A
licenseNot graded
qualityD
maintenanceA LangGraph-powered MCP server for infrastructure orchestration with autonomous subagents.
Apache 2.0
mcp-server-and-agent
by malcomzww
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@mcp-server-and-agentwhat are the failure rates for each topology?"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
mcp-server-and-agent
A hand-written MCP server at the JSON-RPC level, four agent topologies over it, and the failure rate of each measured under a controlled fault model. The agent brain is a deterministic simulation, not a live LLM — a scripted policy executes plans over the real MCP server while a parameterised fault process perturbs its choices at stated rates. That is the instrument, not a compromise: a topology's failure rate measured against a live model is confounded by that model's nondeterminism, and you cannot tell whether a difference came from the topology or from the sampler. Everything below is a failure rate of a topology under a fault model, never of any real model.
This repo answers one question:
What is each agent topology's failure rate, and does supervisor actually beat single-agent?
The answer
Supervisor beats single-agent, by less than it costs, and it is dominated by two simpler designs.
topology | failure rate | tokens/run | vs single | steps | handoffs |
| 31.7% | 2,449 | 1.00x | 5.44 | 0.00 |
| 28.2% | 4,238 | 1.73x | 5.16 | 3.88 |
| 21.2% | 3,244 | 1.32x | 5.37 | 1.66 |
| 4.5% | 2,996 | 1.22x | 6.31 | 0.32 |
600 runs per topology (6 tasks x 100 trials), every topology facing the identical fault stream for a given (task, trial) — a paired comparison, not four independent samples.
Supervisor's 3.5-point gain is real, not noise: paired bootstrap delta -0.035 [-0.062, -0.008] at 95%, interval excludes zero.
It costs 1.73x the tokens.
pipelineandreflexiveboth beat it on failure rate and on tokens. Paying 1.7x for the third-best outcome is the finding.The ranking
reflexive < pipeline < supervisor < singleholds across a 0.5x–2.0x sweep of the fault rates.The gaps narrow as faults rise. Topology is a second-order effect; tool reliability is the first-order one.
Full table, confidence intervals and sensitivity sweep:
results/topologies.md. Every number is generated
by scripts/generate_results.py, which asserts its own claims and exits
non-zero if they break.
Related MCP server: agentloop
The more useful answer
Under the blended fault model above the topologies look similar. Turn one fault up at a time and they are radically different — and which topology helps depends entirely on which fault you have:
failure mode | best | worst | is topology the answer? |
Infinite loop |
|
| Yes — per-unit step budgets |
Tool misselection |
|
| No — fix the schemas |
Error cascade |
|
| No — fix the error messages |
Context exhaustion |
|
| Yes — fresh contexts |
Partial failure | — | — | No — journal and compensate |
Unconfirmed destruction | — | — | No — gate the tool |
Two of six are fixed by topology, both by the same property — isolation of resources per unit of work, not supervision as such. The other four are fixed in the tool layer. Note that supervisor and pipeline are worse than single on error cascades: a fresh worker context discards the error history that would have told it not to repeat the call. Isolation contains cascades and also amputates learning.
The judgement artifact, with reproduction seeds, real traces and a mitigation
per mode: docs/failure-taxonomy.md.
Scope
Deliberately narrow. In scope: the MCP protocol surface, four topologies, six failure modes, and the token cost of each. Out of scope: anything that does not help answer the question above.
Quickstart
uv sync --extra dev
uv run pytest -q # 90 tests
uv run python scripts/generate_results.py # regenerates results/
uv run python scripts/find_failure_seeds.pyRun the MCP server against any client speaking stdio:
uv run python -m mcp_server_and_agent.serverWhat is in here
file | what it is |
| JSON-RPC 2.0 framing, error objects, request validation |
| MCP lifecycle, dispatch, idempotency dedupe, stdio loop |
| 5 tools, 1 resource, 1 prompt, the confirmation gate, rollback journal |
| the fault model — the experiment's independent variable |
| the scripted policy, the ReAct loop, the task set |
| the four topologies |
The MCP server is written against the spec, not on an SDK
initialize / tools/list / tools/call / resources/read / prompts/get
/ ping, with correct -32700 / -32600 / -32601 / -32602 / -32603
error objects. The reason is not purity: an SDK hides exactly the seams this
repo measures. Protocol conformance is one of the few things in an agent
stack that is exactly testable — a malformed request has one correct error
code — so tests/test_protocol_conformance.py covers the cases a happy-path
implementation gets wrong: notifications getting no reply, "id": null being
a request rather than a notification, batch rejection, and the boundary
below.
A tool that does not exist is -32602. A tool that exists and fails is a
successful response carrying isError. The first is a bug in the client;
the second is feedback the agent can act on. Collapsing them means the agent
either retries unfixable calls forever or gives up on recoverable ones.
Four topologies
single— one agent, the whole tool list, the whole plan. Baseline.supervisor— a supervisor dispatches each step to a fresh worker. Each dispatch pays a handoff tax because the worker starts cold.pipeline— a fixed discover → fetch → aggregate chain. No routing decision to get wrong; no re-planner when a stage fails. Context threads forward.reflexive— single agent plus exactly one reflection-and-retry pass. Chosen as the fourth because it isolates what supervisor confounds: whether a second attempt is worth more than a second agent. Both cost extra tokens; under this fault model only one adds a capability.
Provenance
Every number in this README comes from a committed script.
Date: 2026-08-25
Hardware: 24-core CPU, 32 GB RAM, no GPU
Model:
simulated-scripted-policy— no LLM involvedSeed:
20260825Reproduce:
python scripts/generate_results.pyRaw artifact:
results/topologies-raw.md(gitignored — per-task detail)Committed artifact:
results/topologies.md
CI regenerates results/ and fails on git diff --exit-code, so a
hand-edited number breaks the build. That gate only means something because
the experiment is deterministic — same seed, same failure rates — which
tests/test_topologies.py asserts in both directions.
Limitations
No LLM was involved in any measurement. The agent brain is a scripted policy and the faults are drawn from a distribution I chose. These are failure rates of topologies under a controlled fault model, not of any real model in any real deployment. What transfers is the shape of the result — which mitigation attacks which mechanism — not the values.
The fault rates are uncalibrated. Nothing here establishes that a real agent misselects a tool 16% of the time. Calibrating them requires the live runs this repo deliberately does not do, and until someone does that, the absolute rates are arbitrary and only the comparisons are meaningful.
Token counts are synthetic: a fixed charge per step plus
len(text)//4for observations. Consistent across topologies so the ratios hold; the dollar figures forecast nobody's bill.Six tasks, one server, one task shape. All six are search-then-fetch-then-aggregate. The case a supervisor is supposed to win — genuinely parallel, separable subtasks — is not represented here, and these numbers are not evidence against it. This is the single biggest thing the repo does not establish.
reflexivegets one retry the others do not. Part of its advantage is a second draw from the fault distribution rather than reflection as such.No LangGraph. The brief named it; the agent loop here is hand-written in ~200 lines because the failure modes under study are properties of the loop, and a framework would have made the step cap, context accounting and cascade detector someone else's implementation details.
Detection is measured; recovery mostly is not. Apart from the rollback path, this establishes that failures are caught, not that a system built on these mitigations completes more tasks.
Built on
llm-client-kitv0.1.0 —CostLedgerfor token and spend accounting.llm-eval-harnessv0.1.0 —stats.paired_delta_ciandis_reportablefor the confidence intervals,types.RunMetafor the provenance block.
License
MIT — see LICENSE.
Available Tools
5 toolsappend_noteB
Append a free-text note to the session note log.
ParametersJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| text | Yes | note body |
TDQS
B3.3/5.0
Behavior2/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare idempotentHint=false and destructiveHint=false, so safety is covered. The description adds only the fact it appends to a log but does not disclose side effects, permissions, or failure behavior. Given the annotations, the description contributes minimal value beyond the obvious write nature.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no extraneous detail. It efficiently conveys the core action and object.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness3/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one parameter and no output schema, the description is minimally adequate. However, it does not mention typical usage scenarios, return behavior, or failure modes, which could be helpful for an agent deciding whether this tool fits a given task.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the parameter 'text' is documented as 'note body'. The description's phrase 'free-text note' adds a slight nuance about the unstructured nature of the input, but does not materially extend the schema. Baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Append') with a clear resource ('session note log') and describes the content ('free-text note'). It is easily distinguished from the sibling tools (search_records, fetch_record, summarise_amounts, delete_record) which perform different actions.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines2/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no explicit guidance on when to use this tool versus alternatives. It does not mention any prerequisites, exclusions, or typical workflows where appending a note would be appropriate over other operations.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
delete_recordADestructive
Permanently delete a record. Destructive and gated: the first call returns a confirm_token describing what would be deleted, and the deletion only happens on a second call carrying that token.
ParametersJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| record_id | Yes | exact record id to delete | |
| confirm_token | No | token from the prior unconfirmed call |
TDQS
A4.4/5.0
Behavior5/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark the tool as destructive and non-idempotent, and the description adds substantial context: permanence, the two-step confirmation mechanism, and the token's role. This is exactly the behavioral detail an agent needs beyond the structured annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, tightly packed sentence that front-loads the destructive nature and then explains the gating protocol. There is no filler, and every clause carries essential behavioral information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness4/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive two-step tool with no output schema, the description covers the critical interaction flow and irreversibility. It stops short of specifying the shape of the token response or any post-deletion confirmation, but the essential calling protocol is fully conveyed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already provides 100% parameter coverage, describing record_id and confirm_token clearly. The description reinforces the confirm_token semantics but does not add new parameter-level detail beyond what the schema already contains.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
States the exact operation ('Permanently delete a record') with a clear resource and irreversible effect. The description also distinguishes this from the sibling read/summarize/append tools by emphasizing deletion and the confirmation gate.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly communicates that deletion is not immediate: the first call generates a confirm_token and only a second call with that token actually deletes. It implicitly tells an agent to never expect deletion on the first call, though it does not explicitly enumerate when not to use the tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
fetch_recordAIdempotent
Fetch one record by its exact id. Returns the record's title, owner, amount and tags.
ParametersJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| record_id | Yes | exact record id, e.g. rec-001 |
TDQS
A4.3/5.0
Behavior4/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare idempotentHint=true and destructiveHint=false, covering the safety profile. The description adds value by disclosing that the response includes title, owner, amount, and tags, which is beyond structured annotations and helps the agent set expectations for the returned data.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
A single, front-loaded sentence that states the operation and its result with no filler. Every word contributes meaning, and the structure is easy to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness5/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter read operation, the description is complete: it names the input, explains the match criterion, and lists the returned fields. The output schema is absent, but the description explicitly fills that gap. Sibling distinctions are evident through the 'exact id' wording, and the annotations cover behavioral safety.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with record_id already documented as an exact record id with an example. The description merely reinforces the schema rather than adding new semantic detail. Baseline of 3 is appropriate because the schema carries the parameter meaning and the description adds minimal extra value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Fetch'), a resource ('one record'), and the lookup key ('exact id'), which clearly differentiates it from the sibling search_records. The added return-field list further clarifies the tool's scope. This is a precise, unambiguous definition.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'by its exact id' implies the proper context: when the caller already knows the precise identifier. It does not explicitly name alternatives like search_records for fuzzy or filtered lookup, but the context is clear enough for an agent to select this tool over the siblings.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
search_recordsAIdempotent
Search the record store by a free-text query matched against title, owner and tags. Returns matching record ids.
ParametersJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes | free-text search term |
TDQS
A4.4/5.0
Behavior4/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate idempotent and non-destructive behavior. The description adds useful behavioral detail: it specifies what fields are matched, that the query is free-text, and that the result is a set of record ids. This is meaningful context beyond the annotations, especially since there is no output schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences with no redundant wording. The action and scope are front-loaded, and every phrase contributes useful information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness4/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter, non-destructive search tool with idempotency annotations, the description covers the core behavior and return value sufficiently. Minor details like pagination, ordering, or empty-result behavior are absent, but they are not essential for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters4/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema fully documents the query parameter as a 'free-text search term'. The description adds semantic value by explaining that the term is matched against title, owner, and tags, which clarifies how the parameter is interpreted beyond the schema alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Search') and resource ('record store'), and further clarifies the scope by naming the matched fields (title, owner, tags) and the output (matching record ids). This clearly distinguishes search_records from siblings like fetch_record and delete_record, which imply direct record retrieval or mutation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines4/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description makes clear this tool is for free-text, field-matching search across records. It gives enough context for an agent to select it for search-style queries, though it does not explicitly contrast it with fetch_record or other alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
summarise_amountsAIdempotent
Compute count, total and mean of the amount field across the given record ids. All ids must exist.
ParametersJSON Schema
| Name | Required | Description | Default |
|---|---|---|---|
| record_ids | Yes | list of exact record ids |
TDQS
A4.1/5.0
Behavior4/5
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The annotations already declare idempotentHint=true and destructiveHint=false, and the description does not contradict them. It adds meaningful behavioral context beyond annotations by stating the precondition that all ids must exist and by naming the calculated summary values, which is especially valuable because no output schema is provided.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Conciseness5/5
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences with no filler: the first states the operation and its outputs, and the second states the single relevant precondition. The key information is front-loaded and easy for an agent to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Completeness5/5
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter, non-destructive, idempotent aggregation tool, the description is complete: it states what is computed, over which input, and the required precondition. Although there is no output schema, naming count, total, and mean sufficiently describes the return values.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Parameters3/5
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% because the input schema already describes record_ids as 'list of exact record ids'. The description adds the role of the ids in the aggregation and mentions the 'amount field', but it does not provide deeper parameter-level detail, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Purpose5/5
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Compute') and identifies the resource ('amount field') and the scope ('given record ids'), clearly distinguishing this as an aggregation tool from the sibling fetch/search/mutation tools. It also enumerates the three outputs (count, total, mean), leaving no ambiguity about what the tool returns.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Usage Guidelines3/5
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied: an agent can infer this tool is for summarizing amounts across a known set of record ids, and the precondition 'All ids must exist' adds a useful constraint. However, it does not explicitly contrast with alternatives like search_records or fetch_record, nor state when this tool should be preferred over them.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
5 tool updates
v0.1.0- First observed
append_note - First observed
delete_record - First observed
fetch_record - First observed
search_records - First observed
summarise_amounts
TDQS
A4/5.0
Disambiguation5/5
Each tool performs a distinct action: searching, fetching by ID, aggregating amounts, appending notes, and deleting records. There is no overlap or ambiguity between them.
Naming Consistency5/5
All tool names consistently follow the verb_noun pattern (search_records, fetch_record, summarise_amounts, append_note, delete_record), using uniform snake_case naming.
Tool Count5/5
With 5 tools, the surface is well-scoped and covers essential operations without bloat or unnecessary duplication. The count is appropriate for a focused record management server.
Completeness3/5
The tools cover search, fetch, aggregation, note appending, and deletion, but lack create and update operations. While the server may be intentionally read-only plus deletion, the asymmetry is a notable gap for a record management domain.
Maintenance
ActivityMaintained
ResponsivenessNo issues
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
MCP server for building and testing AI agents with multi-model experimentation and insights.
Agent-native collaboration network: orchestrate a team of long-running agents from any MCP client.
Monitoring for the agent economy — liveness, latency, trust scoring for MCP endpoints
1MCP server for AI agents to plan, verify, and deploy Cloudflare-native apps.
Related MCP Servers
- AlicenseNot gradedqualityAmaintenanceMCP server that enables AI agents to run a deterministic orchestration loop with decomposition, subagent execution, and review feedback across multiple LLM backends.55MIT
- AlicenseNot gradedqualityBmaintenanceMCP server that enables agents to dynamically switch between multiple AI models (OpenAI, Anthropic, Google, etc.) with unified protocol-driven configuration and capability discovery.Apache 2.0
- FlicenseNot gradedqualityCmaintenanceMCP server implementing clean architecture with LangGraph for building and managing agent workflows.-
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/malcomzww/mcp-server-and-agent'
If you have feedback or need assistance with the MCP directory API, please join our Discord server