Codex SSH Terminal MCP
The Codex SSH Terminal MCP acts as a local, agent-native SSH control plane that lets AI coding agents operate SSH sessions through a human-supervised local bridge, keeping credentials and sensitive actions under user control.
Bridge & Session Management
Start/stop a local Web/PTY SSH bridge to initiate SSH sessions from saved profiles
Start a config-only server without opening an SSH session
Check bridge and SSH session status
Profile Management
List saved, redacted SSH profiles (passwords never included)
Delete profiles or set a default profile
Command Execution & Terminal Interaction
Send non-secret shell commands to the SSH terminal
Send terminal control signals (Ctrl-C, Ctrl-D, Enter)
Terminal Output Observation
Read incremental or full terminal output with cursor tracking and compaction
Reset the incremental read cursor or clear in-memory terminal history
File Uploads (Human-in-the-Loop)
Request user-confirmed file uploads (scp/rsync) requiring browser approval before transfer
List, check status of, or cancel upload requests
Runtime Configuration
Check or set the Python/Conda runtime used to launch the bridge server
Key Design Constraints
Passwords, MFA codes, and private keys are never passed through MCP tools — entered only via the local web page
The bridge binds to
127.0.0.1by default for local-only accessFile uploads require explicit user approval before transfer begins
Enables Docker diagnostics and management on remote servers via SSH commands.
Facilitates NGINX configuration checks and status monitoring through SSH.
Provides PostgreSQL database diagnostics and query execution via SSH.
Allows Redis diagnostics and command execution through SSH.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Codex SSH Terminal MCPconnect to prod server and show disk usage"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Codex SSH Terminal MCP
Agent-native DevOps control plane with local multi-session Web Terminals, human-in-the-loop secret input, keychain-backed profiles, compact session awareness, and user-confirmed uploads for Codex, Claude Code, and MCP-compatible coding agents.
简体中文 | Security | Usage Workflow
codex-ssh-terminal-mcp lets an AI coding agent operate one or more SSH sessions through a local, user-controlled bridge. It is designed for workflows where you would otherwise open Xshell, SecureCRT, iTerm, or another SSH client, run commands manually, copy terminal output back to the agent, and repeat.
There are already other SSH-oriented MCP servers. This project focuses on a different operating model: a shared local Web Terminal where the agent can observe and act, while the user keeps credentials, MFA, bastion interaction, and file-transfer approval inside a local control surface.
The goal is to be the most practical DevOps MCP tool for real engineering work: close to actual SSH, bastions, logs, installs, deployments, uploads, and human approval, while exposing only the minimum useful context to the agent. The agent sees redacted profiles, compact multi-session metadata, and on-demand incremental output instead of full connection details or full terminal history.

Local Web Terminal and profile configuration page with example-only connection placeholders.

Demo screenshot with redacted/example server data.
This project is not a traditional SSH client clone. It turns an SSH terminal into an agent-observable and user-governed execution channel:
The agent can observe terminal output incrementally.
The agent can send commands through MCP tools.
The agent can coordinate up to four concurrent SSH sessions by explicit
session_id.The user keeps passwords, MFA codes, and upload approvals in a local browser page.
The remote server still uses standard SSH, bastion, sudo, ACL, and audit boundaries.
✨ What It Is
This project sits between three layers:
Codex / Claude Code / MCP client
|
| MCP tools
v
Local MCP Server + Local Bridge + Web Terminal
|
| SSH / SCP / rsync
v
Server / Bastion / JumpServer / ProxyJump targetThe agent does not need to know your SSH password. The user does not need to repeatedly copy terminal output into chat. The server does not need any custom agent-side daemon.
The result is a local SSH control plane for agent-assisted server operations, optimized for workflows where safety, shared visibility, and user confirmation matter as much as command execution.
Related MCP server: portal-mcp-server
🎯 Why This Exists
Traditional SSH tools are built for humans operating terminals. Agent-assisted operations need a different interface:
Observable: the agent needs structured access to terminal output.
Interactive: the agent needs to send commands and react to remote prompts.
Bounded: secrets and high-impact actions should stay under user control.
Incremental: long logs and install progress should not flood the agent context.
Precise: multi-server operations should be addressed by explicit session IDs, not hidden "current terminal" state.
Compatible: the remote side should remain plain SSH, bastion, or ProxyJump.
This project is for reducing the friction of:
server environment checks
log inspection
Docker / Redis / PostgreSQL / Nginx diagnostics
installation and post-install verification
bastion or JumpServer menu interaction
user-confirmed file upload
replacing the "run it in Xshell, paste the output to the agent" loop
🧠 Capability Model
Observe
The agent can read incremental terminal output with cursors and tail limits. This avoids reloading the full terminal history on every step and keeps noisy progress output from consuming the entire context window.
Act
The agent can send commands to a specific SSH session through MCP tools. This works for normal shells, interactive prompts, and menu-style bastions as long as the terminal interaction is visible in the selected session.
Coordinate
The bridge can run up to 4 concurrent SSH sessions by default. The agent uses list_sessions to see compact, redacted metadata such as sessionId, profile name, host hint, user hint, port hint, running state, and cursor position. It then passes session_id to send_command, snapshot, and control.
There is no hidden global "current server" for agent commands when multiple sessions exist. If a multi-session command or read is missing session_id, the bridge rejects it instead of guessing. send_command can also include expected_profile_name so the bridge rejects commands if the session belongs to a different profile.
Confirm
High-impact flows such as file upload are human-in-the-loop. The agent can request an upload, but the user confirms it in the local web page before transfer starts.
Persist
Users can save connection profiles. The agent can later list redacted profile metadata and connect to a selected profile without asking the user to paste credentials into chat.
Constrain
The bridge is local-first, token-protected, origin-checked, and designed to keep sensitive connection details out of the agent context.
Minimize Context
Session lists are intentionally compact and do not include terminal history. Terminal output is read only on demand, per session, through incremental cursors and tail limits. This makes multi-server operations practical without filling the agent context window with unrelated logs.
🔐 Security Design
This project is built around a simple rule:
The agent may operate an authorized SSH session, but it should not need to own your secrets.
Security features already implemented include:
Credential isolation
SSH passwords, MFA codes, private key contents, and cloud access secrets should be entered only in the local web page.
The backend avoids request-body logging.
Secrets should not be pasted into Codex, Claude Code, or any agent chat.
System keychain-backed profiles
macOS: Keychain.
Linux / WSL: Secret Service through
secret-tool.The local profile file stores profile names, descriptions, redacted hints, and keychain references.
New page-created profiles do not store full host, user, ProxyJump, or raw SSH command values in ordinary project files.
Agent least knowledge
MCP profile listing returns redacted metadata.
MCP session listing returns compact per-session metadata, not terminal history.
The agent does not need to see passwords, verification codes, private keys, or full connection details.
Keychain-backed profiles are not reflected back into the page as editable plaintext.
Local API hardening
The bridge binds to
127.0.0.1by default.Non-local bind addresses are rejected.
/api/*and/eventsrequire a random local API token.MCP calls use
Authorization: Bearer ....Browser access uses a same-origin
HttpOnlycookie.
Browser-origin protection
Requests must use a local
Host.Browser cookie write requests must come from a same-origin
OriginorReferer.This reduces the risk of a malicious local webpage driving the bridge through CSRF-style requests.
Human-in-the-loop upload
The agent can create an upload request.
The user must approve it in the web page.
Upload completion reports remote path, remote size verification, and optional SHA-256 verification.
Upload transfer runs through
scporrsync, not through the shared terminal history.
Bounded local state
Terminal history is read incrementally.
Noisy progress output is compacted for agent reads.
Bridge logs rotate.
Upload tasks expire and compact their logs.
No privilege bypass
This project does not bypass SSH, bastion policies, JumpServer permissions, sudo rules, ACLs, or audit systems.
The remote permissions are exactly the permissions of the account you connect with.
See SECURITY.md for the detailed security boundary.
⚠️ Permission Risk Statement
This project is based on MCP extension capabilities for agents such as Codex and Claude Code. Using it means you allow an agent to participate in operations inside an SSH session that you are already authorized to access.
Risks caused by broad server permissions, unsafe production accounts, incorrect agent instructions, third-party model behavior, or user-approved destructive commands are outside the responsibility of this project. This project provides a controlled local channel, credential isolation, token protection, origin checks, and user confirmation points; it does not guarantee that every command produced by an agent is safe.
Recommended practice:
use low-privilege accounts where possible
keep production root access out of default profiles
review high-impact commands before execution
keep bastion and server-side audit enabled
stop the bridge when the task is complete
🧩 Supported Connection Shapes
Connection shape | Shared terminal | File upload | Notes |
Direct SSH | Supported | Supported | Standard host / port / user profile. |
SSH bastion host | Supported | Supported to the bastion host itself | Second-hop upload needs an addressable route. |
ProxyJump | Supported | Supported | Use structured profile fields with |
Menu-based bastion / JumpServer | Supported | Not directly for second-hop assets | Create a direct or ProxyJump profile for the final asset when upload is needed. |
Platform boundary:
Platform | Status | Notes |
macOS | Supported | Uses POSIX PTY and system OpenSSH. |
Linux | Supported | Requires |
Windows via WSL | Supported | Run the MCP inside WSL. |
Native Windows | Not supported yet | Needs a ConPTY / pywinpty backend. |
🚀 Quick Start
Install from source:
git clone <your-repo-url>
cd codex-ssh-terminal-mcp
python3 -m pip install -e .Register the MCP server in your MCP client. For Codex-style configuration:
[mcp_servers.codex-ssh-terminal-mcp]
command = "codex-ssh-terminal-mcp"
args = []If you do not install the console script, use the source script directly:
[mcp_servers.codex-ssh-terminal-mcp]
command = "python3"
args = ["/path/to/codex-ssh-terminal-mcp/mcp_server.py"]Then ask your agent to start the configuration page:
Use codex-ssh-terminal-mcp to start the configuration page.Open the returned local URL, create a connection profile, and enter passwords or MFA prompts only in the local web page.
After a profile is saved, ask the agent to connect:
Connect to the saved bastion profile.🛠️ MCP Tool Overview
The MCP server exposes tools for agent-driven SSH work:
start_config_server: start the local configuration page without opening SSH.list_profiles: list saved redacted connection profiles.list_sessions: list active SSH sessions with compact redacted server metadata.start_bridge: start a local web terminal and create an SSH session from a profile.bridge_status: inspect bridge and SSH session status.send_command: send a command to a specific SSH session; passsession_idwhen multiple sessions exist, and optionallyexpected_profile_nameas a target guard.snapshot: read incremental terminal output for one SSH session.reset_cursor: reset the agent-side incremental read cursor, optionally for one session.clear_history: clear one session's in-memory terminal history.control: send terminal controls such asctrl-c,ctrl-d, orenterto one session.request_upload: request a user-confirmed file upload.list_uploads: list upload requests and transfer states.upload_status: inspect one upload request.cancel_upload: cancel an upload.stop_bridge: stop the SSH bridge.runtime_config_status/set_runtime_config: control how the bridge Python runtime is launched.
Credentials and MFA codes should not be passed through these tools.
Recommended multi-session pattern:
list_profiles()
start_bridge(profile_name="prod-a")
start_bridge(profile_name="prod-b")
list_sessions()
send_command(session_id="sess_...", expected_profile_name="prod-a", command="hostname")
snapshot(session_id="sess_...", limit=80)💬 Example Agent Prompts
For Codex:
Use codex-ssh-terminal-mcp to start the configuration page.Connect to the saved bastion profile.Check what services are running on this server.Check whether PostgreSQL is installed and which ports are listening.Request an upload of this local file to /tmp/app.tar.gz. I will confirm it in the page.For Claude Code or another MCP-compatible client, configure this project as an MCP server, then use the same flow: start page, save profile, connect profile, read output, send commands, confirm uploads.
🖥️ How It Relates To Xshell / SecureCRT
Xshell and SecureCRT are excellent human-first SSH clients. This project serves a different workflow.
It focuses on:
MCP integration
agent-readable terminal output
incremental observation
local secret isolation
user-confirmed uploads
agent-assisted diagnosis and operation loops
It can replace part of the manual "open Xshell, run a command, copy the output to the agent" workflow. It is not intended to replace every feature of a professional SSH client.
🧭 Typical Workflow
Start the local configuration page through MCP.
Create a direct SSH, bastion, ProxyJump, or command-based profile in the page.
Store real connection details in the system keychain.
Ask the agent to list available profiles.
Ask the agent to start one or more sessions from selected profiles, up to the default limit of
4.Enter password, MFA, or bastion menu choices in the local page for the relevant session tab.
Ask the agent to call
list_sessions, then use explicitsession_idvalues for commands and snapshots.Let the agent read incremental output and send commands only to the intended session.
Confirm uploads or high-impact interactions in the page.
Stop the bridge after the task is complete.
🧱 Limitations
This project does not provide privilege escalation.
This project does not bypass bastion or server-side audit.
This project does not guarantee that agent-generated commands are correct.
Native Windows is not supported yet; use WSL.
The default concurrent SSH session limit is
4; raise it only after considering local process, PTY, thread, and operator attention costs.Menu-based bastions depend on stable terminal prompts and menu output.
Automatic upload to second-hop menu-selected assets requires a separate addressable SSH route.
High-risk production operations should still be reviewed by a human.
🤝 Community / Call for Contributors
This project was started by an individual developer from real-world agent-assisted server operation needs.
The core path is already implemented: MCP integration, local Web Terminal, SSH bridge, profile management, system keychain storage, local API token protection, Host / Origin / Referer checks, user-confirmed uploads, incremental terminal reads, upload verification, and bounded local logs.
That said, one developer has limited time, test environments, and security review capacity. Contributions are very welcome, especially in:
more MCP client compatibility
native Windows terminal backend
Linux Secret Service compatibility testing
additional bastion and JumpServer scenarios
stronger security review
file transfer hardening
UI / UX improvements
documentation and installation experience
real-world compatibility reports
If you have experience with SSH, MCP, terminal emulation, DevOps, bastions, local app security, or cross-platform desktop environments, your review and contributions would be highly valuable.
The goal is not to build a closed tool. The goal is to explore how agents can safely participate in server operations.
📄 License
This project is licensed under the Apache License 2.0.
For security-sensitive issues, please avoid posting secrets in public issues. Rotate exposed credentials first, then report with redacted details.
Available Tools
18 toolsbridge_statusA
Check whether the local SSH terminal bridge is reachable and return its SSH/session status.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. It clearly indicates the tool is a nondestructive read operation (checking reachability), which is transparent. However, it does not detail error handling or response format.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, front-loaded with the action and resource. No unnecessary words; every part adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple no-parameter tool, the description is sufficient. It could specify the format of the returned status, but given the lack of output schema and low complexity, it is reasonably complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has no parameters, and schema description coverage is 100%. With zero parameters, the description adds no parameter info, but this is acceptable. Baseline 4 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool checks reachability of the local SSH terminal bridge and returns its status. It uses a specific verb 'check' and resource 'local SSH terminal bridge', distinguishing it from sibling tools like start_bridge and stop_bridge.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is for checking bridge status but does not explicitly state when to use it versus alternatives like runtime_config_status. No when-not or alternative guidance is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
cancel_uploadC
Cancel a running upload transfer.
| Name | Required | Description | Default |
|---|---|---|---|
| upload_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided; description only says 'Cancel' implying a destructive action. Lacks details on side effects, permissions, or confirmations. For a mutation tool with no annotations, more disclosure expected.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, no redundancy. Efficiently communicates core purpose without waste.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and no annotations, description should cover errors, return values, or state changes. It does not. For a simple one-parameter tool, this is minimally complete but leaves significant gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only parameter is upload_id with no description in schema and no additional context in description. Schema coverage is 0%, and description fails to clarify the parameter's format, source, or constraints beyond being required.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description states 'Cancel a running upload transfer.' Clearly indicates verb and resource. Name and description align. Could be more specific about the upload ID context but sufficient.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus siblings like upload_status, or prerequisites (e.g., upload must be running). No mention of alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
clear_historyA
Clear the bridge server's in-memory terminal history and move the MCP cursor to the new end.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description carries full burden. It discloses the core effect (clear history, move cursor) but omits details like permanence, impact on ongoing operations, or required state (e.g., whether bridge must be running).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence that is efficient and front-loaded. Every part of the description contributes to understanding the tool's action.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no parameters and no output schema, the description is mostly sufficient. It could be improved by mentioning that history clearing is irreversible or that it only affects the current session, but it still communicates the main purpose clearly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters; schema coverage is 100% with no parameters. Baseline for 0 params is 4. The description adds no parameter-specific meaning, but none is needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action: clearing in-memory terminal history and moving the MCP cursor. This is a specific verb-resource combination that distinguishes it from sibling tools, none of which mention clearing history.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like reset_cursor. The description does not provide any context for appropriate usage scenarios or prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
controlB
Send terminal control input such as ctrl-c, ctrl-d, or enter.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must fully disclose behavior. It simply states the action without detailing effects, side effects, or what happens after sending the control input.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence with no redundant information. While not structured with bullets, it is efficient and front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one enum parameter), the description is adequately complete for an agent to understand its purpose. However, it lacks any mention of return values or effects, which is acceptable due to the lack of output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the description merely repeats the enum values from the schema, adding no additional meaning or context for the 'name' parameter.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Send' and the resource 'terminal control input', with specific examples (ctrl-c, ctrl-d, enter) that distinguish it from sibling tools like 'send_command', which sends arbitrary commands.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives like 'send_command'. The description implies it's for control signals but does not mention when not to use it or under what circumstances.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
delete_profileC
Delete a saved SSH connection profile.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden for behavioral disclosure. It only states 'Delete' but does not mention permanence, reversibility, authorization requirements, or error handling. This is insufficient for a destructive action.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single efficient sentence with no fluff. However, it could be slightly more informative without losing conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple 1-parameter tool with no output schema, the description is minimal but lacks important context like idempotency (can it be called multiple times?), error behavior, and side effects. An agent needs more to invoke it safely.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds no meaning beyond the input schema for the single 'name' parameter. Schema description coverage is 0%, and the description does not clarify what the name represents (e.g., profile identifier) or constraints (e.g., must exist).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Delete' and the resource 'saved SSH connection profile', which distinguishes it from list_profiles (list) and set_default_profile (set default). It is specific and directly tells what the tool does.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives, such as prerequisites (e.g., profile must exist) or implications of deletion. No usage context is given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_profilesA
List saved SSH connection profiles. Profiles never include passwords or verification codes.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses that profiles never include passwords, which is a key safety trait. However, it lacks other behavioral details such as whether it is read-only, if it requires an active connection, or the format of returned data. Without annotations, the description could be more transparent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the purpose and a critical safety detail. Every sentence earns its place; no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple list tool with no parameters and no output schema, the description is adequate but not complete. It does not specify what fields or properties are included in the profile list, nor any prerequisites for using the tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, and schema coverage is trivially 100%. According to the rubric, baseline for 0 parameters is 4. The description does not need to add parameter info, and its safety note adds some value beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool lists saved SSH connection profiles, using a specific verb ('list') and resource. It distinguishes from sibling tools like delete_profile or set_default_profile by noting that profiles never include passwords.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives such as delete_profile or set_default_profile. The description only states what it does, without any when-to-use or when-not-to-use context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_uploadsB
List upload requests and transfer statuses. Does not include file contents.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description bears full burden. It discloses that file contents are not included, which is a key behavioral trait. However, it omits any other details (e.g., authentication, rate limits, or system impact). Adequate for a simple list operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, zero wasted words. Front-loaded with the primary action, followed by a clarifying exclusion.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite zero parameters and no output schema, the description is concise but lacks differentiation from sibling tools and does not explain what 'transfer statuses' entails. Adequate but could be more complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Zero parameters, so schema coverage is 100%. The description adds no parameter info, but none is needed. Baseline 4 for no parameters.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it lists 'upload requests and transfer statuses' and notably excludes file contents, which distinguishes it from potential siblings that might include file data. However, it does not explicitly differentiate from sibling 'upload_status'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like 'upload_status' or 'request_upload'. The description implies usage for status viewing but lacks explicit context or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
request_uploadC
Create a local-file upload request for the user to confirm in the HTML page. File bytes are not sent through MCP or terminal history.
| Name | Required | Description | Default |
|---|---|---|---|
| method | No | scp | |
| checksum | No | Remote size is always verified after upload. Use sha256 for an additional checksum check. | none |
| if_exists | No | fail | |
| local_path | Yes | Local file path on the machine running this MCP server. | |
| remote_path | Yes | Destination path on the remote host. | |
| profile_name | Yes | Saved host/port/user profile name. Optional ProxyJump profiles are supported for uploads; full SSH command profiles are not. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must disclose all behavioral traits. It notes file bytes are not sent through MCP or terminal history, which is valuable, but omits critical details like the confirmation process, timeout behavior, error handling, and post-confirmation steps.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences, front-loaded with the primary action. Every word serves a purpose, efficiently communicating the tool's function and a key security caveat.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no annotations and no output schema, the description is too brief. It lacks information about the upload workflow, user confirmation steps, error states, and relationship to siblings like cancel_upload and upload_status, leaving the agent underinformed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 67%, covering basic parameter roles. The description adds useful context that profile_name supports ProxyJump for uploads, but does not explain enum options (method, if_exists) or other parameter semantics beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool creates a local-file upload request, specifying the verb and resource. It distinguishes from siblings like upload_status and cancel_upload by focusing on initiation, but could be more explicit about the confirmation step.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives. Siblings like upload_status and cancel_upload imply a multi-step process, but the description does not advise when to choose this tool over others or mention prerequisites.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
reset_cursorB
Reset the MCP client's local incremental read cursor.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description must carry the full burden of behavioral disclosure. It only states the action without detailing side effects, prerequisites, or the effect on client state. The description is minimal.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is front-loaded with the key action and resource. No extraneous information is present.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the lack of parameters and output schema, the description is too minimal. It does not explain the purpose of the cursor, when resetting is needed, or potential side effects. Sibling tools suggest a bridge context, but the description remains unclear for new users.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There are no parameters, and the schema coverage is 100%. The description does not add parameter-specific meaning, but the baseline for zero parameters is 4. The description could elaborate on the cursor's role but remains adequate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('reset') and resource ('local incremental read cursor'), making the purpose understandable. However, it does not differentiate from sibling tools that might also reset state, such as clear_history.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. Sibling tools like clear_history or cancel_upload could be related, but no comparisons or exclusions are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
runtime_config_statusB
Check the local Python or Conda runtime configuration used to start the bridge server.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description implies a read-only operation ('Check'), which is appropriate. However, no annotations are provided, and the description does not explicitly state that it is safe or non-destructive. For a simple check, this is adequate but minimal.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, clear sentence front-loads the action ('Check') and object ('runtime configuration'). No extraneous words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with no parameters and no output schema, the description provides the core purpose. However, it does not describe the return value format, leaving some ambiguity about what the agent will receive.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has no parameters with 100% coverage, so the description does not need to add parameter details. The description reinforces the purpose of the tool, which aligns with the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool checks the local Python or Conda runtime configuration used to start the bridge server. It uses a specific verb and resource, but does not explicitly distinguish from sibling tools like bridge_status, which might also report configuration.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives. The description only states what it does, without context on prerequisites or when to avoid it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
send_commandB
Send a non-secret shell command to the shared SSH terminal. Do not use for passwords or verification codes.
| Name | Required | Description | Default |
|---|---|---|---|
| command | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. It implies a non-destructive, non-secret operation but does not disclose side effects, output, error states, or any execution details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no wasted words. Front-loaded with purpose and critical constraint.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and a single parameter, the description still fails to explain return values, execution behavior, or error conditions, leaving the agent with limited information for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one parameter 'command' is described implicitly as a shell command. The description adds the meaning 'shell command' and the constraint 'non-secret', which goes beyond the schema's mere string type, but lacks format or length guidance.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('send'), the resource ('non-secret shell command to shared SSH terminal'), and includes an important exclusion ('do not use for passwords or verification codes'). It differentiates from secret-related commands but is brief.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides a negative guideline (do not use for secrets) but no explicit context on when to use this tool over siblings like 'control' or other terminal-related tools. Lacks positive usage scenarios.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
set_default_profileB
Set the default SSH connection profile used by start_bridge when no host, command, or profile is provided.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It only states what the tool does (sets a default profile) without disclosing side effects, permissions required, validation behavior (e.g., whether the profile must exist), or what happens to a previous default.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that front-loads the action. It is concise and to the point, but there is room to include more structure without becoming verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (single parameter, no output schema, no annotations), the description is inadequate. It does not explain return values, error scenarios, or prerequisites such as the profile needing to exist or being valid.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description does not add any meaning to the 'name' parameter beyond its type. It does not specify whether the name must correspond to an existing profile or any constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Set' and the resource 'default SSH connection profile used by start_bridge'. It specifies the condition under which this profile is used (when no host, command, or profile is provided), which distinguishes it from sibling tools like delete_profile or list_profiles.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage: to set a default profile for start_bridge. It provides context on when the default applies, but lacks explicit guidance on when to use this versus alternatives or when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
set_runtime_configC
Persist the local Python or Conda runtime used to start server.py. This stores no SSH passwords or secrets.
| Name | Required | Description | Default |
|---|---|---|---|
| mode | Yes | ||
| conda_env | No | Conda environment name when mode=conda. | |
| python_path | No | Python executable path when mode=python. | |
| conda_executable | No | Conda executable path or name when mode=conda. Defaults to conda. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description must disclose behavioral aspects. It reassures that no SSH passwords or secrets are stored, which is good. However, it does not mention whether it overwrites existing config, requires a restart, or persists across sessions. These are critical for a mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with two sentences. The first sentence clearly states the purpose, and the second adds a security reassurance. No unnecessary text. It is well-structured and front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity of a persistence operation and the absence of an output schema, the description is incomplete. It does not describe return values, error conditions, or the effect on the system state. The schema provides some parameter descriptions, but the tool's overall behavior is under-specified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 75%, but the tool description adds minimal semantic value beyond the schema. It mentions 'Python or Conda runtime' but does not explain the mode enum values or when to use each parameter. The security note about not storing secrets is peripheral to parameter usage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it persists the local Python or Conda runtime used to start server.py. The verb 'persist' indicates a write operation, and it distinguishes from the sibling runtime_config_status which likely reads the config. However, it could be more explicit about setting/updating the config.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives like runtime_config_status. It does not mention prerequisites, when persistence is needed, or how it interacts with other tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
snapshotA
Read terminal output. Defaults to incremental compact lines and advances the MCP cursor.
| Name | Required | Description | Default |
|---|---|---|---|
| full | No | Read recent history from the beginning of retained history instead of the saved MCP cursor. | |
| peek | No | Read without advancing the saved MCP cursor. | |
| after | No | Explicit seq cursor to read after. | |
| limit | No | Line limit by default, or event limit when events=true. | |
| events | No | Return raw event chunks instead of compact lines. | |
| no_compact | No | Disable carriage-return progress compaction. | |
| event_limit | No | Maximum raw events to inspect when building compact lines. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description reveals key behaviors: default incremental compact lines, cursor advancement. No annotations exist, so the description carries the transparency burden. It adequately covers cursor advancement and compaction, but could disclose more about side effects of reading (e.g., cursor mutation).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences that front-load the core purpose. No wasted words; every part adds information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 7 parameters and no output schema, the description could better clarify return format (e.g., lines vs events). It is adequate but leaves the agent guessing about output structure.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% with descriptions for each parameter. The tool description adds context by linking defaults (compact lines, cursor advancement) to the relevant parameters (peek, full, events, no_compact). This ties the schema together.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it reads terminal output, defaulting to compact lines and advancing the cursor. This differentiates it from sibling tools like reset_cursor, clear_history, or send_command, which serve different purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit when-to-use or when-not-to-use guidance is provided. Since there are no other read tools among siblings, usage is implied but not clarified.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
start_bridgeC
Start the local Web/PTY SSH bridge. Passwords must still be entered by the user in the HTML page.
| Name | Required | Description | Default |
|---|---|---|---|
| port | No | ||
| profile_name | No | Saved profile name. If omitted, the default profile is used. | |
| no_auto_start | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so the description must fully disclose behavior. It mentions password entry requirement, but lacks details on destructiveness, authentication needs, or side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two efficient sentences with no redundancy. Could be more informative without being verbose, but it is concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and 3 params, the description lacks behavioral details and parameter explanations, making it incomplete for an agent to use correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 33% (only profile_name described). The description does not add meaning to 'port' or 'no_auto_start', failing to compensate for the gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Start' and identifies the resource as 'local Web/PTY SSH bridge', clearly indicating the tool's action. It distinguishes from sibling tools like 'stop_bridge'.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives like 'start_config_server' or prerequisites. The description only states what it does, not usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
start_config_serverA
Start only the local HTML configuration page, without requiring or starting an SSH profile.
| Name | Required | Description | Default |
|---|---|---|---|
| port | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It discloses the core behavior (starts config page, no SSH) but omits side effects, idempotency, or conflicts. Adequate for a simple tool but lacks depth.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that front-loads the action and key distinction. Every word earns its place with no redundancy, fitting the scope of a simple tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity and sibling context, the description covers the main purpose and contrast. However, it omits the port parameter, which is relevant for usage. Overall, minimally complete but not comprehensive.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, yet the description fails to explain the port parameter. Baseline for low coverage requires compensation; the description adds no value beyond the schema for the parameter, leaving its purpose and format unspecified.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool starts only the local HTML configuration page, and distinguishes it from SSH profile tools by explicitly noting it does not require or start an SSH profile. This differentiates it from siblings like start_bridge.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use (want config page without SSH) and when not (need SSH profile). It contrasts with the implied alternative of starting an SSH profile, but does not explicitly name sibling tools or provide detailed usage context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
stop_bridgeB
Stop the SSH session and optionally terminate the bridge process started by start_bridge.
| Name | Required | Description | Default |
|---|---|---|---|
| stop_ssh | No | ||
| kill_process | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without annotations, the description carries full behavioral disclosure burden. It mentions stopping SSH and optionally terminating the process, referencing parameters, but does not explain parameter interactions or consequences (e.g., what happens if stop_ssh is false or kill_process is false). Lack of clarity on destructive nature.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no wasted words. It could be slightly improved by separating parameter explanations, but it remains efficient and front-loads the primary action.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 2 parameters, no output schema, and no annotations, the description is insufficient. It omits parameter semantics, return behavior, and side effects, leaving the agent without enough context to call the tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so parameters are undocumented in the schema. The description only hints at parameter roles via 'optionally terminate the bridge process', failing to explicitly explain what 'stop_ssh' and 'kill_process' control individually. This leaves ambiguity for an agent.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool stops the SSH session and optionally terminates the bridge process, referencing the sibling 'start_bridge' for context. The verb 'stop' and resource (SSH session/bridge process) are specific, making the purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage after starting a bridge with start_bridge, but provides no explicit guidance on when not to use it or what alternatives exist (e.g., bridge_status for checking state, cancel_upload for other cancellations). The guidance is minimal.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
upload_statusC
Get one upload request or transfer status by upload_id.
| Name | Required | Description | Default |
|---|---|---|---|
| upload_id | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description bears full burden. It only states 'Get...status' without disclosing read-only nature, error behavior, or response structure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, front-loaded, no redundant words. However, it is under-specified for the lack of other cues.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple retrieval tool with one parameter, the description is minimally adequate. It lacks behavioral details like success/failure indicators, but given low complexity, it partially suffices.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% (no parameter description). The description mentions 'by upload_id' but adds no meaning about the format or constraints beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Get' and the resource 'upload request or transfer status', distinguishing it from siblings like list_uploads. However, the phrase 'one upload request or transfer status' is slightly ambiguous about whether it handles two types.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus siblings. The description does not mention alternatives or prerequisites, leaving the agent to infer context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
18 tool updates
v0.1.0- First observed
bridge_status - First observed
cancel_upload - First observed
clear_history - First observed
control - First observed
delete_profile - First observed
list_profiles - First observed
list_uploads - First observed
request_upload - First observed
reset_cursor - First observed
runtime_config_status - First observed
send_command - First observed
set_default_profile - First observed
set_runtime_config - First observed
snapshot - First observed
start_bridge - First observed
start_config_server - First observed
stop_bridge - First observed
upload_status
TDQS
Every tool has a clearly distinct purpose, with descriptions that precisely differentiate between similar concepts like control vs send_command and snapshot vs clear_history.
Names mix verb_noun (e.g., cancel_upload, delete_profile), noun_noun (e.g., bridge_status, runtime_config_status), and single words (control, snapshot), lacking a consistent pattern.
18 tools cover bridge management, session control, profile management, uploads, and configuration without being excessive for the domain.
Covers most CRUD/lifecycle operations, but notably missing a create_profile tool for managing SSH connection profiles.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Shared control plane for AI coding agents — tasks, memory, decisions, file locks. 12 tools.
MCP-first control plane for ProAgentStore agents and private instances.
Operate Linux, macOS and Windows from your LLM. Every action runs through an auditable allowlist.
Control plane for autonomous software labor. Agents claim objectives over MCP with audit trail.
Related MCP Servers
- AlicenseNot gradedqualityCmaintenanceTerminal-first SSH access for MCP clients and AI agents, enabling interactive remote sessions, file uploads, and stateful workflows.111MIT
- AlicenseAqualityBmaintenanceSSH orchestration MCP server for coding agents, enabling persistent bash sessions, hash-protected remote file editing, SFTP transfers, SSH tunnels, and multi-host orchestration with connection reuse across tools.143Apache 2.0
- AlicenseNot gradedqualityCmaintenanceAI-native SSH orchestration server enabling Claude or any MCP agent to execute commands, manage files, tunnels, and fleet operations across multiple hosts with security policies and audit logs.2Apache 2.0
- FlicenseNot gradedqualityDmaintenanceEnables AI agents to securely access encrypted secrets (SSH keys, API tokens, passwords) with real-time user approval via Passkey, and supports SSH remote execution through the MCP protocol.-
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/NullPointerChef/codex-ssh-terminal-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server