qwen-cli-mcp
Delegate coding tasks to your locally installed Qwen Code CLI from any MCP client, returning only qwen's final result and stats.
Start a new qwen task (
qwen) with a self-contained prompt, optional cwd, model, approval mode, tool allowlist, effort, system prompt append, transport, and timeout.Resume sessions (
qwen_reply) after completion, timeout, or cancellation, even across server restarts.Interrupt or steer running turns (
qwen_send) via abort, steer, or follow_up on stream-transport runs.List reachable models (
qwen_models) with a live probe so you can pick a valid model.Monitor activity (
qwen_running) for in-flight stream turns and (qwen_sessions) for known past sessions.Control safety and scope per call or via environment defaults: approval modes (
plantoyolo), allowed-tools allowlists, working-directory sandboxing, timeouts, and output caps.Use two transports:
stream(default) keeps qwen alive for mid-run delivery;printruns one isolated process per turn.
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@qwen-cli-mcpAsk Qwen to review the auth refactor in src/auth.ts and suggest fixes"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
qwen-cli-mcp
MCP server that delegates coding tasks to your locally installed Qwen Code CLI.
It wraps the real qwen binary instead of bundling its own copy of the agent, so every call
inherits your qwen auth, models, MCP servers and settings. Nothing about your model stack is
duplicated here, and the server does not drift when you upgrade qwen.
Sibling of pi-cli-mcp — same architecture, same principles, qwen behind the wheel. The authoritative design document is SPEC.md.
Use it when your primary agent (Claude Code, Cursor, pi itself, any MCP client) should hand work to qwen: a second opinion from a different model family, an investigation you want kept out of the main context window, or parallel work.
Install
npx -y qwen-cli-mcp # no install
npm install -g qwen-cli-mcp # or globalRequires Node ≥ 22 and a working qwen on PATH (npm i -g @qwen-code/qwen-code).
Claude Code
claude mcp add-json qwen -s user '{
"type": "stdio",
"command": "npx",
"args": ["-y", "qwen-cli-mcp"],
"timeout": 3600000
}'
claude mcp list | grep '^qwen:' # expect: ✔ ConnectedThe generous timeout matters: the server applies no run deadline by default, and a real
delegated task can run for minutes.
Any other MCP client
{
"mcpServers": {
"qwen": { "command": "npx", "args": ["-y", "qwen-cli-mcp"] }
}
}Keep the server name short (qwen): it becomes part of the tool names your model sees.
⚠️ Default approval mode is
yolo. Delegation is only useful when the delegate can act, so this server starts qwen with full tool approval by default — insidecwd, as your user. Narrow it withQWEN_MCP_APPROVAL_MODE, per-callapproval_mode, orallowed_tools. For analysis-only work passallowed_tools: "read,grep,ls"-style allowlists.
Related MCP server: consult-mcp
Tools
Tool | Purpose |
| Start a session. Returns |
| Continue a finished or interrupted session — including one killed by a timeout. |
| List models qwen can actually reach right now (live probe via the control plane). |
| Deliver into a turn executing right now ( |
| List turns executing right now that |
| List known sessions, newest first, with their working directory. |
qwen
Argument | Notes |
| Required. Must be self-contained — qwen cannot see your conversation. |
| Absolute path; defaults to this server's cwd. |
|
|
|
|
| Comma-separated tool allowlist passed as |
|
|
| Appended to qwen's system prompt for this run. |
|
|
| Wall clock for this run. Off unless you set it — the task decides whether it needs a deadline. |
What comes back
Only qwen's final result plus aggregate stats — never the transcript, tool arguments or raw stdout:
[session: 0927adc5-a840-4b68-93ca-5ca344c9fafb]
Refactored retry() in src/http.rs; all 12 tests pass.
---
qwen: qwen3-coder-plus · 6 turns · 5 tool calls: bash×2, read×2, edit · 18k in / 310 out · 41sThe answer is the result envelope qwen emits at the end of a turn — there is no answer-selection
guesswork. An error envelope (error_max_turns, error_during_execution) fails the call while
keeping everything qwen managed to say, so the work stays resumable. A stream that ends without any
result envelope is reported as broken, never silently replaced by raw output.
Sessions
qwen returns a session id; qwen_reply resumes it with --resume. The conversation lives in
qwen's own session store, so follow-ups keep working across restarts of this server — the
session → directory map is persisted in ~/.local/state/qwen-mcp/sessions.json.
Concurrent replies to one session are serialized per server process: two qwen processes writing one session file would corrupt it. Cross-process caveat: if you run two MCP clients against two server processes and both reply to the same session id at the same time, nothing serializes them. In practice one client owns a session; for a hard guarantee, keep one server process.
Transports
|
| |
command |
|
|
process | stays up, speaks the control plane on stdin | one process per turn, exits when done |
mid-run delivery |
| impossible: qwen reads nothing while working |
deadline / cancel | qwen's own | SIGTERM, then SIGKILL |
stream is the default because it is a superset: the same message stream, plus a running turn
stays reachable and an interrupted one is ended in-protocol, keeping the tail of the stream.
Pick per call with transport, or set the default with QWEN_MCP_TRANSPORT=print.
This server never sends anything into qwen on its own. No automatic wrap-up before a deadline,
no injected instructions: qwen_send fires only when the caller calls it.
Environment
Variable | Default | Meaning |
|
| Path to the qwen binary. |
|
| Default approval mode for every call. See the warning above. |
| unset | Default model for every call. |
|
| Default transport: |
| unset | Server-wide default wall clock; unset means no deadline. |
|
| Ceiling on what |
|
| Concurrent qwen processes. |
| unset | Cap on the answer. Unset means no truncation. |
|
| stderr tail included in the response. |
| unset |
|
|
| Read-buffer guard against a runaway stream. |
|
| Longest single message line from qwen before it is dropped. |
|
| Longest single JSON-RPC frame from the client. |
|
| Remembered sessions before the oldest is dropped. |
|
| SIGTERM → SIGKILL grace period. |
|
| How long |
|
| Initialize-handshake timeout (stream only). |
|
| Whole-run budget for the |
|
| Session → cwd map. |
| unset | Command prefix, e.g. a sandbox wrapper around qwen. |
Design
Process per call. Qwen's own session files are the source of truth, which is what makes follow-ups survive a restart of this server.
The wire contract is qwen's own stream-json protocol, spoken directly — newline-delimited messages on stdout, control requests and user turns on stdin. Its shapes are borrowed from
@qwen-code/sdkthroughimport type, so an upstream change breaks the build instead of the server. Zero runtime dependencies.Fail closed on anything from qwen. An unknown result subtype, a failed handshake, a line that does not parse — reported as such, never normalized into success.
No process outlives its request. Timeouts, cancellations and shutdown reap the whole qwen process tree; nothing is left behind on any path.
Development
TypeScript (native tsc), Biome, Vitest. Tests drive the real server binary over stdio against a
fixture that speaks qwen's protocol; live tests against the installed qwen are opt-in.
npm run hooks # once per clone: git hooks from .githooks/
npm run build # tsc -> dist/
npm test # unit + type tests, no API access, no tokens
npm run test:live # 4 live tests against the real qwen binary (spends tokens)
npm run check # format + types + tests
npm run fix # biome --writeLicense
MIT
Available Tools
6 toolsqwenA
Start a NEW task in the local Qwen Code agent — a separate CLI coding agent with its own file/shell tools and its own context window. Blocks until qwen settles, then returns only its final result plus stats, prefixed [session: ]; continue that session later with qwen_reply.
Good for: a second opinion from a different model, work kept out of this context, or parallel investigation.
Caution: with approval_mode 'yolo' (the server default) qwen edits files and runs shell commands as your user inside cwd without asking. For analysis-only work pass an allowed_tools list or approval_mode 'plan'.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Usually omit to use this server's cwd. If set, must be an absolute path (relative is rejected). qwen works and edits here, and reads QWEN.md / context files from here. | |
| model | No | Model id, optionally plan-qualified: 'qwen3-coder-plus' or 'qwen3.7-plus@coding' / '@token'. Qualify when the id exists in more than one provider plan (qwen_models marks those) — a bare ambiguous id is rejected. Defaults to qwen's own settings. | |
| effort | No | Reasoning effort tier. Only transport 'stream' can apply it (no CLI flag exists); print mode rejects the call rather than silently ignoring it. | |
| prompt | Yes | The complete task. qwen cannot see this conversation, so include everything it needs: file paths, goal, constraints, expected output format. | |
| transport | No | Usually omit. The default 'stream' keeps qwen up, so a running turn can be steered or aborted with qwen_send. 'print' runs one process per turn that cannot be reached while it works. | |
| timeout_ms | No | Usually omit — the server default is generous. Override only when the task's real size demands it. A run killed at the deadline is not lost: it still returns its session id and is resumable with qwen_reply. | |
| allowed_tools | No | Set a comma-separated allowlist of tool names to auto-approve only those, e.g. 'read_file,glob,grep' for a read-only run. Combined with --exclude semantics of the approval mode; pairs well with approval_mode 'yolo'. | |
| approval_mode | No | How qwen approves tool use: 'plan' (plan only), 'default' (prompt — unusable headless, tools get denied), 'auto-edit' (auto-approve edits), 'auto' (classifier-approved safe actions), 'yolo' (approve everything). Defaults to the server's QWEN_MCP_APPROVAL_MODE (itself defaulting to yolo): delegation is the point of this server. Restrict instead with allowed_tools when it matters. | |
| system_prompt_append | No | Extra text appended to qwen's system prompt for this run. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With zero annotations, the description carries the full burden and delivers thoroughly: it discloses blocking-until-settle behavior, the output shape (final result plus stats, prefixed [session: <id>]), the separate-context limitation (qwen cannot see this conversation), the yolo approval default that edits files and runs shell commands as the user without asking, kill-time resumability, and stream-vs-print reachability semantics. This is exemplary behavioral disclosure for a mutation-capable tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Well-organized in descending importance: core purpose first, then return format and session routing, then 'Good for' usage, then the safety caution. Although on the longer side, every sentence conveys distinct information — parameter implications, failure resumability, and approval semantics all earn their place with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex 9-parameter tool with no annotations and no output schema, the description covers the full operational picture: blocking behavior, output contract with session-id prefix, the self-contained-prompt requirement, safety default, failure mode (resumable on kill), and integration with siblings (qwen_reply, qwen_send). Nothing an agent needs to invoke it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3. The description adds genuine value beyond the schema by contextualizing approval_mode (yolo defaults to full delegation, 'delegation is the point'), allowed_tools (pairs with yolo for read-only runs), transport (steerability via qwen_send), and cwd (where qwen edits and reads QWEN.md). This meaningfully exceeds the baseline by linking parameters to behavioral consequences.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Start a NEW task in the local Qwen Code agent') and explicitly frames it as a separate agent with its own file/shell tools and context window. The 'NEW task' emphasis and 'continue that session later with qwen_reply' directly distinguish it from all siblings (qwen_reply, qwen_send, qwen_models, qwen_running, qwen_sessions) without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides explicit 'Good for' scenarios: a second opinion from a different model, work kept out of this context, and parallel investigation. It implies routing (continue with qwen_reply) and steers safety-constrained usage via the caution. However, it lacks an explicit 'when not to use' or a comparative list against the sibling tools, leaving some selection logic to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
qwen_modelsA
List the models this qwen installation can actually reach right now — id, label, capabilities, context window — read live from the CLI over its control protocol. Use it to pick a model value for qwen / qwen_reply. Starts no task.
| Name | Required | Description | Default |
|---|---|---|---|
| search | No | Optional substring filter on model id or label, e.g. 'coder', 'max'. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are present, so the description carries the full burden. It discloses that the tool reads live from the CLI over a control protocol, that it reflects what is 'actually reachable right now' (i.e., dynamic, not cached), and that it 'starts no task'. It also names the return fields, covering the main behavioral aspects of a listing operation without side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two compact sentences with zero fluff. The first sentence states the action, scope, and output fields; the second gives the direct use case and a safety note ('Starts no task'). Information is front-loaded and every clause earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple listing tool with one optional parameter and no output schema, the description is complete. It explains what the tool returns, when to use it, that it is live, and that it is non-mutating. An agent has everything needed to invoke it correctly — no missing context about return format, side effects, or usage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already documents the single optional `search` parameter with a description ('Optional substring filter on model id or label, e.g. 'coder', 'max''), giving 100% schema coverage. The tool description adds no semantic detail beyond that — it simply repeats that it lists models. Per the rule, with full schema coverage the baseline is 3, and no additional value is provided.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description begins with 'List the models' — a specific verb and resource — and enumerates the exact fields returned (id, label, capabilities, context window). It also differentiates from siblings by specifying it reads live from the CLI and is used to select a `model` value for `qwen` / `qwen_reply`, making its role distinct from conversation and send tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly states when to use it ('Use it to pick a `model` value for `qwen` / `qwen_reply`') and notes 'Starts no task', which implies it is a read-only query rather than an action. It does not explicitly name sibling alternatives to avoid, but the purpose is clear enough that an agent would not confuse it with the conversation tools. The condition for selection is stated, though not the exclusion of alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
qwen_replyA
Send a new turn to an existing qwen session that is not executing right now — including one that timed out or was cancelled: the session survives in qwen's own store, so resume it here instead of restarting with qwen. qwen still has its prior turns (but never this conversation), so the follow-up can be short. Survives restarts of this server. For a turn still running under 'stream', use qwen_send instead.
| Name | Required | Description | Default |
|---|---|---|---|
| cwd | No | Absolute path override. Defaults to the directory where the session started. | |
| model | No | Model id, optionally plan-qualified: 'qwen3-coder-plus' or 'qwen3.7-plus@coding' / '@token'. Qualify when the id exists in more than one provider plan (qwen_models marks those) — a bare ambiguous id is rejected. Defaults to qwen's own settings. | |
| effort | No | Reasoning effort tier. Only transport 'stream' can apply it (no CLI flag exists); print mode rejects the call rather than silently ignoring it. | |
| prompt | Yes | Follow-up message for this session. | |
| session | Yes | Session id from a [session: <id>] prefix, or from qwen_sessions. | |
| transport | No | Usually omit. The default 'stream' keeps qwen up, so a running turn can be steered or aborted with qwen_send. 'print' runs one process per turn that cannot be reached while it works. | |
| timeout_ms | No | Usually omit — the server default is generous. Override only when the task's real size demands it. A run killed at the deadline is not lost: it still returns its session id and is resumable with qwen_reply. | |
| allowed_tools | No | Comma-separated allowlist of tool names to auto-approve for this run. | |
| approval_mode | No | How qwen approves tool use: 'plan' (plan only), 'default' (prompt — unusable headless, tools get denied), 'auto-edit' (auto-approve edits), 'auto' (classifier-approved safe actions), 'yolo' (approve everything). Defaults to the server's QWEN_MCP_APPROVAL_MODE (itself defaulting to yolo): delegation is the point of this server. Restrict instead with allowed_tools when it matters. | |
| system_prompt_append | No | Extra text appended to qwen's system prompt for this run. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden and delivers richly: it discloses that sessions survive timeouts/cancels in qwen's own store, survive server restarts, and that qwen never sees this conversation (so the follow-up should be short). The parameter texts add further behavioral detail (effort only applies to stream transport and is rejected in print mode; timeout-killed runs still return their session id and are resumable), going well beyond what the schema names alone imply.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four sentences, zero filler, and the core purpose plus scope constraint are front-loaded in the first clause. Every sentence earns its place: purpose/scope, persistence rationale, context-separation note, and sibling routing. Dense but efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex 10-parameter, 3-enum tool with no output schema, this is nearly complete. It explains the session lifecycle, resumability guarantees, how to obtain a session id, and routes to the correct sibling for a running turn. All parameters are documented, and the nuance about context separation helps the agent craft an appropriately scoped follow-up.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100% and the property descriptions are already behavior-rich, so the baseline is 3. The main description adds genuine value on top for the two required params: session ('the session survives… resume it here') and prompt ('the follow-up can be short'). That lifts it above baseline, though individual property semantics are largely carried by the schema itself.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('send a new turn to an existing qwen session') plus a hard scope constraint ('not executing right now', including timed-out or cancelled sessions). It explicitly names sibling alternatives (qwen, qwen_send) and the conditions that select between them, so an agent can distinguish it without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit when-to-use ('resume it here instead of restarting with qwen'), when-not-to-use ('For a turn still running under stream, use qwen_send instead'), and names the alternatives directly. Also communicates the follow-up can be short because qwen retains prior turns — practical guidance for how to phrase the prompt.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
qwen_runningA
List qwen turns executing at this moment — the ones qwen_send can reach — with session id, working directory, elapsed time, and messages already sent in. Only stream-transport runs appear; 'print' runs are unreachable mid-run. For past sessions use qwen_sessions.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full burden. It discloses the key behavioral constraint that only stream-transport runs are listed and print runs are excluded mid-run. It also lists the output fields, which adds transparency. It doesn't mention potential failure modes or permissions, but for a simple list operation this is adequate; a 4 reflects strong disclosure without being exhaustive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is three sentences of pure signal. The first sentence states the action and output fields, the second adds a critical scope constraint, and the third names the sibling alternative. There is no fluff or redundancy, and the most important info is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given zero parameters, no output schema, and low complexity, the description covers everything needed to call the tool correctly: what it returns, the scope (stream-transport only), and the alternative for past runs. No critical information is missing for an agent to invoke it appropriately.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the schema covers them 100% (vacuously). Per the rubric, 0 params earns a baseline of 4. The description appropriately adds no parameter-specific detail because there is nothing to add, and it stays consistent with the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('List') and a precise resource ('qwen turns executing at this moment'), and names the exact fields returned (session id, working directory, elapsed time, messages sent). It also differentiates from the sibling qwen_sessions by stating 'For past sessions use qwen_sessions,' making the purpose unambiguous and distinct.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly states when to use it (to see currently executing qwen turns that qwen_send can reach) and when not to ('Only stream-transport runs appear; 'print' runs are unreachable mid-run'). It also names the alternative for past sessions (qwen_sessions). This gives clear guidance with no inference required.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
qwen_sendA
Deliver a message into a qwen turn that is executing right now. Works only on runs started with transport 'stream' — 'print' runs cannot be reached, and a session that already finished takes qwen_reply, not qwen_send. Returns immediately; qwen's reaction appears in the answer of the qwen/qwen_reply call still waiting on that turn. qwen_running lists reachable sessions.
Note: the adapter reports the first result envelope; a follow_up queued behind the current turn is delivered but its answer is not awaited by the original call.
| Name | Required | Description | Default |
|---|---|---|---|
| command | No | 'abort' (default) interrupts the current turn via qwen's control protocol; 'steer' interrupts and immediately submits the message as a new user turn; 'follow_up' queues the message without interrupting. | |
| message | No | Text to deliver. Required for 'steer' and 'follow_up', ignored by 'abort'. | |
| session | Yes | Session id of the running turn (see qwen_running). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description fully carries the behavioral burden. It states that the call returns immediately and queued follow-ups are not awaited, adding critical nuance about asynchronous behavior. It also explains how results surface via qwen_reply, making the operation's effects clear.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured and front-loaded: it opens with the core purpose, then states constraints, then behavioral details, and ends with a clarifying note. Every sentence adds information without redundancy or verbosity, achieving high informational density.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (3 params, no annotations, no output schema), the description covers all necessary aspects: when to use it, when not, how it behaves, and where results appear. It also points to qwen_running for session management, making it self-contained for correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema already provides 100% description coverage for all parameters, so the baseline is 3. The tool description adds meaningful extra context, such as the note that a follow_up is delivered but its answer is not awaited, which clarifies parameter behavior beyond the schema. This raises the score to 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Deliver a message into a qwen turn that is executing right now.' It distinguishes itself from siblings by specifying the transport restriction ('stream' vs 'print') and when to use qwen_reply instead. The core purpose is unambiguous and unique among the listed tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description explicitly delineates when to use this tool versus alternatives: it works only on 'stream' runs, cannot reach 'print' runs, and handles finished sessions via qwen_reply. It also directs agents to qwen_running for session discovery. These are concrete, actionable criteria for tool selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
qwen_sessionsA
List all qwen sessions started through this server, newest first, with their working directory — running or finished, including runs that timed out. Use it to recover an id for qwen_reply. For turns still executing (qwen_send targets), use qwen_running.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so the description carries the full burden. It discloses that it lists both running and finished runs including timeouts, and orders them newest first. This is a read-only listing operation with no hidden side effects; the description adequately conveys its behavior without needing to mention permissions or rate limits.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, front-loaded with the core listing purpose and ordering, followed by usage guidance. No filler words; every sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter, no-output-schema tool, the description covers everything an agent needs: what it lists, the ordering, scoping to this server, inclusion of timeouts, and how to use it for id recovery. It also points to the sibling for a different case. Nothing is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so the baseline is 4. The description doesn't need to explain parameter meanings since there are none, and it doesn't attempt to add any.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb (List) and resource (qwen sessions), with details: newest first, with working directory, running or finished, including timeouts. It distinguishes from siblings by referencing qwen_reply and qwen_running, making the purpose unmistakable.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly instructs to use it to recover an id for qwen_reply, and tells when NOT to use it: 'For turns still executing (qwen_send targets), use qwen_running.' This gives clear when-to-use and alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
6 tool updates
v0.1.1- First observed
qwen - First observed
qwen_models - First observed
qwen_reply - First observed
qwen_running - First observed
qwen_send - First observed
qwen_sessions
TDQS
Each tool has a clearly distinct role: starting a new session, resuming an idle one, messaging a running turn, listing models, listing currently running sessions, and listing historical sessions. The boundaries between qwen_reply and qwen_send (idle vs. executing) and between qwen_running and qwen_sessions (current vs. all) are explicitly explained, leaving no ambiguity for an agent.
All tools share the snake_case prefix `qwen_`, with descriptive suffixes (`qwen_reply`, `qwen_models`, `qwen_running`). While the suffixes mix verbs and nouns, the pattern is uniform and predictable, making it easy to infer purpose from the name alone.
With 6 tools, the server is well-scoped for managing a CLI coding agent. Each tool addresses a distinct need (creation, interaction, inspection, enumeration) without redundancy, fitting comfortably within the ideal 3–15 range.
The tool surface covers the full lifecycle: start, resume, interrupt (via send), list running, list models, and list historical sessions. A terminate/kill tool for running sessions is absent, but this is a minor gap given that sessions can be resumed after timeout and the descriptions encourage using `qwen_reply` for stalled sessions.
Maintenance
Related MCP Connectors
Remote MCP server for supportsheep: run AI interviews and manage support content for your blog.
Nifty's MCP server — exposes tasks, projects, messages, and files as tools for AI agents.
MCP server for progressive tool usage at any scale (see https://klavis.ai)
MCP server for generating rough-draft project plans from natural-language prompts.
Related MCP Servers
- AlicenseAqualityBmaintenanceLocal MCP server that wraps the headless Claude Code CLI as MCP tools, providing stateless access to Claude's coding capabilities through prompt-based interactions. It enables users to execute Claude Code commands with various prompt formats and structured outputs directly from MCP clients.3MIT
- AlicenseAqualityDmaintenanceMCP server orchestrating local CLI agents (Claude Code, OpenAI Codex, Google Gemini) for cross-validation, second opinions, and persona-driven prompting.18MIT
- AlicenseNot gradedqualityBmaintenanceA local MCP server that delegates coding tasks to local Qwen and cloud Gemini models, enabling orchestrators like Claude Code to offload routine code generation and receive verified results with automatic correction logging.MIT
- AlicenseNot gradedqualityAmaintenanceAn MCP server that bridges CLI coding agents like Claude Code, Codex, opencode, and Antigravity into any MCP client, enabling synchronous and asynchronous task execution, follow-up input, and a structured code review tool.151MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/minmax/qwen-cli-mcp'
If you have feedback or need assistance with the MCP directory API, please join our Discord server