What can you do with this server?

The mcp-audit server is a security and observability proxy wrapping an upstream filesystem MCP server. It provides two layers of functionality: Filesystem Operations (via proxied server) * Read files: read_text_file (full or first/last N lines), read_media_file (images/audio as base64), read_multiple_files (batch), read_file (deprecated) * Write/Edit: write_file to create or overwrite; edit_file for line-based edits with diff output and dry-run support * Directory operations: create_directory, list_directory, list_directory_with_sizes (sortable), directory_tree (recursive JSON tree), list_allowed_directories * File management: move_file to move or rename; search_files with glob patterns; get_file_info for size, timestamps, and permissions Security & Observability (mcp-audit proxy layer) * Audit trails: All tool calls, resource reads, and JSON-RPC methods are logged as signed JSONL or SQLite entries * Data redaction: Sensitive fields are automatically redacted before storage * Policy enforcement: Synchronous allow/deny policies can block specific tools (e.g., destructive operations), with per-tool rate limiting * Monitoring: A local read-only dashboard shows recent audit entries, top tools, and error rates; Prometheus metrics are exposed for external monitoring

mcp-audit

by P4ST4S

Overview Schema Related Servers Score Discussions

Hybrid

mcp-audit

codecov mcp-audit MCP server License Status GitHub Discussions

A drop-in security and observability proxy for MCP servers. mcp-audit sits between an MCP client and any upstream MCP server to produce signed audit trails, redact sensitive payloads, enforce allow/deny policies and per-tool rate limits, and expose a local read-only dashboard.

For a contributor-oriented map of the runtime, package boundaries, concurrency model, and design invariants, see ARCHITECTURE.md.

Why mcp-audit?

The MCP 2026 roadmap calls out enterprise needs around audit trails, gateway patterns, and operational visibility. mcp-audit fills that gap as a deployable sidecar or local wrapper: it sits between any MCP client and server, preserves protocol traffic, and records signed audit entries for tool calls, resource reads, prompt requests, and all other JSON-RPC methods.

+-------------+    JSON-RPC / MCP     +-----------+      JSON-RPC / MCP     +-------------+
| MCP client  | <-------------------> | mcp-audit | <---------------------> | MCP server  |
+-------------+                       +-----------+                         +-------------+
                                            |
                                            v
                                JSONL or SQLite audit log
                                            |
                                            v
                                   Read-only dashboard

Related MCP server: GitHub MCP Server Plus

What This Is / Is Not

mcp-audit is not a domain-specific MCP server. It is a transparent security and observability proxy that wraps any MCP server and audits the JSON-RPC traffic passing through it.

Directories may show the tools exposed by the upstream server, not tools implemented by mcp-audit itself.

Supported Transports

stdio for local MCP clients such as Claude Desktop
http for MCP servers exposed over HTTP

HTTP upstreams can use custom CA bundles, TLS server name overrides, and optional mTLS client certificates. Upstream retries are disabled by default and only apply to conservative, idempotent JSON-RPC methods when enabled; tools/call is not retried.

Use Cases

Audit tool calls made by AI agents in regulated environments
Detect unexpected or dangerous MCP tool usage
Keep signed JSONL or SQLite logs for incident review
Redact sensitive fields before storing requests and responses
Block disallowed tools and apply per-tool rate limits without modifying the upstream MCP server

Demo

mcp-audit demo

Install

For detailed platform-specific instructions and troubleshooting, see INSTALL.md.

Download the latest prebuilt binary and run:

# Linux/macOS: resolve latest, download, verify it starts
version=$(curl -fsSL https://api.github.com/repos/P4ST4S/mcp-audit/releases/latest \
  | grep '"tag_name"' | head -n1 | cut -d'"' -f4 | sed 's/^v//')
os=$(uname | tr '[:upper:]' '[:lower:]')
arch=$(uname -m); [ "$arch" = "x86_64" ] && arch=amd64 || arch=arm64
base="https://github.com/P4ST4S/mcp-audit/releases/download/v${version}"
archive="mcp-audit_${version}_${os}_${arch}.tar.gz"
curl -L -o "${archive}" "${base}/${archive}"
tar -xzf "${archive}"
./mcp-audit --version

Run with Docker:

docker run --rm ghcr.io/p4st4s/mcp-audit:latest --version

Install from source with Go:

go install github.com/P4ST4S/mcp-audit/cmd/mcp-audit@latest

To pin a specific release for reproducible installs, see INSTALL.md.

Quick Start

Run in stdio mode:

AUDIT_SECRET="$(openssl rand -hex 32)" \
mcp-audit --transport stdio --upstream "npx @modelcontextprotocol/server-filesystem /tmp"

On Windows PowerShell, generate the secret and set it as an environment variable:

$env:AUDIT_SECRET = -join ((1..32) | ForEach-Object { '{0:x2}' -f (Get-Random -Max 256) })
.\mcp-audit.exe --transport stdio --upstream "npx @modelcontextprotocol/server-filesystem C:\Temp"

Run in HTTP mode:

mcp-audit --transport http --upstream http://localhost:8080 --port 4422

Run with Docker Compose:

docker compose up --build

The dashboard is available at http://127.0.0.1:9090 by default. Prometheus metrics are available at http://localhost:9091/metrics by default.

Examples

Configuration

mcp-audit loads config.yaml from the current directory by default. CLI flags override config values, and AUDIT_SECRET overrides audit.secret.

Key	Default	Description
`proxy.transport`	`stdio`	Proxy transport: `stdio` or `http`.
`proxy.upstream`	required	Stdio command or HTTP upstream URL.
`proxy.port`	`4422`	HTTP listen port.
`proxy.upstream_timeout_ms`	`30000`	HTTP upstream request timeout in milliseconds.
`proxy.forward_headers`	empty	Request headers allowed to bypass the default upstream strip list. Use `["Authorization"]` only when the upstream MCP HTTP server requires bearer-token auth.
`proxy.tls.ca_file`	empty	Optional CA bundle used to verify an HTTPS upstream MCP server.
`proxy.tls.server_name`	empty	Optional TLS server name override for the upstream MCP server.
`proxy.tls.insecure_skip_verify`	`false`	Skip upstream TLS certificate verification. Intended only for local testing.
`proxy.tls.client_cert_file`	empty	Optional client certificate for upstream mTLS. Must be configured with `proxy.tls.client_key_file`.
`proxy.tls.client_key_file`	empty	Optional client key for upstream mTLS. Must be configured with `proxy.tls.client_cert_file`.
`proxy.retry.max_retries`	`0`	Maximum conservative retry attempts for safe HTTP upstream requests. Off by default.
`proxy.retry.initial_interval_ms`	`200`	Initial upstream retry backoff.
`proxy.retry.max_interval_ms`	`2000`	Maximum upstream retry backoff.
`proxy.client_id`	`claude-desktop`	Client identifier written to audit entries.
`proxy.server_id`	`filesystem`	Server identifier written to audit entries.
`audit.storage`	`jsonl`	Storage backend: `jsonl` or `sqlite`.
`audit.path`	`./audit.jsonl`	JSONL audit log path.
`audit.sqlite_path`	`./audit.db`	SQLite database path.
`audit.sign`	`true`	Enable HMAC-SHA256 signatures when a secret is set.
`audit.secret`	empty	HMAC secret. Prefer `AUDIT_SECRET`.
`audit.async.enabled`	`false`	Enable asynchronous batched audit writes through a bounded ring buffer.
`audit.async.queue_size`	`4096`	Maximum queued audit entries before backpressure blocks writers.
`audit.async.batch_size`	`128`	Maximum entries written per storage batch.
`audit.async.flush_interval_ms`	`1000`	Maximum time before a partial batch is flushed.
`audit.rotation.max_size_bytes`	`0`	Maximum active JSONL file size before archive rotation. `0` disables built-in rotation.
`audit.rotation.max_files`	`0`	Maximum number of rotated JSONL archives to keep. `0` disables retention.
`audit.rotation.interval`	empty	Optional time-based JSONL rotation interval: `hourly` or `daily`. Empty disables time-based rotation.
`audit.rotation.max_age_days`	`0`	Delete JSONL archives whose filename rotation timestamp is older than this many days. `0` disables age retention.
`middleware.rate_limit.enabled`	`true`	Enable per-client, per-tool token buckets.
`middleware.rate_limit.requests_per_minute`	`60`	Allowed requests per minute per `(client_id, tool_name)`.
`middleware.redact.enabled`	`true`	Enable JSON key-based PII redaction.
`middleware.redact.patterns`	sensitive keys	Case-insensitive key fragments to redact.
`policy.enabled`	`false`	Enable synchronous allow/deny policy checks for `tools/call`.
`policy.default_action`	`allow`	Fallback action when no policy rule matches: `allow` or `deny`.
`policy.rules`	empty	Ordered first-match allow/deny rules for tool calls.
`dashboard.enabled`	`true`	Serve the dashboard.
`dashboard.bind_address`	`127.0.0.1`	Dashboard listen address. Set explicitly, for example to `0.0.0.0`, only when the dashboard is protected by network controls or auth.
`dashboard.port`	`9090`	Dashboard listen port.
`dashboard.auth.token`	empty	Optional bearer token required as `Authorization: Bearer <token>` for dashboard HTML and API requests.
`metrics.enabled`	`true`	Serve Prometheus metrics on a separate HTTP endpoint.
`metrics.port`	`9091`	Metrics listen port.
`metrics.path`	`/metrics`	Metrics HTTP path.
`metrics.include_go_metrics`	`true`	Include Go runtime metrics.
`metrics.include_process_metrics`	`true`	Include process metrics.
`metrics.tool_labels`	`true`	Include `tool_name` and `client_id` labels for tool-level metrics. Disable to minimize label cardinality.
`otel.enabled`	`false`	Export `tools/call` audit entries as OTLP/HTTP JSON spans.
`otel.endpoint`	`http://localhost:4318`	OTLP HTTP endpoint base URL. `/v1/traces` is appended automatically.
`otel.service_name`	`mcp-audit`	OpenTelemetry `service.name` resource attribute.
`otel.headers`	empty	Additional OTLP HTTP headers, for example `Authorization` or API key headers.
`otel.tls.ca_file`	empty	Optional CA bundle used to verify the OTLP endpoint.
`otel.tls.server_name`	empty	Optional TLS server name override.
`otel.tls.insecure_skip_verify`	`false`	Skip OTLP TLS certificate verification. Intended only for local testing.
`otel.retry.max_retries`	`3`	Maximum OTLP retry attempts after a failed export request.
`otel.retry.initial_interval_ms`	`200`	Initial OTLP retry backoff.
`otel.retry.max_interval_ms`	`2000`	Maximum OTLP retry backoff.
`otel.queue_size`	`1024`	Maximum queued audit entries before trace exports are dropped.
`otel.batch_size`	`64`	Maximum spans per OTLP export request.
`otel.flush_interval_ms`	`1000`	Maximum time before a partial OTLP batch is exported.
`otel.timeout_ms`	`5000`	OTLP HTTP request timeout.

By default, mcp-audit strips hop-by-hop request headers and Authorization before forwarding HTTP requests to the upstream. To pass a bearer token to a trusted authenticated upstream, opt in explicitly:

proxy:
  forward_headers:
    - Authorization

Security note: forwarded headers, including secrets like bearer tokens, are transmitted verbatim to the upstream server. Only enable this if you control or trust the upstream MCP server. Authorization is the only sensitive header that can be opt-in forwarded because some MCP HTTP servers require it for upstream authentication. Cookie, Set-Cookie, and Proxy-Authorization are always rejected: they represent state destined for other components such as browser sessions or proxy chains and have no legitimate use in MCP request forwarding. If an existing deployment relied on implicit Authorization forwarding, add the config above.

JSONL rotation is disabled by default and supports size-based and UTC time-based triggers. Rotated archives use UTC timestamps such as audit.jsonl.20260610T214605Z; if multiple rotations happen in the same second, numeric suffixes are added. The archive timestamp reflects the wall-clock time of the rotation event, not the cutoff that was crossed. Time-based rotation is append-driven: mcp-audit does not start a background timer, so if no writes occur for several days, the active file is not rotated until the next append after the cutoff. Missed cutoffs are not caught up; the next append creates at most one archive.

audit:
  storage: jsonl
  rotation:
    max_size_bytes: 104857600
    interval: daily
    max_files: 10
    max_age_days: 30

max_age_days uses the rotation timestamp encoded in the archive filename. This means age since rotation, not the age of the oldest entry inside the archive. Age retention runs before max_files retention. Compression and SQLite archival are not part of this release.

CLI flags:

--transport    stdio | http
--upstream     upstream server command or URL
--port         proxy port for http mode
--upstream-timeout upstream HTTP request timeout in milliseconds
--config       path to config.yaml
--storage      jsonl | sqlite
--no-dashboard disable the web dashboard
--no-metrics   disable Prometheus metrics
--version      print version and exit
--log-level    debug | info | warn | error

Claude Desktop

Configure Claude Desktop to spawn mcp-audit instead of the upstream MCP server:

{
  "mcpServers": {
    "filesystem-audited": {
      "command": "mcp-audit",
      "args": [
        "--transport",
        "stdio",
        "--upstream",
        "npx @modelcontextprotocol/server-filesystem /tmp"
      ],
      "env": {
        "AUDIT_SECRET": "replace-with-a-long-random-secret"
      }
    }
  }
}

Dashboard

The dashboard shows recent entries, filters, expandable request/result JSON, top tools, calls today, and error rate. It refreshes every five seconds.

By default the dashboard listens only on 127.0.0.1:9090. To expose it on another interface, configure dashboard.bind_address explicitly and enable authentication or place it behind a trusted access proxy.

dashboard:
  enabled: true
  bind_address: 127.0.0.1
  port: 9090
  auth:
    token: "replace-with-a-long-random-token"

When dashboard.auth.token is configured, requests to /, /api/entries, and /api/stats must include:

Authorization: Bearer replace-with-a-long-random-token

Missing or invalid credentials return 401 Unauthorized with WWW-Authenticate: Bearer realm="mcp-audit-dashboard". Repeated failed authentication attempts from the same remote address are throttled with 429 Too Many Requests.

Dashboard JSON API responses include Cache-Control: no-store so intermediaries and browsers do not retain audit payloads.

Prometheus Metrics

mcp-audit exposes Prometheus metrics on a separate endpoint so platform teams can scrape operational data without exposing the dashboard.

scrape_configs:
  - job_name: mcp-audit
    static_configs:
      - targets: ["localhost:9091"]

Application metrics use the mcp_audit_ prefix and avoid unbounded labels. Tool-level labels can be disabled with metrics.tool_labels: false for stricter cardinality control. Policy decisions are exposed as mcp_audit_policy_decisions_total{action="allow|deny"}.

For a ready-made Prometheus + Grafana stack, see examples/docker-compose-observability.

Policy Engine

mcp-audit can enforce synchronous allow/deny rules before a tools/call reaches the upstream MCP server. Denied calls return a JSON-RPC error and are still written to the audit log.

policy:
  enabled: true
  default_action: allow
  rules:
    - action: deny
      client_id: claude-desktop
      server_id: filesystem
      tool_name: delete_file
      reason: "Destructive filesystem operations are blocked"

Rules are evaluated in order. Empty fields and * match any value, so default_action: deny can be used with explicit allow rules for stricter deployments.

OpenTelemetry

mcp-audit can export tools/call audit entries as OTLP/HTTP JSON spans to Jaeger, Tempo, Honeycomb, or any OTLP-compatible collector.

otel:
  enabled: true
  endpoint: "http://localhost:4318"
  service_name: "mcp-audit"
  headers:
    Authorization: "Bearer your-token"
  timeout_ms: 5000
  retry:
    max_retries: 3
    initial_interval_ms: 200
    max_interval_ms: 2000

The exporter uses current OpenTelemetry MCP and GenAI semantic conventions where possible, including mcp.method.name, jsonrpc.request.id, gen_ai.operation.name, gen_ai.tool.name, network.transport, network.protocol.name, rpc.response.status_code, and error.type. Project-specific attributes are kept link-oriented, such as mcp_audit.entry_id, mcp_audit.direction, mcp_audit.client_id, mcp_audit.server_id, mcp_audit.storage, and mcp_audit.signature.present.

Request params and tool results are not exported to spans by default. The signed JSONL or SQLite audit row remains the evidence artifact; OTLP provides correlation, latency, and operational visibility.

Exporter health is visible through Prometheus metrics under the mcp_audit_otel_ prefix, including export requests, span outcomes, dropped spans, queue depth, and queue capacity. Temporary OTLP failures are retried with bounded exponential backoff; Retry-After is honored for retryable responses up to otel.retry.max_interval_ms.

Audit Entries

Each stored entry includes a ULID, timestamp, direction, transport, JSON-RPC method, tool name when present, redacted params/result, JSON-RPC error when present, duration, client/server identifiers, and an optional HMAC-SHA256 signature.

Example JSONL entry:

{
  "id": "01HY8G6Y8S6W9K6ZD7VJ4Q8X4R",
  "timestamp": "2026-05-25T12:34:56Z",
  "direction": "client_to_server",
  "transport": "stdio",
  "method": "tools/call",
  "tool_name": "read_file",
  "params": {
    "name": "read_file",
    "arguments": {
      "path": "/tmp/example.txt",
      "token": "[REDACTED]"
    }
  },
  "duration_ms": 18,
  "client_id": "claude-desktop",
  "server_id": "filesystem",
  "signature": "hmac-sha256:..."
}

The signature covers:

id + timestamp + method + tool_name + raw_params

Roadmap

SIEM-friendly exports
OTLP compression and trace context propagation

Contributing

Keep changes small, run go build ./... and go vet ./..., and prefer standard library behavior over new dependencies. Stability guarantees are documented in STABILITY.md.

See CONTRIBUTING.md for setup, PR expectations, and project principles. See CHANGELOG.md for release history.

Community

Discussions: questions, ideas, and design conversations
Issues: bug reports and concrete feature requests
Security: see SECURITY.md for the private vulnerability reporting process

License

Apache-2.0. See LICENSE.

Available Tools

14 tools

create_directoryCreate DirectoryA

Idempotent

Create a new directory or ensure a directory exists. Can create multiple nested directories in one operation. If the directory already exists, this operation will succeed silently. Perfect for setting up directory structures for projects or ensuring required paths exist. Only works within allowed directories.

ParametersJSON Schema

Name	Required	Description	Default
`path`	Yes

Output Schema

ParametersJSON Schema

Name	Required	Description
`content`	Yes

TDQS

A4.5/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds context beyond annotations: nested directory creation, silent success if exists, and restriction to allowed directories. Annotations already indicate idempotency and non-destructive behavior; description reinforces and expands.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is four sentences, each adding value: purpose, capability, behavior, use case, constraint. No redundant or irrelevant information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's simplicity (one parameter, annotations present, output schema exists), the description covers purpose, behavior, constraints, and use cases adequately. No major gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The sole parameter 'path' has no schema description coverage (0%). The description mentions 'only works within allowed directories' but does not specify path format, allowed directories list, or how to specify nested paths. Partial compensation but insufficient detail.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action: 'Create a new directory or ensure a directory exists.' It specifies the ability to create nested directories and the silent success on existing directories, distinguishing it from siblings like write_file or move_file.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives usage scenarios ('Perfect for setting up directory structures for projects or ensuring required paths exist'), implying when to use. It does not explicitly mention when not to use or alternatives, but the context is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

directory_treeDirectory TreeA

Read-only

Get a recursive tree view of files and directories as a JSON structure. Each entry includes 'name', 'type' (file/directory), and 'children' for directories. Files have no children array, while directories always have a children array (which may be empty). The output is formatted with 2-space indentation for readability. Only works within allowed directories.

ParametersJSON Schema

Name	Required	Description	Default
`path`	Yes
`excludePatterns`	No

Output Schema

ParametersJSON Schema

Name	Required	Description
`content`	Yes

TDQS

A3.7/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations provide readOnlyHint; description adds access constraint ('Only works within allowed directories') and output structure details (children arrays, indentation). No performance or depth limits mentioned.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four sentences, each adding value: purpose, output detail, structure specifics, constraint. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Output schema covers return values, but parameter semantics are absent. For a moderate-complexity tool with two parameters, description is mostly complete except for parameter details.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0% and description does not explain the two parameters (path, excludePatterns) beyond what the schema already provides.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states 'Get a recursive tree view' with specific verb and resource. It distinguishes from sibling tools like list_directory (flat) and list_directory_with_sizes, and details output structure.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Implies usage for recursive tree view but no explicit when-to-use, when-not-to-use, or alternatives among 14 sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

edit_fileEdit FileA

Destructive

Make line-based edits to a text file. Each edit replaces exact line sequences with new content. Returns a git-style diff showing the changes made. Only works within allowed directories.

ParametersJSON Schema

Name	Required	Description
`path`	Yes
`edits`	Yes
`dryRun`	No	Preview changes using git-style diff format

Output Schema

ParametersJSON Schema

Name	Required	Description
`content`	Yes

TDQS

A3.8/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate destructive behavior (destructiveHint=true). The description adds valuable behavioral details: line-based edits replacing exact sequences, returns a git-style diff, and directory restriction. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise with two sentences, front-loading the purpose and then adding key details. Every sentence adds value without redundancy.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Basic aspects are covered (purpose, behavior, range restriction, output format), but missing common contextual information like error handling (e.g., what happens if oldText not found) or prerequisite knowledge. The existence of an output schema partially mitigates this.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 33% (only dryRun has a description). The tool description adds no additional parameter explanation beyond the schema, failing to compensate for the low coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose with a specific verb 'edit' and resource 'text file.' It distinguishes itself from sibling tools like write_file (which overwrites) and read_file (which reads).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description mentions a restriction (works only within allowed directories) but does not explicitly guide when to use this tool over alternatives like write_file for partial edits. No exclusion or comparison context provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_file_infoGet File InfoA

Read-only

Retrieve detailed metadata about a file or directory. Returns comprehensive information including size, creation time, last modified time, permissions, and type. This tool is perfect for understanding file characteristics without reading the actual content. Only works within allowed directories.

ParametersJSON Schema

Name	Required	Description	Default
`path`	Yes

Output Schema

ParametersJSON Schema

Name	Required	Description
`content`	Yes

TDQS

A4.1/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, so no need to repeat. Description adds the allowed directories constraint, which is useful behavioral context beyond what annotations provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three concise sentences, each adding value. No redundant or misleading information. Front-loaded with the primary action.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given low complexity (1 param, readonly, output schema exists), description covers metadata details and directory restriction. Missing error handling for nonexistent paths, but still adequate for a simple tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description should explain the path parameter. It only implicitly indicates it's a file or directory path, missing specifics like format or constraints. Minimal compensation for the schema gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states it retrieves file/directory metadata and lists specific attributes (size, creation time, etc.). Distinguishes from sibling tools like read_file by noting it does not read content.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says when to use: for understanding file characteristics without reading content. Includes constraint 'Only works within allowed directories'. Lacks explicit when-not-to-use or named alternatives, but context is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_allowed_directoriesList Allowed DirectoriesA

Read-only

Returns the list of directories that this server is allowed to access. Subdirectories within these allowed directories are also accessible. Use this to understand which directories and their nested paths are available before trying to access files.

ParametersJSON Schema

Name	Required	Description	Default
No parameters

Output Schema

ParametersJSON Schema

Name	Required	Description
`content`	Yes

TDQS

A4.5/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint: true, and the description adds that subdirectories are also accessible, giving useful behavioral context beyond the annotation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences, no wasted words, front-loaded with the core purpose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a parameter-less, read-only tool with an output schema, the description fully explains what is returned and why to use it.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There are 0 parameters, so baseline is 4. The description does not need to add param info, and schema coverage is 100%.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'returns' and the resource 'list of directories that this server is allowed to access', and distinguishes from siblings like 'list_directory' by focusing on allowed directories.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description advises use 'before trying to access files' to understand available directories, providing clear context. It lacks explicit when-not-to-use or alternatives but is sufficiently directive.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_directoryList DirectoryA

Read-only

Get a detailed listing of all files and directories in a specified path. Results clearly distinguish between files and directories with [FILE] and [DIR] prefixes. This tool is essential for understanding directory structure and finding specific files within a directory. Only works within allowed directories.

ParametersJSON Schema

Name	Required	Description	Default
`path`	Yes

Output Schema

ParametersJSON Schema

Name	Required	Description
`content`	Yes

TDQS

A3.9/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations provide readOnlyHint=true, which the description does not contradict. The description adds valuable behavioral context: it only works within allowed directories and outputs results with distinguishing prefixes. This goes beyond what annotations alone provide.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is three sentences long, each serving a distinct purpose: purpose, output format, and constraint. No redundant or unnecessary information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the output schema exists, return values need not be explained, but the description covers output format. However, it does not state whether the listing is recursive or just immediate children (a key distinction from directory_tree) or if hidden files are included. More context would improve completeness.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single 'path' parameter has no description in the schema (0% coverage). The description mentions 'specified path' and adds the constraint of allowed directories, but does not clarify the expected format (e.g., absolute vs relative, trailing slash) or whether glob patterns are accepted.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('Get a detailed listing'), the resource ('files and directories'), and the scope ('in a specified path'). It also specifies the output format with [FILE] and [DIR] prefixes, distinguishing it from sibling tools like directory_tree or list_directory_with_sizes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description indicates the tool is 'essential for understanding directory structure and finding specific files,' giving a general use case. However, it does not explicitly guide when to use this tool over siblings like directory_tree or list_directory_with_sizes, nor does it provide exclusion criteria.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

list_directory_with_sizesList Directory with SizesA

Read-only

Get a detailed listing of all files and directories in a specified path, including sizes. Results clearly distinguish between files and directories with [FILE] and [DIR] prefixes. This tool is useful for understanding directory structure and finding specific files within a directory. Only works within allowed directories.

ParametersJSON Schema

Name	Required	Description	Default
`path`	Yes
`sortBy`	No	Sort entries by name or size	name

Output Schema

ParametersJSON Schema

Name	Required	Description
`content`	Yes

TDQS

A4.2/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond annotations (readOnlyHint: true), the description adds behavioral details such as output format with [FILE] and [DIR] prefixes and scope restriction to allowed directories. No contradictions with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise with four sentences, front-loaded with the main action. No redundant information, every sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers purpose, usage context, behavioral traits, and scope. With an output schema present, it does not need to detail return values. Minor gaps in error handling or prerequisites, but sufficient for a simple listing tool.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 50% (only sortBy has a description). The tool description adds context for the 'path' parameter by noting the scope, but does not fully compensate for the missing schema description. Hence a baseline score of 3.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states that the tool gets a detailed listing of files and directories including sizes, and distinguishes from sibling 'list_directory' by mentioning detailed listing and size information. It uses specific verbs and resource names.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides context for when to use the tool (understanding directory structure, finding specific files) and notes a constraint (only works within allowed directories). However, it does not explicitly state when not to use it or mention alternatives among siblings.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

move_fileMove FileA

Move or rename files and directories. Can move files between directories and rename them in a single operation. If the destination exists, the operation will fail. Works across different directories and can be used for simple renaming within the same directory. Both source and destination must be within allowed directories.

ParametersJSON Schema

Name	Required	Description	Default
`source`	Yes
`destination`	Yes

Output Schema

ParametersJSON Schema

Name	Required	Description
`content`	Yes

TDQS

A4.4/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Describes failure condition on existing destination, which is critical behavioral information. Annotations are neutral, so description adds useful context beyond them.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences, no redundancy, front-loaded with primary action. Every sentence adds value.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Covers essential behavior and constraints. Output schema exists but not detailed; however, the tool is straightforward, so the description is sufficiently complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has no descriptions for parameters (0% coverage), but the tool description clarifies that both source and destination are paths and must be within allowed directories, adding meaning.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Clearly states it moves/renames files and directories, with a single operation. Differentiates from siblings like create_directory, write_file, etc., which serve different purposes.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explains key behaviors: fails if destination exists, works across directories, and sources must be within allowed directories. Does not explicitly contrast with alternatives but implies correct usage.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

read_fileRead File (Deprecated)A

Read-only

Read the complete contents of a file as text. DEPRECATED: Use read_text_file instead.

ParametersJSON Schema

Name	Required	Description
`path`	Yes
`tail`	No	If provided, returns only the last N lines of the file
`head`	No	If provided, returns only the first N lines of the file

Output Schema

ParametersJSON Schema

Name	Required	Description
`content`	Yes

TDQS

A3.8/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate readOnlyHint=true, and the description adds that it reads the file 'as text' and supports partial reading via head/tail parameters. This goes beyond the annotations, though it omits details about output format or size limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is extremely concise: two sentences, front-loaded with the core purpose, and immediately followed by the deprecation notice. No wasted words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool is deprecated and has a recommended replacement (read_text_file), the description suffices. The output schema exists to document return values, so no need to describe them. However, it doesn't explain what read_text_file offers differently, but for a deprecated tool this is acceptable.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 3 parameters, with 67% description coverage (tail and head have descriptions, path does not). The description does not add meaning to the path parameter beyond stating the tool reads files; it fails to compensate for the missing schema description. Tail and head are already well-described in the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it reads the complete contents of a file as text, and explicitly marks it as deprecated. This distinguishes it from siblings like read_text_file, though it doesn't explain the difference. The purpose is well-defined.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The deprecation notice directly tells the agent not to use this tool and to use read_text_file instead. This provides clear guidance on when to use (rarely) and why. No further context is given for when to use the deprecated version, but that is acceptable.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

read_media_fileRead Media FileA

Read-only

Read an image or audio file. Returns the base64 encoded data and MIME type. Only works within allowed directories.

ParametersJSON Schema

Name	Required	Description	Default
`path`	Yes

Output Schema

ParametersJSON Schema

Name	Required	Description
`content`	Yes

TDQS

A3.9/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate read-only. The description adds that it returns base64 and MIME type, and restricts to allowed directories. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, no filler. Every sentence adds value: what it reads, what it returns, and a constraint.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema presumed to document return values, the description covers purpose, outputs, and constraints adequately for a simple tool. Minor gaps like supported file formats are missing but acceptable.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema has 0% description coverage for the 'path' parameter. The description only notes the allowed-directories constraint, not the format or expected value of the path. More detail is needed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly specifies reading image or audio files and returning base64 plus MIME type. It distinguishes itself from siblings like 'read_file' (generic) and 'read_text_file' (text) by targeting media files.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description mentions a constraint ('only works within allowed directories') but does not explicitly state when to use this tool versus siblings. No alternatives or exclusion criteria are provided.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

read_multiple_filesRead Multiple FilesA

Read-only

Read the contents of multiple files simultaneously. This is more efficient than reading files one by one when you need to analyze or compare multiple files. Each file's content is returned with its path as a reference. Failed reads for individual files won't stop the entire operation. Only works within allowed directories.

ParametersJSON Schema

Name	Required	Description	Default
`paths`	Yes	Array of file paths to read. Each path must be a string pointing to a valid file within allowed directories.

Output Schema

ParametersJSON Schema

Name	Required	Description
`content`	Yes

TDQS

A4.5/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Adds key behavioral traits beyond annotations: 'Failed reads for individual files won't stop the entire operation' and 'Only works within allowed directories'. Annotations only provide readOnlyHint, so description significantly enhances understanding.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Four sentences covering action, efficiency benefit, failure behavior, and directory constraint. No redundant information, and the most critical details come first.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having an output schema (not shown), the description provides essential operational context: multiple file handling, partial failures, and access limitations. With simple parameters and annotations, it adequately prepares the agent.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema already has 100% coverage with a clear description of the 'paths' parameter. Tool description does not add new semantic meaning beyond reinforcing the allowed directories constraint, meeting baseline expectations.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description clearly states 'Read the contents of multiple files simultaneously', specifying the action and resource. It distinguishes from siblings like 'read_file' by emphasizing batch operation and efficiency for multiple files.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Explicitly says 'more efficient than reading files one by one when you need to analyze or compare multiple files', guiding when to use. However, it does not directly name alternative tools like 'read_file' for single files, though siblings are listed for context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

read_text_fileRead Text FileA

Read-only

Read the complete contents of a file from the file system as text. Handles various text encodings and provides detailed error messages if the file cannot be read. Use this tool when you need to examine the contents of a single file. Use the 'head' parameter to read only the first N lines of a file, or the 'tail' parameter to read only the last N lines of a file. Operates on the file as text regardless of extension. Only works within allowed directories.

ParametersJSON Schema

Name	Required	Description
`path`	Yes
`tail`	No	If provided, returns only the last N lines of the file
`head`	No	If provided, returns only the first N lines of the file

Output Schema

ParametersJSON Schema

Name	Required	Description
`content`	Yes

TDQS

A4.7/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description adds significant behavioral context beyond the readOnlyHint annotation: handles various encodings, provides detailed error messages, operates as text regardless of extension, and restricts to allowed directories. No contradictions.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise with 4 purposeful sentences, front-loading the core purpose. Each sentence adds unique value without redundancy, creating a well-structured and efficient definition.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 3-param tool with an output schema, the description is thorough: covers purpose, usage context, parameters, encoding, error handling, and directory restrictions. No gaps remain for a typical use case.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 67% (path undocumented). The description adds meaning for head and tail by explaining their line-count behavior, matching schema. For path, it adds context about file system and allowed directories, partially compensating for missing schema description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states 'Read the complete contents of a file from the file system as text' with a specific verb and resource. It distinguishes from siblings like 'read_media_file' and 'read_multiple_files' by emphasizing single file and text handling.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly says 'Use this tool when you need to examine the contents of a single file' and implies alternatives through sibling context. It lacks explicit when-not-to-use but provides clear guidance on using head/tail for partial reads.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_filesSearch FilesA

Read-only

Recursively search for files and directories matching a pattern. The patterns should be glob-style patterns that match paths relative to the working directory. Use pattern like '.ext' to match files in current directory, and '**/.ext' to match files in all subdirectories. Returns full paths to all matching items. Great for finding files when you don't know their exact location. Only searches within allowed directories.

ParametersJSON Schema

Name	Required	Description	Default
`path`	Yes
`pattern`	Yes
`excludePatterns`	No

Output Schema

ParametersJSON Schema

Name	Required	Description
`content`	Yes

TDQS

A4.1/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already mark readOnlyHint=true. The description adds that the search recurses, returns full paths, and is limited to allowed directories, which are useful behavioral traits beyond the annotation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is concise (4 sentences), front-loaded with purpose, and every sentence adds value. No redundant or vague language.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity, the presence of an output schema, and annotations, the description covers the essential aspects: search mechanism, glob patterns, scope. It is adequate but could include more detail on results formatting or limitations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, so the description must compensate. It explains pattern and path with examples, but completely omits excludePatterns, a parameter with a default. Only partial coverage of parameters.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it recursively searches files and directories matching a glob pattern, using action verbs and specific resource. It distinguishes from sibling tools like list_directory by focusing on pattern-based search and returning full paths.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives usage context ('Great for finding files when you don't know their exact location') and provides pattern examples. However, it does not explicitly state when not to use this tool or mention alternatives for specific cases.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

write_fileWrite FileA

DestructiveIdempotent

Create a new file or completely overwrite an existing file with new content. Use with caution as it will overwrite existing files without warning. Handles text content with proper encoding. Only works within allowed directories.

ParametersJSON Schema

Name	Required	Description	Default
`path`	Yes
`content`	Yes

Output Schema

ParametersJSON Schema

Name	Required	Description
`content`	Yes

TDQS

A3.8/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate destructive behavior and non-readonly. The description adds context about overwriting without warning, proper encoding, and directory restrictions, which goes beyond annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Three sentences front-load the purpose, then add warnings and constraints. No excess wording, but could be slightly more structured (e.g., separate when-to-use).

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the simple tool and existing annotations, the description covers purpose, destructive behavior, encoding, and allowed directories. Missing error or return value details, but output schema likely handles that.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage, the description must compensate. It only hints at content encoding but does not elaborate on path format or content constraints. Both parameters remain underspecified.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool creates or overwrites files, distinguishing it from sibling tools like edit_file which modifies partially. It also mentions the directory constraint, which sets scope.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description warns about overwriting but does not explicitly guide when to use this tool versus alternatives like edit_file or create_directory. No when-to-use or when-not-to-use advice is given.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

14 tool updatesv0.1.0May 25, 2026
- First observedcreate_directory
- First observeddirectory_tree
- First observededit_file
- First observedget_file_info
- First observedlist_allowed_directories
- First observedlist_directory
- First observedlist_directory_with_sizes
- First observedmove_file
- First observedread_file
- First observedread_media_file
- First observedread_multiple_files
- First observedread_text_file
- First observedsearch_files
- First observedwrite_file

Install Server

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

TDQS

A3.8/5.0

Disambiguation4/5

Most tools have distinct purposes, but there is confusion between `list_directory` and `list_directory_with_sizes` (one includes sizes, the other not), and the deprecated `read_file` alongside `read_text_file` adds ambiguity.

Naming Consistency3/5

Most names follow a verb_noun pattern (e.g., `create_directory`, `read_text_file`), but `directory_tree` is a noun phrase and `list_allowed_directories` is verbose, breaking full consistency.

Tool Count5/5

With 14 tools covering creation, reading, writing, editing, moving, searching, and listing, the count is well-suited for a file system utility without being excessive or sparse.

Completeness2/5

The tool set lacks critical operations like file deletion and copying, which are expected for comprehensive file management. This gap may cause agents to fail when needing to remove files.

Maintenance

ActivityStale

ResponsivenessResponsive

Resources

GitHub Repository

Need Help?

Related Servers

Related MCP Connectors

agent-audit-logger-mcp
io.github.CSOAI-ORG
Hash-chained HMAC-signed audit log MCP for A2A (agent-to-agent) calls. Every tool-call, agent-ha...
Security Observability
2
Occludra — MCP Gateway (AI Security Gateway)
ai.occludra
Security & DLP proxy for MCP: tool-poisoning scans, PII redaction on tool args/results. Beta.
Security Agent Orchestration
1
MANDATE Credential Broker B
io.github.projetnanocorp
MCP server for mandates, delegation, policy-gated execution, credential grants, and audit.
111
clianythingharness-mcp
com.clauxel.clianythingharness
A paid remote MCP for CLI tool MCP, built to return verdicts, receipts, usage logs, and audit-ready
Command Line Monitoring
21

Related MCP Servers

Filesystem MCP Serverofficial
File Systems Developer Tools
modelcontextprotocol
A
license
A
quality
A
maintenance
Node.js server implementing Model Context Protocol (MCP) for filesystem operations.
Updated 3 days ago (2026-09-03 01:42 UTC)
14
668,809
90,042
-
GitHub MCP Server Plus
Version Control Developer Tools
PhialsBasement
A
license
B
quality
D
maintenance
MCP Server for the GitHub API, providing features for file operations, repository management, and advanced search, with automatic branch creation and comprehensive error handling.
Updated a year ago (2025-05-05 10:31 UTC)
18
13
8
MIT
Postgres MCP
Databases Developer Tools Code Execution
crystaldba
A
license
A
quality
D
maintenance
Postgres Pro is an open source Model Context Protocol (MCP) server built to support you and your AI agents throughout the entire development process—from initial coding, through testing and deployment, and to production tuning and maintenance.
Updated 20 days ago (2026-08-17 05:06 UTC)
9
3,260
MIT
Brave Search MCP Serverofficial
Research & Data Search Text Summarization
brave
A
license
A
quality
A
maintenance
An MCP implementation that integrates the Brave Search API, providing comprehensive search capabilities including web, local business, image, video, news searches, and AI-powered summarization.
Updated 11 days ago (2026-08-26 12:56 UTC)
8
15,853
1,409
MIT

Latest Blog Posts

Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)
By Om-Shree-0709 on July 25, 2026.
mcp
Agent Identity
OAuth 2.1
Your AI Chatbot Just Exposed Your CEO's Salary to an Intern
By Om-Shree-0709 on July 2, 2026.
Agent Identity
MCP Security
OAuth Delegation
Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)
By Om-Shree-0709 on June 30, 2026.
Agentic Ai
Prompt Injection
WebAssembly

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/P4ST4S/mcp-audit'

If you have feedback or need assistance with the MCP directory API, please join our Discord server

mcp-audit

Why mcp-audit?

What This Is / Is Not

Supported Transports

Use Cases

Demo

Install

Quick Start

Examples

Configuration

Claude Desktop

Dashboard

Prometheus Metrics

Policy Engine

OpenTelemetry

Audit Entries

Roadmap

Contributing

Community

License

Available Tools

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Output Schema

Tool Schema Changelog

Maintenance

Resources

Related MCP Connectors

Related MCP Servers

Filesystem MCP Serverofficial

Brave Search MCP Serverofficial

Latest Blog Posts

MCP directory API