Skip to main content
Glama
g2zz
by g2zz

Open Subagent MCP

English | 简体中文

这是一个基于标准输入输出 (stdio) 的本地 MCP 服务器,允许 MCP 主机将任务委托给兼容 OpenAI 接口的子代理 (Subagent) 运行时执行。

Open Subagent MCP 专为开发者工作站设计。它可以读取文件、写入文件、执行命令、记录副作用 (side effects),并尽最大努力回滚对本地文件所做的修改。它不是沙盒,不是托管服务,也不提供生产级别的隔离。

功能特性

  • 它是一个可由 Codex、Claude Code 或其他兼容 MCP 的客户端启动的本地 MCP 服务器。

  • 内置一个轻量级的子代理运行时,后端可接入任何兼容 OpenAI 接口的大模型 (Chat Completions) 服务。

  • 提供一套处理代码任务的结构化操作循环:包括读取、搜索、解析代码库、运行测试、修改文件、捕获日志,并最终生成可审计的执行凭证。

  • 提供一个基于快照、写入日志以及命令副作用扫描的文件回滚系统(尽力而为机制)。

Related MCP server: MCP Server

非目标特性

  • 它不是容器沙盒,也不提供安全边界。

  • 它不会回滚网络请求、外部服务调用、数据库更改、长时间运行的进程或生产环境的操作。

  • 它不能保证您的模型服务端点是绝对可信的。用户或组织必须自行评估并决定哪个服务端点可以接收您的工作区代码。

  • request_main_tool 并非 MCP 的标准功能。它是一种结构化的主机/编排器请求机制,用于在子代理需要运行时本身不具备的能力时向外寻求协助。

架构

flowchart LR
    Host["MCP 主机 / 编排器"] -->|"stdio MCP 工具"| Server["open-subagent-mcp"]
    Server -->|"聊天补全接口"| Model["兼容 OpenAI 的模型端点"]
    Server -->|"JSON 操作循环"| Runtime["子代理运行时"]
    Runtime --> Workspace["本地工作区"]
    Runtime --> Runs[".runs 日志、快照、状态"]
    Runtime --> Rollback["尽力而为的本地文件回滚"]

快速开始

git clone https://github.com/g2zz/open-subagent-mcp.git
cd open-subagent-mcp
python3.11 -m venv .venv
. .venv/bin/activate
pip install -e ".[dev]"

配置兼容 OpenAI 的模型端点:

export OPENAI_BASE_URL="http://localhost:8000/v1"
export OPENAI_API_KEY="your-api-key"
export OPENAI_MODEL_NAME="your-model-name"

运行本地检查:

pytest -q
python scripts/smoke_mcp_stdio.py

Codex 配置

将服务器添加到 ~/.codex/config.toml 中:

[mcp_servers.open_subagent_mcp]
command = "/absolute/path/to/open-subagent-mcp/.venv/bin/open-subagent-mcp"
args = []
startup_timeout_sec = 20
tool_timeout_sec = 180

[mcp_servers.open_subagent_mcp.env]
OPENAI_BASE_URL = "http://localhost:8000/v1"
OPENAI_API_KEY = "your-api-key"
OPENAI_MODEL_NAME = "your-model-name"

修改 MCP 配置后请重启 Codex。

Claude Code 配置

Claude Code 可以按照官方 MCP 文档的方式添加本地 stdio MCP 服务器:

claude mcp add --transport stdio open-subagent-mcp \
  --env OPENAI_BASE_URL=http://localhost:8000/v1 \
  --env OPENAI_API_KEY=your-api-key \
  --env OPENAI_MODEL_NAME=your-model-name \
  -- /absolute/path/to/open-subagent-mcp/.venv/bin/open-subagent-mcp

注意 -- 分隔符非常重要:它后面的所有内容都会被视为服务器的启动命令及参数。Claude Code 会为 stdio 服务器设置 CLAUDE_PROJECT_DIR,但 Open Subagent MCP 要求每次调用 subagent_spawn 时都必须显式传入 cwd

当 MCP 工具的输出过大时,Claude Code 会发出警告。因此,Open Subagent MCP 会返回日志文件的路径和截断后的预览内容,以控制工具输出的体积。

其他 MCP 主机

请使用您的主机支持的标准 stdio 服务器格式进行配置:

{
  "mcpServers": {
    "open_subagent_mcp": {
      "command": "/absolute/path/to/open-subagent-mcp/.venv/bin/open-subagent-mcp",
      "args": [],
      "env": {
        "OPENAI_BASE_URL": "http://localhost:8000/v1",
        "OPENAI_API_KEY": "your-api-key",
        "OPENAI_MODEL_NAME": "your-model-name"
      }
    }
  }
}

Open Subagent MCP 仅依赖于标准 MCP stdio 通信和标准的工具 Schema。诸如审批 UI、项目信任机制、技能系统、浏览器工具或工具代理等功能,均由您的 MCP 主机决定和提供。

模型接入示例

Open Subagent MCP 通过兼容 OpenAI 的 Chat Completions 接口与模型通信。常见的接入方式包括:

  • 本地网关,例如运行在 http://localhost:8000/v1 的 LiteLLM。

  • 提供兼容 OpenAI API 的本地模型应用。

  • 您的组织内部署的、且被允许接收工作区代码的兼容 OpenAI 端点。

  • 官方的 OpenAI API(前提是您的数据安全策略允许将工作区代码发送至云端)。

模型端点必须在每次对话的回复文本中返回且仅返回一个有效的 JSON 操作指令。在将新的模型服务投入实际工作前,请务必先运行冒烟测试。

MCP 工具列表

本服务器暴露了以下五个 MCP 工具:

  • subagent_spawn:启动一次执行任务(run)。传入 agent_type="explorer" 进行只读探索,传入 agent_type="worker" 进行允许修改的工作。

  • subagent_wait:等待一个或多个任务执行完毕。返回状态、摘要、被修改的文件、命令日志、副作用记录以及回滚分段信息。

  • subagent_send_message:向正在执行的任务发送追加消息。每次发送都会生成一个新的回滚分段。

  • subagent_close:关闭任务并释放运行时状态。

  • subagent_rollback:尽最大努力回滚整个任务或单个分段中对本地文件造成的修改。

任务(Runs)的最终状态可能为:completed(已完成)、failed(失败)、waiting_input(等待输入)、interrupted(被中断)、closed(已关闭)、rolled_back(已回滚)或 partially_rolled_back(部分回滚)。

当子代理需要运行时本身不具备的能力时,它可以调用 request_main_tool。此时任务状态将变为 waiting_input 并附带 requested_main_tool 信息。MCP 主机或编排器可以选择执行或拒绝该请求,随后通过 subagent_send_message 恢复任务的执行。

运行时环境变量

模型服务变量:

  • OPENAI_BASE_URL

  • OPENAI_API_KEY

  • OPENAI_MODEL_NAME

运行时控制变量:

  • SUBAGENT_MCP_RUNS_DIR

  • SUBAGENT_MCP_MAX_CONCURRENCY

  • SUBAGENT_MCP_MAX_STEPS

  • SUBAGENT_MCP_DEFAULT_COMMAND_TIMEOUT_SECONDS

  • SUBAGENT_MCP_LOG_TRUNCATE_CHARS

  • SUBAGENT_MCP_SNAPSHOT_IGNORE_DIRS

  • SUBAGENT_MCP_SENSITIVE_PATH_PATTERNS

  • SUBAGENT_MCP_FAKE_LLM_OUTPUTS

安全与回滚机制

Open Subagent MCP 会在本地工作区读取文件、写入文件和执行命令。在将其连接到私有代码库或不受信任的模型端点前,请务必阅读 SECURITY.md

内置的安全保护措施包括:路径规范化、允许的根目录校验、敏感路径拦截、只读的资源管理器模式、对子代理操作进行严格的 Schema 验证、本地日志记录、文件快照、命令副作用扫描以及回滚元数据记录。

回滚功能是尽力而为的本地文件还原机制。它无法撤销网络请求、数据库写入、云端操作、生产环境变更或任何超出文件系统监控范围的影响。

在使用 stdio 传输时,MCP 协议要求标准输出(stdout)必须只包含合法的 MCP 消息。Open Subagent MCP 会将日志写入文件或通过标准错误(stderr)机制输出;严禁在服务器启动过程或工具代码中使用原生的 print() 打印调试信息。

评估与测试 (Evals)

确定性基础检查:

pytest -q
ruff check .
python scripts/smoke_mcp_stdio.py
python scripts/eval_runtime_fake.py
python scripts/eval_mcp_blackbox.py
python scripts/eval_security_adversarial.py

真实模型冒烟测试:

OPENAI_BASE_URL=http://localhost:8000/v1 \
OPENAI_API_KEY=your-api-key \
OPENAI_MODEL_NAME=your-model-name \
RUN_REAL_LLM_SMOKE=1 \
python scripts/smoke_openai_compatible.py

真实模型高阶测试(Canary):

OPENAI_BASE_URL=http://localhost:8000/v1 \
OPENAI_API_KEY=your-api-key \
OPENAI_MODEL_NAME=your-model-name \
RUN_REAL_LLM_EVAL=1 \
python scripts/eval_real_subagent_canary.py

注:接入真实模型的评估测试被设计为手动运行,并未包含在默认的 CI 流程中。

升级迁移

如果您之前使用的是旧版的本地版本,请参阅 docs/MIGRATING_FROM_LEGACY_LOCAL_VERSION.md

Available Tools

5 tools
subagent_closeB

Close an Open Subagent MCP run and release runtime state.

ParametersJSON Schema
NameRequiredDescriptionDefault
targetYes

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

B3/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description must fully disclose behavior. It only states 'release runtime state' but omits side effects, mutability, or whether the action is reversible.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence with no waste, though it could afford a few more words for clarity without losing conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having an output schema, the description fails to address parameter usage or any contextual details, making it incomplete for a tool with no annotations.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 0%, and the description does not mention the required parameter 'target' or hint at its meaning, leaving the agent without guidance.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb 'Close' and identifies the resource 'Open Subagent MCP run', clearly distinguishing it from sibling tools like subagent_spawn (create) or subagent_rollback (undo).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage (closing an open run) but provides no explicit guidance on when to use it versus alternatives, nor any conditions or prerequisites.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

subagent_rollbackA

Rollback recorded file changes for an Open Subagent MCP run or segment.

By default this also reverts command side effects that were detected by filesystem scans. The rollback refuses conflicts unless force is true.

ParametersJSON Schema
NameRequiredDescriptionDefault
agent_idYes
segment_idNo
pathsNo
include_command_effectsNo
forceNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It discloses default revert of command side effects and conflict handling with force flag. However, it does not detail prerequisites (e.g., existence of recorded changes) or failure modes beyond conflicts.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short paragraphs, front-loaded with the main action. Every sentence adds value with no redundancy. Efficient and to the point.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema (not shown) and 5 parameters, the description covers core behavior but leaves gaps: what are 'recorded file changes'? What happens if segment_id is null? No mention of error conditions or return format. Sufficient for basic understanding but not fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so description must add value. It touches on parameters indirectly: rollback implies agent_id and paths; default revert relates to include_command_effects; force conflict handling. But precise semantics for segment_id and paths are absent. The description provides context but not comprehensive documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's purpose: 'Rollback recorded file changes for an Open Subagent MCP run or segment.' The verb 'rollback' and resource 'recorded file changes' are specific and distinct from sibling tools like subagent_close or subagent_spawn, which focus on lifecycle or communication.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies the use case (undoing changes) but does not explicitly state when not to use or compare to alternatives. Since sibling tools are clearly different (close, send_message, spawn, wait), context suffices, but explicit exclusions are missing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

subagent_send_messageA

Send a follow-up message to an existing Open Subagent MCP run.

Each follow-up creates a new rollback segment. Use segment_id with subagent_rollback to undo only the follow-up's effects.

ParametersJSON Schema
NameRequiredDescriptionDefault
targetYes
messageYes
itemsNo
interruptNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.6/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It discloses a key behavioral trait: each follow-up creates a new rollback segment. This adds value beyond just stating the purpose. However, other aspects like idempotency, error handling, or permissions are absent.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, front-loaded with the purpose, and no unnecessary words. Every sentence earns its place by conveying essential information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Despite having an output schema, the description omits parameter guidance and usage alternatives. For a tool with 4 parameters and no annotations, the description provides only the rollback context, leaving gaps in understanding how to use each parameter effectively.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the tool has 4 parameters (target, message, items, interrupt). The description fails to explain any of these parameters, only mentioning segment_id which is not a parameter of this tool. The description does not compensate for the missing schema descriptions.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool sends a follow-up message to an existing subagent run. The verb 'send' and resource 'follow-up message' are specific and distinguish it from siblings like spawn, close, rollback, or wait.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explains how to use segment_id with subagent_rollback for undo, but does not provide explicit guidance on when to use this tool versus alternatives. It implies usage for follow-up messages, but lacks when-not scenarios or comparative context.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

subagent_spawnA

Start an Open Subagent MCP run.

agent_type must be "explorer" for read-only exploration or "worker" for writable work. By default, Open Subagent MCP may only access files under cwd. Repository-external paths must be declared in allowed_external_roots and still pass realpath, symlink, and sensitive path checks.

Keep timeout_seconds <= 120 for normal tasks. For larger tasks, increase max_steps first and narrow the search scope. If timeout_seconds > 120 is required, pass explicit_authorizations=["long_running_commands"].

ParametersJSON Schema
NameRequiredDescriptionDefault
agent_typeYes
messageYes
cwdYes
itemsNo
fork_contextNo
modelNo
dry_runNo
max_stepsNo
timeout_secondsNo
allowed_external_rootsNo
explicit_authorizationsNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations present, so description carries full burden. It discloses that only files under cwd are accessible, external paths must be declared and pass security checks, and that long timeouts need explicit authorization. This adds behavioral context beyond the basic 'start a run'.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Description is a single paragraph of three sentences with no wasted words. It front-loads the purpose and then adds important behavioral details. Could benefit from slight structuring (e.g., bullet points for parameters) but overall efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description covers key aspects like agent type, timeout, and external paths, but leaves many parameters (items, fork_context, dry_run, max_steps) undefined. With 11 parameters and no annotations, the description is incomplete for full autonomous selection. Output schema exists but doesn't compensate for missing parameter semantics.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, yet the description only clarifies agent_type, timeout_seconds, allowed_external_roots, and explicit_authorizations. Parameters like items, fork_context, dry_run, max_steps are left unexplained. Given the high parameter count, more parameter-level detail is needed.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool starts an Open Subagent MCP run. It distinguishes between 'explorer' (read-only) and 'worker' (writable) agent types, which differentiates it from sibling tools like subagent_close or subagent_rollback.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides clear context: agent type selection based on need, default timeout guidelines (<=120 for normal tasks, >120 requires explicit authorizations), and note about file access. Does not explicitly list when-not-to-use, but the guidance is strong and implies appropriate use.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

subagent_waitA

Wait for one or more Open Subagent MCP runs.

Results include status, summaries, changed_files, commands_run, command_effects, and rollback_segments so the MCP host can audit what the subagent did before using its answer.

ParametersJSON Schema
NameRequiredDescriptionDefault
targetsYes
timeout_msNo

Output Schema

ParametersJSON Schema
NameRequiredDescription

No output parameters

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full burden. It discloses that results include status, summaries, changed_files, etc., for audit purposes, but it does not explain blocking behavior, timeout handling, or error states. The timeout parameter is not mentioned.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description consists of two concise, front-loaded sentences. The first states the purpose, the second details the output. No extraneous information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (waiting for subagents with a timeout), the description lacks completeness. It does not address error conditions, partial results, or how to interpret outputs like 'status'. The timeout parameter is undocumented.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has 2 parameters (targets, timeout_ms) with 0% description coverage. The description does not define what 'targets' refers to (e.g., subagent IDs) or explain the timeout parameter. It adds no semantic value beyond the schema property names.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'Wait' and the resource 'one or more Open Subagent MCP runs'. This directly distinguishes it from sibling tools like subagent_spawn, subagent_close, subagent_rollback, and subagent_send_message, each of which has a different action.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage after spawning subagents, but it does not explicitly state when to use this tool versus its siblings. There is no guidance on prerequisites or when not to use it.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.

  1. 5 tool updatesv0.1.0
    • First observedsubagent_close
    • First observedsubagent_rollback
    • First observedsubagent_send_message
    • First observedsubagent_spawn
    • First observedsubagent_wait

TDQS

A3.9/5.0
Disambiguation5/5

Each tool has a distinct and clearly defined purpose: spawn, send_message, wait, rollback, and close. There is no overlap in functionality.

Naming Consistency5/5

All tools follow the consistent pattern 'subagent_' followed by a descriptive verb (or verb phrase), using snake_case throughout.

Tool Count5/5

With 5 tools, the set is well-scoped for managing subagent runs, covering all essential lifecycle operations without excess or deficiency.

Completeness5/5

The tool set covers the full lifecycle: spawning, messaging, waiting for results, rolling back changes, and closing. No obvious gaps exist for the stated purpose.

Maintenance

ActivityStale
ResponsivenessSyncing

Resources

Unclaimed servers have limited discoverability.

Looking for Admin?

If you are the server author, to access and configure the admin panel.

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    C
    maintenance
    A self-hosted MCP server that gives AI agents controlled access to a machine: filesystem, shell, background processes, git, web fetching and persistent key-value memory.
    GPL 3.0

Latest Blog Posts

MCP directory API

We provide all the information about MCP servers via our MCP API.

curl -X GET 'https://glama.ai/api/mcp/v1/servers/g2zz/open-subagent-mcp'

If you have feedback or need assistance with the MCP directory API, please join our Discord server