e.g. from a deleted container) returns: bool - True after the container is disconnected

ParametersJSON Schema
NameRequiredDescriptionDefault
forceNo
containerYes
id_or_nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations only indicate `readOnlyHint: false` and `destructiveHint: false`, which are minimal. The description adds substantial behavioral context: the container remains running with other attachments, only the specified endpoint is removed, networks with connected containers cannot be deleted, and force clears stale endpoints. It also states the return value. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core action, then provides a concise behavioral note, a usage precondition, and a clearly formatted args/returns section. Every sentence adds value; no filler or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 3-parameter mutation tool, the description covers purpose, side effects, preconditions, parameter semantics, and return type (bool). The presence of an output schema for the return value is complemented by the explicit 'returns: bool' line. It is fully self-contained and sufficient for an agent to invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the full burden. It explicitly documents all three parameters: id_or_name (network id/name), container (container id/name), and force (with its purpose). This adds meaning beyond the bare schema types and default.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with the specific verb+resource: 'Disconnect a container from a network.' It clearly distinguishes itself from siblings by defining the exact scope: only the endpoint is removed while the container keeps running. It also references `network_connect` and `network_remove`, making the tool's role unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit guidance is provided: the description states this is the reverse of `network_connect`, and that it must be used before `network_remove` when a network has connected containers. It also explains when to use `force` (to clear stale endpoints from deleted containers). This gives the agent clear decision rules among related tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

network_inspectA
Read-only

Return the full inspect detail for a single network.

Includes the connected containers (Containers, keyed by container id, with each entry's assigned IP), IPAM config, and driver options. For a quick overview of many networks use network_list instead — its default (non-greedy) response omits the per-network Containers detail for speed.

args: id_or_name - The network id or name returns: dict - Full network inspect attrs (equivalent to docker network inspect)

ParametersJSON Schema
NameRequiredDescriptionDefault
id_or_nameYes

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, covering safety. The description adds valuable behavioral context: it details what the inspect result includes (connected containers with IPs, IPAM config, driver options) and states the return is equivalent to `docker network inspect`. This goes beyond the annotations by explaining output contents and performance tradeoffs, though it doesn't cover error cases or permissions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core action, followed by useful detail and a structured args/returns section. Every sentence earns its place, with no filler or repetition. The layout is logically organized and scannable, making it easy for an agent to parse quickly.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only, single-parameter inspection tool, the description is complete. It states what the tool does, what data is included in the response, the return type, and when to use an alternative. The lack of an output schema is mitigated by the explicit mention of return structure and contents, making this sufficient for an agent to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description provides the essential param explanation: 'id_or_name - The network id or name.' This fully compensates for the bare schema field, clearly indicating the parameter accepts either an ID or a name. It adds the exact semantic meaning needed beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Return the full inspect detail for a single network,' which is a clear, specific verb+resource statement. It differentiates from siblings like network_list by explicitly contrasting the 'quick overview of many networks' use case, making the tool's purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides explicit guidance: 'For a quick overview of many networks use `network_list` instead — its default (non-`greedy`) response omits the per-network `Containers` detail for speed.' This tells the agent when to use this tool versus an alternative, which is exactly the kind of usage direction needed.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

network_listA
Read-only

List networks.

Valid filter keys: driver (driver name), label (key or key=value), type ("custom" or "builtin"). names/ids are a separate shorthand for filtering by exact name/id, applied in addition to filters. Set greedy to fetch each network's attrs individually (adds the connected-containers detail that network_inspect returns, at the cost of one extra daemon call per network) — leave it False for a fast summary list.

args: names - Filter by exact network names ids - Filter by exact network ids filters - Additional server-side filters; see description for valid keys greedy - Fetch extended per-network details (including connected containers) managed_only - Only return networks created by this MCP server (filters on the docker-mcp-server.managed label); combines with any filters given returns: list - One dict ({"Id", "Name", "Driver", "Scope", ...}) per network: summary attrs by default, full inspect attrs (adding "Containers") when greedy=True

ParametersJSON Schema
NameRequiredDescriptionDefault
idsNo
namesNo
greedyNo
filtersNo
managed_onlyNo

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint annotation, the description discloses performance costs ('one extra daemon call per network'), filter behavior (valid keys and shorthand semantics), and the managed_only label filtering. It also specifies return format (summary vs full attrs), adding substantial operational context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose and then methodically covers filters and parameters. Each sentence delivers meaningful detail without redundancy, and the args/returns structure improves scannability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers return format, all parameter semantics, performance trade-offs, and filter syntax, which is comprehensive for a read-only list tool with no output schema. It leaves no obvious gaps for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description fully documents all five parameters. It explains exact name/id filtering, valid filter keys (driver, label, type), the combination of names/ids with filters, and the managed_only label behavior, completely compensating for the schema gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'List networks,' a clear verb+resource statement that distinguishes it from other network tools. It further clarifies that greedy mode adds the connected-containers detail that network_inspect returns, making its role distinct.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear guidance on when to use greedy versus default mode ('leave it False for a fast summary list') and contrasts with network_inspect. It does not explicitly name alternative tools like network_create or network_remove, but the context is sufficient for the primary list-vs-inspect decision.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

network_pruneA
DestructiveIdempotent

Remove networks that have no active container endpoints.

Built-in networks (bridge, host, none) are never removed. Only networks with zero connected containers are eligible. Valid filter keys: until (RFC3339 timestamp or duration — removes networks created before that point), label (key or key=value). Use network_remove to delete one specific network instead.

args: filters - Narrow which networks to remove; omit to remove all unused custom networks returns: dict - {"NetworksDeleted": [...]}

ParametersJSON Schema
NameRequiredDescriptionDefault
filtersNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

While annotations already declare destructive and idempotent behavior, the description adds crucial context: built-in networks are never removed and only networks with zero connected containers are eligible. It also documents the return dict, going beyond the bare annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two succinct paragraphs: the first states purpose, eligibility, and safety; the second documents args and return. No redundancy or filler, front-loaded with the core action.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given one loosely-typed parameter and no output schema, the description covers purpose, usage conditions, filter semantics, alternative tool, and return format. It is entirely sufficient for an agent to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description fully compensates by explaining the 'filters' parameter: valid keys 'until' and 'label' with formats, and that omitting it removes all unused custom networks. This is far more than the bare schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Remove networks that have no active container endpoints' – a specific verb, resource, and condition. It also distinguishes itself from network_remove by explicitly noting the alternative for single-network deletion.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states when to use: 'Only networks with zero connected containers are eligible' and clearly names the alternative: 'Use network_remove to delete one specific network instead.' It also specifies built-in networks are never removed, providing clear boundaries.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

network_removeA
Destructive

Remove a single custom network by id or name.

Fails if any container is still attached (disconnect with network_disconnect or stop the containers first). Built-in networks (bridge, host, none) can never be removed and return an error regardless of attachment state. For bulk cleanup of every unused custom network at once use network_prune instead.

args: id_or_name - The network id or name returns: bool - True after removal

ParametersJSON Schema
NameRequiredDescriptionDefault
id_or_nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations indicate destructive behavior, but the description adds actionable details: fails if containers are attached, built-in networks always error, and returns True after removal. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact yet information-dense, front-loading purpose and following with failure modes, alternatives, and parameter/return details. Every sentence contributes value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter tool with an output schema, the description covers purpose, failure scenarios, alternatives, parameter meaning, and return value. It is fully sufficient for an agent to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description fully compensates by explaining id_or_name as 'The network id or name'. This directly adds meaning beyond the raw schema, which only specifies type string.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states the action ('Remove') and resource ('a single custom network by id or name'). It distinguishes from sibling tools like network_prune and network_disconnect, making the scope explicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit usage context: when to use (single custom network), failure conditions (attached containers must be disconnected), built-in network restrictions, and an alternative for bulk cleanup (network_prune). Clearly differentiates from related tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

node_inspectA
Read-only

Get a swarm node's full inspect payload by id or name.

Must run against a swarm manager. Shows role, availability, status, and manager reachability — use node_list to enumerate nodes first, or the docker://nodes resource for a fleet summary; service_ps(filters={"node": ...}) shows what a service runs on one node.

args: id_or_name - The node id or hostname (as shown by node_list) returns: dict - The node's attrs (Spec{Role, Availability}, Status, ManagerStatus for managers)

ParametersJSON Schema
NameRequiredDescriptionDefault
id_or_nameYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, covering the safety profile. The description adds value by disclosing the manager requirement ('Must run against a swarm manager') and detailing the information returned ('Shows role, availability, status, and manager reachability' and 'returns: dict - The node's attrs'). This goes beyond the annotations without contradicting them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured: a one-sentence summary, a prerequisite/alternatives sentence, and explicit args/returns sections. It is slightly verbose due to the multiple alternatives in one long sentence, but every part contributes useful context. No redundant information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple read-only tool with one parameter and no output schema, the description is fairly complete: it covers purpose, prerequisite, parameter meaning, return structure, and related tools. It does not discuss error handling or authentication, but those are less critical given the annotations and the straightforward nature of an inspect operation. It ranks above average for completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has no description for the only parameter (schema coverage 0%), so the description must compensate. It does so effectively: 'args: id_or_name - The node id or hostname (as shown by node_list).' This clarifies the accepted values and provides a reference for obtaining them. The description adds sufficient meaning beyond the bare type 'string'.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Get a swarm node's full inspect payload by id or name.' This clearly distinguishes it from sibling tools like node_list (which enumerates nodes) and node_update (which modifies nodes). The mention of 'full inspect payload' further differentiates it from other inspect tools by specifying the swarm node scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states a prerequisite: 'Must run against a swarm manager.' It also provides alternatives: 'use node_list to enumerate nodes first, or the docker://nodes resource for a fleet summary; service_ps(filters={"node": ...}) shows what a service runs on one node.' This gives clear guidance on when to use this tool versus related tools, satisfying the 'when vs alternatives' requirement.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

node_listA
Read-only

List swarm nodes.

Must run against a swarm manager. The fleet view of membership, role, and state; drill into one node with node_inspect, or read the docker://nodes resource for a computed summary.

args: filters - Filter by attributes (id, name, membership, role) returns: list - One full node document per node (Spec, Status, ManagerStatus for managers)

ParametersJSON Schema
NameRequiredDescriptionDefault
filtersNo

TDQS

A4.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, and the description adds useful context: it is a fleet view, returns full node documents with specific fields, and requires a swarm manager. No contradiction with annotations. It does not mention pagination or rate limits, but with strong annotations and return details, this is well-covered.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and front-loaded with the core action 'List swarm nodes'. The subsequent sentences add essential context, usage notes, and return format, all without redundancy. The args/returns structure is efficiently included without breaking flow.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list tool with one optional parameter and no output schema, the description is complete: it explains the return format (list of full node documents with specific fields), the runtime requirement (swarm manager), and provides pointers to alternatives for deeper inspection. No additional detail is needed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema merely defines 'filters' as an object with no description, but the description compensates by explicitly listing 'Filter by attributes (id, name, membership, role)'. This gives the agent concrete guidance on what to pass for the parameter, which is essential given 0% schema coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'List swarm nodes' with a specific verb and resource. It further distinguishes itself from siblings by noting 'drill into one node with node_inspect, or read the docker://nodes resource for a computed summary', making it explicit that this tool is for the fleet-level view.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides strong usage guidance: 'Must run against a swarm manager' sets the prerequisite, and it explicitly names alternatives (node_inspect for single node, docker://nodes for summary), helping the agent decide when to choose this tool over others.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

node_removeA
Destructive

Remove a node from the swarm.

A node should normally be drained (node_update with Availability "drain") and have left the swarm first, so its tasks reschedule cleanly. Removing an active/reachable node requires force=True.

args: id_or_name - The node id or name to remove force - Force removal of an active/reachable node returns: bool - True after the node is removed

ParametersJSON Schema
NameRequiredDescriptionDefault
forceNo
id_or_nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate this is destructive (destructiveHint=true). The description adds valuable behavioral context: the need to drain first, the force flag's effect on active nodes, and the boolean return value. It could mention error behavior or permissions, but the key behaviors are disclosed beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and well-structured: purpose statement, usage/context note, args list, and return type. Every sentence earns its place with no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 2-parameter tool with an output schema, the description is sufficiently complete. It covers the normal workflow, the force exception, and the return value. It omits error scenarios (e.g., node not found) but these are not critical for basic usage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the full burden for parameter meaning. It clearly explains id_or_name (node id or name to remove) and force (force removal of active/reachable node), adding significant value beyond the bare schema types.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Remove a node from the swarm', which is a specific verb+resource statement that clearly distinguishes this from sibling tools like node_inspect, node_list, and node_update. The purpose is immediately unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit when-to-use guidance: it instructs to drain the node with node_update and have it leave before removal, and explains that force=True is required for active/reachable nodes. This is excellent context for selecting the correct approach and references the relevant sibling tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

node_updateA

Replace a node's spec (availability, name, role, labels).

Replacement, not a merge: spec becomes the node's entire spec, and omitted keys are cleared. Fetch the current spec via node_inspect (its Spec key), modify it, and resubmit the whole dict — e.g. sending just {"Availability": "drain"} would also wipe the node's role and labels.

args: id_or_name - The node id or name spec - The complete new node spec (see description — omitted keys are cleared) returns: bool - True after the update

ParametersJSON Schema
NameRequiredDescriptionDefault
specYes
id_or_nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Discloses the non-obvious replacement behavior: 'omitted keys are cleared' and the example about wiping role and labels. This goes beyond annotations (readOnlyHint=false, destructiveHint=false) by explaining the actual side effects and the necessity of using node_inspect first.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is somewhat long but well-structured: purpose sentence, behavioral caveat, args/returns block. Each sentence adds value, though the args section could be more compact. It front-loads the primary purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a mutation tool, it covers the essential context: what the operation does, the non-merge semantics, how to prepare the value safely, and the return type. It also gives a concrete cautionary example, which is more than sufficient for an agent to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Despite 0% schema description coverage, the description fully defines both parameters: id_or_name as node id/name and spec as the complete new spec with the crucial caveat that omitted keys are cleared. This adds significant meaning beyond the bare schema types.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description opens with a specific verb+resource+fields: 'Replace a node's spec (availability, name, role, labels).' This clearly distinguishes it from node_inspect (read), node_remove (delete), and node_wait (status wait).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly explains when and how to use: 'Replacement, not a merge' and advises fetching current spec via node_inspect, modifying, and resubmitting the whole dict. Also provides a concrete example of the pitfall (sending just Availability wipes role/labels), which serves as a clear guideline.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

node_waitA
Read-only

Block until a swarm node's Status.State reaches a target value.

Never raises on timeout — the result always carries met and timed_out. Polls Status.State (one of "unknown"/"down"/"ready"/"disconnected") every poll_intervals. Common uses: until="ready" after a newly joined node, or until="down" while draining a node before removal. Does not track task placement — for "has this drained node's workload fully moved off", inspect the relevant services' tasks directly; no single cheap call spans every service in the swarm, so that check isn't built into this tool. service_wait covers service convergence; node_list shows every node's state at once.

args: id_or_name - The node id or name until - Target Status.State to wait for: "ready" (default), "down", "disconnected", "unknown" timeout_seconds - Max seconds to wait before returning with timed_out=true (default 300) poll_interval - Seconds between re-inspections (default 2, > 0); capped by the time left so a large value can't push the total wait past the timeout returns: dict - {"node", "until", "met", "timed_out", "state", "availability", "waited_seconds"}

ParametersJSON Schema
NameRequiredDescriptionDefault
untilNoready
id_or_nameYes
poll_intervalNo
timeout_secondsNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only declare readOnlyHint and destructiveHint, but the description adds crucial behavioral details: it never raises on timeout, always returns met and timed_out, polls at poll_interval, and caps poll_interval by remaining time so a large value cannot exceed timeout. These details inform the agent of failure modes and timing semantics not present in annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Though longer than typical descriptions, every sentence is load-bearing: core blocking behavior, timeout semantics, common use cases, task-tracking caveat, parameter list, and return shape. The structure is well-organized with paragraphs and an args block, front-loaded with the essential action.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, so the description's explicit return-field list (node, until, met, timed_out, state, availability, waited_seconds) is essential. Combined with full parameter semantics, timeout/polling behavior, and caveats about task placement, the description is complete for a wait-type tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, but the description fully compensates by explaining each parameter: id_or_name, until (with allowed states), timeout_seconds (default 300), and poll_interval (default 2, >0, capped). It adds meaning beyond the schema's bare type and enum definitions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening sentence precisely states the verb, resource, and target: 'Block until a swarm node's Status.State reaches a target value.' It further distinguishes itself from sibling tools by naming what it does not do (task placement tracking) and pointing to alternatives like service_wait and node_list.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit use cases are provided ('until="ready"' after a newly joined node, 'until="down"' while draining a node before removal). The description also states clear exclusions: it does not track task placement, and for that check the agent should inspect services' tasks directly, with service_wait and node_list named as relevant alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

plugin_configureA

Set runtime configuration options on an installed plugin.

Use plugin_inspect first to see which keys the plugin exposes under Settings.Env; pass those same keys as a plain dict, e.g. {"DEBUG": "1", "SOCKET": "/run/x.sock"}. The plugin must be disabled before reconfiguring — call plugin_disable first if it is currently active, then plugin_enable afterwards to apply the new settings.

args: name - Plugin name, e.g. "vieux/sshfs:latest" options - Key/value settings to apply, matching the plugin's declared env keys returns: bool - True after configuration

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes
optionsYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only include readOnlyHint=false and destructiveHint=false, which are minimal. The description compensates by revealing that the plugin must be disabled before reconfiguring and that the operation returns a boolean after configuration. It also warns that option keys must match the plugin's declared env keys. However, it does not mention what happens if the plugin is active (e.g., error) or whether unlisted settings are overridden, leaving some behavioral nuance undisclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is tightly written with no filler. It leads with a one-sentence purpose, follows with actionable instructions and an example, then lists args/returns in a clear format. Every sentence earns its place; the structure is easy to scan and parse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite the simple schema, the description covers the full workflow: how to discover valid keys, how to construct options, the disable/configure/enable sequence, and the return value. It even includes an example. Given the tool's modest complexity and the availability of an output schema, the description is complete and self-sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema provides only names and types with zero description coverage. The description adds rich semantic detail: name is exemplified ('vieux/sshfs:latest'), options are explained as 'Key/value settings to apply, matching the plugin's declared env keys', and a concrete dict example is given. It also tells the agent where to find valid keys (Settings.Env via plugin_inspect), fully compensating for the sparse schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource: 'Set runtime configuration options on an installed plugin.' This clearly distinguishes it from sibling tools like plugin_inspect (viewing config) and plugin_disable/enable (lifecycle operations). The phrase 'runtime configuration options' conveys the exact scope of the tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit guidance: 'Use plugin_inspect first to see which keys the plugin exposes under Settings.Env' and 'The plugin must be disabled before reconfiguring — call plugin_disable first if it is currently active, then plugin_enable afterwards.' This tells the agent both the prerequisite workflow and how to alternate with related tools, leaving no ambiguity about when/how to invoke.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

plugin_createA

Build a plugin from a local plugin data directory and install it under name.

The counterpart to plugin_install, which pulls an already-published plugin from a registry: use this only for a plugin rootfs you built yourself, and plugin_install for anything on a registry. plugin_data_dir is read on the machine running this server (not on the daemon host), must already contain a config.json manifest and a rootfs directory, and is tarred client-side and posted to the daemon — in a container it must be a bind mount or the path resolves to nothing. The new plugin is created disabled: call plugin_configure for any settings it declares, then plugin_enable to activate it. Raises if the directory is missing or lacks config.json/rootfs, or if name is already installed (remove it first with plugin_remove). Unlike the other create tools, this stamps no provenance labels — the Engine API's plugin-create call accepts none.

args: name - Local name for the plugin, author/name:tag; the :latest tag is optional and is the default if omitted plugin_data_dir - Path on this server's filesystem to the plugin data directory (containing config.json and rootfs) gzip - Compress the uploaded directory with gzip (default False) returns: dict - The created plugin's attrs ({"Id", "Name", "Enabled", "Settings", "Config"})

ParametersJSON Schema
NameRequiredDescriptionDefault
gzipNo
nameYes
plugin_data_dirYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (readOnlyHint=false, destructiveHint=false), the description discloses crucial behaviors: the plugin is created disabled, errors are raised for missing directories or duplicate names, no provenance labels are stamped, and plugin_data_dir is read client-side (not on the daemon host). These details are not inferable from annotations and materially affect tool usage.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with a crisp purpose sentence, followed by a compact but dense paragraph of behavioral context, and then a clean args/returns section. Every sentence adds value—no filler, redundancy, or restatement of the tool name.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema and sparse parameter descriptions, the description carries the full burden. It includes the return dict fields, preconditions, error conditions, lifecycle steps, and the distinction from the sibling plugin_install tool. This is as complete as an agent needs for correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, but the description fully compensates. It explains the name format (`author/name:tag` with optional `:latest`), specifies that plugin_data_dir must contain config.json and rootfs and is read on the server's filesystem, and clarifies gzip's role and default. This adds substantial meaning beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence states a specific verb ('Build') and resource ('plugin from a local plugin data directory and install it under name'). It explicitly distinguishes this from plugin_install, which pulls an already-published plugin from a registry, making it clear among sibling plugin tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit guidance: use this only for a self-built rootfs, use plugin_install for anything on a registry. It also provides prerequisites (config.json and rootfs required), container bind-mount requirement, and a clear lifecycle sequence: plugin_configure then plugin_enable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

plugin_disableA

Disable a plugin so it stops intercepting Docker API calls; the plugin remains installed.

A disabled plugin cannot be used by new containers but existing containers that already have it attached are unaffected. Use force=True to disable even if active containers are still using it — this may cause those containers to lose access to plugin-provided resources (e.g. a volume driver). Re-enable with plugin_enable.

args: name - The plugin name force - Disable even if active containers are using the plugin (may disrupt them) returns: bool - True after the plugin is disabled

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes
forceNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes well beyond annotations by detailing side effects: plugin remains installed, existing containers unaffected, new containers cannot use it, and force may disrupt active containers and cause loss of access to plugin-provided resources. This is rich behavioral disclosure that annotations (readOnlyHint=false, destructiveHint=false) do not capture.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well-structured: a one-sentence summary, two sentences of behavioral detail, explicit args and returns. Each sentence delivers essential information without redundancy or fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a two-parameter tool with an output schema (bool return), the description is complete. It covers purpose, side effects, parameter semantics, return type, and even points to plugin_enable for reversal. No major gaps exist.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description carries the burden. It explains 'name' as plugin name (adequate) and 'force' with meaningful semantics: 'Disable even if active containers are using the plugin (may disrupt them).' This adds practical meaning beyond the schema's raw boolean. A tad more detail on name (e.g., use plugin_list) would push it higher.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource: 'Disable a plugin so it stops intercepting Docker API calls; the plugin remains installed.' It clearly distinguishes the operation from related siblings like plugin_enable (re-enable) and plugin_remove (removal), and states the resource remains installed.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear when-to-use context: disabled plugins affect new containers but not existing attached ones, and force=True is recommended for active containers. It also explicitly mentions the alternative 'Re-enable with plugin_enable.' However, it does not cover all possible alternatives (e.g., plugin_remove) or when not to use this tool, so a small gap remains.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

plugin_enableA

Activate an installed plugin so Docker routes relevant API calls through it.

Activates a plugin that is currently disabled — either freshly installed or previously disabled via plugin_disable. If the plugin exposes configuration (check via plugin_inspect), call plugin_configure while it is still disabled before enabling it. timeout_seconds controls how long Docker waits for the plugin process to become healthy; 0 means wait indefinitely.

args: name - The plugin name to enable timeout_seconds - Seconds to wait for the plugin to become healthy (0 = no timeout) returns: bool - True after the plugin is enabled

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes
timeout_secondsNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses behavioral implications beyond the annotations: enabling causes Docker to route API calls through the plugin, and timeout_seconds controls the health wait. It does not, however, mention potential side effects such as service disruption or how enabling affects existing plugin state, but the core behavior is clearly conveyed. Annotations already indicate mutation (readOnlyHint: false), so the description adds useful context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured: a concise opening definition, followed by relevant usage context and configuration advice, then a clear args/returns section. Every sentence adds value, with no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with two parameters, an output schema, and annotation context, the description is complete. It explains what the tool does, when to use it, how parameters behave, and even covers the related configuration workflow. No critical information seems missing for an agent to invoke it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description fully compensates by explicitly defining both parameters: 'name - The plugin name to enable' and 'timeout_seconds - Seconds to wait for the plugin to become healthy (0 = no timeout)'. This adds meaning far beyond the bare schema types and defaults.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose with a specific verb ('Activate') and resource ('an installed plugin'), and explains the functional outcome ('so Docker routes relevant API calls through it'). It distinguishes itself from sibling tools by focusing on enabling a disabled plugin, while siblings handle install, disable, configure, etc.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit guidance on when to use: 'a plugin that is currently disabled — either freshly installed or previously disabled via plugin_disable'. It also provides a key prerequisite: if the plugin exposes configuration, call plugin_configure while disabled before enabling. This effectively tells the agent the recommended order of operations relative to sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

plugin_inspectA
Read-only

Return the full attrs for a single installed plugin.

Use this to check a plugin's Enabled state before calling plugin_enable / plugin_disable, or to read the config keys it exposes under Settings.Env before calling plugin_configure. For the set of all installed plugins use plugin_list.

args: name - Plugin name, e.g. "vieux/sshfs:latest" returns: dict - The plugin's attrs, including Enabled and Settings

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is clear. The description adds useful behavioral context by stating it returns 'the full attrs... including Enabled and Settings', and it frames usage around inspecting state before mutations. This goes beyond the annotations without contradicting them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is four concise sentences. The first sentence states the core purpose, the second provides usage context and alternatives, and the final two give parameter and return details. Every sentence earns its place, no redundancy or fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple single-parameter read-only tool with no output schema, this description is complete. It covers purpose, usage scenarios, alternatives, parameter semantics, and return value expectations. It tells the agent everything needed to invoke it correctly and interpret results, given the simplicity of the tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema only has a required 'name' string with no description, so 0% schema coverage. The description compensates by defining the parameter: 'args: name - Plugin name, e.g. "vieux/sshfs:latest"' plus a concrete example. This adds meaningful semantic info that the schema lacks, though it doesn't specify any format constraints or possible values beyond the example.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description begins with 'Return the full attrs for a single installed plugin,' which is a specific verb+resource statement. It clearly distinguishes from sibling plugin_list by saying 'For the set of all installed plugins use plugin_list.' It also mentions the return includes Enabled and Settings, making its purpose unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says 'Use this to check a plugin's Enabled state before calling plugin_enable / plugin_disable, or to read the config keys it exposes under Settings.Env before calling plugin_configure.' It even names the alternative tool plugin_list for when you need all plugins. This provides clear when-to-use guidance and alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

plugin_installA

Install a plugin from Docker Hub.

remote is a Docker Hub reference in author/name:tag form, e.g. vieux/sshfs:latest. The daemon handles permission grants non-interactively — call plugin_privileges first to see what host access the plugin is asking for. After installation use plugin_inspect to confirm the plugin's enabled state, then call plugin_enable to activate it if needed, and optionally plugin_configure first if it requires settings. Use plugin_list to list all plugins, or plugin_remove to uninstall.

args: remote - Docker Hub plugin reference, e.g. "vieux/sshfs:latest" local_name - Alias to refer to the plugin locally; defaults to remote returns: dict - The installed plugin's attrs ({"Id", "Name", "Enabled", "Settings", "Config"})

ParametersJSON Schema
NameRequiredDescriptionDefault
remoteYes
local_nameNo

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only indicate non-read-only and non-destructive. The description adds valuable behavioral context: the daemon handles permission grants non-interactively, so users must proactively check privileges. It also specifies the return value structure, which is absent from annotations. Slightly lacking on failure modes or what happens if the plugin already exists, but overall transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is moderately long but well-structured: main action, workflow guidance, then arguments/returns. It avoids unnecessary fluff, though the workflow narrative could be tightened without losing essential guidance.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with two parameters and no output schema, the description covers the action, prerequisites, parameter formats, return type, and post-install steps. It effectively situates the tool within the plugin lifecycle, making it self-contained for an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has no descriptions (0% coverage), but the description fully compensates. It explains `remote` with an example (vieux/sshfs:latest) and `local_name` as an alias defaulting to remote, making both parameters clear and actionable.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Install a plugin from Docker Hub', a specific verb and resource. It clarifies the remote reference format and distinguishes itself by outlining the install->inspect->enable workflow, which clearly separates it from sibling plugin tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly directs users to call plugin_privileges first to inspect permissions, then details post-install steps (plugin_inspect, plugin_enable, plugin_configure). It also notes alternatives like plugin_list and plugin_remove, providing clear usage context and a recommended sequence.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

plugin_listA
Read-only

List installed engine plugins with their full attrs.

Covers managed engine plugins (volume/network/logging drivers installed via plugin_install) — not docker CLI plugins such as compose, buildx, or scout. Use it to find exact plugin names for plugin_inspect/plugin_enable/plugin_disable/plugin_remove; the Enabled key shows each plugin's state.

returns: list - One attrs dict per installed plugin (Id, Name, Enabled, Settings, Config)

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so safety is clear. The description adds behavioral context about the Enabled key and return contents, which is useful beyond annotations. It does not need to mention side effects since this is a read-only list.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Every sentence earns its place: first sentence gives the verb/resource, second clarifies scope with an exclusion, third provides usage guidance and return format. Compact, well-structured, and no fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having no output schema and no parameters, the description fully covers the return shape and the state key semantics. It also contextualizes the tool within the plugin lifecycle, making it complete for an agent to invoke and interpret results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Tool has zero parameters, so baseline is 4. The description compensates by detailing the return attrs (Id, Name, Enabled, Settings, Config), which helps the agent understand what the list will contain without an output schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States exactly what it does: 'List installed engine plugins with their full attrs.' It distinguishes engine plugins from Docker CLI plugins and names the related sibling tools (plugin_inspect, plugin_enable, etc.), making its purpose unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-to-use: 'Use it to find exact plugin names for plugin_inspect/plugin_enable/plugin_disable/plugin_remove.' Also clarifies what it does not cover (Docker CLI plugins), giving a clear boundary and aiding tool selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

plugin_privilegesA
Read-only

Ask the registry which host privileges a not-yet-installed plugin demands.

The review step before plugin_install, which grants these privileges non-interactively (the daemon never prompts) — so this is the only chance to see what a plugin wants before it has it. Worth checking for anything not already trusted: plugins routinely request host mounts, devices, and elevated capabilities, and a granted privilege is host-level access, not container-scoped. Reads the remote plugin from its registry and installs nothing; for the privileges of a plugin already installed, read Config from plugin_inspect instead. Credentials come from system_login, or from ~/.docker/config.json if the host ran docker login. Raises if the reference cannot be resolved in the registry.

args: remote - Registry plugin reference, author/name:tag; the :latest tag is optional and is the default if omitted returns: list - One dict per requested privilege ({"Name", "Description", "Value"}), e.g. Name "mount" with Value ["/data"], or "capabilities" with Value ["CAP_SYS_ADMIN"]; empty if the plugin requests none

ParametersJSON Schema
NameRequiredDescriptionDefault
remoteYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Description adds substantial behavioral context beyond the readOnlyHint/destructiveHint annotations: it reads remote plugin data without installing, may raise on unresolved references, relies on credentials from system_login or ~/.docker/config.json, and explains the security significance of host-level privileges. No contradictions with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Despite its length, every sentence earns its place. The description is front-loaded with purpose, uses structured 'args' and 'returns' sections, and avoids redundancy. It's detailed but not bloated.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is fully complete for a tool with one parameter and no output schema: it covers return format with examples, error behavior, authentication, and use-case context. Nothing essential is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single parameter 'remote' is fully explained with format ('author/name:tag'), optional ':latest' default, and return structure. Schema coverage is 0%, so the description completely compensates, leaving no ambiguity.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Ask the registry which host privileges a not-yet-installed plugin demands.' It distinguishes itself from sibling tools by explicitly specializing in uninstalled plugins and contrasts with plugin_inspect for installed plugins.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit when-to-use guidance: 'The review step before plugin_install' and warns of non-interactive grants. It also names the alternative for installed plugins: 'read Config from plugin_inspect instead.' This is clear, actionable, and specific.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

plugin_pushA

Push an installed plugin to its registry.

The write-side counterpart to plugin_install (which pulls) and the publish step after plugin_create builds a plugin locally: name must already be the registry-qualified name the plugin is installed under, since — unlike image_push — there is no plugin equivalent of image_tag to rename it first, so create it under the target name. The plugin does not need to be enabled. Credentials come from system_login, or from ~/.docker/config.json if the host ran docker login. Does NOT raise when the registry rejects the push: an authentication or quota failure arrives as a final progress record and is surfaced as the error key, so check that key rather than assuming success. Raises RuntimeError if the installed docker-py is too old to expose the internals below, and docker.errors.APIError if the plugin isn't installed.

Bypasses docker-py's Plugin.push()/APIClient.push_plugin(), which cannot work: both POST to /plugins/{name}/pull, a route the Engine does not define (push is /plugins/{name}/push), so they 404 against any daemon. Bug present since the method was written in 2017 and still in docker-py main; it survives because upstream has no test covering it. This calls the correct endpoint through docker-py's private request helpers, in the manner of system_logout's api._auth_configs reach-in, and fails loudly if those internals change shape.

Caveat for ssh:// daemons: docker-py can't cancel an SSH stream, so the timeout_seconds watchdog can't interrupt a push that stalls with the connection still open — the same limitation container_logs carries in follow mode. The call still returns normally once the registry answers or the stream ends.

args: name - Installed plugin name to push, [registry/]author/name:tag; :latest if the tag is omitted. A bare author/name pushes to Docker Hub timeout_seconds - Max wall-clock seconds to wait on the push stream before returning what was collected (default 300); raise it for a large plugin over a slow link returns: dict - {"name", "progress": [], "truncated": bool, "error": str or None} — error is non-None only when the registry reported a failure

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes
timeout_secondsNo

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (readOnlyHint=false, destructiveHint=false), the description discloses crucial behavior: registry rejections surface as an 'error' key rather than raising, credentials come from system_login or ~/.docker/config.json, the plugin need not be enabled, a docker-py bug is worked around, and SSH daemons have a timeout limitation. This is rich, meaningful behavioral context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is lengthy and structured in paragraphs, but every sentence earns its place by covering purpose, context, error handling, edge cases, and parameters. It is front-loaded with the main purpose, and while it could be tightened, the detail is justified given the tool's complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite the absence of an output schema, the description details the return dict structure (name, progress, truncated, error), error semantics, credential requirements, and behavioral caveats. It provides complete context for using and debugging the tool in real-world scenarios.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description fully compensates by explaining both parameters: 'name' format ([registry/]author/name:tag, :latest omitted, Docker Hub for bare author/name) and 'timeout_seconds' (max wall-clock seconds, default 300). The args section adds meaning the schema lacks.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a precise verb+resource statement, 'Push an installed plugin to its registry,' and clearly distinguishes this from plugin_install (pull) and image_push (no plugin equivalent of image_tag). It explicitly defines the tool's scope and relationship to sibling tools, making the purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly frames the tool as the write-side counterpart to plugin_install and the publish step after plugin_create. It also notes the prerequisite that the name must already be registry-qualified, and contrasts with image_push by explaining there is no plugin rename step. This gives clear when-to-use and when-not-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

plugin_removeA
Destructive

Uninstall an engine plugin from the daemon.

Permanent removal — to deactivate but keep a plugin installed use plugin_disable instead. An enabled plugin must be disabled first unless force=True. Plugin names come from plugin_list.

args: name - The plugin name (e.g. "vieux/sshfs:latest") force - Remove even if the plugin is enabled (default False) returns: bool - True after removal

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes
forceNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond annotations (destructiveHint=true, readOnlyHint=false), the description adds key behavioral details: permanent removal, the requirement to disable before removal unless force=True, and that plugin names come from plugin_list. This fully discloses the operational scope and consequences.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well-structured, using clear sections for behavior, args, and returns. Every sentence provides necessary information without redundancy or fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite 0% schema parameter coverage, the description covers purpose, usage, parameters, and return value, while also referencing plugin_list and plugin_disable for context. It is fully complete for an agent to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description fully compensates by explaining both parameters: name (plugin name with example) and force (remove even if enabled, default False). It also documents the return value (bool), providing complete parameter meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool uninstalls an engine plugin from the daemon, using a specific verb and resource. It further distinguishes itself from plugin_disable by noting permanent removal, which fully differentiates it from sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says when to use this tool vs the alternative: 'to deactivate but keep a plugin installed use plugin_disable instead.' It also covers the prerequisite that an enabled plugin must be disabled first unless force=True, providing clear usage context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

plugin_upgradeA

Upgrade an installed plugin to a newer version.

The plugin must be disabled first — call plugin_disable before this, then plugin_enable afterwards to bring it back up. remote lets you upgrade to a different reference (e.g. a newer tag) than the plugin's current name; omit it to re-pull the same reference. Existing settings and volumes created by the plugin persist across the upgrade.

args: name - The plugin name to upgrade remote - Reference to upgrade to, e.g. "vieux/sshfs:next" (default: same as name) returns: bool - True after the upgrade completes

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes
remoteNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

While annotations already indicate readOnlyHint=false and destructiveHint=false, the description adds valuable behavioral context: the plugin must be disabled first, and existing settings/volumes persist across the upgrade. This goes beyond the annotation basics, though it could also mention failure modes or permission requirements to reach a full 5.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise and well-structured: a one-sentence purpose, a usage paragraph covering prerequisites and persistence, then clear args and returns sections. Every sentence adds value, with no filler or redundant repetition of schema data.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's moderate complexity (prerequisite disable/enable, remote reference semantics, persistence guarantee), the description covers all needed aspects: workflow, parameter behavior, return type, and persistence. It is complete enough for an agent to invoke the tool correctly, and the return schema is simple (bool) requiring no extra explanation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Although the input schema has no descriptions (0% coverage), the description fully compensates by explaining both parameters: `name` as the plugin to upgrade and `remote` with a concrete example ('vieux/sshfs:next') and default behavior. It also clarifies the return value, making the parameter and output semantics complete.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Upgrade an installed plugin to a newer version,' which clearly states a specific action (upgrade), target (installed plugin), and outcome (newer version). This distinguishes it from sibling tools like plugin_install, plugin_disable, and plugin_enable, which have different purposes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly instructs to call plugin_disable before, and plugin_enable after, the upgrade. It also explains when to use the `remote` parameter versus omitting it (to re-pull the same reference). This is clear, actionable usage guidance with no ambiguity about the intended workflow.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

registry_image_configA
Read-only

Fetch and parse an image's config blob from a registry without pulling.

Answers "what's inside this image?" — env vars, entrypoint/cmd, workdir, exposed ports, user, labels, layer history (what registry_manifest only points at via config.digest). Resolves in up to three hops: manifest -> (if multi-platform) the platform entry's manifest -> the config blob.

args: repository - Image/repository ref, e.g. "ghcr.io/org/repo"; :tag/@digest is stripped — pass via reference reference - Tag or digest (default "latest") platform - Platform to select from a multi-platform image, "os/arch[/variant]" (default "linux/amd64"); ignored for single-platform images username - Optional registry username (overrides DOCKER_MCP_SERVER_REGISTRY_USERNAME) password - Optional registry password/token (overrides DOCKER_MCP_SERVER_REGISTRY_PASSWORD) returns: dict - {"name", "registry", "reference", "platform", "config_digest", "config": }; platform is the selected platform (None if single-platform)

ParametersJSON Schema
NameRequiredDescriptionDefault
passwordNo
platformNolinux/amd64
usernameNo
referenceNolatest
repositoryYes

TDQS

A4.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark the tool as read-only and non-destructive. The description adds valuable behavioral context: multi-hop resolution (manifest -> platform entry -> config blob), stripping of `:tag`/`@digest` from repository, default platform behavior, and credential override behavior. It also discloses the return format. This goes beyond the annotation's simple safety profile, though it does not cover failure modes or rate limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured and front-loaded. The opening sentence states the core function, followed by a useful list of extracted fields, then a brief explanation of resolution hops. The `args` list is clear and the `returns` note completes the picture. Every sentence serves a purpose without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only registry inspection tool with no output schema, the description provides complete context: purpose, parameter semantics, multi-platform resolution, credential handling, and the exact return dictionary. It is self-contained and leaves the agent with sufficient information to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Although the input schema has zero descriptions (0% coverage), the description's `args` section thoroughly documents all five parameters: repository, reference, platform, username, and password. It explains defaults, overrides, and special behaviors such as '`:tag`/`@digest` is stripped — pass via `reference`'. This fully compensates for the sparse schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific action: 'Fetch and parse an image's config blob from a registry without pulling.' It then enumerates the exact contents (env vars, entrypoint, cmd, workdir, ports, user, labels, layer history) and explicitly contrasts with sibling `registry_manifest`, which only points at the config digest. This makes the tool's purpose unmistakable and distinguishes it from related tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies use when you need to inspect an image's configuration without pulling it, and explicitly contrasts with `registry_manifest`. It also provides context about multi-platform resolution and auth overrides. However, it does not explicitly state when not to use this tool or name alternative tools like `image_inspect` or `image_registry_data`, leaving some room for ambiguity.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

registry_manifestA
Read-only

Fetch a repository's manifest without pulling.

May return a single-platform image manifest or a multi-platform manifest list / OCI image index, depending on what the registry serves for that tag. Talks HTTPS directly — no daemon or CLI needed. Alternatives for the same question: buildx_imagetools_inspect (uses the docker CLI and its credential store) and image_registry_data (asks the daemon).

args: repository - Image/repository ref, e.g. "ghcr.io/org/repo"; :tag/@digest is stripped — pass via reference reference - Tag or digest (default "latest") username - Optional registry username (overrides DOCKER_MCP_SERVER_REGISTRY_USERNAME; no config.json) password - Optional registry password/token (overrides DOCKER_MCP_SERVER_REGISTRY_PASSWORD) returns: dict - {"name", "registry", "reference", "media_type", "digest", "manifest": }

ParametersJSON Schema
NameRequiredDescriptionDefault
passwordNo
usernameNo
referenceNolatest
repositoryYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint annotation, it discloses that the response may be a single-platform manifest or multi-platform list depending on the registry's tag, and explains that `repository` strips `:tag`/`@digest`, which is a non-obvious behavior. Also details credential overriding without config.json support. This is substantial added context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but every sentence is informative: core action, response variability, transport mechanism, alternatives, parameter doc, and return structure. It is front-loaded with the essential purpose and well-structured.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

No output schema exists, yet the description explicitly defines the return dict keys ('name', 'registry', 'reference', 'media_type', 'digest', 'manifest'). The combination of parameter details, alternatives, and response shape makes it self-sufficient for an agent to invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has zero descriptions, but the description provides full parameter semantics: `repository` with example and tag-stripping note, `reference` with default, `username`/`password` with override behavior. This completely compensates for the schema gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states the primary function: 'Fetch a repository's manifest without pulling.' It goes further to explain the possible response types (single-platform vs multi-platform list) and explicitly names alternative tools, making its purpose unambiguous and distinct from siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Directly addresses when to use this tool by presenting alternatives: `buildx_imagetools_inspect` (uses docker CLI and credential store) and `image_registry_data` (asks the daemon). This gives the agent a clear decision framework. Also notes 'Talks HTTPS directly — no daemon or CLI needed' to justify its suitability.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

registry_tagsA
Read-only

List tags for a repository in an OCI v2 registry without pulling.

Works against Docker Hub, GHCR, ECR, GAR, and any OCI-compliant registry; anonymous if no credentials are passed. Talks directly to the registry over HTTPS and does NOT read ~/.docker/config.json — for private registries prefer the DOCKER_MCP_SERVER_REGISTRY_USERNAME / DOCKER_MCP_SERVER_REGISTRY_PASSWORD env vars (keeps secrets out of tool args, which clients often log). Fetch one tag's manifest with registry_manifest; hub_tags adds Hub-specific tag metadata (sizes, push dates).

args: repository - Image/repository ref, e.g. "alpine", "ghcr.io/org/repo"; any :tag/@digest is stripped username - Optional registry username (overrides DOCKER_MCP_SERVER_REGISTRY_USERNAME) password - Optional registry password/token (overrides DOCKER_MCP_SERVER_REGISTRY_PASSWORD) limit - Max tags to return (default 1000, >= 1); pagination capped at 50 pages returns: dict - {"name": , "registry": , "tags": [..], "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
passwordNo
usernameNo
repositoryYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, but the description adds substantial behavioral context: it bypasses ~/.docker/config.json, supports anonymous access, strips tag/digest from repository input, caps pagination at 50 pages, and includes a truncated flag in the return. This goes well beyond the structured annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact yet information-dense. It front-loads the primary purpose, uses a clear args: section, and every sentence contributes meaningful detail. No filler or repetition of schema/annotations.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having no output schema, the description documents the return dict structure (name, registry, tags, truncated). It addresses auth behavior, registry support, pagination limits, and input normalization, making it complete for a tool of this complexity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Input schema has zero descriptions for any of the 4 parameters, but the description compensates fully with an 'args:' block explaining each: repository format (e.g. alpine, ghcr.io/org/repo), username/password overrides, and limit default with pagination cap. This is complete semantic coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource+scope: 'List tags for a repository in an OCI v2 registry without pulling.' It clearly distinguishes itself from sibling tools like registry_manifest (fetch one tag's manifest) and hub_tags (Hub-specific tag metadata).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-to-use context for various registries (Docker Hub, GHCR, ECR, GAR), and points to alternatives: 'Fetch one tag's manifest with registry_manifest; hub_tags adds Hub-specific tag metadata.' Also gives guidance on auth for private registries, explaining why env vars are preferred over args.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

registry_tag_waitA
Read-only

Block until a specific tag appears in a repository (e.g. waiting for a CI push to land).

Never raises on timeout — the result always carries met and timed_out. Polls registry_tags every poll_intervals and checks whether tag is in its result. Works against Docker Hub too (registry_tags' own scope covers it), so there is no separate Hub variant. Unlike every other wait tool, this has no host argument — registry tools talk HTTPS directly to the registry, not a Docker daemon.

Caveat: registry_tags paginates up to 50 pages (or limit tags, whichever comes first); if tag would only appear beyond that window it is never found, even once it exists. Raise limit if you expect a very large tag list.

args: repository - Image/repository ref, e.g. "alpine", "ghcr.io/org/repo"; any :tag/@digest is stripped tag - The exact tag name to wait for username - Optional registry username (overrides DOCKER_MCP_SERVER_REGISTRY_USERNAME) password - Optional registry password/token (overrides DOCKER_MCP_SERVER_REGISTRY_PASSWORD) limit - Max tags to scan per poll (default 1000, >= 1); forwarded to registry_tags timeout_seconds - Max seconds to wait before returning with timed_out=true (default 600) poll_interval - Seconds between re-checks (default 5, > 0); capped by the time left so a large value can't push the total wait past the timeout returns: dict - {"repository", "tag", "met", "timed_out", "waited_seconds"}

ParametersJSON Schema
NameRequiredDescriptionDefault
tagYes
limitNo
passwordNo
usernameNo
repositoryYes
poll_intervalNo
timeout_secondsNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint/destructiveHint annotations, the description discloses critical behavior: it never raises on timeout, polls registry_tags at a configurable interval, and has a pagination limitation that can cause tags to be missed. It also notes that repository :tag/@digest suffixes are stripped, which is non-obvious behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a clear summary, a caveat paragraph, and a parameter list. Every sentence adds value, and the most important purpose is front-loaded. It is appropriately sized for the tool's complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 7-parameter polling tool with no output schema, the description covers purpose, behavior, parameter semantics, return value shape, and a critical edge case. It is fully self-contained and leaves no significant gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description includes a detailed args section that explains each of the 7 parameters, including defaults, constraints, and forwarding behavior (e.g., limit forwarded to registry_tags). This fully compensates for the input schema having zero descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool blocks until a specific tag appears in a repository, with a concrete example of waiting for a CI push to land. It also distinguishes itself from other wait tools by explicitly noting the lack of a host argument and its registry-specific scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit usage guidance by stating it works against Docker Hub too (so no separate Hub variant) and contrasts with other wait tools. It also advises raising the limit for very large tag lists, helping the agent decide when and how to configure the tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scout_compareA
Read-only

Compare two image references and report the CVE delta.

Exactly one of to, to_env, or to_latest=True must be supplied to identify the comparison target. Use it after a rebuild to check the new image against the old (scout_cves scans a single image). Does not raise on a non-zero CLI exit (a missing scout plugin still raises) — inspect raw.stderr. Raises ValueError if to names a local directory/archive while the call has to run on a remote ssh:// host (no local scout plugin): the file is not staged, so it would resolve against that host's filesystem instead.

args: image - The new / candidate image reference to - Compare against this image reference, directory, or archive (a local directory/archive only when the CLI runs on this host — see above) to_env - Compare against an image associated with this Scout environment to_latest - Compare against the latest scan of image only_severity - Filter to these severities (omit for all) ignore_unchanged - Exclude unchanged packages from the diff format - Output format; only "json" (the default) is parsed into result platform - Platform of the image to analyze returns: dict - {"format": , "result": , "raw": }

ParametersJSON Schema
NameRequiredDescriptionDefault
toNo
imageYes
formatNojson
to_envNo
platformNo
to_latestNo
only_severityNo
ignore_unchangedNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnly and destructive annotations, the description discloses failure modes (does not raise on non-zero exit, raises on missing plugin, raises ValueError for remote host with local path) and explains the return dict structure, adding significant transparency.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured, front-loaded with purpose, then usage, error conditions, parameter list, and return format. Each sentence adds value; no fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 8 parameters, complex constraints, and no output schema, the description is complete. It covers all parameters, constraint rules, error cases, and return format, making it fully informative for an agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description fully compensates by explaining each parameter's purpose, constraints, and defaults. It also clarifies the format parameter's parsing behavior and the to/to_env/to_latest exclusivity.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool compares two image references and reports the CVE delta, using specific verb and resource. It also distinguishes from the sibling scout_cves, which scans a single image.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use (after a rebuild) and contrasts with scout_cves. Also specifies the exact one-of requirement for to/to_env/to_latest and notes error behaviors like non-zero exit handling and remote host limitations.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scout_cvesA
Read-only

List vulnerabilities (CVEs) in an image via Docker Scout.

Anonymous scans work for public images; Hub policy enforcement and richer recommendations need docker login on the host that runs the CLI — this server's host, or the target ssh:// host itself when no local scout plugin is installed. Start with scout_quickview for a per-severity summary; scout_sbom inventories packages without vulnerability matching. Does not raise on a non-zero CLI exit (a missing scout plugin still raises) — inspect raw.stderr.

args: image - Image reference (a tag or a digest) only_fixed - Only report CVEs with a fixed version available only_severity - Filter to these severities (omit for all) ignore_base - Exclude CVEs introduced by the base image format - Parsed into result as JSON: "sarif" (default, the standard vulnerability-report schema), "spdx", "gitlab", "sbom". Returned verbatim as text: "packages" (Scout's own default, grouped by package), "markdown". There is no plain "json" for this subcommand platform - Platform of the image to analyze, e.g. "linux/amd64" returns: dict - {"format": , "result": , "raw": }

ParametersJSON Schema
NameRequiredDescriptionDefault
imageYes
formatNosarif
platformNo
only_fixedNo
ignore_baseNo
only_severityNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark the tool as read-only and non-destructive, but the description adds substantial behavioral context: authentication prerequisites, platform-specific host login needs, format-dependent result encoding, and the non-zero exit behavior (only missing plugin raises, otherwise inspect raw.stderr). This goes well beyond the annotation baseline.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is dense but every sentence earns its place. It covers purpose, usage alternatives, auth prerequisites, error behavior, and all parameters in a well-organized structure with no fluff or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having no output schema, the description explains the return dict structure (format, result, raw) and how result varies by format. It also covers error handling and authentication context. For a tool with 6 parameters and no output schema, this is complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description's args section fully compensates by explaining each parameter's meaning. It clarifies format semantics (no plain 'json', some formats parsed into result, some returned verbatim), only_fixed, ignore_base, only_severity, and platform. This adds meaning that the bare schema names and enums do not provide.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'List vulnerabilities (CVEs) in an image via Docker Scout.' It also explicitly distinguishes itself from sibling tools by pointing to scout_quickview for summaries and scout_sbom for package inventory without vulnerability matching.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-to-use guidance: anonymous scans for public images, docker login requirements for policy enforcement, and clear alternatives ('Start with scout_quickview...; scout_sbom inventories...'). It also warns about exit-code behavior and when to inspect raw.stderr.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scout_quickviewA
Read-only

Render a compact summary of an image's CVE posture.

The fastest triage step — counts per severity plus base-image status. Drill into individual findings with scout_cves, which unlike this tool can emit machine-readable JSON; get upgrade suggestions with scout_recommendations. Output is plain text only: docker scout quickview has no output-format option, so result is always the rendered text rather than a parsed document. Does not raise on a non-zero CLI exit (a missing scout plugin still raises) — inspect raw.stderr.

args: image - Image reference platform - Platform of the image to analyze, e.g. "linux/amd64" returns: dict - {"result": , "raw": }

ParametersJSON Schema
NameRequiredDescriptionDefault
imageYes
platformNo

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Even though annotations include readOnlyHint=true and destructiveHint=false, the description adds significant behavioral context: output is plain text only with no output-format option, the result is always rendered text, and it discloses that non-zero CLI exits do not raise exceptions (except missing plugin) and suggests inspecting raw.stderr. This goes beyond annotations to describe error handling and output format nuances.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, front-loading the purpose in the first sentence. It uses short paragraphs and bullet-like structure for args and returns, making it scannable. Every sentence adds value—no fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simple interface (2 params, no output schema), the description is complete: it covers purpose, usage, output format, error behavior, and return structure. The agent can confidently invoke and interpret results without additional information. The return dict is explicitly described, compensating for the lack of an output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate. It describes 'image' as 'Image reference' and 'platform' as 'Platform of the image to analyze, e.g. "linux/amd64"', which adds meaningful examples and clarity beyond the bare schema names. The description does not fully elaborate on image reference formats, but the provided context is adequate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool renders a compact summary of an image's CVE posture, with specific details on counts per severity and base-image status. It effectively distinguishes from siblings by naming scout_cves and scout_recommendations and describing what they do differently.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly positions the tool as the fastest triage step and provides clear guidance on when to use alternatives: scout_cves for machine-readable JSON and drill-down, scout_recommendations for upgrade suggestions. This is an explicit when-to-use and when-not-to-use pattern with named alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scout_recommendationsA
Read-only

Suggest base-image upgrades for an image.

Computed against Docker Scout's catalog; generally needs docker login on the host that runs the CLI (the target ssh:// host itself when no local scout plugin is installed) to return useful results for private or rarely-scanned base images. The natural follow-up to scout_cves when the fix is a newer base image. Output is plain text only: docker scout recommendations has no output-format option, so result is always the rendered text rather than a parsed document. Does not raise on a non-zero CLI exit (a missing scout plugin still raises) — inspect raw.stderr.

args: image - Image reference only_refresh - Only show "refresh" recommendations (same major/minor) only_update - Only show "update" recommendations (newer minor/major) tag - Restrict to suggestions matching this tag pattern platform - Platform of the image to analyze returns: dict - {"result": , "raw": }

ParametersJSON Schema
NameRequiredDescriptionDefault
tagNo
imageYes
platformNo
only_updateNo
only_refreshNo

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, but the description adds valuable non-obvious behavior: it requires docker login to be useful, does not raise on non-zero CLI exit (except when scout plugin missing), and outputs plain text only. It also explicitly points to inspecting raw.stderr for errors, which is beyond annotation info.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is moderately lengthy but well-organized: purpose statement, context, output/error behavior, and args list. Each section serves a distinct purpose and is not redundant. The args section is necessary due to 0% schema coverage. It could be tightened slightly (e.g., merging some sentences) but remains efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (5 parameters, no output schema, non-trivial error handling), the description covers all essential aspects: purpose, dependencies (login), output format, error semantics, parameters, and return value structure. It even mentions the relationship to scout_cves. This is sufficient for an agent to correctly invoke and interpret results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must define parameters. It lists all 5 args with brief but meaningful descriptions: only_refresh and only_update explain the distinction between same major/minor and newer, tag clarifies pattern matching, platform clarifies target, and image is defined. Although not exhaustive, it compensates for the missing schema descriptions adequately.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Suggest base-image upgrades for an image.' It names the specific resource (base-image upgrades) and verb (suggest). It also distinguishes from siblings by noting it is 'The natural follow-up to scout_cves,' which shows unique positioning among the scout_* tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit context for when to use this tool: 'The natural follow-up to scout_cves when the fix is a newer base image.' It also notes prerequisites (docker login) and mentions the output limitation (plain text only). This gives clear guidance for selection among alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

scout_sbomA
Read-only

Generate a Software Bill of Materials (SBOM) for an image.

Package inventory only — scout_cves adds vulnerability matching on top. SBOMs can be large; captured stdout is subject to MAX_CLI_OUTPUT_BYTES and may be truncated for big images. If that's a concern, run docker scout sbom -o file.json … on the host and load the file separately. Does not raise on a non-zero CLI exit (a missing scout plugin still raises) — inspect raw.stderr.

args: image - Image reference format - "spdx" (default, SPDX JSON), "cyclonedx" (CycloneDX JSON), "json" (Scout's native JSON), or "list" (plain-text package list) platform - Platform of the image to analyze returns: dict - {"format", "result", "raw": }. result is a parsed dict when format is "spdx"/"cyclonedx"/"json" and stdout parses cleanly; for "list" or a parse failure it's the raw text.

ParametersJSON Schema
NameRequiredDescriptionDefault
imageYes
formatNospdx
platformNo

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds significant behavioral context beyond the readOnlyHint annotation: Xlucidity truncation behavior ('captured stdout is subject to MAX_CLI_OUTPUT_BYTES and may be truncated for big images'), error semantics ('Does not raise on a non-zero CLI exit (a missing scout plugin still raises)'), and instructions to inspect `raw.stderr`. These are precisely the non-obvious runtime behaviors an agent needs to know, with no contradiction to the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description front-loads the purpose effectively and contains no fluff; every sentence earns its place. However, the middle paragraph is dense, cramming the truncation warning, the host fallback, and the exit-code behavior into a single run-on block that could be better structured with bullets for scanability.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the absence of an output schema and the 0% schema coverage, the description meaningfully covers all gaps: it documents the return dict, edge cases around truncation and exit codes, sibling distinctions, and all parameter semantics. It's complete even without explicitly explaining return values for a read-only tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description fully compensates by documenting all three parameters. It expands all four enum values of `format` with their meanings, clarifies the `image` parameter as a reference, and explicitly documents the return structure including when `result` is a parsed dict vs raw text. This exceeds what's in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening line, 'Generate a Software Bill of Materials (SBOM) for an image,' uses a specific verb and resource, making the tool's function immediately clear. The description then goes further by distinguishing it from its sibling: 'Package inventory only — `scout_cves` adds vulnerability matching on top.' This explicit scope boundary and sibling differentiation is exactly what a score of 5 requires.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly defines when to use the tool ('Package inventory only') and points to the alternative (`scout_cves`) for vulnerability matching. It even provides a workaround for large SBOMs with a specific command suggestion ('run `docker scout sbom -o file.json …` on the host'), giving clear practical guidance beyond basic invocation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

secret_createA

Create a swarm secret; requires a swarm manager.

Write-once: the payload can never be read back through the API (secret_inspect returns metadata only) and cannot be changed later — to rotate, create a new secret and update the consuming services, keeping your own copy of the value. For non-sensitive data that should stay readable, use config_create instead. Created secrets are stamped with provenance labels.

args: name - Name for the secret (unique within the swarm) data - The secret payload (max 500 KB; must be empty when driver is set) labels - Labels to set on the secret driver - Optional secret-driver config for values held in an external store returns: dict - The created secret's attrs (ID and Spec metadata; never the payload)

ParametersJSON Schema
NameRequiredDescriptionDefault
dataYes
nameYes
driverNo
labelsNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations, the description discloses critical behaviors: the payload can never be read back, cannot be changed, and requires keeping a local copy. It also mentions provenance labels, providing useful context not captured by structured fields.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a concise intro, a focused behavioral note, an args list, and a returns line. Every sentence adds value, and the structure makes the information easy to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a create tool with no output schema, the description covers prerequisites, return format, constraints, and alternatives. It fully explains the write-once limitation and rotation strategy, making it complete for an agent to select and invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description fully compensates by explaining every parameter: name (unique within swarm), data (max 500 KB, must be empty when driver set), labels, and driver (external store config). This adds meaning the schema alone lacks.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the function: 'Create a swarm secret' and adds the prerequisite 'requires a swarm manager.' It also distinguishes this tool from config_create, making it easy to differentiate from sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-to-use guidance: 'For non-sensitive data that should stay readable, use config_create instead.' It also instructs on write-once semantics and rotation, giving clear context for when this tool is appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

secret_inspectA
Read-only

Get a swarm secret's metadata by id or name; requires a swarm manager.

The returned attrs never include the secret's actual data (Spec.Data is write-only — the daemon accepts it on secret_create but never returns it back, by design). Use this to check a secret's CreatedAt, Labels, or which driver created it, not to read its contents. To see which services reference it, inspect each service's spec via service_inspect (there is no server-side filter for "services using this secret").

args: id_or_name - The secret id or name returns: dict - The secret's attrs, excluding the actual secret data

ParametersJSON Schema
NameRequiredDescriptionDefault
id_or_nameYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint/destructiveHint annotations, the description discloses that `Spec.Data` is write-only and never returned, and that there is no server-side filter for services using the secret. This adds meaningful behavioral context that annotations do not capture.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with a clear one-sentence summary, followed by a necessary caveat and focused usage guidance. The args/returns block is compact, and every sentence adds substantive information without digression.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter readonly inspection tool, the description covers what is returned, what is excluded, the operational prerequisite, and the relevant alternative approach. Even without an output schema, the description is sufficiently complete for an agent to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has one parameter with no description, but the description includes 'args: id_or_name - The secret id or name', fully explaining the parameter. It also clarifies that both ID and name are accepted, which is valuable semantic information.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states 'Get a swarm secret's metadata by id or name', which is a specific verb, resource, and scope. It clearly differentiates from sibling tools like secret_create, secret_list, and secret_remove by focusing on inspection of metadata rather than creation, listing, or removal.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says when to use the tool ('check CreatedAt, Labels, or which driver created it') and when not to use it ('not to read its contents'). It also names the alternative `service_inspect` for finding services that reference a secret, and notes the prerequisite of a swarm manager.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

secret_listA
Read-only

List swarm secrets' metadata; requires a swarm manager.

Like secret_inspect, results never include secret data, only metadata (name, id, labels, timestamps). Valid filter keys: id, name, names, label (key or key=value).

args: filters - Narrow the list; omit to return every secret returns: list - A list of secret attrs dicts (data-free)

ParametersJSON Schema
NameRequiredDescriptionDefault
filtersNo

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Even though annotations already declare readOnlyHint=true, the description adds valuable context: results never include secret data, only metadata, and a swarm manager is required. This goes beyond the annotations and clarifies privacy and prerequisite behaviors.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise, front-loaded with the main purpose, and includes necessary details (filter keys, args, returns) without redundancy. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple list tool, the description covers the operation, prerequisites, safety characteristics, filter options, and return type. No output schema exists, but the return format is described. It is sufficiently complete for an agent to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema only defines 'filters' as an object with no description, but the description explains its purpose ('Narrow the list; omit to return every secret') and lists valid filter keys. This fully compensates for the 0% schema description coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool 'List swarm secrets' metadata' with a specific verb and resource, and distinguishes it from secret_inspect by emphasizing metadata-only results. The purpose is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides context by mentioning 'requires a swarm manager' and compares behavior with secret_inspect, but does not explicitly state when to use this tool vs alternatives or when not to use it. The guidance is clear but not fully explicit.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

secret_removeA
Destructive

Remove a Swarm secret; requires a swarm manager.

Removing a secret does not immediately affect running service tasks — tasks that already have the secret mounted retain access until they are restarted or the service is updated. Use service_list and inspect each service's spec via service_inspect to identify services that mount the secret before removing it (service filters do not support filtering by secret reference).

args: id_or_name - The secret id or name to remove returns: bool - True after removal

ParametersJSON Schema
NameRequiredDescriptionDefault
id_or_nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate destructiveHint, but the description adds important subtle behavior: removal does not immediately affect running service tasks; they retain access until restarted/updated. This is valuable context that goes beyond the annotation and helps set expectations without contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with purpose, followed by behavioral nuance and a structured args/returns block. Each sentence earns its place; the second paragraph is slightly long but provides necessary detail on removal semantics.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With one parameter, a bool output schema, and annotations, the description covers all essential aspects: purpose, prerequisite, side-effects, parameter meaning, and return value. The inclusion of helper tool references makes it self-contained and practically complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has zero description, but the description compensates by explaining that id_or_name accepts either a secret id or name. This clarifies the parameter's flexibility and purpose beyond the bare schema definition.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Remove a Swarm secret' using a specific verb and resource. It is clearly distinguished from sibling secret tools like secret_create, secret_inspect, and secret_list, which handle other operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit pre-removal guidance: use service_list and service_inspect to identify services mounting the secret, and notes that service filters don't support secret reference. The 'requires a swarm manager' line sets a prerequisite but doesn't explicitly contrast with alternatives in terms of when not to use this tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

service_createA

Create a Swarm service; requires a swarm manager node.

Use this instead of container_run when you need replicated or global scheduling, rolling updates, or automatic restart across the swarm. Common extra_kwargs keys: name (str), env (list of "KEY=VAL"), mode ({"Replicated": {"Replicas": N}} or {"Global": {}}), networks (list of network names/ids), endpoint_spec ({"Ports": [{"PublishedPort": 80, "TargetPort": 8080}]}), labels (dict), restart_policy ({"Condition": "on-failure", "MaxAttempts": 3}), resources ({"Limits": {"NanoCPUs": 500000000, "MemoryBytes": 134217728}}). For anything else docker-py's ServiceCollection.create accepts, call docs_lookup(section="services") rather than guessing a key name.

args: image - Image to run service tasks from (e.g. "nginx:alpine") command - Override the image's default command; string or list of strings extra_kwargs - Additional docker-py ServiceCollection.create keyword arguments returns: dict - The created service's full document ({"ID", "Version", "Spec", ...})

ParametersJSON Schema
NameRequiredDescriptionDefault
imageYes
commandNo
extra_kwargsNo

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=false and destructiveHint=false, so the description's added value is the precondition about swarm manager and the return value description. It mentions it creates a service and returns the full document, but it doesn't elaborate on side effects like image pulls or synchronous vs asynchronous behavior. Still, with annotations covering the basic mutation safety profile, the description provides decent additional context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is somewhat long but information-dense. It is front-loaded with the core purpose and prerequisite, and the extra_kwargs examples are useful rather than filler. The structure (description → args → returns) is logical. Every sentence contributes value, though the extra_kwargs list could arguably be shortened for absolute conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a complex tool like service_create with no output schema, the description covers all key aspects: purpose, prerequisites, alternative tools, parameter details with examples, and return type. It appropriately points to docs_lookup for edge cases, making it a complete guide for an agent to invoke the tool correctly. This is a genuinely comprehensive description.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description fully compensates. It explains each parameter: image with example, command with allowed types, and extra_kwargs with a detailed list of common keys and example structures. It also advises using docs_lookup for unknown keys, which further guides parameter usage. This exceeds what the bare schema provides by a large margin.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Create a Swarm service' with specific verb and resource, and even notes the prerequisite of a swarm manager node. It distinguishes itself from sibling tools like container_run by explicitly mentioning this is for replicated/global scheduling, rolling updates, and automatic restart. This is unambiguous and differentiates from alternatives.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly says 'Use this instead of container_run when you need replicated or global scheduling, rolling updates, or automatic restart across the swarm.' This gives direct comparison and when-to-use guidance. It also mentions the requirement of a swarm manager node and instructs to use docs_lookup for any other docker-py parameters, preventing guessing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

service_inspectA
Read-only

Get a swarm service by id or name.

Must run against a swarm manager. Returns the desired-state spec and rollout status — for the actually-running tasks use service_ps, or the service-tasks://{id_or_name} resource for a computed rollout summary.

args: id_or_name - The service id or name insert_defaults - Merge default values into the output returns: dict - The full service document ({"ID", "Version", "Spec", "Endpoint", ...}; "UpdateStatus" during a rolling update)

ParametersJSON Schema
NameRequiredDescriptionDefault
id_or_nameYes
insert_defaultsNo

TDQS

A4.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false. The description adds useful behavioral context: the requirement to run against a swarm manager, and that the response includes desired-state spec, rollout status, and UpdateStatus during rolling updates. No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured: a one-sentence purpose, then prerequisites and alternatives, then labeled args and returns. Every sentence adds value; no fluff or redundancy beyond a minor mention of desired-state spec in both the intro and returns, which is acceptable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite no output schema, the description explains the return format (full service document with key fields). It covers prerequisites, alternatives, parameters, and behavioral nuances, making it complete for an inspect tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must explain parameters. It does: 'id_or_name - The service id or name' and 'insert_defaults - Merge default values into the output', adding meaning beyond the schema's type-only definitions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description opens with 'Get a swarm service by id or name,' using a specific verb and resource. It distinguishes from service_ps by clarifying it returns desired-state spec and rollout status, not running tasks, and points to alternatives for that purpose.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states 'Must run against a swarm manager' and provides clear alternative guidance: use `service_ps` or the `service-tasks://` resource for running tasks. This is explicit when-to-use and alternatives guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

service_listA
Read-only

List swarm services.

Must run against a swarm manager. One entry per service (the desired state); service_ps lists a service's tasks, and stack_services groups services by stack.

args: filters - Filter by attributes (id, name, label, mode) managed_only - Only return services created by this MCP server (filters on the docker-mcp-server.managed label); combines with any filters given returns: list - One full service document ({"ID", "Spec", ...}) per service

ParametersJSON Schema
NameRequiredDescriptionDefault
filtersNo
managed_onlyNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond annotations (readOnlyHint=true, destructiveHint=false), the description adds meaningful behavioral context: it notes that one entry per service represents the desired state (not the actual tasks), and explains the `managed_only` label behavior. This enriches the agent's understanding without contradicting annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is efficiently organized with an initial one-line summary, then detailed args and returns in a clear format. Every sentence contributes necessary information without fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite minimal schema and no output schema, the description covers prerequisites, alternatives, parameter semantics, and return format (list of full service documents), making it sufficient for correct tool selection and invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, but the description fully compensates by explaining both `filters` (attributes id, name, label, mode) and `managed_only` (filters on docker-mcp-server.managed label, combines with other filters). This adds meaning well beyond the bare schema types.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'List swarm services' with a specific verb and resource. It explicitly distinguishes from siblings by mentioning `service_ps` for tasks and `stack_services` for grouping by stack, so the agent knows exactly what this tool does relative to others.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides explicit prerequisite ('Must run against a swarm manager') and names alternatives (`service_ps` and `stack_services`) for different use cases, giving clear when-to-use versus when-not-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

service_logsA
Read-only

Get a bounded snapshot of a swarm service's logs (never follows).

follow is intentionally not exposed: the stream is joined into one string before returning, so following would block forever and grow unbounded. Collection is capped at max_bytes (ValueError if exceeded) so a noisy service can't OOM the server. The default is a bounded tail=200; tail="all" returns the whole buffer, which can be huge on long-running services and exceed the agent's context — prefer an integer, or since, to constrain output. Logs aggregate across all the service's tasks — container_logs reads a single container, and the service-logs://{id_or_name} resource is the resource-flavored equivalent of this tool.

args: id_or_name - The service id or name details - Show extra details stdout - Include stdout stderr - Include stderr since - Show logs since this Unix timestamp timestamps - Include timestamps tail - Number of lines from the end (default 200), or the literal "all" for everything max_bytes - Abort with ValueError if the buffered logs exceed this many bytes (default 32 MiB) returns: str - Decoded log output

ParametersJSON Schema
NameRequiredDescriptionDefault
tailNo
sinceNo
stderrNo
stdoutNo
detailsNo
max_bytesNo
id_or_nameYes
timestampsNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint and destructiveHint annotations, the description discloses key behavioral traits: never follows (avoids blocking), joins the stream into one string, caps at max_bytes with a ValueError, and aggregates across all tasks. These details are not present in annotations and are essential for safe invocation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is moderately long but every sentence contributes value. It front-loads the core purpose and then details caveats and parameter semantics in a structured list. Slight verbosity in the caveat paragraphs could be trimmed, but the structure is clear and effective.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (8 parameters, output schema, safety concerns), the description is remarkably complete. It covers edge cases like unbounded output, OOM risks, and the difference from container_logs. The return type is specified as 'str - Decoded log output', making it self-sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema has 0% description coverage, but the description includes an args section that explains every parameter's meaning, defaults, and special values. For example, tail explains the default 200 and the literal 'all', max_bytes explains the ValueError abort, and since is defined as a Unix timestamp. This fully compensates for the schema gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource+scope: 'Get a bounded snapshot of a swarm service's logs (never follows)'. This clearly states what the tool does and its non-following behavior. It also distinguishes itself from siblings by mentioning 'container_logs reads a single container', providing clear differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit usage guidance is provided: it warns against using 'tail="all"' due to context overflow, recommends using an integer or 'since' to constrain output, and contrasts with 'container_logs' for single-container logs. It also explains why 'follow' is not exposed. This goes well beyond implied usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

service_psA
Read-only

List a swarm service's tasks (per-replica scheduling units), like docker service ps.

Shows where replicas run and why they fail: each task carries Status (State/Message/ContainerStatus), DesiredState, NodeID, and Slot. Prefer this over container_list for services (tasks may run on other nodes), stack_ps for a whole stack, and the service-tasks://{id_or_name} resource for a computed rollout summary. Requires a swarm manager.

args: id_or_name - The service id or name filters - Filter dict; keys: id, name, node, label, desired-state (running|shutdown|accepted) returns: list - Task dicts (ID, Slot, NodeID, Status, DesiredState, Spec)

ParametersJSON Schema
NameRequiredDescriptionDefault
filtersNo
id_or_nameYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the bar is lower. The description adds meaningful behavioral context by explaining what the tasks reveal ('Shows where replicas run and why they fail'), detailing the fields in each task, and noting the swarm manager requirement. This goes well beyond the safety annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose, then provides layered detail in a well-structured format (args/returns). Every sentence contributes value: the Docker CLI analogy, the failure-analysis context, alternatives, prerequisites, and parameter documentation. No filler or repetition exists.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having no output schema, the description specifies the return structure: 'list - Task dicts (ID, Slot, NodeID, Status, DesiredState, Spec).' It also explains the significance of the data and how this tool relates to other service inspection methods. Given the tool's moderate complexity, this description is fully self-sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must carry parameter documentation. It fully does: 'id_or_name - The service id or name' and 'filters - Filter dict; keys: id, name, node, label, desired-state (running|shutdown|accepted).' This provides types, allowed keys, and enum-like values directly in the description, compensating completely for the sparse schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'List a swarm service's tasks (per-replica scheduling units), like `docker service ps`.' It clearly differentiates from siblings by mentioning `container_list`, `stack_ps`, and the `service-tasks://` resource, making the tool's unique purpose unmistakable.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit guidance is provided: 'Prefer this over `container_list` for services (tasks may run on other nodes), `stack_ps` for a whole stack, and the `service-tasks://{id_or_name}` resource for a computed rollout summary.' It also states the prerequisite 'Requires a swarm manager,' giving clear when-to-use and alternative context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

service_removeA
Destructive

Stop and remove a swarm service.

Requires a swarm manager. Deletes the service definition and shuts down its tasks — no confirmation, no undo. To stop work but keep the definition, service_scale to 0 replicas.

args: id_or_name - The service id or name returns: bool - True after the service is removed

ParametersJSON Schema
NameRequiredDescriptionDefault
id_or_nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the destructiveHint annotation, the description details what happens: 'Deletes the service definition and shuts down its tasks — no confirmation, no undo.' This adds crucial irreversible-behavior context. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is tight and well-organized: purpose, prerequisites, effects, alternative, then args/returns. Every sentence delivers value with no redundancy, front-loading the primary action.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a single-parameter destructive service removal, the description covers prerequisites, behavior, alternatives, and return value. Paired with the destructiveHint annotation and output schema, this is complete for an AI agent to use it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema coverage, the description compensates by explaining the sole parameter ('id_or_name - The service id or name') and the return value ('True after the service is removed'). While the parameter explanation is minimal, it clarifies the expected input and output, which is adequate for this simple tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource: 'Stop and remove a swarm service.' It distinguishes itself from siblings by naming service_scale as an alternative for non-destructive stopping, making the purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It states a prerequisite ('Requires a swarm manager') and explicitly provides an alternative usage scenario: 'To stop work but keep the definition, `service_scale` to 0 replicas.' This gives clear when-to-use vs. when-not-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

service_rollbackA

Roll a swarm service back to its previous spec (the docker service rollback equivalent).

Re-applies the service's PreviousSpec — the spec from before the most recent service_update / service_scale. Raises ValueError if the service has no PreviousSpec (it has never been updated, or was already rolled back). The high-level SDK exposes no rollback, so this reads the current version and previous spec via the low-level APIClient and submits them with the low-level update_service API call.

args: id_or_name - The service id or name returns: dict - The daemon response (a dict with a "Warnings" key)

ParametersJSON Schema
NameRequiredDescriptionDefault
id_or_nameYes

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate readOnlyHint=false and destructiveHint=false, and the description aligns with that. It adds valuable behavioral context: it re-applies PreviousSpec, raises ValueError if no PreviousSpec, and explains the low-level API mechanism. It also discloses the return format (dict with Warnings key), providing transparency beyond annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the main purpose and efficiently covers behavior, error condition, implementation notes, args, and returns. It is slightly wordy (implementation detail about APIClient), but every sentence adds useful information and no content is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (1 param, no output schema), the description covers the essential aspects: what it does, how it works, potential error, and return value. It is complete enough for an agent to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must define the parameter. It clearly states 'id_or_name - The service id or name', which fully explains the single parameter. This compensates for the schema's lack of description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description starts with a clear verb and resource: 'Roll a swarm service back to its previous spec', explicitly naming the docker equivalent. It distinguishes itself from siblings like service_update and service_scale by focusing on reverting to a prior spec.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear context for when to use this tool (when a rollback is needed) and states a precondition (PreviousSpec must exist, otherwise ValueError). It does not explicitly name alternative tools for exclusions, but the context is sufficient to avoid confusion with service_update or service_scale.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

service_scaleA

Set the desired replica count for a Replicated-mode swarm service.

Only applies to services in Replicated mode; a Global service runs one task per eligible node and has no replica count to set. The swarm scheduler places or removes tasks asynchronously to converge on the new count — this call returns once the update is accepted, not once every task is running. Check progress with service_ps or service_inspect. For any other spec change (image, env, resources) use service_update instead.

args: id_or_name - The service id or name replicas - The desired number of running task replicas returns: bool - True once the scale request is accepted

ParametersJSON Schema
NameRequiredDescriptionDefault
replicasYes
id_or_nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations only indicate readOnlyHint=false and destructiveHint=false, which are minimal. The description adds crucial behavior: the call returns once the update is accepted, not when tasks are running, and scaling is asynchronous. It also clarifies mode restrictions. This goes well beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured: a clear one-line purpose, then context paragraphs, then a concise args list. Every sentence provides necessary information—mode restriction, async behavior, alternatives, and return value—without fluff or redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple (2 params, no nested objects), and the description covers all essential context: what it does, when to use it, async behavior, return type, and how to verify progress. The output schema exists and is supplemented by the 'returns: bool' line. This is complete for an agent to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description fully compensates with an explicit args section: 'id_or_name - The service id or name' and 'replicas - The desired number of running task replicas.' This adds meaningful semantic explanation beyond the raw schema, which only lists types and required status.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb+resource: 'Set the desired replica count for a Replicated-mode swarm service.' It clearly identifies the operation and differentiates from siblings by mentioning 'Replicated-mode' and noting that Global services have no replica count. This prevents confusion with service_update or other service tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use this tool (Replicated-mode services), when not to use it (Global services), and provides an alternative for other spec changes ('use service_update instead'). It also advises checking progress via service_ps or service_inspect. This is exemplary usage guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

service_updateA

Update a swarm service's configuration, or force a redeploy with no spec change.

Pass exactly one of updates (fields to change, same parameters as service_create) or force=True (the docker service update --force equivalent: bumps the ForceUpdate counter so the service's tasks redeploy with an unchanged spec — e.g. to reschedule after a node change or re-pull a mutable tag).

args: id_or_name - The service id or name updates - Fields to update on the service; exactly one of updates/force force - Redeploy the service without changing its spec; exactly one of updates/force returns: bool - True after the update

ParametersJSON Schema
NameRequiredDescriptionDefault
forceNo
updatesNo
id_or_nameYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.5/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate this is a write operation (readOnlyHint=false) and not destructive (destructiveHint=false). The description adds valuable behavioral context by explaining that force=True 'bumps the ForceUpdate counter' to trigger redeployment, and it states the return type. This goes beyond the basic hints and gives the agent a clearer expectation of side effects.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with a clear purpose sentence, followed by a succinct explanation of the two modes, then a compact args list. There is no filler or repetition. Every sentence adds information, and the structure makes the material easy to scan.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a moderately complex tool with nested objects and a boolean return, the description covers the purpose, the two mutually exclusive parameter sets, the behavior of force redeploy, and the return value. Given that an output schema exists for the bool and annotations are present, this is a complete picture for an agent to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description takes on the full burden of documenting parameters. It provides an args section that explains id_or_name, updates, and force, and clarifies the mutual exclusivity constraint. The 'updates' field is described as using 'same parameters as service_create', which requires a cross-reference but is still actionable. This meaningfully compensates for the schema's lack of descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource: 'Update a swarm service's configuration, or force a redeploy with no spec change.' This clearly distinguishes the tool's core purpose from siblings like service_scale or service_rollback. The two operational modes are explicitly named, leaving no ambiguity about what the tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear usage guidance for the tool's two modes, including the 'exactly one of updates/force' constraint and a concrete real-world example for force redeploy (rescheduling after a node change or re-pulling a mutable tag). However, it does not explicitly contrast with alternative sibling tools (e.g., service_scale), so it misses an explicit exclusion statement.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

service_waitA
Read-only

Block until a swarm service's tasks converge, or a rolling update finishes.

One contract for both modes: never raises on timeout — the result always carries met and timed_out. "running" polls task state via the same task-counting logic as service-tasks://{id_or_name} (not the unconfirmed daemon ServiceStatus field) until running tasks reach the desired count (Replicated mode) or every returned task is running (Global mode, which has no fixed target). "update-converged" polls UpdateStatus.State until it reaches a terminal value (completed or rollback_completed); if the service has never been updated (no UpdateStatus at all), returns promptly with met=false — there's nothing to converge to, same as container_wait's no-healthcheck case.

args: id_or_name - The service id or name until - Condition to wait for: "running" (default) or "update-converged" replicas - "running" mode only: override the desired replica count (e.g. right after a same-turn service_scale call, before polling reflects the new target) timeout_seconds - Max seconds to wait before returning with timed_out=true (default 600) poll_interval - Seconds between re-checks (default 2, > 0); capped by the time left so a large value can't push the total wait past the timeout returns: dict - {"service", "until", "met", "timed_out", "running_tasks", "desired_tasks", "failed_tasks", "update_state", "waited_seconds"}

ParametersJSON Schema
NameRequiredDescriptionDefault
untilNorunning
replicasNo
id_or_nameYes
poll_intervalNo
timeout_secondsNo

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (readOnlyHint=true, destructiveHint=false), it reveals critical behaviors: never raises on timeout, always returns met/timed_out, uses specific task-counting logic rather than unconfirmed daemon field, and returns met=false for never-updated services. This is rich behavioral disclosure.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is longer than typical but every sentence carries information: purpose, contract, mode-specific behavior, parameter semantics, and return keys. It is well-structured with a clear heading and list, front-loading the core purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description lists the return dict keys. It also covers both modes, timeout behavior, and parameter interactions, making it complete for an agent to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description explains every parameter in detail: id_or_name, until with enum values, replicas as an override, timeout_seconds with default, and poll_interval with capping behavior. This fully compensates for the schema's lack of descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource: 'Block until a swarm service's tasks converge, or a rolling update finishes.' This clearly distinguishes it from sibling wait tools like container_wait and compose_wait by naming 'swarm service' as the target.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides detailed context for both modes ('running' vs 'update-converged') and explains when each terminates, including the edge case for never-updated services. However, it does not explicitly state when to choose this over sibling wait tools, relying on the resource specificity.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

stack_deployA

Deploy (or update) a stack to the swarm from one or more Compose files.

Requires the target daemon to be a swarm manager. Re-running with the same name updates the stack in place. Defaults to detach=True (returns once specs are submitted, not on convergence); set detach=False to wait for the rollout (give it a generous timeout_seconds). The swarm analogue of compose_up; watch the rollout with stack_services / stack_ps. Does not raise on a non-zero CLI exit — inspect returncode/stderr in the result.

args: name - Name of the stack to create or update compose_files - One or more Compose file paths (repeated -c; later override earlier). At least one required. with_registry_auth - Send registry credentials to swarm agents (needed for private images) prune - Remove services no longer defined in the Compose file resolve_image - Image-digest resolution; omit for the CLI default ("always") detach - Return immediately after submitting specs (True) vs wait for convergence (False) cwd - Working directory for resolving relative Compose paths (defaults to the server's cwd; copied to the target host if no local docker CLI) timeout_seconds - Subprocess timeout (default 1800s) returns: dict - {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
cwdNo
nameYes
pruneNo
detachNo
compose_filesYes
resolve_imageNo
timeout_secondsNo
with_registry_authNo

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations indicate `readOnlyHint` and `destructiveHint` are false, meaning action is expected. The description adds key behaviors: defaults to `detach=True`, re-running with same `name` updates in place, does not raise on non-zero exit, and the actual return value structure. It does not mention side effects like whether it modifies existing services, but the update behavior is covered. This goes beyond annotations, earning a high score.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a clear overview paragraph and a bulleted args list. Every sentence adds valuable information—prerequisites, behavior, usage warnings, and param semantics. It is concise for the complexity involved (8 params) without being verbose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 8 parameters, no output schema, and no annotations beyond read/destructive hints, the description covers all necessary aspects: purpose, usage, parameter details, return format, and error handling. It also mentions swarm manager requirement and detach behavior, which are critical. The tool is complex, and the description is complete enough for an agent to use it correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate for all 8 parameters. It does: explains `name` (create or update), `compose_files` (repeated `-c`, later override earlier, at least one required), `detach` (immediate vs wait), `cwd` (for resolving relative paths), and others. It also clarifies defaults and nuances that are not in schema, like the `timeout` recommendation. Slightly less detail on `prune` and `with_registry_auth` but still adds value.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Deploy (or update) a stack to the swarm from one or more Compose files.' It uses specific verbs (deploy/update) and identifies the resource (stack, swarm, Compose files). It distinguishes from sibling `compose_up` by explicitly calling it 'The swarm analogue of `compose_up`' and mentions alternative monitoring tools like `stack_services` and `stack_ps`.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit usage guidance: requires the daemon to be a swarm manager, explains the detach behavior with a clear recommendation ('set `detach=False` to wait for the rollout (give it a generous `timeout_seconds`)'), and contrasts with `compose_up` and monitoring tools. It also warns that the tool does not raise on non-zero exit, telling users to inspect `returncode`/`stderr`.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

stack_listA
Read-only

List the stacks deployed to the swarm, parsed from --format '{{json .}}'.

Requires the target daemon to be a swarm manager. compose_list is the non-swarm equivalent; drill into one stack with stack_services. Raises RuntimeError if the CLI call fails.

returns: list - One dict per stack (name, services count, orchestrator)

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, and the description adds valuable behavioral context: it parses output via `--format '{{json .}}'` but abstracts that, states a prerequisite (swarm manager), explains error behavior (raises RuntimeError on CLI failure), and describes the return shape (list of dicts with name, services count, orchestrator).

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise—four sentences, each serving a distinct purpose: what it does, when to use it, error behavior, and return value. There is no redundancy or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, read-only tool with annotations and no output schema, the description covers all essential aspects: purpose, prerequisites, error handling, and return format. It is complete for the tool's simplicity.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the baseline score is 4. The schema is empty and the description correctly avoids inventing parameter details.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists stacks deployed to the swarm, which is a specific verb+resource pair. It also distinguishes itself from `compose_list` (non-swarm equivalent) and `stack_services` (drill into a single stack), making sibling differentiation explicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides explicit when-to-use guidance: requires the target daemon to be a swarm manager, points to `compose_list` as the non-swarm alternative, and suggests `stack_services` for drilling into one stack. This gives clear context and alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

stack_psA
Read-only

List the tasks of a stack, parsed from --format '{{json .}}'.

Task-level view across every service in the stack (service_ps covers one service): where each task runs and why it failed. Requires a swarm manager. Raises RuntimeError if the CLI call fails.

args: name - The stack to list tasks for no_trunc - Do not truncate task IDs / errors in the output filters - Filter by attributes, e.g. {"desired-state": "running"}; a list value repeats the filter returns: list - One dict per task (id, name, node, image, desired/current state, error)

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes
filtersNo
no_truncNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint/destructiveHint annotations, the description discloses that output is parsed from CLI `--format '{{json .}}'`, that a RuntimeError is raised on CLI failure, and that results include error details. This adds meaningful behavioral context not available from annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a one-sentence summary, an args section, and a returns section. Every sentence adds value, and the text is compact without being overly verbose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description covers the return type (list of dicts with fields), all parameter meanings, error behavior, and the swarm manager prerequisite. This makes it self-sufficient for an agent to invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Despite 0% schema coverage, the description provides detailed semantics for all three parameters: `name` identifies the stack, `no_trunc` controls truncation, and `filters` includes an example and explains list-value behavior. This fully compensates for the schema's lack of descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states 'List the tasks of a stack' with a clear verb and resource, and explicitly contrasts with `service_ps` to clarify scope. It differentiates itself as the task-level view across every service.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly names `service_ps` as an alternative for one-service coverage, and notes the swarm manager requirement. This gives clear context for when to use this tool versus alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

stack_removeA
Destructive

Remove one or more stacks from the swarm (tears down their services, networks, and secrets).

Destructive: this stops and deletes every service in the named stack(s) — the reverse of stack_deploy and the swarm analogue of compose_down. Defaults to detach=True so the call returns once removal is requested rather than waiting for teardown. Does not raise on a non-zero CLI exit — inspect returncode/stderr in the result.

args: names - One or more stack names to remove. At least one is required. detach - Return immediately (True) vs wait for the stack(s) to be fully removed (False) timeout_seconds - Subprocess timeout (default 300s) returns: dict - {"returncode": int, "stdout": str, "stderr": str, "truncated": bool}

ParametersJSON Schema
NameRequiredDescriptionDefault
namesYes
detachNo
timeout_secondsNo

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark destructiveHint=true and readOnlyHint=false. The description adds substantial behavioral details beyond that: tears down services/networks/secrets, does not raise on non-zero CLI exit (instructs to inspect returncode/stderr), and explains the detach default behavior. No contradictions with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is appropriately detailed and front-loaded: main purpose, destructive warning, behavioral notes, then structured parameter descriptions. Every sentence adds value, with no repetition or filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given its destructive nature and the lack of an output schema, the description is complete. It specifies the return dict format, exit-code behavior, teardown scope, parameter behaviors, and default detach behavior, equipping the agent to use it correctly and interpret results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description's 'args' section provides meaningful explanations for all three parameters: names (required, one or more), detach (immediate vs await teardown), and timeout_seconds (default 300s). This fully compensates for the schema's bare structure.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Remove one or more stacks from the swarm' and explicitly details the scope (services, networks, secrets). It distinguishes itself from siblings by referencing stack_deploy as the reverse and compose_down as the swarm analogue, making its unique role clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives strong contextual guidance: it is destructive, reverses stack_deploy, parallels compose_down, and defaults to detach=True. It does not explicitly list when-not-to-use cases, but the clear inverse relationship to stack_deploy and the destructive nature imply appropriate usage contexts.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

stack_servicesA
Read-only

List the services of a stack, parsed from --format '{{json .}}'.

Service-level rollup (replicas ready per service); use stack_ps for individual tasks and service_inspect for one service's full spec. Requires a swarm manager. Raises RuntimeError if the CLI call fails.

args: name - The stack to list services for filters - Filter by attributes, e.g. {"name": "web"}; a list value repeats the filter returns: list - One dict per service (id, name, mode, replicas, image, ports)

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes
filtersNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (readOnlyHint=true, destructiveHint=false), the description adds meaningful behavioral traits: it raises RuntimeError on CLI failure, requires a swarm manager, and describes the parsing method and output format. This goes beyond the annotation baseline and provides useful operational details.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is appropriately sized and well-structured. It front-loads the core purpose in the first sentence, then provides alternatives, prerequisites, error behavior, and parameter details in a compact format. Every sentence and section contributes value without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

There is no output schema, but the description specifies the return type and shape: 'list - One dict per service (id, name, mode, replicas, image, ports)'. It covers all necessary context for a simple list tool, including filtering syntax and the distinction from sibling tools, making it complete for an agent to invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% coverage, but the description compensates fully by explaining both parameters: 'name - The stack to list services for' and 'filters - Filter by attributes, e.g. {"name": "web"}; a list value repeats the filter'. This adds concrete semantics beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'List the services of a stack'. It specifies the verb 'list' and resource 'services of a stack', and distinguishes it from related siblings by noting that `stack_ps` is for individual tasks and `service_inspect` for full spec.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit guidance on when to use this tool versus alternatives is provided: 'use `stack_ps` for individual tasks and `service_inspect` for one service's full spec'. It also states the prerequisite 'Requires a swarm manager', giving clear context for usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

swarm_initA

Initialize a new swarm, making this Engine its first manager node.

Fails if the Engine is already part of a swarm — call swarm_leave first to reset it. advertise_addr only needs setting when the host has multiple network interfaces or is behind NAT (otherwise it is auto-detected); it must be reachable by every other node that will join. To add more nodes afterwards, retrieve join tokens with swarm_join_tokens and call swarm_join on each one. Set autolock_managers=True to require the unlock key (swarm_unlock_key) on every manager restart — store that key securely immediately, since it is only shown once autolock is enabled.

args: advertise_addr - Externally reachable address advertised to other nodes listen_addr - Listen address used for inter-manager communication force_new_cluster - Force a new single-node cluster from this node's current state (disaster recovery when a majority of managers is lost) default_addr_pool - IP address pools for swarm overlay networks subnet_size - Subnet size for the IP pool data_path_addr - Address to use for data path traffic data_path_port - Port number for data path traffic name - Name of the swarm labels - Labels to set on the swarm autolock_managers - Require the unlock key after every manager restart log_driver - Default log driver configuration returns: str - The node id of the newly created swarm manager

ParametersJSON Schema
NameRequiredDescriptionDefault
nameNo
labelsNo
log_driverNo
listen_addrNo0.0.0.0:2377
subnet_sizeNo
advertise_addrNo
data_path_addrNo
data_path_portNo
autolock_managersNo
default_addr_poolNo
force_new_clusterNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses critical behavior such as failure when already in a swarm, the one-time display of the unlock key after enabling autolock, and the force_new_cluster disaster recovery option. It also explains advertise_addr requirements, which goes beyond the minimal annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-organized with a general intro followed by an arg list. While detailed, every sentence adds value, from failure conditions to parameter explanations.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given 11 parameters, no schema descriptions, and a complex domain, the description covers initialization workflow, prerequisites, parameter meanings, return value, and important caveats, making it fully self-contained.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Despite the schema having 0% description coverage, the description includes a dedicated 'args:' section that explains all 11 parameters with meaningful details, such as 'advertise_addr - Externally reachable address advertised to other nodes' and 'force_new_cluster - Force a new single-node cluster...'.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description begins with 'Initialize a new swarm, making this Engine its first manager node,' which clearly states the action and scope. It distinguishes itself from sibling tools like swarm_join and swarm_leave by describing the initialization role.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly warns 'Fails if the Engine is already part of a swarm — call swarm_leave first' and instructs using swarm_join_tokens and swarm_join for additional nodes. This provides clear when-to-use and alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

swarm_inspectA
Read-only

Inspect the swarm this daemon belongs to (id, spec, join-token config, CA info).

Works on a manager node only. Cluster-level configuration — for per-node state use node_list; for the tokens new nodes need, swarm_join_tokens.

returns: dict - The swarm's attrs, as returned by the daemon's swarm inspect endpoint

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is known. The description adds an important operational constraint ('Works on a manager node only') and defines the return type, but does not describe error behavior when invoked on a non-manager node.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three concise sentences, each serving a distinct purpose: what it inspects, when to use, and what it returns. It is front-loaded with the primary purpose and contains no wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a parameterless, read-only inspect tool with no output schema, the description fully covers the resource (swarm), the scope (daemon's swarm), the prerequisite (manager node), the return type (dict), and the alternatives. No additional information is needed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the schema coverage is trivially 100%. The description adds context about the returned data (id, spec, join-token config, CA info), but there are no parameters to explain, meeting the baseline for a 0-parameter tool.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it inspects the swarm the daemon belongs to, listing the included fields (id, spec, join-token config, CA info). It also differentiates from sibling tools by explicitly comparing with node_list and swarm_join_tokens.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly specifies when to use: on a manager node for cluster-level configuration. It names direct alternatives: node_list for per-node state and swarm_join_tokens for new node tokens, leaving no ambiguity.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

swarm_joinA

Join this Engine to an existing swarm as a worker or manager.

Fails if the Engine is already part of a swarm. Whether this node joins as a worker or a manager is determined entirely by which token is passed — join_token must be one of the two tokens from swarm_join_tokens, called against any existing manager. advertise_addr only needs setting when this host has multiple network interfaces or is behind NAT (otherwise it is auto-detected from the interface used to reach remote_addrs); it must be reachable by every other node in the swarm.

args: remote_addrs - Address(es) of existing swarm managers to connect to join_token - The worker or manager join token (from swarm_join_tokens) — determines the role this node joins as listen_addr - Listen address for inter-manager communication advertise_addr - Externally reachable address advertised to other nodes data_path_addr - Address to use for data path traffic returns: bool - True after the engine joins the swarm

ParametersJSON Schema
NameRequiredDescriptionDefault
join_tokenYes
listen_addrNo0.0.0.0:2377
remote_addrsYes
advertise_addrNo
data_path_addrNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the sparse annotations (readOnlyHint=false, destructiveHint=false), the description discloses important behaviors: it fails if already in a swarm, the role is entirely token-dependent, advertise_addr is auto-detected under certain conditions and must be reachable by all nodes, and it returns a boolean. This adds substantial transparency about failure modes and networking requirements.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a purpose statement, behavioral details, and a clean args list. Every sentence adds necessary information, including the failure condition and auto-detection nuance. It is appropriately sized for the complexity of the operation without excessive verbosity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has moderate complexity (swarm networking) and an output schema (bool) which is mentioned in the description. The description covers all parameters, failure modes, and return value. It also references related tools (swarm_join_tokens) for context. Nothing critical appears missing for an agent to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema provides zero parameter descriptions, but the 'args:' section fully explains each parameter's purpose: remote_addrs, join_token, listen_addr, advertise_addr, and data_path_addr. It also elaborates on join_token's role-determining semantics and advertise_addr's auto-detection behavior, going well beyond the raw schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's action: 'Join this Engine to an existing swarm as a worker or manager.' It uses a specific verb+resource and distinguishes from siblings like swarm_init (which creates a new swarm) by explicitly referencing 'existing swarm.' The role (worker/manager) is also clarified as determined by the token.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit when-not guidance: 'Fails if the Engine is already part of a swarm.' It also explains the prerequisite of obtaining tokens from swarm_join_tokens, indicating proper context. While it doesn't name alternatives like swarm_init, the failure condition and existing-swarm context provide clear usage boundaries.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

swarm_join_tokensA
Read-only

Return the swarm's worker and manager join tokens.

These are the tokens a new node passes to swarm_join — without one, swarm_join cannot be called, so this closes the init -> join loop. The tokens are secret bearer credentials (anyone holding the manager token can join as a manager); treat the result as sensitive and avoid logging it. Reads swarm.attrs["JoinTokens"] after a reload, so it always reflects the current tokens.

returns: dict - {"Worker": , "Manager": }

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false. The description adds significant behavioral context beyond that: the tokens are secret bearer credentials, anyone holding the manager token can join as a manager, the result should not be logged, and it always reflects current tokens after a reload. This is substantial and not redundant with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured and every sentence earns its place: purpose, usage relationship, security warning, implementation detail, and return format. It is front-loaded with the primary action and remains compact without padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple zero-parameter read-only tool, the description is complete. It covers return format, sensitivity, and the relationship to `swarm_join`, leaving no critical gaps. The lack of an output schema is compensated by the explicit dict return description.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the baseline is 4 per the rubric. The description clarifies the return format (dict with Worker and Manager keys) and token meanings, which is useful given there is no output schema, but there are no parameter semantics to explain.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb+resource: 'Return the swarm's worker and manager join tokens.' It clearly distinguishes from siblings like swarm_join (which consumes tokens) and swarm_init (which initializes the swarm), and explains the role in the init -> join loop.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description states that these tokens are required for `swarm_join`, providing clear context for when to use this tool. It also advises treating the result as sensitive and avoiding logging. However, it does not explicitly name alternatives or when not to use it, so it falls slightly short of a 5.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

swarm_leaveA
Destructive

Leave the current swarm.

The daemon's service tasks are rescheduled to the remaining nodes. A manager refuses to leave without force=True, since leaving can break raft quorum. The departed node lingers as "down" in node_list until a manager runs node_remove.

args: force - Force leave even if the node is a manager returns: bool - True after leaving the swarm

ParametersJSON Schema
NameRequiredDescriptionDefault
forceNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.8/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the destructiveHint annotation, the description discloses key behavioral traits: service tasks are rescheduled, leaving can break raft quorum, managers are refused without force, and the departed node remains 'down' until a manager removes it. This is rich, non-obvious context that helps the agent anticipate consequences.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and efficiently structured: a one-sentence purpose, a two-sentence behavioral explanation, and a clear args/returns block. Every sentence adds value without redundancy or padding.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter destructive tool with annotations, the description covers all essential aspects: what it does, when force is needed, what side effects occur, what the parameter means, and what the return value is. No critical information is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema only defines a boolean 'force' with a default. The description explains the parameter's meaning ('Force leave even if node is a manager') and also specifies the return type and value ('True after leaving'). This fully compensates for the lack of schema description coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states the exact action 'Leave the current swarm' with a specific verb and resource, clearly distinguishing it from sibling swarm tools like swarm_init, swarm_join, and swarm_update. It also adds behavioral context that reinforces its unique role.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides clear usage context: managers must set force=True to leave, and the node will linger as 'down' until node_remove is run. While no explicit alternatives are mentioned, the unique nature of the action makes this unnecessary. The force guidance is a practical rule for when and how to use the tool.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

swarm_task_inspectA
Read-only

Inspect a single swarm task, like docker inspect --type task.

For when you already hold a task reference -- from a swarm_task_list or service_ps row, a service event, or an error message -- and want just that task. swarm_task_list returns the same document for every task, so prefer it when scanning; this is the single-object fetch. To reach the container behind a running task, read Status.ContainerStatus.ContainerID and pass it to container_inspect / container_logs -- but note the container may be on another node, where those tools cannot see it, and service_logs aggregates across tasks instead. Read-only. Requires a swarm manager; raises docker.errors.APIError if the task does not exist, if a prefix matches more than one task, or if this node is not a manager.

args: id_or_name - The task id, an unambiguous id prefix, or the task's full name -- which is the container-name form <service>.<slot>.<taskid> (<service>.<nodeid>.<taskid> for a global service), NOT the shorter <service>.<slot> that docker service ps prints in its NAME column, which does not resolve. The daemon tries full id, then full name, then prefix, and rejects an ambiguous prefix rather than picking a match returns: dict - Full task inspect payload, as docker inspect --type task. Carries no name field of its own; compose one from ServiceID/Slot if you need it

ParametersJSON Schema
NameRequiredDescriptionDefault
id_or_nameYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations readOnlyHint=true and destructiveHint=false, the description adds meaningful behavioral context: it is read-only, requires a swarm manager, and raises `docker.errors.APIError` when the task does not exist, when a prefix is ambiguous, or when the node is not a manager. It also explains the daemon's resolution order for ids and names. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is organized into clear paragraphs and explicit `args` / `returns` sections. It is long but every sentence provides actionable guidance or necessary caveats, with no wasted repetition. The clarity and structure enable accurate tool invocation.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given one simple string parameter, no output schema, and the subtle Docker swarm name-resolution behavior, the description is thorough enough to support correct invocation. It covers the single-task purpose, return payload shape, required manager authority, error conditions, and caveats about accessing the underlying container across nodes.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Even though schema description coverage is 0%, the description fully compensates by thoroughly explaining `id_or_name`: it covers valid id prefixes, full name form `<service>.<slot>.<taskid>`, the global-service variant, the trap that `docker service ps` NAME column does not resolve, and the daemon's fallback order plus ambiguity rejection. This is far beyond the bare schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool inspects a single swarm task, using the docker CLI analogy `docker inspect --type task` and explicitly distinguishes it from `swarm_task_list` as the single-object fetch. The verb-resource pairing is unambiguous and differentiates from sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit when-to-use guidance: when the agent already holds a task reference and wants only that task. It also names alternatives and exclusions: prefer `swarm_task_list` when scanning, use `container_inspect`/`container_logs` to reach containers with caveats, and use `service_logs` for cross-task logs. It additionally states the prerequisite of a swarm manager.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

swarm_task_listA
Read-only

List tasks across the whole swarm, like docker service ps with no service to scope it.

The cluster-wide view of what is actually scheduled. service_ps covers one service and stack_ps one stack, so answering "what is failing anywhere" or "what is running on this node" through those means looping over every service; this is one call. Filter by node for a node's workload (the CLI's docker node ps), desired-state to separate what should be running from what is shutting down, or service for a single service -- for which service_ps is the simpler call. Each task carries its full Spec, including the ContainerSpec (image, command, env), so this returns much more per task than the service-tasks://{id_or_name} resource's computed rollout summary. Read-only. Requires a swarm manager: any other node raises docker.errors.APIError.

args: filters - Filter dict; keys: id, name, service, node, label, desired-state (running|shutdown|accepted); omit for every task in the cluster returns: list - One full task document per task (ID, ServiceID, NodeID, Slot, Spec, Status, DesiredState), the same shape service_ps returns

ParametersJSON Schema
NameRequiredDescriptionDefault
filtersNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (readOnlyHint, destructiveHint), the description adds critical behavioral details: it is read-only, requires a swarm manager, and raises an error on non-manager nodes. It also notes that each task contains its full spec, which affects output size.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured, starting with a one-line summary, then usage comparisons, filter details, and return information. It packs substantial information without redundancy and remains clear and readable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the minimal schema and no output schema, the description provides a complete picture: purpose, usage, parameter semantics, return shape, error conditions, and prerequisites. It leaves no significant gaps for an AI agent to guess.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema only provides a filter object without documentation, but the description thoroughly explains all valid filter keys (id, name, service, node, label, desired-state) and the possible values for desired-state. This fully compensates for the sparse schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool lists tasks across the entire swarm, and uses an analogy to `docker service ps` to make the purpose instantly understandable. It also distinguishes it from related tools like `service_ps` and `stack_ps`.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly explains when to use this tool (for cluster-wide task listing) versus the alternatives (service-scoped, stack-scoped). It also details how filters can narrow down results, providing concrete usage guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

swarm_unlockA

Unlock a manager node that is locked after restart due to autolock being enabled.

When autolock is enabled (via swarm_init or swarm_update), manager nodes require the unlock key after every restart before they can rejoin the swarm and resume scheduling. Must be called on the locked manager node directly. Retrieve the current unlock key with swarm_unlock_key from any unlocked manager — store it securely when enabling autolock. A locked node cannot serve API requests and cannot return its own key while locked; other unlocked managers in the swarm can still serve the key. Once unlocked the manager resumes automatically.

args: key - The swarm unlock key (from swarm_unlock_key) returns: bool - True after the swarm is unlocked

ParametersJSON Schema
NameRequiredDescriptionDefault
keyYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds behavioral context beyond the annotations (readOnlyHint=false, destructiveHint=false): it explains that a locked node cannot serve API requests, that unlocking resumes the manager automatically, and that the key must be retrieved from another unlocked manager. However, it does not mention failure modes like an incorrect key or idempotency, which would have made it more transparent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with an opening purpose, a detailed usage paragraph, and args/returns. Every sentence adds valuable context, though the explanatory paragraph is slightly verbose. Front-loaded with the primary action, it remains clear and scannable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (swarm autolock and locked manager states), the description is complete: it covers the cause, prerequisites, invocation location, key retrieval method, post-unlock behavior, and return type. The output schema corroborates the bool return, so no further details are needed.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema only defines 'key' as a string with no description (0% coverage). The description fully compensates by stating 'key - The swarm unlock key (from swarm_unlock_key)', giving the agent a clear source for the parameter value and its meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb-resource pair: 'Unlock a manager node that is locked after restart due to autolock being enabled.' This clearly states the action and target, and distinguishes it from siblings like swarm_unlock_key (which retrieves the key) and swarm_init/swarm_update (which control autolock).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit usage context: when autolock is enabled and a manager node is locked after restart. It specifies where to call the tool ('Must be called on the locked manager node directly'), how to obtain the key (via swarm_unlock_key from any unlocked manager), and explains why other managers must be used (a locked node cannot return its own key). This is exemplary guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

swarm_unlock_keyA
Read-only

Return the swarm's current unlock key.

The key only serves a purpose when autolock is enabled (see swarm_init's / swarm_update's autolock_managers / rotate_manager_unlock_key). Must be called against an unlocked manager — a locked manager cannot serve API requests, including this one. Feed the result's key to swarm_unlock to unlock a manager after restart. Treat the key as a sensitive credential.

returns: dict - {"UnlockKey": }

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnlyHint=true and destructiveHint=false, and the description adds behavioral context: that a locked manager cannot serve this API request, that the key is a sensitive credential, and the exact return structure. No contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loaded one-line purpose, followed by compact context in three sentences, each adding unique information about key usage, locked manager behavior, and security handling. No filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description explicitly states the return format. It covers preconditions (unlocked manager), use cases (autolock enabled), and security handling, making it a complete reference for a parametrized tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

This tool has zero parameters (100% schema coverage), so the baseline is 4. The description adds a return type specification (dict with "UnlockKey") but there are no parameter semantics to clarify.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Return the swarm's current unlock key' — a specific verb and resource. It distinguishes itself from sibling swarm_unlock by explaining that the result's key is fed to swarm_unlock, making its role complementary rather than ambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-to-use conditions: only relevant when autolock is enabled, must be called against an unlocked manager, and how the output relates to swarm_unlock. References swarm_init/swarm_update parameters for context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

swarm_updateA

Update swarm-wide settings: the single home for join-token and unlock-key rotation.

Must be called on a swarm manager node. Token rotation invalidates the old join token immediately — nodes that have not yet joined using the old token must use the new one. Existing joined nodes are unaffected. Use swarm_join_tokens to retrieve the new tokens after rotation. Rotating the unlock key requires all managers to be re-unlocked on restart with the new key; retrieve it immediately via swarm_unlock_key.

args: rotate_worker_token - Issue a new worker join token, invalidating the current one rotate_manager_token - Issue a new manager join token, invalidating the current one rotate_manager_unlock_key - Issue a new autolock unlock key for manager restart returns: bool - True after the update completes

ParametersJSON Schema
NameRequiredDescriptionDefault
rotate_worker_tokenNo
rotate_manager_tokenNo
rotate_manager_unlock_keyNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond annotations, it discloses important side effects: 'Token rotation invalidates the old join token immediately' and 'Rotating the unlock key requires all managers to be re-unlocked on restart.' It also clarifies that existing joined nodes are unaffected. This is rich behavioral context that annotations (which only say readOnlyHint false, destructiveHint false) do not provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is appropriately sized, front-loaded with purpose, then usage constraints, then side effects, then params and return value. Every sentence earns its place; no redundant filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given three parameters, no required params, no robust schema descriptions, and no output schema, the description covers all necessary aspects: prerequisites, effects, related tools, param explanations, and return type. It is complete for effective tool invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description fully compensates by explaining each parameter: 'rotate_worker_token - Issue a new worker join token, invalidating the current one' and similarly for others. This adds meaning beyond the bare boolean names and default values.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific verb and resource: 'Update swarm-wide settings' with a specific scope: 'the single home for join-token and unlock-key rotation.' It distinguishes itself from siblings like swarm_join_tokens and swarm_unlock_key by being the update/rotation counterpart.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use ('Must be called on a swarm manager node') and provides complementary guidance: 'Use swarm_join_tokens to retrieve the new tokens after rotation' and 'retrieve it immediately via swarm_unlock_key.' This clearly maps to sibling tools for retrieval, setting expectations for the correct workflow.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

system_closeA

Close and drop pooled Docker client connection(s); each is rebuilt lazily on next use.

Use this to force a stale or errored connection to be discarded. Prefer system_reconnect when you want to immediately re-establish the connection rather than wait for the next tool call to trigger a lazy rebuild. With host omitted every pooled client is closed (unlike other tools, where omitting it means the default host). Closing clients does not affect running containers.

returns: bool - True once closed

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.2/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses key behavioral traits beyond the sparse annotations: lazy rebuild on next use, the difference from system_reconnect, and that closing connections does not affect running containers. It stops short of explaining idempotence (what happens if already closed) or required permissions, but the provided context is valuable for an agent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is compact and front-loaded, with each sentence serving a distinct purpose: action, usage, alternative, special case, side effect, and return value. No filler or wordiness is present.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter tool, the description covers most important aspects: purpose, usage, side effects, and return value. However, the unsupported `host` parameter confuses the context and the tool's actual signature, leaving an agent uncertain whether parameters should be passed. This undermines completeness despite the otherwise thorough explanation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema declares zero parameters with 100% coverage, yet the description repeatedly references a `host` parameter and its omitted behavior. This introduces a parameter that does not exist in the schema, actively misleading an agent. The description adds no correct parameter semantics beyond the empty schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: "Close and drop pooled Docker client connection(s)". It clearly distinguishes this tool from siblings by noting the lazy rebuild behavior and explicitly contrasting with system_reconnect.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit when-to-use guidance: "Use this to force a stale or errored connection to be discarded." It also names an alternative: "Prefer `system_reconnect` when you want to immediately re-establish the connection..." and explains the host omission nuance, offering clear decision-making context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

system_dfA
Read-only

Summarize Docker disk usage: layer storage plus per-object sizes for images, containers, volumes, build cache.

Equivalent to docker system df. Use it to find what to reclaim before image_prune / container_prune / volume_prune / buildx_prune; use system_info for daemon config and counts rather than sizes. The reply enumerates every object on the daemon, so expect a large payload on busy hosts.

returns: dict - {"LayersSize", "Images", "Containers", "Volumes", "BuildCache"} with per-object size fields

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Even though annotations already mark the tool as readOnly and non-destructive, the description adds valuable behavioral context: it warns about a large payload on busy hosts and describes the return structure. This goes beyond the annotations and gives the agent a clear expectation of output size and format.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three concise sentences: the first defines the purpose, the second provides usage context and alternatives, and the third warns about payload size and return type. Every sentence adds unique value with no redundancy. It is well-structured and front-loaded.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, read-only tool with no output schema, the description fully covers what an agent needs: what the tool does, when to use it, what to expect in the return, and a caveat about large payloads. It is complete in context with sibling tools and annotations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, so the schema fully documents the input (empty object). The description correctly implies no parameters are needed, meeting the baseline of 4 for no-parameter tools. No additional parameter explanation is required.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: 'Summarize Docker disk usage' with breakdown of layer storage and per-object sizes for images, containers, volumes, and build cache. It also clarifies the equivalent docker command (`docker system df`). This clearly distinguishes it from sibling tools like `system_info` and `buildx_du`.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly tells the agent when to use this tool ('Use it to find what to reclaim before image_prune / container_prune / volume_prune / buildx_prune') and provides an alternative tool for different needs ('use system_info for daemon config and counts rather than sizes'). This is exemplary usage guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

system_eventsA
Read-only

Stream real-time events from the Docker server, bounded by limit events or timeout_seconds.

Returns when limit events are collected or timeout_seconds elapses, whichever comes first (limit caps memory; timeout_seconds caps how long the call blocks — without it a quiet daemon would block indefinitely, since the stream only yields on an actual event).

Caveat for ssh:// daemons: docker-py can't cancel an SSH stream, so the timeout_seconds watchdog can't interrupt a fully idle stream — bound with until/limit (or a non-SSH endpoint).

"Wait for the next matching event" idiom: pass limit=1 with filters narrowed to what you care about (e.g. {"type": "container", "event": "health_status"}) and a generous timeout_seconds. This blocks until that one event arrives (or the timeout elapses, returning an empty list) instead of re-polling a snapshot on a timer — there's no separate wait tool for this since the filtering this call already does covers it.

args: since - Show events created since this timestamp until - Show events created until this timestamp filters - Filters to apply to the event stream limit - Max events to return (default 100) timeout_seconds - Max wall-clock seconds before returning what was collected (default 30) returns: list - A list of decoded event dicts (length <= limit)

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
sinceNo
untilNo
filtersNo
timeout_secondsNo

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint annotation, the description discloses that the call blocks until limit or timeout, that a quiet daemon would block indefinitely without timeout, and that SSH streams cannot be cancelled. It also explains memory (limit) and wall-clock (timeout) reasoning. This is rich behavioral context well beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections: intro, blocking conditions, SSH caveat, usage idiom, and args. Each sentence provides necessary information, and the 'wait for event' idiom paragraph justifies the tool's existence concisely. No fluff or repetition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no output schema, the description covers return values (list of decoded event dicts, length <= limit), explains edge cases (idle stream, SSH), and gives practical usage guidance. It fully addresses the complexity of a streaming API, making it complete for an agent to invoke correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The 'args' section provides a one-line meaning for all 5 parameters, which is essential given the 0% schema description coverage. Limit and timeout are clearly defined with defaults. 'since' and 'until' are minimally described as timestamps, and 'filters' is vague, but the description compensates for the schema's complete lack of field documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Stream real-time events from the Docker server', using a specific verb and resource. It distinguishes itself from sibling system tools (system_info, system_ping) by focusing on event streaming and clearly states the bounded behavior (limit/timeout). The 'wait for next matching event' idiom further clarifies a unique use case.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly explains the core use case (waiting for a matching event) and even notes that 'there's no separate wait tool for this since the filtering this call already does covers it', thereby addressing alternatives. It also provides a caveat for ssh:// daemons, guiding when timeouts won't behave as expected, which is essential for correct usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

system_infoA
Read-only

Return system-wide Docker information, like docker info.

Daemon runtime state: container/image counts, storage and logging drivers, swarm role, and daemon warnings. Use system_version for version/API level and system_df for disk usage.

returns: dict - {"Containers", "Images", "Driver", "ServerVersion", "Swarm", "Warnings", ...}

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false. The description adds return structure, field names, and notes it follows `docker info` semantics, which is useful behavioral context beyond the annotations. No contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Description is concise: three sentences front-loaded with purpose, followed by relevant detail and a compact return signature. Every sentence earns its place with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter read-only system info tool, this description is fully complete. It explains what it returns, gives a helpful analogy to docker info, and directs to alternatives for adjacent needs. The return dict keys provide sufficient expectations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Tool has zero parameters, so schema coverage is 100% by default and the description doesn't need to explain parameters. Baseline 4 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states 'Return system-wide Docker information, like `docker info`', with specific examples of returned fields. It distinguishes itself from sibling tools by mentioning the exact alternatives for version and disk usage.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly tells the agent to use `system_version` for version/API level and `system_df` for disk usage, providing clear guidance on when not to use this tool. The context of 'Daemon runtime state' further clarifies its appropriate use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

system_loginA

Authenticate with a Docker registry.

Security: the password is sent as a tool argument, which many MCP clients log verbatim. Prefer running docker login once on the host so the docker module reuses the credentials cached in ~/.docker/config.json, and avoid calling this tool from an agent loop. Credentials let image_pull / image_push reach private repositories; system_logout clears them.

args: username - Registry username password - Registry password or token email - Registry account email registry - URL to the registry (defaults to Docker Hub) reauth - Force re-authentication even if valid credentials exist dockercfg_path - Path to a custom dockercfg file returns: dict - The login response: {"Status"} always; "IdentityToken" only when the registry issues one

ParametersJSON Schema
NameRequiredDescriptionDefault
emailNo
reauthNo
passwordYes
registryNo
usernameYes
dockercfg_pathNo

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds significant context beyond the sparse annotations: it warns about password logging, mentions credential caching, details the return dict structure, and notes reauth behavior. It fully discloses security implications and side effects, with no contradiction to the readOnlyHint=false and destructiveHint=false annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with purpose, security note, args list, and returns, and every sentence adds value. It is slightly longer than necessary but the security warning is important. A minor condensation could improve it, but it remains efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema and minimal annotations, the description covers all necessary aspects: purpose, security, parameter semantics, return format, and relation to sibling tools. It is complete enough for an agent to select and invoke the tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description's 'args' section explains every parameter with meaningful context (e.g., reauth forces re-authentication, registry defaults to Docker Hub, dockercfg_path is a custom config). This fully compensates for the schema's lack of descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Authenticate with a Docker registry,' a specific verb+resource statement that clearly defines the tool's action. It also distinguishes itself from siblings by explaining how credentials enable image_pull/image_push and are cleared by system_logout.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit guidance is given: prefer running `docker login` on the host instead, avoid calling from an agent loop due to security, and use system_logout to clear credentials. This clearly states when and how to use the tool versus alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

system_logoutA

Clear cached registry credentials from this server's in-memory Docker client.

docker-py / the Engine have no true logout: system_login validates against the registry (the daemon's /auth is stateless) and caches credentials in-process. This drops that in-memory cache; it does NOT contact the daemon or touch the host's ~/.docker/config.json. With no registry, clears every cached credential; pass one to clear just that entry (key must match system_login; Docker Hub is cached under "docker.io"). system_close/system_reconnect also clear it by discarding the client.

Reaches into a private docker-py attribute (api._auth_configs); degrades to clearing nothing if that internal shape changes.

args: registry - Registry key to clear, or None to clear every cached credential returns: dict - {"cleared": []}

ParametersJSON Schema
NameRequiredDescriptionDefault
registryNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description goes well beyond annotations, detailing that there is no true logout, the daemon is not contacted, host config is untouched, the private docker-py attribute is accessed, and it degrades gracefully. This gives the agent accurate expectations for side effects and failure modes.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is moderately long but every sentence adds value—key facts are front-loaded, and technical caveats are organized in a clear paragraph. The args/returns block makes it scannable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given a simple schema and no output schema, the description covers the operation's behavior, return value, edge cases, and internal implementation notes. It is fully self-contained and leaves no important gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Despite 0% schema coverage, the description fully documents the single 'registry' parameter, including its meaning, default (None = all), and the Docker Hub key name ('docker.io'). This is far more than the schema provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: 'Clear cached registry credentials from this server's in-memory Docker client.' It clearly distinguishes itself from siblings like system_login, system_close, and system_reconnect by explaining it only clears the in-memory cache and doesn't contact the daemon.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly states when to use this tool: to clear cached credentials, and names alternatives (system_login, system_close, system_reconnect) that also clear it. It explains the difference between clearing all vs a specific entry and the key matching requirement, giving the agent clear decision criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

system_pingA
Read-only

Check that the Docker server is responsive.

The cheapest daemon health check. A failure here usually means connection config rather than daemon load — system_reconnect rebuilds a wedged client, host_list shows the configured endpoints. For daemon details use system_version / system_info.

returns: bool - True if the daemon responded successfully

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false. The description adds valuable context beyond that: it labels the tool as the 'cheapest' check (performance characteristic), explains failure likely means connection config rather than load, and documents the bool return value. No contradictions with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three concise sections: purpose, usage context with alternatives, and return type. The description is front-loaded with the main verb and uses each sentence to add distinct value without redundancy or fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter, read-only health check with a bool output schema, the description covers purpose, usage, alternatives, and return semantics. It is fully self-contained and leaves no significant gaps for an agent selecting or invoking this tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, and the input schema confirms this (empty properties, 100% coverage). With no params to document, the description reasonably omits parameter details. Baseline for 0 params is 4; nothing extra needed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: 'Check that the Docker server is responsive.' It clearly differentiates from sibling tools by explicitly naming alternatives (system_reconnect, host_list, system_version/system_info), making the tool's unique scope obvious.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit when-to-use and when-not-to-use guidance: identifies it as the 'cheapest daemon health check,' notes failure usually points to connection config rather than load, and names specific alternatives for different situations (system_reconnect for wedged clients, host_list for endpoints, system_version/system_info for details).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

system_reconnectA

Rebuild a pooled Docker client from its configured endpoint, to recover a wedged connection.

Validates the rebuilt client before swapping in (and only then closes the old one), so a failed rebuild leaves the working client in place. Rebuilds the default host's client when host is omitted. It CANNOT retarget to a different daemon — to add or change a daemon, edit DOCKER_MCP_SERVER_HOSTS and restart. system_close closes pooled clients without rebuilding; host_list shows the configured endpoints.

returns: dict - the rebuilt host's version info (same shape as system_version), confirming connectivity

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.6/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (readOnlyHint=false, destructiveHint=false), the description explains the safety-critical behavior: the rebuilt client is validated before the old one is closed, so a failed rebuild preserves the working client. It also discloses the limitation about not retargeting daemons and explains the return shape. This adds meaningful behavioral context that annotations alone do not provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured and front-loaded, starting with the core purpose and then adding important behavioral details in a logical order. It is concise enough given the amount of necessary context, and every sentence contributes meaning—no filler or repetition of schema/annotation data.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a zero-parameter tool with no output schema, the description covers all necessary bases: what it does, why it exists, safety behavior, limitations, alternatives, and return value shape. It is fully self-contained and leaves no important gap in the agent's understanding.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema declares zero parameters, but the description references a `host` parameter ('Rebuilds the default host's client when `host` is omitted'), which is misleading given the schema. With no parameters defined, the description should not imply an optional parameter that cannot be passed. This creates ambiguity about how to invoke the tool and undermines the otherwise clear semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's specific action: 'Rebuild a pooled Docker client from its configured endpoint, to recover a wedged connection.' It distinguishes itself from related tools by explicitly mentioning system_close and host_list, and by stating what it cannot do (retarget to a different daemon). This gives a precise verb+resource+scope definition.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives an explicit use case ('to recover a wedged connection'), tells the user when not to use it ('CANNOT retarget to a different daemon'), and names alternatives: edit DOCKER_MCP_SERVER_HOSTS for adding/changing daemons, system_close for closing without rebuilding, and host_list for showing endpoints. This is excellent when-to-use vs. when-not-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

system_versionA
Read-only

Return Docker server version information.

Engine version, API level, and per-component versions — the first thing to check for feature availability. system_info reports runtime state (counts, drivers, swarm role) instead.

returns: dict - {"Version", "ApiVersion", "MinAPIVersion", "Os", "Arch", "Components", ...}

ParametersJSON Schema
NameRequiredDescriptionDefault

No parameters

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and destructiveHint=false, and the description is consistent, adding context about the return format and use case. It doesn't mention further behavioral nuances, but for a simple version-info read, the additional return-value detail is sufficient.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the main purpose, adds one line of distinguishing context, and includes a compact return-type hint. Every sentence earns its place with no redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a no-parameter read-only tool, the description is complete: it names the resource, clarifies the difference from sibling `system_info`, and gives expected return fields. No output schema exists, but the inline dict summary fills that gap.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The tool has zero parameters, and the input schema is empty with 100% coverage. Since there is nothing to explain, the baseline of 4 applies; no additional parameter information is needed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb-resource pairing ('Return Docker server version information') and immediately distinguishes itself from sibling `system_info` by explaining that `system_info` reports runtime state instead. This makes the purpose unmistakable and distinct.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use this tool ('the first thing to check for feature availability') and names an alternative (`system_info`) with its specific purpose, providing clear when-to-use and when-not-to-use guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

tool_listA
Read-only

List this server's registered tools as compact rows, filtered by domain, category or keyword.

A tool-callable mirror of docker-mcp://tool-catalog for clients that can't read MCP resources (e.g. Claude Desktop, Cursor), and the only way to ask what no per-tool description search can express: which tools are destructive, which accept a host, what this server actually registered. Use it to brief on an unfamiliar area (domain="buildx" returns one line per tool rather than ~13 full definitions), to check blast radius (category="destructive"), or to establish that nothing matches — matched: 0 is a definitive negative, which a client's fuzzy search cannot give. Covers this server's own surface; docs_lookup covers external Docker reference documentation. Rows are summaries, not definitions — fetch a tool's own definition for its parameters. Read-only, never raises on a query matching nothing, and always registered even when DOCKER_MCP_SERVER_DISABLE drops every domain. A tool dropped by a switch or a disabled domain is absent rather than flagged; hidden_by_configuration reports how many each domain hides.

args: domain - Exact domain name (see any result's domains key); omit for every domain category - Exact category; omit for all three keyword - Case-insensitive substring over tool names, summaries and parameter names returns: dict - {"matched": int, "tools": [{"name", "domain", "category", "summary"}], "domains": {domain: count}, "no_domain": int, "hidden_by_configuration": {domain: count}, "switches", "filters"}. Every domains key is a value domain accepts; no_domain counts the domain-less tools, whose rows carry domain: null and which no domain value selects.

ParametersJSON Schema
NameRequiredDescriptionDefault
domainNo
keywordNo
categoryNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already say readOnlyHint=true and destructiveHint=false, but the description goes further: "Read-only, never raises on a query matching nothing, and always registered even when DOCKER_MCP_SERVER_DISABLE drops every domain." It also discloses that rows are summaries, not definitions, and how `hidden_by_configuration` works. This adds behavioral context well beyond the structural hints.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with a one-sentence summary, then structured into args and returns sections. It is dense but every sentence adds value, covering edge cases, comparisons, and return structure without redundancy. Length is justified by the tool's complexity and 3 parameters.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no output schema, the description provides a detailed returns dict: "{matched, tools, domains, no_domain, hidden_by_configuration, switches, filters}" and explains key semantics like `domains` keys and `no_domain`. It also covers configuration-related behavior and definitive negative matches, making the tool fully self-explanatory.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 0% description coverage, but the description's `args:` block fully compensates: "domain - Exact domain name (see any result's `domains` key); omit for every domain,” plus category and keyword semantics. It explains categorical enum values and how omission behaves, which the schema alone does not convey.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: "List this server's registered tools as compact rows, filtered by domain, category or keyword." It clearly distinguishes itself from siblings by positioning as a mirror of the MCP resource and noting "docs_lookup covers external Docker reference documentation." The scope ('this server's own surface') and unique abilities (e.g., filtering by destructive category) make its purpose unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicit usage scenarios are provided: "Use it to brief on an unfamiliar area (`domain="buildx"`)... to check blast radius (`category="destructive"`), or to establish that nothing matches." It contrasts with `docs_lookup` for external docs and clarifies that dropped/disabled tools are absent rather than flagged. These are clear when-to-use and when-not-to-use guidelines with named alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

volume_createA

Create a volume managed by Docker.

Named volumes persist after their containers stop or are removed; use them for databases, uploads, or any data that must outlive a container. Anonymous volumes (no name) are only removed automatically when the container was started with --rm or removed with docker rm -v; otherwise they accumulate and must be pruned manually. Common driver_opts for the default local driver: bind-mount an existing host path with {"type": "none", "device": "/host/path", "o": "bind"}, or mount an NFS share with {"type": "nfs", "device": "server:/export", "o": "addr=server,rw"}. Third-party drivers (e.g. rexray, convoy) accept their own option keys. List existing volumes with volume_list; reclaim unused ones with volume_prune. Created volumes are stamped with provenance labels.

args: name - Volume name; auto-generated if omitted (creates an anonymous volume) driver - Volume driver to use (default: "local") driver_opts - Driver-specific options dict labels - Labels to set on the volume returns: dict - The created volume's attrs ({"Name", "Driver", "Mountpoint", "Labels", ...})

ParametersJSON Schema
NameRequiredDescriptionDefault
nameNo
driverNo
labelsNo
driver_optsNo

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

While annotations indicate the tool is not read-only and not destructive, the description adds significant behavioral context: the lifecycle differences between named and anonymous volumes, the '--rm' and 'docker rm -v' removal caveat, and the fact that volumes are 'stamped with provenance labels.' These details are not available in the annotations or schema.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is longer than average, but every sentence provides necessary information: use cases, lifecycle caveats, driver option examples, related tools, and return format. It is well-structured in paragraphs and not repetitive, earning its length without fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (4 parameters, nested objects, no output schema), the description is complete. It covers purpose, parameter semantics, driver options, lifecycle behaviors, related tools, and return value shape. The agent has everything needed to invoke the tool correctly without guessing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, but the description compensates by explaining each parameter in context: 'name' determines anonymous vs. named volume, 'driver' defaults to 'local', and 'driver_opts' includes concrete examples for bind mounts and NFS. It also documents the return value structure, which is not in an output schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description begins with a clear, specific statement: 'Create a volume managed by Docker.' It distinguishes this from related volume tools by explaining when anonymous vs. named volumes are appropriate, making the purpose unambiguous and distinct from volume_list, volume_prune, and volume_remove.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states use cases: 'use them for databases, uploads, or any data that must outlive a container.' It also provides alternative actions: 'List existing volumes with volume_list; reclaim unused ones with volume_prune.' This goes beyond a simple usage hint and tells the agent when to use this tool versus related operations.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

volume_inspectA
Read-only

Get a volume's full inspect payload by name.

Use it after volume_list to see a volume's on-disk location, driver, and labels — e.g. before a backup or volume_remove. Volumes are addressed purely by name; they have no separate id.

args: name - The volume name (volumes have no ids) returns: dict - The volume's attrs (Name, Driver, Mountpoint, CreatedAt, Labels, Options, Scope)

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes

TDQS

A4.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The annotations already declare readOnlyHint=true and destructiveHint=false, so the safety profile is covered. The description adds value by disclosing the return payload structure (Name, Driver, Mountpoint, CreatedAt, Labels, Options, Scope) and the lack of IDs. It doesn't cover error behavior, but for a simple read-only inspect tool, the additional context is sufficient.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with a clear opening statement, a usage note, and properly labeled sections for arguments and return values. Every sentence adds value: the usage note provides context, and the args/returns section succinctly documents the API. It is concise without being terse.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite lacking an output schema, the description lists the expected return keys, which fully informs the agent about the result structure. It also includes usage context for the volume lifecycle. For a single-parameter, read-only tool with strong annotations, this description is complete and self-sufficient.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has zero description coverage (the parameter 'name' is just a string with no explanation). The description compensates fully by including 'args: name - The volume name (volumes have no ids)', which not only clarifies the parameter's purpose but also explains why there is no id. This is a complete semantic addition for the single parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: 'Get a volume's full inspect payload by name.' This is a specific verb+resource combination that distinguishes it from volume_list (which lists volumes) and other inspect tools (which inspect different resource types). The additional context about addressing volumes by name without ids further clarifies the scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use this tool: 'Use it after volume_list' and provides concrete examples such as 'before a backup or volume_remove.' It also clarifies the addressing scheme ('volumes have no separate id'), which helps the agent understand prerequisites and avoid common mistakes. This is explicit usage guidance with context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

volume_listA
Read-only

List volumes.

Volumes are addressed by name only — feed a Name to volume_inspect for detail or volume_remove / volume_prune to clean up. filters={"dangling": True} finds volumes that no container references.

args: filters - Filter by attributes (e.g. dangling, name, label) managed_only - Only return volumes created by this MCP server (filters on the docker-mcp-server.managed label); combines with any filters given returns: list - One volume document ({"Name", "Driver", "Mountpoint", ...}) per volume

ParametersJSON Schema
NameRequiredDescriptionDefault
filtersNo
managed_onlyNo

TDQS

A4.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate readOnlyHint=true and destructiveHint=false. The description adds useful behavioral context such as 'Volumes are addressed by name only' and explains how managed_only filters on a specific label. It doesn't contradict the annotations and supplements them with details about return format and filter behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is reasonably concise at ~90 words and well-structured with a brief intro, usage hint, args, and returns sections. Every sentence adds value, but the 'Volumes are addressed by name only' sentence could be seen as slightly tangential; still, it's important context for how to interact with volume entities.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite no output schema, the description specifies the return format as a list of volume documents with example fields. It covers parameters, return type, and alternative tools, making it complete for a list operation with two parameters.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has 0% parameter descriptions, but the description thoroughly explains both parameters: filters with examples (dangling, name, label) and managed_only with its label-filtering behavior and how it combines with filters. This fully compensates for the lack of schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'List volumes' with a specific verb and resource. It distinguishes itself from sibling tools by noting that volume_inspect is for detail and volume_remove/prune are for cleanup, making its purpose clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly tells when to use this tool vs alternatives: 'feed a Name to volume_inspect for detail or volume_remove / volume_prune to clean up.' It also gives a concrete example of using filters for dangling volumes, providing strong usage guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

volume_pruneA
DestructiveIdempotent

Remove volumes not referenced by any container, running or stopped.

A volume used by even one stopped container is not "unused" and survives the prune — remove the container first (or use container_prune, then this) to reclaim its volumes. Valid filter keys: label (key or key=value), all ("true" as a string — without it only anonymous volumes are eligible, matching docker volume prune's default). Use volume_list first to see what currently exists.

args: filters - Narrow which unused volumes to remove; omit to remove all anonymous ones returns: dict - {"VolumesDeleted": [...], "SpaceReclaimed": }

ParametersJSON Schema
NameRequiredDescriptionDefault
filtersNo

TDQS

A4.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark this as destructive and idempotent. The description adds useful nuance about what counts as 'unused' (stopped containers still protect a volume), the default anonymous-only behavior, and the return payload. It doesn't cover permission requirements or confirmation behavior, but the annotations plus added context are sufficient.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is front-loaded with the core purpose, then elaborates on edge cases, filter keys, and pre-conditions in a structured way. The args/returns section at the end is clearly labeled. Every sentence provides actionable information without waste.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having no output schema, the description explicitly states the return dict shape (VolumesDeleted and SpaceReclaimed). It covers usage context, default behavior, filter semantics, and sibling tool coordination (volume_list, container_prune), making it self-sufficient for correct selection and invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% and the only parameter (filters) has no schema description. The description fully compensates by explaining that filters narrow which unused volumes to remove, omitting removes all anonymous ones, and listing valid filter keys (label, all) with their syntax and semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb and resource: "Remove volumes not referenced by any container, running or stopped." It clearly scopes the operation (unused volumes only) and distinguishes it from sibling tools like volume_remove and container_prune.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly tells when to use it versus alternatives: volumes used by stopped containers survive, so remove the container first or use container_prune first. It also advises using volume_list to see what exists and explains filter key usage, including the all key's default behavior.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

volume_removeA
Destructive

Remove a single volume by name.

Fails if any container, running or stopped, still references the volume — remove or recreate those containers first, or pass force=True to remove it anyway (the containers keep their reference but lose the underlying data). For bulk cleanup of volumes with no container references at all, use volume_prune instead.

args: name - Volume name to remove force - Remove even if a container still references the volume returns: bool - True after removal

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYes
forceNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the annotations (destructiveHint=true), the description discloses critical behavior: it fails if any container references the volume, force=True lets removal proceed but containers lose underlying data, and it returns a bool. This adds significant context beyond what annotations alone provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is tightly written with a clear structure: purpose, failure behavior, alternative, and then a structured args/returns section. Every sentence contributes meaning without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple removal tool with annotations and an output schema, the description covers all essential aspects: what it does, failure modes, force behavior, the alternative tool, parameter meanings, and return type. No significant gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Since the schema has no parameter descriptions (0% coverage), the description fully compensates by explaining both parameters: 'name' as the volume name and 'force' as permitting removal despite container references. This is complete semantic coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with 'Remove a single volume by name,' which is a specific verb+resource statement that clearly distinguishes it from other volume tools. It also contrasts with volume_prune by noting bulk cleanup, cementing the differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly states when to use this tool versus the alternative: 'For bulk cleanup of volumes with no container references at all, use volume_prune instead.' It also describes the failure condition when containers reference the volume, giving clear context for when force is appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 14 tool updatesv2.2.5
    • Changedcompose_config1 field changed
      • addedInput schema / properties / format / enum
        Added value: +[
        +  "yaml",
        +  "json"
        +]
    • Changedcompose_up1 field changed
      • addedInput schema / properties / pull / enum
        Added value: +[
        +  "always",
        +  "missing",
        +  "never"
        +]
    • Addedimage_import
    • Changednetwork_create1 field changed
      • addedInput schema / properties / scope / enum
        Added value: +[
        +  "local",
        +  "global",
        +  "swarm"
        +]
    • Addedplugin_privileges
    • Changedscout_compare2 fields changed
      • addedInput schema / properties / format / enum
        Added value: +[
        +  "json",
        +  "markdown",
        +  "text"
        +]
      • addedInput schema / properties / only_severity / items / enum
        Added value: +[
        +  "critical",
        +  "high",
        +  "medium",
        +  "low",
        +  "unspecified"
        +]
    • Changedscout_cves3 fields changed
      • changedInput schema / properties / format / default
        Previous value: -"json"New value: +"sarif"
      • addedInput schema / properties / format / enum
        Added value: +[
        +  "packages",
        +  "sarif",
        +  "spdx",
        +  "gitlab",
        +  "markdown",
        +  "sbom"
        +]
      • addedInput schema / properties / only_severity / items / enum
        Added value: +[
        +  "critical",
        +  "high",
        +  "medium",
        +  "low",
        +  "unspecified"
        +]
    • Changedscout_quickview1 field changed
      • removedInput schema / properties / format
        Removed value: -{
        -  "default": "json",
        -  "type": "string"
        -}
    • Changedscout_recommendations1 field changed
      • removedInput schema / properties / format
        Removed value: -{
        -  "default": "json",
        -  "type": "string"
        -}
    • Changedscout_sbom1 field changed
      • addedInput schema / properties / format / enum
        Added value: +[
        +  "list",
        +  "json",
        +  "spdx",
        +  "cyclonedx"
        +]
    • Changedstack_deploy1 field changed
      • addedInput schema / properties / resolve_image / enum
        Added value: +[
        +  "always",
        +  "changed",
        +  "never"
        +]
    • Addedswarm_task_inspect
    • Addedswarm_task_list
    • Addedtool_list
  2. 3 tool updates
    • Addedimage_prune_builds
    • Addedplugin_create
    • Addedplugin_push
  3. 6 tool updatesv2.2.1
    • Addedbuildx_prune
    • Addedplugin_disable
    • Addedvolume_inspect
    • Addedvolume_list
    • Addedvolume_prune
    • Addedvolume_remove
  4. 16 tool updatesv2.1.4
    • Addedbuildx_bake
    • Addedbuildx_build
    • Addedbuildx_du
    • Addedbuildx_history_inspect
    • Addedbuildx_history_list
    • Addedbuildx_imagetools_create
    • Addedbuildx_imagetools_inspect
    • Addedbuildx_inspect
    • Addedbuildx_list
    • Addedcompose_port
    • Addedcompose_wait
    • Removedplugin_disable
    • Removedvolume_inspect
    • Removedvolume_list
    • Removedvolume_prune
    • Removedvolume_remove
  5. 12 tool updatesv2.1.4
    • Removedbuildx_bake
    • Removedbuildx_build
    • Removedbuildx_du
    • Removedbuildx_history_inspect
    • Removedbuildx_history_list
    • Removedbuildx_imagetools_create
    • Removedbuildx_imagetools_inspect
    • Removedbuildx_inspect
    • Removedbuildx_list
    • Removedbuildx_prune
    • Removedcompose_port
    • Removedcompose_wait
  6. 5 tool updatesv2.0.1
    • Changedcontainer_wait3 fields changed
      • addedInput schema / properties / pattern
        Added value: +{
        +  "default": null,
        +  "type": "string"
        +}
      • addedInput schema / properties / regex
        Added value: +{
        +  "default": false,
        +  "type": "boolean"
        +}
      • changedInput schema / properties / until / enum
        Previous value: -[
        -  "not-running",
        -  "next-exit",
        -  "removed",
        -  "healthy"
        -]New value: +[
        +  "not-running",
        +  "next-exit",
        +  "removed",
        +  "healthy",
        +  "log-match"
        +]
    • Addeddocs_lookup
    • Addednode_wait
    • Addedregistry_tag_wait
    • Addedservice_wait
  7. 225 tool updatesv2.0.0
    • Removedbuild_image
    • Addedbuildx_history_list
    • Removedbuildx_history_ls
    • Changedbuildx_imagetools_create2 fields changed
      • addedInput schema / properties / descriptor_files
        Added value: +{
        +  "default": null,
        +  "items": {
        +    "type": "string"
        +  },
        +  "type": "array"
        +}
      • removedInput schema / properties / files
        Removed value: -{
        -  "default": null,
        -  "items": {
        -    "type": "string"
        -  },
        -  "type": "array"
        -}
    • Addedbuildx_list
    • Removedbuildx_ls
    • Changedbuildx_prune3 fields changed
      • removedInput schema / properties / filter
        Removed value: -{
        -  "default": null,
        -  "type": "object"
        -}
      • addedInput schema / properties / filters
        Added value: +{
        +  "default": null,
        +  "type": "object"
        +}
      • removedInput schema / properties / keep_storage
        Removed value: -{
        -  "default": null,
        -  "type": "string"
        -}
    • Addedbuildx_remove
    • Removedbuildx_rm
    • Removedclose
    • Removedcommit_container
    • Addedcompose_list
    • Changedcompose_logs2 fields changed
      • addedInput schema / properties / tail / anyOf
        Added value: +[
        +  {
        +    "type": "integer"
        +  },
        +  {
        +    "const": "all",
        +    "type": "string"
        +  }
        +]
      • removedInput schema / properties / tail / type
        Removed value: -"integer"
    • Removedcompose_ls
    • Addedconfig_create
    • Addedconfig_inspect
    • Addedconfig_list
    • Addedconfig_remove
    • Removedconfigure_plugin
    • Removedconnect_network
    • Addedcontainer_archive_get
    • Addedcontainer_archive_get_to_file
    • Addedcontainer_archive_put
    • Addedcontainer_commit
    • Addedcontainer_create
    • Addedcontainer_exec
    • Addedcontainer_export
    • Addedcontainer_inspect
    • Addedcontainer_kill
    • Addedcontainer_list
    • Changedcontainer_logs4 fields changed
      • addedInput schema / properties / follow
        Added value: +{
        +  "default": false,
        +  "type": "boolean"
        +}
      • addedInput schema / properties / limit_lines
        Added value: +{
        +  "default": 200,
        +  "type": "integer"
        +}
      • changedInput schema / properties / tail / default
        Previous value: -"all"New value: +200
      • addedInput schema / properties / timeout_seconds
        Added value: +{
        +  "default": 30,
        +  "type": "number"
        +}
    • Addedcontainer_pause
    • Addedcontainer_prune
    • Addedcontainer_remove
    • Addedcontainer_rename
    • Addedcontainer_restart
    • Addedcontainer_run
    • Addedcontainer_start
    • Addedcontainer_stop
    • Addedcontainer_unpause
    • Addedcontainer_update
    • Addedcontainer_wait
    • Addedcontext_list
    • Removedcontext_ls
    • Addedcontext_remove
    • Removedcontext_rm
    • Removedcreate_config
    • Removedcreate_container
    • Removedcreate_network
    • Removedcreate_secret
    • Removedcreate_service
    • Removedcreate_volume
    • Removeddf
    • Removeddisable_plugin
    • Removeddisconnect_network
    • Removedenable_plugin
    • Removedevents
    • Removedexec_in_container
    • Removedexport_container
    • Removedexport_container_to_file
    • Removedfollow_container_logs
    • Removedforce_update_service
    • Removedget_config
    • Removedget_container
    • Removedget_container_archive
    • Removedget_container_archive_to_file
    • Removedget_image
    • Removedget_network
    • Removedget_node
    • Removedget_plugin
    • Removedget_registry_data
    • Removedget_secret
    • Removedget_service
    • Removedget_swarm_join_tokens
    • Removedget_swarm_unlock_key
    • Removedget_volume
    • Addedhost_list
    • Removedhub_list_tags
    • Addedhub_tags
    • Addedimage_build
    • Changedimage_history3 fields changed
      • addedInput schema / properties / id_or_name
        Added value: +{
        +  "type": "string"
        +}
      • removedInput schema / properties / name
        Removed value: -{
        -  "type": "string"
        -}
      • changedInput schema / required
        Previous value: -[
        -  "name"
        -]New value: +[
        +  "id_or_name"
        +]
    • Addedimage_inspect
    • Addedimage_list
    • Addedimage_load
    • Addedimage_prune
    • Addedimage_pull
    • Addedimage_push
    • Addedimage_registry_data
    • Addedimage_remove
    • Addedimage_save
    • Addedimage_search
    • Addedimage_tag
    • Removedinfo
    • Removedinit_swarm
    • Removedinstall_plugin
    • Removedjoin_swarm
    • Removedkill_container
    • Removedleave_swarm
    • Removedlist_configs
    • Removedlist_containers
    • Removedlist_hosts
    • Removedlist_images
    • Removedlist_networks
    • Removedlist_nodes
    • Removedlist_plugins
    • Removedlist_secrets
    • Removedlist_services
    • Removedlist_volumes
    • Removedload_image
    • Removedload_image_from_file
    • Removedlogin
    • Removedlogout
    • Addednetwork_connect
    • Addednetwork_create
    • Addednetwork_disconnect
    • Addednetwork_inspect
    • Addednetwork_list
    • Addednetwork_prune
    • Addednetwork_remove
    • Addednode_inspect
    • Addednode_list
    • Addednode_remove
    • Addednode_update
    • Removedpause_container
    • Removedping
    • Addedplugin_configure
    • Addedplugin_disable
    • Addedplugin_enable
    • Addedplugin_inspect
    • Addedplugin_install
    • Addedplugin_list
    • Addedplugin_remove
    • Addedplugin_upgrade
    • Removedprune_containers
    • Removedprune_images
    • Removedprune_networks
    • Removedprune_volumes
    • Removedpull_image
    • Removedpush_image
    • Removedpush_plugin
    • Removedput_container_archive
    • Removedput_container_archive_from_file
    • Removedreconnect
    • Removedregistry_get_config
    • Addedregistry_image_config
    • Removedregistry_inspect_manifest
    • Removedregistry_list_tags
    • Addedregistry_manifest
    • Addedregistry_tags
    • Removedreload_swarm
    • Removedremove_config
    • Removedremove_container
    • Removedremove_image
    • Removedremove_network
    • Removedremove_node
    • Removedremove_plugin
    • Removedremove_secret
    • Removedremove_service
    • Removedremove_volume
    • Removedrename_container
    • Removedresize_container
    • Removedrestart_container
    • Removedrollback_service
    • Removedrotate_swarm_join_token
    • Removedrun_container
    • Removedsave_image
    • Removedsave_image_to_file
    • Removedscale_service
    • Removedsearch_images
    • Addedsecret_create
    • Addedsecret_inspect
    • Addedsecret_list
    • Addedsecret_remove
    • Addedservice_create
    • Addedservice_inspect
    • Addedservice_list
    • Changedservice_logs4 fields changed
      • addedInput schema / properties / id_or_name
        Added value: +{
        +  "type": "string"
        +}
      • removedInput schema / properties / service_id
        Removed value: -{
        -  "type": "string"
        -}
      • changedInput schema / properties / tail / default
        Previous value: -"all"New value: +200
      • changedInput schema / required
        Previous value: -[
        -  "service_id"
        -]New value: +[
        +  "id_or_name"
        +]
    • Addedservice_ps
    • Addedservice_remove
    • Addedservice_rollback
    • Addedservice_scale
    • Removedservice_tasks
    • Addedservice_update
    • Changedstack_deploy3 fields changed
      • addedInput schema / properties / name
        Added value: +{
        +  "type": "string"
        +}
      • removedInput schema / properties / stack_name
        Removed value: -{
        -  "type": "string"
        -}
      • changedInput schema / required
        Previous value: -[
        -  "stack_name",
        -  "compose_files"
        -]New value: +[
        +  "name",
        +  "compose_files"
        +]
    • Addedstack_list
    • Removedstack_ls
    • Changedstack_ps5 fields changed
      • removedInput schema / properties / filters / items
        Removed value: -{
        -  "type": "string"
        -}
      • changedInput schema / properties / filters / type
        Previous value: -"array"New value: +"object"
      • addedInput schema / properties / name
        Added value: +{
        +  "type": "string"
        +}
      • removedInput schema / properties / stack_name
        Removed value: -{
        -  "type": "string"
        -}
      • changedInput schema / required
        Previous value: -[
        -  "stack_name"
        -]New value: +[
        +  "name"
        +]
    • Addedstack_remove
    • Removedstack_rm
    • Changedstack_services5 fields changed
      • removedInput schema / properties / filters / items
        Removed value: -{
        -  "type": "string"
        -}
      • changedInput schema / properties / filters / type
        Previous value: -"array"New value: +"object"
      • addedInput schema / properties / name
        Added value: +{
        +  "type": "string"
        +}
      • removedInput schema / properties / stack_name
        Removed value: -{
        -  "type": "string"
        -}
      • changedInput schema / required
        Previous value: -[
        -  "stack_name"
        -]New value: +[
        +  "name"
        +]
    • Removedstart_container
    • Removedstop_container
    • Addedswarm_init
    • Addedswarm_inspect
    • Addedswarm_join
    • Addedswarm_join_tokens
    • Addedswarm_leave
    • Addedswarm_unlock
    • Addedswarm_unlock_key
    • Addedswarm_update
    • Addedsystem_close
    • Addedsystem_df
    • Addedsystem_events
    • Addedsystem_info
    • Addedsystem_login
    • Addedsystem_logout
    • Addedsystem_ping
    • Addedsystem_reconnect
    • Addedsystem_version
    • Removedtag_image
    • Removedunlock_swarm
    • Removedunpause_container
    • Removedupdate_container
    • Removedupdate_node
    • Removedupdate_service
    • Removedupdate_swarm
    • Removedupgrade_plugin
    • Removedversion
    • Addedvolume_create
    • Addedvolume_inspect
    • Addedvolume_list
    • Addedvolume_prune
    • Addedvolume_remove
    • Removedwait_container
    • Removedwait_for_container_healthy
  8. 162 tool updatesv1.9.0
    • First observedbuild_image
    • First observedbuildx_bake
    • First observedbuildx_build
    • First observedbuildx_create
    • First observedbuildx_du
    • First observedbuildx_history_inspect
    • First observedbuildx_history_ls
    • First observedbuildx_imagetools_create
    • First observedbuildx_imagetools_inspect
    • First observedbuildx_inspect
    • First observedbuildx_ls
    • First observedbuildx_prune
    • First observedbuildx_rm
    • First observedbuildx_use
    • First observedclose
    • First observedcommit_container
    • First observedcompose_build
    • First observedcompose_config
    • First observedcompose_cp
    • First observedcompose_down
    • First observedcompose_exec
    • First observedcompose_images
    • First observedcompose_kill
    • First observedcompose_logs
    • First observedcompose_ls
    • First observedcompose_pause
    • First observedcompose_port
    • First observedcompose_ps
    • First observedcompose_pull
    • First observedcompose_restart
    • First observedcompose_run
    • First observedcompose_start
    • First observedcompose_stop
    • First observedcompose_top
    • First observedcompose_unpause
    • First observedcompose_up
    • First observedcompose_wait
    • First observedconfigure_plugin
    • First observedconnect_network
    • First observedcontainer_diff
    • First observedcontainer_logs
    • First observedcontainer_stats
    • First observedcontainer_top
    • First observedcontext_create
    • First observedcontext_inspect
    • First observedcontext_ls
    • First observedcontext_rm
    • First observedcontext_use
    • First observedcreate_config
    • First observedcreate_container
    • First observedcreate_network
    • First observedcreate_secret
    • First observedcreate_service
    • First observedcreate_volume
    • First observeddf
    • First observeddisable_plugin
    • First observeddisconnect_network
    • First observedenable_plugin
    • First observedevents
    • First observedexec_in_container
    • First observedexport_container
    • First observedexport_container_to_file
    • First observedfollow_container_logs
    • First observedforce_update_service
    • First observedget_config
    • First observedget_container
    • First observedget_container_archive
    • First observedget_container_archive_to_file
    • First observedget_image
    • First observedget_network
    • First observedget_node
    • First observedget_plugin
    • First observedget_registry_data
    • First observedget_secret
    • First observedget_service
    • First observedget_swarm_join_tokens
    • First observedget_swarm_unlock_key
    • First observedget_volume
    • First observedhub_list_tags
    • First observedhub_rate_limit
    • First observedhub_repo_info
    • First observedimage_history
    • First observedinfo
    • First observedinit_swarm
    • First observedinstall_plugin
    • First observedjoin_swarm
    • First observedkill_container
    • First observedleave_swarm
    • First observedlist_configs
    • First observedlist_containers
    • First observedlist_hosts
    • First observedlist_images
    • First observedlist_networks
    • First observedlist_nodes
    • First observedlist_plugins
    • First observedlist_secrets
    • First observedlist_services
    • First observedlist_volumes
    • First observedload_image
    • First observedload_image_from_file
    • First observedlogin
    • First observedlogout
    • First observedpause_container
    • First observedping
    • First observedprune_containers
    • First observedprune_images
    • First observedprune_networks
    • First observedprune_volumes
    • First observedpull_image
    • First observedpush_image
    • First observedpush_plugin
    • First observedput_container_archive
    • First observedput_container_archive_from_file
    • First observedreconnect
    • First observedregistry_get_config
    • First observedregistry_inspect_manifest
    • First observedregistry_list_tags
    • First observedreload_swarm
    • First observedremove_config
    • First observedremove_container
    • First observedremove_image
    • First observedremove_network
    • First observedremove_node
    • First observedremove_plugin
    • First observedremove_secret
    • First observedremove_service
    • First observedremove_volume
    • First observedrename_container
    • First observedresize_container
    • First observedrestart_container
    • First observedrollback_service
    • First observedrotate_swarm_join_token
    • First observedrun_container
    • First observedsave_image
    • First observedsave_image_to_file
    • First observedscale_service
    • First observedscout_compare
    • First observedscout_cves
    • First observedscout_quickview
    • First observedscout_recommendations
    • First observedscout_sbom
    • First observedsearch_images
    • First observedservice_logs
    • First observedservice_tasks
    • First observedstack_deploy
    • First observedstack_ls
    • First observedstack_ps
    • First observedstack_rm
    • First observedstack_services
    • First observedstart_container
    • First observedstop_container
    • First observedtag_image
    • First observedunlock_swarm
    • First observedunpause_container
    • First observedupdate_container
    • First observedupdate_node
    • First observedupdate_service
    • First observedupdate_swarm
    • First observedupgrade_plugin
    • First observedversion
    • First observedwait_container
    • First observedwait_for_container_healthy

TDQS

A4.4/5.0
Disambiguation4/5

Each tool has a distinct purpose with cross-references clarifying differences, but the sheer number of closely related operations (e.g., compose_stop vs compose_down vs compose_kill; container_stop vs container_pause vs container_kill) creates some risk of misselection. Descriptions are detailed enough to resolve most ambiguity.

Naming Consistency5/5

All tools follow a consistent <domain>_<verb> pattern (e.g., container_stop, image_pull, service_create, network_connect). Even subdomains like buildx, compose, and swarm maintain the same convention, making the naming highly predictable.

Tool Count1/5

With 156 tools, the server vastly exceeds even the 50+ threshold for 'extreme mismatch'. While Docker has a broad API, the sheer number of tools overwhelms agent context and tool selection, and many are niche (e.g., scout_*, buildx_history_*, context_*). A more curated set covering core workflows would be far more usable.

Completeness5/5

The server covers the Docker surface exceptionally well: containers, images, networks, volumes, swarm, compose, buildx, registry, secrets, configs, contexts, plugins, and security scanning. Missing operations are rare (e.g., no single 'system prune', but individual prunes cover it), and most domains have full CRUD plus operational tools.

Maintenance

ActivityActive
ResponsivenessSlow

Related MCP Connectors

Related MCP Servers

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/L337-org/docker-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server