winrm-mcp
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@winrm-mcpRun PowerShell command Get-Service on host sql01"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
winrm-mcp
A deliberately small MCP server for running PowerShell and CMD commands on Windows hosts over WinRM. It takes
the WinRM execution ideas from ssh-winrm-mcp, adds a focused multi-host inventory, and leaves out SSH,
persistent sessions, jobs, command groups, and file transfer.
Tools
winrm_test— verify authentication and connectivity.winrm_execute_powershell— execute PowerShell.winrm_execute_cmd— execute CMD.winrm_inventory_status,winrm_inventory_init,winrm_inventory_validate— manage inventory files.winrm_host_list,winrm_host_get,winrm_host_save,winrm_host_update,winrm_host_delete— manage reusable hosts.
Each tool accepts an optional connection object. Values in it override the process environment:
{
"host": "192.168.1.50",
"username": "Administrator",
"password_env": "MY_WINRM_PASSWORD",
"auth": "ntlm",
"ssl": true,
"cert_validation": false
}ssl chooses HTTPS (normally port 5986) versus HTTP (normally port 5985). cert_validation=false is needed for
self-signed HTTPS listeners, but should only be used for trusted hosts.
Supported connection fields are host, username, password, password_env, port, ssl, auth,
cert_validation, encryption, path, connect_timeout, read_timeout, and operation_timeout.
Related MCP server: Win MCP Server
Multi-host inventory
Hosts can be stored in either inventory scope:
user(default):${XDG_CONFIG_HOME:-~/.config}/winrm-mcp/inventory.jsonon Linux/macOS, or the matching%APPDATA%location on Windows.project:.winrm-mcp/inventory.jsonunder the current working directory.
Choose the process default with WINRM_MCP_INVENTORY_SCOPE=user or WINRM_MCP_INVENTORY_SCOPE=project.
Every inventory and host tool also accepts an explicit scope, and execution tools accept inventory_scope.
Project scope uses WINRM_MCP_PROJECT_DIR, then the launcher's logical PWD, then the process working directory.
It refuses temporary deepagents_server_* paths instead of silently saving disposable inventory data. Set
WINRM_MCP_PROJECT_DIR when the launcher working directory is not the desired project root. A fully custom file is
supported through WINRM_MCP_INVENTORY_FILE; it is used when a call does not explicitly select a scope.
Create a project inventory and save two hosts:
winrm_inventory_init(scope="project")
winrm_host_save(
name="epv1",
scope="project",
settings={
"host": "10.0.110.50",
"username": "Administrator",
"password_env": "EPV1_WINRM_PASSWORD",
"auth": "ntlm",
"ssl": true,
"cert_validation": false
}
)
winrm_host_save(
name="epv2",
scope="project",
settings={
"host": "10.0.110.51",
"username": "Administrator",
"password_env": "EPV2_WINRM_PASSWORD",
"auth": "ntlm",
"ssl": true,
"cert_validation": false
}
)Use a saved host by name:
winrm_test(saved_host="epv1", inventory_scope="project")
winrm_execute_powershell(saved_host="epv1", inventory_scope="project", command="hostname")
winrm_execute_cmd(saved_host="epv2", inventory_scope="project", command="whoami")The optional connection object overrides fields from the saved host for that call. Inventory writes are atomic,
and the inventory file is restricted to the current user (0600) on Unix-like systems. Inline passwords are
supported but stored as plaintext in that protected JSON file; prefer password_env.
Omit connection when no overrides are needed. For compatibility with agents that serialize an optional value as
text, connection="None", connection="null", and an empty connection string are treated as JSON null.
DeepAgents
DeepAgents can run the server directly from GitHub, so a local checkout is not required. Add the following
entry to your DeepAgents .deepagents/.mcp.json file:
{
"winrm": {
"type": "stdio",
"command": "uv",
"args": [
"tool",
"run",
"--with",
"mcp>=1.28,<2",
"--from",
"git+https://github.com/bigbatmanorg/winrm-mcp.git",
"winrm-mcp"
],
"env": {
"WINRM_MCP_HOST": "192.168.1.50",
"WINRM_MCP_USERNAME": "Administrator",
"WINRM_MCP_PASSWORD": "YOUR_SECRET",
"WINRM_MCP_PORT": "5986",
"WINRM_MCP_AUTH": "ntlm",
"WINRM_MCP_SSL": "true",
"WINRM_MCP_CERT_VALIDATION": "false",
"WINRM_MCP_INVENTORY_SCOPE": "project",
"WINRM_MCP_PROJECT_DIR": "${PWD}",
"WINRM_MCP_CONNECT_TIMEOUT": "30",
"WINRM_MCP_READ_TIMEOUT": "60",
"WINRM_MCP_OPERATION_TIMEOUT": "30"
}
}
}For reproducible installations, pin the repository to a release tag or commit:
"git+https://github.com/bigbatmanorg/winrm-mcp.git@YOUR_TAG_OR_COMMIT"The example uses HTTPS with certificate verification disabled for a trusted development host with a self-signed
certificate. Keep WINRM_MCP_CERT_VALIDATION=true when the listener certificate is trusted. Do not commit a real
password to source control; use your normal DeepAgents secret-injection workflow for WINRM_MCP_PASSWORD.
DeepAgents expands ${PWD} before launching the MCP server. Replace it with an absolute path if DeepAgents itself
is launched from somewhere other than the project root.
Install and run
uv sync --extra dev
uv run pytest
uv run winrm-mcpThe default transport is stdio. A client configuration can supply stable connection defaults without putting credentials in every tool call:
{
"servers": {
"winrm": {
"type": "stdio",
"command": "uv",
"args": ["--directory", "/home/toor/projects/winrm-mcp", "run", "winrm-mcp"],
"env": {
"WINRM_MCP_HOST": "192.168.1.50",
"WINRM_MCP_USERNAME": "Administrator",
"WINRM_MCP_PASSWORD_ENV": "MY_WINRM_PASSWORD",
"MY_WINRM_PASSWORD": "replace-me",
"WINRM_MCP_AUTH": "ntlm",
"WINRM_MCP_SSL": "true",
"WINRM_MCP_CERT_VALIDATION": "false"
}
}
}
}Available environment defaults correspond to the connection fields and use the WINRM_MCP_ prefix. Server
settings are WINRM_MCP_TRANSPORT, WINRM_MCP_SERVER_HOST, and WINRM_MCP_SERVER_PORT. Inventory settings are
WINRM_MCP_INVENTORY_SCOPE, WINRM_MCP_PROJECT_DIR, and WINRM_MCP_INVENTORY_FILE.
For Kerberos or CredSSP support, install the matching optional extra:
uv sync --extra kerberos
uv sync --extra credsspAvailable Tools
11 toolswinrm_execute_cmdB
Execute a CMD command over WinRM and return stdout, stderr, and exit code.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | ||
| env | No | ||
| command | Yes | ||
| timeout | No | ||
| connection | No | ||
| saved_host | No | ||
| output_limit | No | ||
| inventory_scope | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses that it returns stdout, stderr, and exit code, which gives some insight into the execution result. However, it does not mention potential side effects of running arbitrary commands, authentication requirements, or failure behavior. With no annotations, the description carries the full burden and could be more explicit about these aspects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that directly states the core action and outputs. It contains no redundant information and is appropriately brief for a tool with this function.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has eight parameters and no schema descriptions, the one-sentence description is insufficient to cover all relevant context. It omits details about output limits, timeout behavior, connection handling, and inventory scoping, which are likely important for correct usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds minimal value beyond the schema. It only references the 'command' parameter implicitly and provides no explanation for parameters like cwd, env, timeout, connection, or inventory_scope. Since the schema has no descriptions for these parameters (0% coverage), the description does not help clarify their purpose or usage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Execute'), a specific resource ('CMD command'), and the context ('over WinRM'), and mentions the return values (stdout, stderr, exit code). This clearly distinguishes it from sibling tools like winrm_execute_powershell, which would handle PowerShell commands.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not provide explicit guidance on when to use this tool versus alternatives. It does not mention that it is intended for CMD commands and that PowerShell commands should use winrm_execute_powershell. The selection criteria are only implicitly inferable from the tool name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
winrm_execute_powershellC
Execute a PowerShell command over WinRM and return stdout, stderr, and exit code.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | ||
| env | No | ||
| command | Yes | ||
| timeout | No | ||
| connection | No | ||
| saved_host | No | ||
| output_limit | No | ||
| inventory_scope | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It states that it returns stdout, stderr, and exit code, but does not describe system impacts, authentication/connection requirements, side effects, or error handling. This is minimal disclosure for a remote execution tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that immediately conveys the core action and expected outputs. It is front-loaded and free of filler, though it omits necessary details.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With 8 parameters, no schema descriptions, no annotations, and a sibling tool that likely covers similar functionality, the description is far from complete. It only addresses the basic execution and return values, leaving parameter meanings, usage context, and alternative selection unexplained.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has zero descriptions for its 8 parameters, and the description mentions only 'PowerShell command' without elaborating any of the parameters (command, cwd, env, timeout, connection, saved_host, output_limit, inventory_scope). The description fails to compensate for the 0% schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific verb ('Execute'), a resource ('PowerShell command over WinRM'), and the expected outputs ('stdout, stderr, and exit code'). This is specific enough to distinguish from the likely cmd-based sibling winrm_execute_cmd, though it does not explicitly name alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus the sibling tools, especially winrm_execute_cmd or winrm_test. It does not mention preferred contexts, prerequisites, or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
winrm_host_deleteB
Delete a saved WinRM host.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | ||
| scope | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations available, the description carries the full burden of behavioral disclosure, but it only says 'Delete a saved WinRM host.' It does not state whether the deletion is permanent, whether confirmation or special permissions are required, whether related resources are affected, or what side effects occur.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, focused sentence with no filler. It front-loads the action and resource, and every word contributes to the core meaning.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The output schema helps with return-value expectations, but the description leaves important invocation context missing: the meaning of 'scope', whether the target must already exist, and the permanent nature of the deletion. Given the tool's destructive nature and undocumented parameters, the description is insufficient for confident tool invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 0% description coverage, and the description adds little meaning beyond the schema's field names. It implies 'name' identifies the host to delete, but it does not explain how 'scope' influences the operation or what valid values exist, leaving a key parameter semantically unexplained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Delete') and a clear resource ('a saved WinRM host'), making the action unmistakable. It distinguishes itself from sibling tools like winrm_host_save, winrm_host_update, and winrm_host_get by naming the delete operation directly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given about when to use this tool versus alternatives such as winrm_host_update or winrm_host_save. There are no prerequisites, conditions, or warnings provided to help an agent decide between deletion and other host-management operations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
winrm_host_getA
Get one saved WinRM host with its password redacted.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | ||
| scope | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses a significant behavioral trait: the password is redacted in the response. This is useful beyond what annotations provide (there are none). It does not mention any other behavioral aspects like side effects, but since this is a GET operation, it's likely read-only. Without annotations, the description carries the burden, and it at least flags the redaction behavior. It doesn't contradict anything.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence, extremely concise, and effectively front-loaded with the purpose and the key behavioral detail (password redaction). Every word earns its place, no fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has an output schema (though not shown in the context) and no nested objects, so complexity is low. The description covers the essential purpose and one key behavior. However, it doesn't mention when to use it vs winrm_host_list, nor the meaning of 'scope'. Given the sibling tools, there might be ambiguity between get and list. For a simple retrieval tool with a required name param, this is mostly complete but lacks usage context that would help an agent decide between list and get.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description should compensate. The description mentions the resource type but does not explain the parameters 'name' or 'scope'. The schema provides 'name' as required string and 'scope' as nullable string, but the description doesn't clarify what 'scope' means (e.g., is it a workspace? a namespace?). Since there are only 2 parameters and the description doesn't add semantic meaning beyond the schema, it's a slight gap, but the naming is fairly clear from the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (get one saved host) and the resource (WinRM host), and mentions that the password is redacted, which distinguishes it from a plain 'list' or 'retrieve' operation. It's concise and unambiguous. However, it doesn't explicitly differentiate from winrm_host_list, which lists hosts; but 'one saved host' with 'password redacted' gives enough hint that this retrieves a single specific host with redaction.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description hints at usage by stating 'get one saved host', implying that name is required, but it doesn't explicitly say when to use this vs winrm_host_list (e.g., 'use list to enumerate, get for a single host'). It doesn't provide exclusions or alternative scenario. It's implicitly clear but lacks explicit guidance on when not to use or which sibling to choose.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
winrm_host_listC
List saved WinRM hosts with passwords redacted.
| Name | Required | Description | Default |
|---|---|---|---|
| scope | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. It does reveal that passwords are redacted, which is a useful behavioral trait. However, it does not state whether the tool only reads data (read-only), any potential side effects, or the output format. The description adds some transparency but lacks depth.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is concise and front-loads the primary action (list hosts) and the key detail (passwords redacted). It earns its place without excess, but it could be slightly more informative without losing conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (simple list operation) and that it has an output schema (which might clarify return values), the description might not need to explain the return format. However, the ambiguity of the 'scope' parameter and lack of usage guidance leave the agent under-informed. The description is incomplete for correct invocation, especially regarding parameter semantics.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has zero description coverage (0%), and the parameter 'scope' has no description. The tool description does not explain what 'scope' means—whether it filters by environment, hostname pattern, or something else. With only one parameter and no schema documentation, the description should clarify its semantics, but it does not, resulting in a significant gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific action (list saved WinRM hosts) and a notable behavioral detail (passwords redacted). However, it does not explicitly differentiate from sibling tools like winrm_host_get, which might also return host information, but the purpose is still clear enough.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance on when to use this tool versus alternatives (e.g., winrm_host_get for a single host, or winrm_inventory_status for inventory status). There is no mention of prerequisites like needing initialized inventory, or when listing all hosts is appropriate. The only hint is the 'scope' parameter, but its purpose is unclear.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
winrm_host_saveC
Save a WinRM host in the project or user inventory. Prefer password_env over password.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | ||
| scope | No | ||
| settings | Yes | ||
| overwrite | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description does not disclose side effects, such as whether the operation overwrites an existing host, what happens if the host already exists, or any required permissions. It also does not mention the 'overwrite' parameter's purpose. With no annotations, the description carries the burden of explaining behavior, which it fails to do.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is brief and to the point, consisting of two short sentences. It efficiently conveys the core action and a useful hint about password handling. No extraneous information is included, so it is well-structured for a tool definition.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the sparse schema (no parameter descriptions) and the minimal description, the tool lacks sufficient context for an agent to construct a valid call. It doesn't clarify the expected structure of 'settings', the effect of 'overwrite', or the possible return values. The 'password_env' hint is helpful but not enough to fill the gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has zero description coverage for its parameters. The description only mentions 'name', 'scope', 'settings', and 'overwrite' implicitly by stating 'Save a WinRM host in the project or inventory' and the password preference. It does not explain what 'settings' should contain, how 'scope' is used, or what 'overwrite' controls, leaving the agent to infer from the names alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action: 'Save a WinRM host' and specifies the scope (project or inventory). It also hints at a preference for using password_env over password, which adds clarity. However, it could be more explicit in distinguishing between creating and updating, though the name suggests an upsert operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives a hint about preferring password_env over password, but it does not explicitly state when to use this tool versus the sibling tools like update or delete. It implies this is the primary save action but lacks clear guidance on conditions for using it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
winrm_host_updateC
Update selected settings on a saved host; remove optional values with remove_fields.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | ||
| scope | No | ||
| changes | Yes | ||
| remove_fields | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of behavioral disclosure. It reveals that the tool mutates a saved host and that remove_fields deletes optional values, but it does not explain effects on existing fields, permission requirements, idempotency, or response behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with no filler. Every word contributes to the core action, though brevity comes at the cost of needed semantic detail.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return-value documentation is not needed, but the description is insufficient for correct invocation. The open-ended changes object, the meaning of scope, and the required name parameter are all undefined, and there are no annotations to fill the gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It adds some meaning by linking 'selected settings' to the changes object and explaining remove_fields, but it leaves name, scope, and the structure of the nested changes object undocumented.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear verb and resource: updating selected settings on a saved host, and mentions the distinct removal behavior via remove_fields. It is identifiable as a partial-update operation, though it does not explicitly differentiate itself from winrm_host_save.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given about when to use this tool versus winrm_host_save, winrm_host_delete, or the inventory tools. 'Selected settings' implies partial updates, but the description never states when this is the right choice or what preconditions exist.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
winrm_inventory_initC
Create an empty project or user inventory without replacing existing data by default.
| Name | Required | Description | Default |
|---|---|---|---|
| scope | No | ||
| overwrite | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must carry the full behavioral burden. It discloses that existing data is not replaced by default, which addresses safety, but it does not mention side effects, permission requirements, or what happens if an inventory already exists. It also doesn't specify whether it creates a new file, modifies a config, or errors on conflict.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no filler. It is concise and gets to the point, though it lacks structure (e.g., separating purpose from behavior). Still, it is efficient for the length.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has 2 parameters, no annotations, and 0% schema coverage, so the description must provide sufficient guidance. It only covers the overwrite behavior and leaves scope undefined. There is an output schema, so return values are covered, but the missing parameter semantics and lack of usage context make this incomplete for reliable invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must explain both parameters. It implicitly covers 'overwrite' by stating 'without replacing existing data by default', aligning with the default false. However, it gives no meaning to 'scope'—what values it accepts or what 'project or user' refers to. Agents cannot correctly set scope from this description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('create an empty project or user inventory') and clarifies the default overwrite behavior. It distinguishes from sibling tools by naming 'init' as creation, while others handle status, validation, or host operations. However, 'project or user' is vague and lacks context on what that means in the WinRM domain.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is for initial setup but does not explicitly say when to use it versus alternatives. There is no mention of when not to use it or how it differs from inventory_status or inventory_validate. No guidance on preconditions or typical invocation contexts.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
winrm_inventory_statusA
Show the project or user inventory path, existence, and saved host count.
| Name | Required | Description | Default |
|---|---|---|---|
| scope | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden of safety disclosure. 'Show' strongly implies a read-only status check and it lists what is inspected, but it does not explicitly rule out side effects or mention prerequisites such as whether the inventory must already be initialized.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no filler. The verb and key output dimensions appear immediately, making it easy to scan.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The output schema covers return shape, but the description leaves gaps around scope value semantics, when to call the tool, and how it relates to sibling tools. It is adequate for a simple status query but not fully self-sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 0% description coverage for the 'scope' parameter, so the description must compensate. It implies project/user are the relevant scope values, but it does not state accepted values or explain what null/default means for the call.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb, 'Show', and names the exact resource and outputs: inventory path, existence, and saved host count. It clearly distinguishes itself from the inventory_init/validate and host management siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given about when to use this tool versus winrm_inventory_init, winrm_inventory_validate, or the host commands. There are no exclusions, prerequisites, or alternative routing instructions, so usage must be inferred from the name and sibling set.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
winrm_inventory_validateC
Validate an inventory file and every saved WinRM host.
| Name | Required | Description | Default |
|---|---|---|---|
| scope | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. The description does not disclose whether validation is read-only (does it modify the inventory? does it require network access to each host?), whether it can be time-consuming, or what side effects might occur. It does not mention if it performs ping/connectivity checks or merely parses the file. The description is too thin to set expectations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is one concise sentence with no filler, which is good for efficiency. It is not over-whelming, but it lacks necessary detail. The structure is acceptable, but it prioritizes brevity over usefulness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given that there is an output schema (though not provided in detail), the description should still explain what validation results will look like, especially since the tool's primary purpose is validation. It also does not clarify the role of the 'scope' parameter. With only a vague sentence, an agent cannot confidently call this tool correctly, especially given the lack of annotations and parameter documentation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and there is one parameter ('scope') with no description. The description does not explain the meaning of 'scope' or its possible values. Since the schema provides no default explanation beyond a null default, the description must compensate, but it does not. This is a significant gap for a tool that likely needs a scope indicator.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states 'Validate an inventory file and every saved WinRM host,' which is a clear verb ('validate') and a resource ('inventory file' and 'saved WinRM host'). It distinguishes itself from sibling tools that manage hosts or inventory (e.g., winrm_host_save, winrm_inventory_status). However, it does not specify what validation entails or what the result looks like, leaving some ambiguity about the exact scope of the operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no mention of when to use this tool versus alternatives. It does not state that it is for checking connection availability, like winrm_test, or for reporting inventory status, like winrm_inventory_status. No exclusions or prerequisites are given. The agent must infer usage from the name, which is insufficient.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
winrm_testB
Test a WinRM connection with a harmless PowerShell marker command.
| Name | Required | Description | Default |
|---|---|---|---|
| timeout | No | ||
| connection | No | ||
| saved_host | No | ||
| inventory_scope | No |
Output Schema
| Name | Required | Description |
|---|---|---|
No output parameters | ||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the behavioral disclosure burden. It discloses that the tool runs a 'harmless PowerShell marker command', which suggests non-destructive intent, but it does not explain side effects, output, failure behavior, or network/auth implications beyond that vague qualifier.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with no filler. It efficiently states the purpose, though the phrase 'harmless PowerShell marker command' is somewhat vague and could be replaced with more actionable detail without sacrificing conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple and an output schema exists, so return values need not be explained. However, with four optional parameters and zero guidance on how to specify the target connection, the description is not fully complete for correct invocation in every reasonable case.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, and the description adds no information about any of the four parameters (timeout, connection, saved_host, inventory_scope). The agent must infer parameter meaning entirely from parameter names and types, which is a significant gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a clear verb ('Test'), a specific resource ('WinRM connection'), and a distinct method ('harmless PowerShell marker command'). It distinguishes the tool from the execution siblings by implying a safe probe rather than an arbitrary command execution, though it does not explicitly contrast with inventory status tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The intended use is implied: use this tool to verify a WinRM connection before other operations. However, there is no explicit guidance about when to prefer this over winrm_inventory_status or winrm_execute_powershell, nor any when-not-to-use guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
11 tool updates
v0.2.2- First observed
winrm_execute_cmd - First observed
winrm_execute_powershell - First observed
winrm_host_delete - First observed
winrm_host_get - First observed
winrm_host_list - First observed
winrm_host_save - First observed
winrm_host_update - First observed
winrm_inventory_init - First observed
winrm_inventory_status - First observed
winrm_inventory_validate - First observed
winrm_test
TDQS
Each tool maps to a distinct concern: inventory management, host CRUD, connection testing, and command execution. Even the two execute tools are cleanly separated by PowerShell vs CMD, and winrm_test is clearly scoped to harmless connectivity verification.
All tools use a consistent snake_case convention with the winrm_ prefix and follow a clear subdomain grouping: inventory_*, host_*, execute_*, and test. The naming pattern is predictable and makes the tool's purpose immediately understandable.
With 11 tools, the server is well-scoped for WinRM host inventory management and remote command execution. Each tool covers a distinct operation without unnecessary overlap or bloat.
The toolset covers the full lifecycle: inventory setup and validation, host CRUD operations, connection testing, and both PowerShell and CMD execution. There are no obvious dead ends or missing operations for the stated domain.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Execute PowerShell commands securely with controlled timeouts and input validation. Retrieve syste…
Scoped, audited SSH exec, sessions, and SFTP on your saved servers without exposing credentials
Run commands and read/write files on your servers over Termalin's keyless tunnels (hosted MCP).
Operate Linux, macOS and Windows from your LLM. Every action runs through an auditable allowlist.
Related MCP Servers
- FlicenseNot gradedqualityNot gradedmaintenanceEnables management of Windows servers from Linux through an MCP server with per-user installation. Provides tools to control Windows systems via API with secure credential management.-
- AlicenseNot gradedqualityDmaintenanceEnables AI agents to securely manage and execute commands on remote Windows servers via WinRM, including PowerShell execution, system information retrieval, and service management.5MIT
- FlicenseNot gradedqualityCmaintenanceEnables remote Windows server administration and troubleshooting via WinRM and SSH PowerShell protocols.6-
- AlicenseAqualityCmaintenanceEnables executing commands and transferring files over SSH on multiple hosts concurrently, with auto-discovery from SSH config and support for various authentication methods.318MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/bigbatmanorg/winrm-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server