MCP Shell Server
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@MCP Shell Serverlist files in current directory"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
MCP Shell Server
A Model Context Protocol server for shell command execution, terminal sessions, and retained output management.
Only Linuxrestrictive mode runs supported local non-interactive commands in
the Bubblewrap-backed restrictive-v1 sandbox. The default permissive mode,
moderate, enhanced, and enhanced-fast execute commands directly on the
host. LLM or sampling evaluation is not filesystem, process, or network
isolation. Interactive terminals, remote execution, and detached execution
are not currently available in restrictive mode.
🚀 Quick Start
Installation
Choose your preferred installation method:
Global Installation (Recommended)
npm install -g @mako10k/mcp-shell-serverAfter installation, verify the CLI:
mcp-shell-server --version
mcp-shell-server --helpLocal Development Installation
git clone https://github.com/mako10k/mcp-shell-server.git
cd mcp-shell-server
npm install
npm run buildYou can also link locally for user-level usage without sudo:
npm link
mcp-shell-server --helpConfiguration for Popular MCP Clients
The minimal configurations below are direct host execution: an omitted mode
defaults topermissive, while enhanced adds evaluation but not OS
isolation. On Linux, set MCP_SHELL_SECURITY_MODE to restrictive when the
supported Bubblewrap boundary is required; otherwise provide isolation and
access control outside this server.
Claude Desktop
{
"mcpServers": {
"mcp-shell-server": {
"command": "mcp-shell-server",
"env": {
"MCP_SHELL_SECURITY_MODE": "permissive"
}
}
}
}Note: After global installation, you can use mcp-shell-server directly or npx @mako10k/mcp-shell-server
VS Code with GitHub Copilot
Create .vscode/mcp.json:
{
"servers": {
"mcp-shell-server": {
"type": "stdio",
"command": "mcp-shell-server",
"env": {
"MCP_SHELL_SECURITY_MODE": "enhanced",
"MCP_SHELL_ELICITATION": "true"
}
}
}
}Cursor
Add to MCP settings:
{
"servers": {
"mcp-shell-server": {
"type": "stdio",
"command": "mcp-shell-server",
"env": {
"MCP_SHELL_SECURITY_MODE": "permissive"
}
}
}
}📚 Documentation Map | Setup Guides | 📁 Configuration Examples
Related MCP server: Terminal MCP Server
Implementation Status
Core features are implemented. Production suitability depends on the selected execution mode and the surrounding host, identity, access-control, and resource containment measures.
Build Status
✅ TypeScript compilation successful
✅ All strict type checking passed
✅ Mode-specific execution-boundary validation working
✅ Core managers operational
✅ MCP integration complete
Key Achievements
🔐 Explicit Execution Boundaries: Bubblewrap-backed restrictive execution and clearly identified direct-host modes
🖥️ 13 MCP Tools: Shell execution, retained outputs, terminals, and command history
📊 Execution Tracking: Query execution state and retained output
🖥️ Terminal Sessions: Interactive PTY-based terminals
📁 Retained Outputs: Managed output reading, deletion, and cleanup
🔌 MCP Integration: Tool discovery and invocation over the MCP SDK
Features
🛡️ Security Controls and Execution Boundaries
Bubblewrap sandboxing for restrictive local non-interactive execution
Fail-closed unsupported restrictive routes
Canonical request-path validation
Execution-time and output limits
Mode and launcher receipts in successful execution responses
🔧 Shell Operations
Multiple execution modes: foreground, background, detached, adaptive
🆕 Pipeline Feature: Command chaining with
input_output_idparameter🆕 Intelligent Guidance: Adaptive mode provides usage hints when commands transition to background
Background process management with timeout handling
Configurable timeouts and output limits
Environment variable control
Input/output capture and partial output support
💻 Terminal Management
Interactive terminal sessions
Multiple shell support (bash, zsh, fish, PowerShell)
🆕 Control Code Support: Send control characters and escape sequences
🆕 Program Guard: Guarded input targeting with process validation
🆕 Foreground Process Detection: On-demand process information
Resizable terminals
Command history
Incremental output reads with tracked positions
🔐 Evaluation and Guard Features
🆕 Enhanced Evaluator: LLM-assisted command evaluation
LLM-based security evaluation with detailed reasoning
Context-aware risk assessment
Intelligent alternative suggestions
Built-in user intent elicitation for complex scenarios
🆕 Program Guard System: Checks a requested process target before terminal input
Target specific processes by name, path, or PID
Session leader detection and validation
Fail-closed behavior when a requested target cannot be verified
🆕 Control Code Parsing: Text forms for terminal control sequences
Mode-specific isolation receipts
Explicit migration failure for legacy custom command lists
📁 File Operations
Output file management
🆕 Automatic Cleanup: Age- and size-based cleanup suggestions with configurable retention policies
🆕 Storage Analysis: Managed-output counts and sizes used for cleanup suggestions
Managed retained-output metadata
Retained-output reading with encoding support
Batch retained-output deletion
📊 Execution State and History
Execution status lookup
Retained-output metadata and cleanup
Command-history query and analytics
Installation
# Clone the repository
git clone https://github.com/mako10k/mcp-shell-server.git
cd mcp-shell-server
# Install dependencies
npm install
# Build the project
npm run buildQuick Start
# Start the MCP server
npm start
# Or run in development mode
npm run devUsing with MCP Client
import { Client } from '@modelcontextprotocol/sdk/client/index.js';
import { StdioClientTransport } from '@modelcontextprotocol/sdk/client/stdio.js';
const transport = new StdioClientTransport({
command: 'node',
args: ['dist/index.js']
});
const client = new Client(
{ name: 'mcp-client', version: '1.0.0' },
{ capabilities: {} }
);
await client.connect(transport);
// Execute a shell command
const result = await client.request({
method: 'tools/call',
params: {
name: 'shell_execute',
arguments: {
command: 'echo "Hello from MCP Shell Server!"',
execution_mode: 'foreground'
}
}
});
console.log(result);🆕 New Features in v2.1.8
Intelligent Command Guidance
Automatic guidance when commands transition to background execution:
// When a command times out or exceeds size limits, get helpful guidance
const result = await client.request({
method: 'tools/call',
params: {
name: 'shell_execute',
arguments: {
command: 'find /usr -name "*.so"',
execution_mode: 'adaptive',
max_output_size: 1024
}
}
});
// Response includes guidance for pipeline processing
console.log(result.guidance.pipeline_usage);
// "input_output_id" reads the retained transition snapshot; wait for completion for final output.Automatic File Cleanup
Cleanup suggestions and automated maintenance:
// Get cleanup suggestions
const suggestions = await client.request({
method: 'tools/call',
params: {
name: 'get_cleanup_suggestions',
arguments: {
max_age_hours: 24,
max_size_mb: 50
}
}
});
// Perform automatic cleanup with retention policies
const cleanup = await client.request({
method: 'tools/call',
params: {
name: 'perform_auto_cleanup',
arguments: {
dry_run: false,
max_age_hours: 24,
preserve_recent: 10
}
}
});🆕 Previous Features in v2.1.0
Control Code Support
// Send Ctrl+C to interrupt a process
await client.request({
method: 'tools/call',
params: {
name: 'terminal_operate',
arguments: {
terminal_id: 'terminal_123',
input: '^C',
control_codes: true
}
}
});
// Send ANSI escape sequences for colored output
await client.request({
method: 'tools/call',
params: {
name: 'terminal_operate',
arguments: {
terminal_id: 'terminal_123',
input: '\\x1b[31mRed Text\\x1b[0m',
control_codes: true
}
}
});Program Guard
// Only allow input to bash processes
await client.request({
method: 'tools/call',
params: {
name: 'terminal_operate',
arguments: {
terminal_id: 'terminal_123',
input: 'echo "guarded command"',
send_to: 'bash',
execute: true
}
}
});
// Target specific process by PID
await client.request({
method: 'tools/call',
params: {
name: 'terminal_operate',
arguments: {
terminal_id: 'terminal_123',
input: '^C',
send_to: 'pid:12345',
control_codes: true
}
}
});Usage
Basic Usage
npm startCLI Usage
mcp-shell-server --help
mcp-shell-server --versionThe server supports various environment variables (see sections below), such as:
BACKOFFICE_ENABLED,BACKOFFICE_PORTEXECUTION_BACKENDandEXECUTOR_*for remote executorMCP_SHELL_DEFAULT_WORKDIR,MCP_SHELL_ALLOWED_WORKDIRSMCP_DISABLED_TOOLS
Development
npm run devBuild
npm run buildTesting
npm testConfiguration
The server security mode and trusted workspace roots are startup configuration supplied through environment variables. They are not mutable through the public MCP tool surface.
Default Execution Settings
The default mode is
permissive: commands execute directly on the host and are not blocked by a command allow/block policyWorking-directory roots limit which existing directory may be selected; this validation is not a child-process sandbox or filesystem confinement boundary
60-second request timeout, subject to the default 300-second startup policy cap
Bounded retained command output; no per-process CPU, PID, or memory containment
Use MCP_SHELL_SECURITY_MODE=restrictive on Linux with Bubblewrap for the fail-closed
restrictive-v1 sandbox. Other modes remain direct host execution; legacy custom command-list
configuration requires migration and does not execute.
Disabling Tools
Set MCP_DISABLED_TOOLS to a comma-separated list of tool names to disable.
Disabled tools will not appear in the tool list and cannot be called.
Environment Variables
The server supports the following environment variables for configuration:
General Configuration
MCP_DISABLED_TOOLS: Comma-separated list of tool names to disableexport MCP_DISABLED_TOOLS="terminal_operate,delete_execution_outputs"
Working Directory Configuration
MCP_SHELL_DEFAULT_WORKDIR: Set the default working directory for all command executionsexport MCP_SHELL_DEFAULT_WORKDIR="/home/user/projects"MCP_SHELL_ALLOWED_WORKDIRS: Comma-separated list of allowed working directoriesexport MCP_SHELL_ALLOWED_WORKDIRS="/home/user/projects/project-a,/home/user/projects/project-b"
Security Configuration
MCP_SHELL_SECURITY_MODE: Set the default security mode (permissive,moderate,restrictive,enhanced,enhanced-fast, orcustom)export MCP_SHELL_SECURITY_MODE="enhanced"MCP_SHELL_BWRAP_PATH: Optional trusted absolute path to Bubblewrap. Restrictive mode otherwise checks/usr/bin/bwrapand/bin/bwrap.MCP_SHELL_ELICITATION: Enable user intent elicitation for complex scenarios (for enhanced modes)export MCP_SHELL_ELICITATION="true"MCP_SHELL_LLM_API_KEY: API key for LLM-based command evaluation (optional, falls back to MCP sampling)MCP_SHELL_LLM_TIMEOUT: Timeout for LLM evaluation in seconds (default: 30)
Execution Limits
MCP_SHELL_MAX_EXECUTION_TIME: Default maximum execution time in secondsexport MCP_SHELL_MAX_EXECUTION_TIME="300"
Per-process memory is not limited by this server. Apply an external cgroup or service-manager limit when memory containment is required.
Complete Configuration Example
# Security settings
export MCP_SHELL_SECURITY_MODE="restrictive"
export MCP_SHELL_MAX_EXECUTION_TIME="300"
# Working directory settings
export MCP_SHELL_DEFAULT_WORKDIR="/home/user/projects"
export MCP_SHELL_ALLOWED_WORKDIRS="/home/user/projects/project-a"
# Tool restrictions
export MCP_DISABLED_TOOLS="terminal_operate,delete_execution_outputs"
# Start the server
npm startNote: restrictive requires Linux and a successfully probed Bubblewrap provider. Provider absence or setup failure stops the request; it never falls back to direct host execution.
Startup Security Configuration
Select the security mode with MCP_SHELL_SECURITY_MODE before starting the server. The public MCP API intentionally does not expose security_set_restrictions, because an evaluated client must not be able to downgrade its own execution boundary.
Security Modes:
permissive/moderate: Direct, unconfined host execution. Command evaluation is not an OS isolation boundary.restrictive: Full Bash syntax runs insiderestrictive-v1: approved workspace mounted read-only, private/tmp, fixed environment, and no IP network. Foreground, background, and adaptive local execution are supported. The enhanced evaluator is bypassed because OS confinement, rather than client sampling support, is the required execution gate.enhanced/enhanced-fast: LLM/Sampling evaluation followed by direct, unconfined host execution. Evaluation does not provide filesystem or process isolation.custom: Legacy command-list configurations returnCUSTOM_MODE_MIGRATION_REQUIREDbefore process creation.
Restrictive mode temporarily rejects interactive terminals, remote execution, detached execution, request environment overrides, and workspaces containing special filesystem endpoints with stable SANDBOX_* codes in an MCP tool-error result's structuredContent.code. A successful response includes execution_isolation describing the actual launcher and profile.
API Reference
Shell Operations
shell_execute
Execute shell commands with various execution modes. Interactive terminal creation is unavailable in restrictive mode until a reviewed sandboxed PTY boundary is provided.
Parameters:
command(required): Command to executeexecution_mode: Execution strategy for the command:'foreground': Wait for command completion within timeout_seconds. Best for quick commands'background': Run asynchronously, monitor viaprocess_get_execution. Best for long-running processes'detached': Fire-and-forget execution, minimal monitoring. Best for independent processes'adaptive'(default): Start foreground for foreground_timeout_seconds, then switch to background if needed. Best for unknown execution times
input_output_id: Use output from another command as input (Pipeline feature)working_directory: Working directoryenvironment_variables: Environment variablestimeout_seconds: Maximum execution timeout (default: 60s; all modes respect this limit)foreground_timeout_seconds: For adaptive mode: initial foreground phase timeout (default: 15s)return_partial_on_timeout: Return partial output on timeoutmax_output_size: Maximum retained output size (default: 5 MiB; schema maximum: 100 MiB)create_terminal: Create new interactive terminal sessionterminal_shell: Shell type for new terminal ('bash', 'zsh', 'fish', etc.)terminal_dimensions: Terminal dimensions {width, height}
Examples:
Regular command execution:
{
"command": "ls -la",
"execution_mode": "foreground"
}Adaptive execution with intelligent background transition:
{
"command": "long-running-process",
"execution_mode": "adaptive",
"foreground_timeout_seconds": 10,
"timeout_seconds": 300,
"return_partial_on_timeout": true
}Pipeline Feature - Command Chaining: The MCP Shell Server supports command chaining through the Pipeline feature, allowing output from one command to be used as input for another command:
Step 1: execute the first command and retain its output_id:
{
"command": "cat input.txt",
"execution_mode": "foreground"
}Step 2: use the returned output_id as input:
{
"command": "grep 'pattern'",
"execution_mode": "foreground",
"input_output_id": "abc123..."
}Important Notes:
Pipeline feature is different from shell pipes (
|)Each command requires a separate
shell_executecallUse
output_idfrom first command's response asinput_output_idfor second commandIf the source execution is still running,
input_output_idreads its retained transition snapshot; it is not a live stream. Wait for completion before consuming final outputFileManager automatically handles data transfer between commands
The schema accepts retained-output limits up to 100 MiB; the default is 5 MiB
Adaptive Mode Features:
Automatically transitions to background when
foreground_timeout_secondsis reachedTransitions to background when
max_output_sizeis reached (for efficiency)Returns
transition_reasonin response:"foreground_timeout"or"output_size_limit"Captures partial output during transitions and saves to FileManager
Single process execution (no duplicate commands)
Respects total
timeout_secondslimit for background phase
Create new terminal session:
{
"command": "vim file.txt",
"create_terminal": true,
"terminal_shell": "bash",
"terminal_dimensions": {"width": 120, "height": 40}
}process_get_execution
Get detailed information about a command execution.
shell_set_default_workdir
Set the default working directory for command execution.
Retained Output Management
list_execution_outputs
List retained command outputs with execution, type, and name filters.
read_execution_output
Read retained output by output_id.
delete_execution_outputs
Delete retained outputs with explicit confirmation.
get_cleanup_suggestions
Inspect retained-output age and storage usage and return cleanup candidates.
perform_auto_cleanup
Apply age and retention policies, with dry-run support.
Terminal Management
terminal_operate
Create a host terminal, send input, resize it, and retrieve output through one
tool. Mutation is unavailable in restrictive mode. Important parameters include
terminal_id, command, input, execute, control_codes, send_to,
dimensions, and get_output.
terminal_list
List active terminal sessions.
terminal_get_info
Get detailed terminal information.
terminal_close
Close a terminal session.
Command History
command_history_query
Query command history by execution ID, search filters, pagination, or analytics.
Architecture
mcp-shell-server/
├── src/
│ ├── core/ # Core managers
│ │ ├── process-manager.ts
│ │ ├── terminal-manager.ts
│ │ ├── file-manager.ts
│ │ └── monitoring-manager.ts
│ ├── security/ # Security components
│ │ └── manager.ts
│ ├── tools/ # MCP tool handlers
│ │ └── shell-tools.ts
│ ├── types/ # Type definitions
│ │ ├── index.ts
│ │ └── schemas.ts
│ ├── utils/ # Utilities
│ │ ├── errors.ts
│ │ └── helpers.ts
│ ├── server.ts # Main MCP server
│ └── index.ts # Entry point
└── docs/
└── specification.mdSecurity Considerations
Execution Boundary: Only restrictive local non-interactive execution is OS-confined by Bubblewrap; other modes are explicitly unconfined
Path Validation: Existing request paths and working directories use canonical component-boundary checks; this alone is not a child-process filesystem sandbox
Resource Limits: Execution-time and host-memory output-retention limits are enforced by the server; complete cgroup-backed CPU/memory containment is not provided
Operational Records: After
shell_executeobtains an initial execution result, it attempts to add command metadata to command history; selected lifecycle and error events are also logged. This is not a complete or tamper-evident audit trail for every MCP tool callFail-closed Sandbox: Restrictive requests never fall back to host execution when Bubblewrap or a covered route is unavailable
Restrictive launch rejects observed sockets, FIFOs, devices, and unknown special entries below the approved root. Keep sensitive runtime endpoints outside approved roots: nested mounts, FUSE behavior, and concurrent host mutation after inspection remain outside this expedited profile's local-operator threat model.
Every readable regular file below the selected approved root is readable inside restrictive mode. Read-only prevents modification, not disclosure, so configure the narrowest project root and never approve a home directory or another tree containing credentials.
Error Handling
The server provides categorized application error codes in MCP tool-error structuredContent.code:
AUTH_*: Authentication and authorization errorsPARAM_*: Parameter validation errorsRESOURCE_*: Resource not found or limit errorsEXECUTION_*: Command execution errorsSYSTEM_*: System and internal errorsSECURITY_*: Security policy violations
Performance
Concurrent Processes: Default limit of 50 simultaneous processes
Terminal Sessions: Default limit of 20 active terminals
Retained Outputs: Up to 10,000 managed output entries
Output Bound: Default 5 MiB and maximum 100 MiB per
shell_executerequestExternal Containment: CPU, PID, and per-process memory limits require an external service manager or cgroup
Platform Support
Linux, macOS, and Windows support direct-host execution
The
restrictive-v1Bubblewrap boundary is Linux-onlyInteractive terminal availability depends on a working
node-ptyinstallation
Contributing
Fork the repository
Create a feature branch
Add tests for new functionality
Ensure all tests pass
Submit a pull request
License
MIT License - see LICENSE file for details.
Version History
The current package version is 2.8.1. See CHANGELOG.md for release history and behavior changes.
Documentation
Core Documentation
API Specification - Complete API reference
Control Codes Guide - Terminal control sequences and escape codes
Program Guard Manual - Guarded terminal input and process targeting
Document Provenance - Sealgraph dependency and review workflow
Documentation Map - Current documents and historical design material
Examples
Control Codes Demo - Control code usage examples
Program Guard Demo - Guarded-input examples
Getting Started
Review the API Specification for complete tool documentation
Check out Control Codes Guide for advanced terminal features
Learn about Program Guard for process-targeted terminal input
Available Tools
13 toolscommand_history_queryA
Universal command history query tool with pagination, search, individual reference, and analytics capabilities. Supports: entry references via execution_id (avoiding duplication with process_get_execution), analytics (stats/patterns/top_commands), paginated search with date filtering. Use this for all command history operations.
| Name | Required | Description | Default |
|---|---|---|---|
| page | No | Page number for pagination (1-based) | |
| query | No | Search term to filter commands (case-insensitive partial match) | |
| date_to | No | Filter entries to this date (ISO string) | |
| entry_id | No | Get specific entry by execution_id | |
| date_from | No | Filter entries from this date (ISO string) | |
| page_size | No | Number of entries per page (1-100) | |
| was_executed | No | Filter by execution status | |
| analytics_type | No | Type of analytics to return: "stats" (general statistics), "patterns" (user confirmation patterns), "top_commands" (most frequent commands) | |
| command_pattern | No | Filter by command using substring match (case-insensitive) | |
| working_directory | No | Filter by working directory | |
| include_full_details | No | Include full entry details or just metadata with IDs | |
| safety_classification | No | Filter by safety classification |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It communicates that the tool is universal, supports pagination, search, analytics, and entry references, and that include_full_details toggles metadata vs. full details. However, it does not disclose the response shape (e.g., whether analytics results differ structurally), default pagination behavior, or how filters interact. The description mentions pagination but lacks details like defaults and limits, which is a moderate gap.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single paragraph with a clear lead sentence, a capability list, and a routing instruction. It is front-loaded with the universal query role and avoids excessive length. The list of capabilities is concise, although it reads somewhat like a feature dump rather than a tight behavioral contract.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with 12 parameters, no annotations, and no output schema, the description covers the main capabilities and one routing hint, but remains incomplete. It does not specify return formats, defaults, or behavior for edge cases like combining analytics_type with query filters. Given the tool's complexity, a more complete description would add operational specifics.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all 12 parameters. The description adds high-level grouping (pagination, search, analytics, entry references) that maps to the schema, but it does not add meaning beyond what the schema provides. A few parameters like analytics_type and include_full_details are mentioned in the description, but not with additional detail beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('query') and resource ('command history') and enumerates distinct capabilities (pagination, search, entry refs, analytics). It names one sibling it is not ('avoiding duplication with process_get_execution'), which helps differentiation. However, it does not systematically distinguish among the other sibling tools (e.g., list_execution_outputs, read_execution_output) beyond naming one alternative, so it falls short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly says 'Use this for all command history operations' and warns against using it for entry references via execution_id to avoid duplication with process_get_execution. This gives clear when-to-use guidance and one key exclusion, but it does not explicitly state when to use alternatives like list_execution_outputs or read_execution_output.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
delete_execution_outputsA
Delete one or more output files by their output_ids. Requires explicit confirmation flag to prevent accidental deletion. Useful for cleanup after processing results.
| Name | Required | Description | Default |
|---|---|---|---|
| confirm | Yes | Deletion confirmation flag. Must be set to true to proceed with deletion. Required to prevent accidental data loss. | |
| output_ids | Yes | List of output file IDs to delete. Get these from list_execution_outputs. All specified files will be permanently removed. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It mentions the mandatory confirmation flag to prevent accidental deletion, which signals destructive behavior, but does not explicitly state permanence, irreversibility, or potential side effects beyond what the schema already conveys.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three short sentences, each earning its place: the action, the safety requirement, and the typical use case. Information is front-loaded and there is no redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple delete operation with well-documented schema and clear safety guidance, the description is reasonably complete. The only gap is lack of explicit differentiation from perform_auto_cleanup, which could affect tool selection in cleanup scenarios.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and both parameters have detailed descriptions in the schema. The tool description adds no extra parameter nuance, so the baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Delete'), a clear resource ('output files'), and the identifier used ('output_ids'). This distinguishes it from sibling tools like list_execution_outputs and read_execution_output without ambiguity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides a clear usage context ('cleanup after processing results'). However, it does not explicitly mention when to avoid this tool or how it relates to perform_auto_cleanup, leaving some selection inference to the agent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
get_cleanup_suggestionsB
Get automatic cleanup suggestions for output file management. Analyzes current directory size and file age to recommend cleanup candidates. Helps manage disk usage by identifying old or large files.
| Name | Required | Description | Default |
|---|---|---|---|
| max_size_mb | No | Size threshold in MB for cleanup warnings. Default: 50MB. | |
| max_age_hours | No | Age threshold in hours for cleanup candidates. Default: 24 hours. | |
| include_warnings | No | Whether to include cleanup recommendations. Default: true. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full behavioral burden. It discloses that the tool analyzes directory size and file age, and the words 'suggestions' and 'recommend' strongly imply a non-destructive read operation. However, it never explicitly states that no files are deleted or modified, which is a meaningful gap given the existence of the perform_auto_cleanup sibling. No contradiction with annotations exists because none were provided.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The first sentence is front-loaded and effective. However, the second sentence ('Analyzes current directory size and file age to recommend cleanup candidates') and the third sentence ('Help manage disk usage by identifying old or large files') substantially overlap, since old files correspond to file age and large files correspond to directory size. The redundancy means not every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with three optional, fully documented parameters, the core invocation details are present. Given there is no output schema, the description could reasonably be expected to hint at the return format (e.g., what a recommendation contains: file paths, sizes, warnings) and to state explicitly that the tool never mutates data. Those two gaps keep it from being complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all three parameters with defaults and meanings. The description adds only high-level conceptual alignment (directory size maps to max_size_mb, file age maps to max_age_hours, warnings map to include_warnings) without new semantic detail, which matches the baseline of 3.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The opening sentence, 'Get automatic cleanup suggestions for output file management,' names a specific verb, resource, and scope, and the following sentence states the concrete analysis criteria (current directory size, file age). It implicitly distinguishes itself from siblings like perform_auto_cleanup and delete_execution_outputs by framing the output as 'suggestions' rather than actions, but it never names those alternatives or explicitly states that no cleanup is performed.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Helps manage disk usage by identifying old or large files' gives a reasonable usage context, but there is no explicit when-to-use versus when-not-to-use guidance, no stated exclusions, and no mention of the relevant siblings (perform_auto_cleanup, delete_execution_outputs) that would perform the actual deletion. The intended use is implied rather than spelled out.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_execution_outputsA
List all output files generated by command executions, including stdout, stderr, and log files. Supports filtering by execution ID, output type, or filename pattern.
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of files to return (1-1000). Use for pagination through large file lists. | |
| output_type | No | Filter by output type: "stdout" (standard output), "stderr" (error output), "combined" (both), "log" (execution logs), or "all" (no filter) | |
| execution_id | No | Filter files by the execution that created them. Use execution_id from shell_execute results. | |
| name_pattern | No | Filter by filename using substring match (case-insensitive). E.g., ".log" will match all log files. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description shoulders the full burden. It states the tool lists all outputs and supports filtering, but does not disclose behavior like pagination limits beyond the schema default, ordering, return structure, or whether it only returns metadata. These gaps are notable for a list tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the core action and scope. The list of output types is slightly redundant with the output_type enum, but the description is otherwise efficient and well ordered.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no output schema and no annotations, a complete description should mention what the returned list contains, any pagination behavior, and how to use the limit parameter effectively. The description covers filtering well but omits these practical details, making it adequate but not comprehensive.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already fully documents each parameter. The description adds a high-level mention of filtering but no extra semantic value beyond what the parameter descriptions provide. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('List') and resource ('output files generated by command executions'), and enumerates content scope (stdout, stderr, log files). It clearly distinguishes from sibling 'read_execution_output' by focusing on listing multiple files rather than reading one.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for discovering/listing output files and mentions filtering options, but it does not explicitly state when to prefer this over siblings like 'read_execution_output' or 'delete_execution_outputs'. No exclusion or alternative guidance is given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
perform_auto_cleanupA
Perform automatic cleanup of old output files based on age and retention policies. Supports dry-run preview and preserves a configurable number of recent files.
| Name | Required | Description | Default |
|---|---|---|---|
| dry_run | No | If true, preview cleanup without deleting files. Default: true. | |
| max_age_hours | No | Files older than this (in hours) will be deleted. Default: 24 hours. | |
| preserve_recent | No | Number of most recent files to preserve regardless of age. Default: 10. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description carries the full burden. It discloses the key behaviors: deletes files based on age, supports dry-run, and preserves recent files. However, it does not mention whether deletions are permanent, require permissions, or are reversible, which would be important for a destructive cleanup operation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two concise sentences with no fluff. The core purpose is stated first, followed by key capabilities (dry-run and configurable retention). Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given that there is no output schema and no annotations, the description is moderate. It covers the essential behavior and options adequately for an agent to invoke the tool, but lacks safety guidance (e.g., recommend dry-run first, confirm permanent deletion). For a destructive operation, slightly more context would improve completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema covers 100% of parameters with clear descriptions, so the schema already documents dry_run, max_age_hours, and preserve_recent. The description adds no new parameter-level detail beyond what the schema provides, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific action ('perform automatic cleanup') and target ('old output files'), with criteria ('age and retention policies'). It distinguishes itself from siblings like get_cleanup_suggestions (suggestions vs execution) and delete_execution_outputs (targeted deletion vs age-based cleanup), though it does not explicitly name those alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use it (when automatic cleanup based on age is desired) and mentions dry-run and preserving recent files, but it does not explicitly state when not to use it or point to alternative sibling tools. Usage context is implied rather than explicitly specified.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
process_get_executionA
Retrieve detailed information about a specific command execution, including status, output, execution time, and any errors. Use the execution_id returned from shell_execute.
| Name | Required | Description | Default |
|---|---|---|---|
| execution_id | Yes | Unique execution ID returned by shell_execute. Use this to retrieve detailed information about a specific command execution. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the burden of behavioral disclosure. It lists the returned information (status, output, execution time, errors) but does not mention side effects, permissions, or distinction from other read-oriented sibling tools. Since this is a retrieval operation, some traits are implied but not fully disclosed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two succinct sentences: the first states the core function and content, the second supplies the required parameter source. No fluff, and essential information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given a single-parameter tool with no output schema, the description provides adequate context about what the tool returns and how to obtain the required ID. It could further differentiate from sibling tools that also access execution outputs, but it is complete enough for effective invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already fully documents the execution_id parameter. The description repeats the same guidance ('Use the execution_id returned from shell_execute') without adding new semantic detail, thus meeting but not exceeding the baseline.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Retrieve') and resource ('detailed information about a specific command execution') and enumerates the content (status, output, execution time, errors). It clearly distinguishes this tool from siblings like shell_execute by indicating it is a follow-up retrieval step.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description instructs to use the execution_id returned from shell_execute, providing clear contextual usage. It does not explicitly mention when not to use this tool or name alternatives like list_execution_outputs, but the usage context is well implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
read_execution_outputA
Read retained output from a command execution. The output_id does not bypass max_output_size; output_truncated=true means additional data was discarded to protect server memory.
| Name | Required | Description | Default |
|---|---|---|---|
| size | No | Number of bytes to read (1B-10MB). Larger sizes may improve efficiency but use more memory. Default: 8KB. | |
| offset | No | Byte offset to start reading from (0-based). Use for reading large files in chunks or continuing from previous read. | |
| encoding | No | Character encoding for text files (utf-8, ascii, latin1, etc.). Use "binary" for non-text files. | utf-8 |
| output_id | Yes | Unique output file ID from list_execution_outputs. Use this to read a specific output file generated by command execution. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries behavioral disclosure. It reveals that this tool cannot circumvent the server's max_output_size and that output_truncated=true signals discarded data, providing memory-protection context. Read-only nature is conveyed by the name and verb 'Read'.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The two-sentence description is tightly packed with no filler; it states the core operation first, then a key caveat. That caveat earns its place by preventing a false assumption about truncation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool likely returns output content plus a truncation flag, and enough is implied by the parameter docs and description. Since no output schema exists, a bit more explicit return-format information would make it fully complete, but nothing necessary for invoking the tool is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
All four parameters have detailed descriptions in the schema, including defaults, ranges, encoding guidance, and how to obtain output_id. The top-level description does not add extra parameter meaning, so the baseline for 100% schema coverage applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly says 'Read retained output from a command execution', naming the action and target resource. It does not explicitly mention sibling tools, but reading an output is distinct from listing/executing it. The 'retained output' phrase clarifies this operates on pre-existing results.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit when-to-use or alternative tool guidance. The note that output_id does not bypass max_output_size offers a boundary condition, and the output_id schema says IDs come from list_execution_outputs, but the main description leaves usage decisions mostly implicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
shell_executeA
Execute shell commands with bounded output retention. When output_id is present, read_execution_output returns the retained output; output_truncated=true means data beyond max_output_size was not retained. Supports adaptive execution mode and input_output_id pipeline operations. NOTE: This is MCP Shell Server tool - do NOT use VS Code internal run_in_terminal parameters like "explanation" or "isBackground".
| Name | Required | Description | Default |
|---|---|---|---|
| command | Yes | Shell command to execute (e.g., "ls -la", "npm install", "python script.py"). Restrictive mode permits full shell syntax only inside its required Bubblewrap profile; other executable modes are not OS-confined. NOTE: This is MCP Shell Server - do NOT use VS Code internal run_in_terminal parameters like "explanation". | |
| comment | No | Optional comment from the LLM client explaining the intent or context behind this command execution. This helps the command evaluator understand the broader context, but will be treated as advisory only and not blindly trusted. | |
| input_data | No | Standard input data to provide to the command. Useful for commands that read from stdin. | |
| session_id | No | Session ID for grouping related command executions. Used for process management and filtering in process_list. | |
| capture_stderr | No | Whether to capture standard error output in addition to stdout. When false, stderr is discarded. | |
| execution_mode | No | How the command should be executed: "foreground" (wait for completion), "background" (run async), "detached" (fire-and-forget), "adaptive" (start foreground, switch to background for long-running commands) | adaptive |
| terminal_shell | No | Shell type for the new terminal (bash, zsh, fish, cmd, powershell). Only used when create_terminal is true. | |
| create_terminal | No | Create a new interactive terminal session instead of running command directly. Restrictive mode rejects this route with SANDBOX_TERMINAL_UNAVAILABLE. | |
| input_output_id | No | Output ID from previous command execution to use as input. Alternative to input_data for pipeline operations. | |
| max_output_size | No | Maximum output size in bytes (1KB-100MB). Output will be truncated if it exceeds this limit. Default: 5MB. | |
| timeout_seconds | No | Global timeout (1-3600s). Default: 60s. Per execution_mode (effective limits before execution starts): • foreground: Schema allows 1-3600s, but the default security policy caps runs at 300s. Increase MCP_SHELL_MAX_EXECUTION_TIME in trusted startup configuration when a larger cap is required. • background: 1-3600s. Intended for >300s runs; still subject to the same security cap (300s by default) unless raised. • detached: 1-3600s. Shares the security cap behavior with background. • adaptive: 1-3600s total cap. The initial foreground phase also respects foreground_timeout_seconds (≤300s) and the security cap. Guidance: For long-running tasks (>300s), raise max_execution_time or use background/adaptive modes. | |
| working_directory | No | Directory where the command should be executed. If not specified, uses the default working directory set by shell_set_default_workdir or the initial server directory. | |
| force_user_confirm | No | Force user confirmation regardless of LLM evaluation result. Use this to test ELICITATION functionality or when direct user confirmation is required even if the evaluator would allow the command. | |
| terminal_dimensions | No | Terminal dimensions in characters (width x height). Only used when create_terminal is true. Default: 120x30. | |
| environment_variables | No | Environment variables to set for direct host execution. Restrictive mode rejects request environment overrides with SANDBOX_ENV_UNSUPPORTED. | |
| return_partial_on_timeout | No | When timeout occurs, return partial output collected so far instead of an error. Useful for monitoring long-running commands. | |
| foreground_timeout_seconds | No | Initial foreground window for adaptive mode (1-300s). Behavior by execution_mode: • adaptive: Duration to remain in foreground before automatically switching to background if the command is still running. Must be ≤ timeout_seconds. • foreground: Does not trigger background switching (value is effectively unused for switching). Use background/adaptive for >300s scenarios. • background/detached: Ignored. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the burden of behavioral disclosure. It does disclose truncation behavior, output retention, pipeline support, and adaptive execution. However, for an arbitrary shell command executor, it does not mention potential side effects, permission requirements, sandbox restrictions, or that commands may modify the system.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is front-loaded with the core purpose and is reasonably compact. The note about VS Code parameters is somewhat extra but helps prevent common misuse. Each sentence contributes useful context without excessive verbosity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a complex tool with 17 parameters and no output schema, so the description must partly explain return behavior. It covers output_id and output_truncated, but it does not describe the full return value or how immediate stdout/stderr and exit status are surfaced, leaving a meaningful gap for an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3. The description adds some cross-parameter meaning by linking output_id to read_execution_output and output_truncated to max_output_size, but most parameter semantics are already thoroughly covered by the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb and resource: 'Execute shell commands.' It further distinguishes itself from related tools by explaining bounded output retention and explicitly referencing read_execution_output, making its role clear among siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives useful context about output retention, output_id, adaptive mode, and pipeline operations, and it warns against VS Code-specific parameters. However, it does not explicitly state when to use this tool versus sibling tools such as terminal_operate, process_get_execution, or command_history_query, leaving some routing to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
shell_set_default_workdirC
Set the default working directory for command execution
| Name | Required | Description | Default |
|---|---|---|---|
| working_directory | Yes | Absolute path to set as the default working directory for all subsequent command executions. Must be an existing, accessible directory. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description alone must disclose the tool's behavioral traits. It only says 'set default working directory' without explaining persistence, session scope, how to reset, or side effects on subsequent commands. The description does not contradict annotations (none exist) but fails to expose key behavioral facts.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, straightforward sentence that states the action and object clearly without unnecessary words. It front-loads the primary function. It is appropriately sized for a simple setter tool, though it could be expanded with usage context without losing conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity (one parameter, no output schema), the description is minimal but incomplete: it does not state the scope of the setting (e.g., whether it applies to all subsequent executions), how it interacts with shell_execute, or any reset mechanism. The schema describes the parameter but the tool's broader execution context is left to inference.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the sole working_directory parameter is already documented in the schema. The description adds little beyond restating that it sets the directory, which is essentially the parameter's purpose. Hence a baseline 3 is appropriate; the description provides no extra parameter details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('Set') and a clear resource ('default working directory for command execution'), which distinguishes it from execution and observation tools among the siblings. It is not a tautology and gives enough to understand the core purpose, though it doesn't explicitly name alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to use this tool vs. shell_execute or terminal_operate. The phrase 'for command execution' hints that it is a prerequisite, but there is no explicit statement of when to use or when not to use it, nor any alternative naming.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
terminal_closeC
Close terminal session
| Name | Required | Description | Default |
|---|---|---|---|
| terminal_id | Yes | Unique terminal ID from terminal_create or terminal_list. All processes in this terminal will be terminated. | |
| save_history | No | Whether to save the command history before closing. History can be restored when creating future terminals. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full responsibility for disclosing behavior. It only states 'Close terminal session' without mentioning that closing terminates all processes in the terminal, any side effects, or whether history saving is affected. Significant behavioral details are absent.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no wasted words, achieving high conciseness. It is appropriately front-loaded with the action, though it could benefit from a bit more context without becoming verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool that closes a terminal, the description is too sparse. It does not explain the outcome of closing (e.g., process termination, session cleanup) or what the agent can expect in response. Given no output schema, the description should clarify the result, but it remains minimal.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for both parameters (terminal_id and save_history), and each has a detailed description. The tool description adds no extra parameter information, but the schema already fully documents them, making the baseline of 3 appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description 'Close terminal session' clearly states a specific verb (close) and resource (terminal session), effectively distinguishing it from sibling tools like terminal_operate or terminal_list. It is concise but unambiguous about the action performed.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance is provided on when to use this tool versus alternatives like terminal_operate or shell_execute. No prerequisites or conditions are mentioned, leaving the agent to infer usage from the name and description alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
terminal_get_infoC
Get terminal detailed information
| Name | Required | Description | Default |
|---|---|---|---|
| terminal_id | Yes | Unique terminal ID from terminal_create or terminal_list. Use this to get detailed information about a specific terminal session. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden of behavioral disclosure. 'Get' implies a read operation, but the description does not explicitly state whether the tool is read-only, whether it makes any state changes, or what happens for invalid terminal IDs. There is no mention of side effects or internal behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise with no fluff. It clearly states the core action. However, it is so brief that it misses key context; still, for a simple single-parameter read tool, brevity can be considered appropriate.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and no annotations, the description should explain what 'detailed information' includes and how it differs from terminal_list. It does not mention return format, possible errors, or behavior. The tool is simple enough that a slightly richer description would have been sufficient, but it currently lacks completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the parameter terminal_id is already well-documented with its source and purpose. The description adds no additional parameter meaning, but the schema covers it adequately; hence baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description states a clear verb-resource pair: 'Get terminal detailed information'. However, it does not differentiate from sibling tools like terminal_list, which likely also returns terminal information, so there is a slight ambiguity about which tool returns overview vs details.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The main description gives no guidance on when to use this tool versus alternatives. The parameter schema hints that terminal_id comes from terminal_create or terminal_list and that this gets details for a specific session, but this is not stated in the tool description itself. There is no explicit mention of exclusions or when to prefer sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
terminal_listC
List active terminal sessions
| Name | Required | Description | Default |
|---|---|---|---|
| limit | No | Maximum number of terminals to return (1-200). Use for pagination through large terminal lists. | |
| status_filter | No | Filter by terminal status: "active" (currently running commands), "idle" (waiting for input), "all" (no filter) | |
| session_name_pattern | No | Filter terminals by session name using substring match (case-insensitive). E.g., "dev" will match "development", "devtools", etc. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It only says 'List active terminal sessions' and does not disclose whether the operation is read-only, what the response looks like, whether pagination is supported (though implied by 'limit'), or what the default status behavior is. This leaves important behavioral traits unstated.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence with no unnecessary words, which earns points for brevity. However, it is so terse that it omits useful behavioral detail, so it is not fully effective despite being concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema and no annotations, the description should provide some context about return values and how results relate to sibling tools. It does not explain what the response contains, whether terminal identifiers are returned, or how to use results with terminal_get_info or terminal_operate. The default status behavior is also ambiguous given the status_filter parameter.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage and provides detailed meanings for all three parameters, including the limit range, status enum values, and substring matching semantics. The description itself adds no parameter information, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states a specific verb ('List') and resource ('active terminal sessions'). It differentiates from sibling operations like terminal_operate and terminal_close by focusing on listing, though it does not explicitly name them. The word 'active' is slightly inconsistent with the status_filter parameter that allows idle and all.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to use this tool versus alternatives like terminal_get_info or terminal_operate. There is no mention of typical workflows, prerequisites, or conditions that would make this tool the right choice. The agent must infer usage solely from the name and schema.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
terminal_operateB
Unified host-terminal operations: create sessions, send input, and get output with automatic position tracking. Creation and input are unavailable in restrictive sandbox mode.
| Name | Required | Description | Default |
|---|---|---|---|
| input | No | Input to send to terminal. Can be partial input or complete command. | |
| command | No | Command to execute in a terminal. Terminal creation and input are unavailable in restrictive mode. | |
| execute | No | Whether to press Enter after sending input (execute command) | |
| send_to | No | Program guard target to ensure input is sent to the correct process. Can be process name, path, "pid:12345", "sessionleader:", or "*" for any process. | |
| dimensions | No | Terminal dimensions. For new terminals: initial size. For existing terminals: resize if different from current size. | |
| get_output | No | Whether to retrieve terminal output after operations | |
| shell_type | No | Shell type for new terminal | bash |
| force_input | No | Force input even if unread output exists. Default: false (input rejected if unread output exists). | |
| terminal_id | No | Existing terminal ID to use. If not provided, creates a new host terminal when command is specified. Creation is unavailable in restrictive mode. | |
| include_ansi | No | Include ANSI codes in output | |
| output_lines | No | Number of output lines to retrieve | |
| session_name | No | Name for new terminal session | |
| control_codes | No | Whether to interpret input as control codes | |
| response_level | No | Response detail level: minimal (only essential data, fastest), standard (balanced info for most use cases), full (complete details, maximum information) | standard |
| output_delay_ms | No | Delay in milliseconds before retrieving output (allows command to complete) | |
| working_directory | No | Working directory for new terminal | |
| return_terminal_info | No | Include terminal information in response | |
| environment_variables | No | Environment variables for new terminal |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
没有注解,描述承担全部行为披露责任。它提及了自动位置跟踪和限制模式下的不可用性,提供了部分行为约束;但未说明权限要求、影响范围、失败行为或返回内容,对18个参数的综合操作工具来说信息仍偏少。
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
描述简短且有信息密度,将核心功能列在句首,随后补充关键限制。没有冗余,但内容非常少,对一个多功能工具来说略过于简略,故不能给出满分的5分。
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
考虑到工具包含18个参数、嵌套对象且无输出 schema,描述只提供一个高度概括的定义,没有解释参数之间的协作,比如何时可新建会话、何时复用 terminal_id。对智能体正确调用来说,上下文仍不充分。
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
输入 schema 的字段描述覆盖率达100%,所有参数在 schema 中均有说明。描述并未额外提供参数关联性或使用层面的语义,例如 terminal_id 与 command 条件的关系,符合高覆盖下的 baseline 3分。
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
描述以一个明确的动名词序列(create sessions, send input, get output)配上资源(host terminals)开头,能够让智能体立即理解工具职责。但它没有与兄弟工具(如 shell_execute、terminal_get_info)做区分,也没有指出自己与这些工具的分界,因此不是最高的5分。
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
描述完全没有说明何时使用本工具而非兄弟工具(如 shell_execute 用于直接执行命令),也没有给出任何流程性的使用指引。唯一提及的‘在限制模式下不可用’是环境限制而非选择条件。
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
13 tool updates
v2.8.1- First observed
command_history_query - First observed
delete_execution_outputs - First observed
get_cleanup_suggestions - First observed
list_execution_outputs - First observed
perform_auto_cleanup - First observed
process_get_execution - First observed
read_execution_output - First observed
shell_execute - First observed
shell_set_default_workdir - First observed
terminal_close - First observed
terminal_get_info - First observed
terminal_list - First observed
terminal_operate
TDQS
Most tools have clear, distinct purposes: shell_execute runs commands, process_get_execution retrieves execution details, and the various output/cleanup tools each handle different aspects. Some overlap exists between shell_execute and terminal_operate, and among cleanup-related tools, but descriptions clarify the boundaries.
Naming follows a general pattern with verbs like list, read, delete, get, close, and terminal_ prefix for terminal tools, but there are inconsistencies such as shell_execute vs process_get_execution, shell_set_default_workdir, and perform_auto_cleanup. The mixed styles (e.g., verb_noun vs noun_verb_noun) are readable but not uniform.
13 tools is well-scoped for a shell server covering execution, process info, output management, cleanup, terminal sessions, and history. Each tool contributes to the core domain without excessive redundancy.
The tool surface covers the main lifecycle: execute commands, retrieve status, manage outputs, cleanup, and query history. Minor gaps include lack of a forceful process termination tool and no direct way to modify or cancel a running execution, but most workflows are supported.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Remote MCP server for supportsheep: run AI interviews and manage support content for your blog.
Personal assistant MCP server with search, execute, packages, jobs, secrets, and integrations.
MCP server for building and testing AI agents with multi-model experimentation and insights.
Nifty's MCP server — exposes tasks, projects, messages, and files as tools for AI agents.
Related MCP Servers
- AlicenseAqualityFmaintenanceAn MCP server that enables secure terminal command execution, directory navigation, and file system operations through a standardized interface for LLMs.1098MIT
- AlicenseBqualityFmaintenanceAn MCP server that allows AI models to execute system commands on local machines or remote hosts via SSH, supporting persistent sessions and environment variables.13628MIT
- FlicenseNot gradedqualityDmaintenanceAn MCP server that gives AI assistants the ability to create, manage, and control terminal sessions through a safe, isolated tmux environment.1-
- FlicenseAqualityDmaintenanceA lightweight MCP server that provides AI assistants with access to a system's terminal through a secure terminal tool. It enables users to execute shell commands and receive stdout, stderr, and exit codes directly within an MCP-compatible client.1-
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/mako10k/mcp-shell-server'
If you have feedback or need assistance with the MCP directory API, please join our Discord server