mcpx
The mcpx (Relay Shell) server provides comprehensive capabilities for managing local and remote Linux hosts through shell execution, interactive PTY sessions, secure file transfers, port forwarding, and host inventory management, backed by auditing and policy controls.
Local Shell Execution
shell_exec– Run a single command locally with configurable timeout, output limits, working directory, environment, stdin, and stderr mergingshell_script– Execute a multi-line script (bash/sh/python) with optional strict mode (set -euo pipefail)shell_spawn– Start a persistent local PTY session (REPL, TUI, long-running process)
Remote SSH Operations
ssh_exec– Run a command on a remote host (supports jump hosts, key/agent auth, known-hosts policy)ssh_spawn– Open an interactive persistent PTY session on a remote hostssh_upload/ssh_download– Upload or download files/directories via SFTP (recursive supported)ssh_forward/ssh_forward_list/ssh_forward_close– Create, list, and close local (L), remote (R), or dynamic SOCKS (D) port forwardsssh_check– Probe connectivity to specific hosts or the entire inventoryssh_hosts– View the resolved host inventory from~/.ssh/configand inventory files
Session Management (unified for local and remote PTY sessions)
session_send– Send input to any active sessionsession_recv– Read buffered output with configurable wait timeoutsession_resize– Resize a session's PTY dimensionssession_kill– Signal or terminate a sessionsession_list– List all active sessions with metadata (age, idle time, byte counters)
Diagnostics & Resources
server_info– Report server version, effective limits, policy mode, and audit statusaudit_tail– View the append-only audit logMCP resources:
relay-shell://inventory,relay-shell://inventory/{host},relay-shell://ssh-configPrometheus metrics via
GET /metricsoperating_guideMCP prompt for tool-selection guidance
Click on "Install Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@mcpxcheck disk usage on db01 via ssh"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Relay Shell
Status: v0.3.0 · Python 3.12 / 3.13 / 3.14 · transports: stdio and
streamable-http · MCP SDK mcp==1.28.1 · last validated against
upstream surfaces on 2026-07-15
(ADR 0005).
A highly reliable, maximally capable Model Context Protocol server for complete shell and SSH mastery.
relay-shell gives an MCP client (Claude, or any MCP-compatible agent) a robust,
auditable interface to operate a Linux host and a fleet of remote hosts over
SSH: one-shot command execution, long-lived interactive PTY sessions, scripted
runs, SFTP transfer, port forwarding, and host-inventory aware connectivity.
It is designed as operator infrastructure tooling for hosts you own and administer. The default operating posture is native, full access (no sandbox), matching the way real administration is performed, paired with the defensive controls a production operator actually needs: an append-only, output-hashed audit trail; a tiered-authority policy layer; secret redaction; strict resource and timeout bounds; and an optional OAuth 2.1 edge.
The architecture, security model, and deployment patterns are modeled on a mature production MCP gateway and on established operational best practices.
Why
Engineers SSH into hosts and run commands from memory, with no structured reasoning trail and no pre-execution review. A well-built MCP relay improves on that baseline: every action is captured with arguments, an output hash, an exit code, and a tier classification; limits and timeouts are enforced centrally; failure paths never crash the transport. The reasoning layer sits inside the loop and can assess blast radius before acting.
Related MCP server: SSH MCP Server
Capabilities
Local shell
Tool | Purpose |
| Run a command. Timeout/output clamps, cwd, env overlay, stdin, exit code. |
| Run a multi-line script (bash/sh/python), optional |
| Start a persistent PTY session (REPLs, TUIs, prompts, long jobs). |
SSH
Tool | Purpose |
| Run a command on a remote host (jump host, key/agent, known-hosts policy). |
| Interactive remote PTY session. |
| SFTP transfer (recursive supported). |
| Local ( |
| Manage active forwards. |
| Connectivity probe across the inventory or a host list. |
| Run a command in parallel across hosts; per-host exit codes in one JSON. |
| Fetch host public keys via |
| Resolved host inventory ( |
Sessions (local PTY and SSH PTY, unified)
Tool | Purpose |
| Send input (optionally with Enter) to a session. |
| Read buffered/new output, with a short wait. |
| Resize the PTY (cols x rows). |
| Signal / terminate a session. |
| List active sessions with metadata. |
Diagnostics
Tool | Purpose |
| Server version, effective limits, policy mode, audit path. |
| Return recent audit records as JSONL, optionally filtered by |
| Arm a Tier-3 confirmation token (opt-in broker, ADR 0009), then re-issue the call. |
The HTTP transport also exposes GET /metrics (Prometheus text format):
relay_shell_tool_calls_total{tool,tier,mode,outcome},
relay_shell_seccomp_notify_events_total{syscall}, and
relay_shell_seccomp_notify_overflow_total (counters), plus
relay_shell_active_sessions, relay_shell_active_forwards, and
relay_shell_audit_degraded (gauges). See
docs/deployment.md §9a.
Resources
Three MCP resources let clients read inventory and ssh_config views
the protocol-native way (no tool call needed):
URI | meaning |
| Flat list of all known hosts (JSON). |
| One host's resolved spec (JSON). |
| ssh_config path + aliases (JSON). |
Resource reads are audited (tier 0). See
docs/tools.md for the full reference.
Prompts
One MCP prompt, operating_guide, carries the detailed "when to use which
tool" guidance (one-shot command vs persistent PTY session, the spawn+session
workflow, fleet and transfer entry points) — the protocol-native counterpart
to the concise instructions string handed to clients at initialize. A fetch
is audited (tier 0, prompt:operating_guide) like a resource read; listing is
not (ADR 0008).
Full reference: docs/tools.md.
Quickstart
Requires Python 3.12+ (CPython, tested on Ubuntu 24.04).
git clone https://github.com/rmednitzer/relay-shell.git && cd relay-shell
python3 -m venv .venv && . .venv/bin/activate
pip install -e ".[dev]"
# stdio transport (local agent / Claude Desktop / MCP Inspector)
relay-shell
# HTTP transport (streamable-http on 127.0.0.1:8080)
RELAY_SHELL_TRANSPORT=http relay-shell
# Validate config without starting the transport (useful for image bakes)
relay-shell --check-config
# Drift-detect shipped templates against /etc/... (useful in production cron)
relay-shell --verify-deployRegister with an MCP client (stdio):
{ "mcpServers": { "relay-shell": { "command": "relay-shell" } } }Configuration is environment-driven; see .env.example and
docs/deployment.md.
Compatibility matrix
Surface | Supported | Notes |
Python | 3.12 / 3.13 / 3.14 | CI runs the full matrix; package floor is |
Host OS (tested) | Ubuntu 24.04 LTS | Validation is run against this image; the systemd + Caddy installers assume it. |
Host OS (dev) | macOS | Unsupported for production; |
Host OS (other) | Windows | Out of scope — no PTY contract, no systemd integration. |
Transports |
| Stdio is the default. HTTP binds loopback and requires a TLS edge (see |
SDK |
| Pinned (ADR 0001); bumps trigger a fresh validation pass. |
SSH library |
| Native async; no shell-out to system |
Security posture
relay-shell runs unsandboxed with the privileges of its service account by design
(see docs/adr/0002-no-sandbox-full-access.md):
sandboxing the process would defeat the very capability it exists to provide.
Safety is achieved with compensating controls, not by crippling the tool:
Audit - every invocation appended as one JSON line with a SHA-256 hash of the output (never the output body), byte length, exit code, request and client id, and the assessed tier. Append-only on disk; rotation-safe handler. Optional per-record hash chain (
RELAY_SHELL_AUDIT_CHAIN, ADR 0007) makes edits, insertions, reorders, and interior deletions detectable withrelay-shell --verify-audit, which is fail-closed (a missing / empty / head-truncated log fails;--segmentaccepts a rotation segment; tail-truncation needs the off-host copy).Syscall visibility (optional) -
RELAY_SHELL_SECCOMP_NOTIFY(ADR 0006) adds an audit-only seccomp user-notify channel that appendssyscall_notifylines for a spawned child'sexecve/ privilege / namespace / mount / write-open/ privilege-relevantprctlsyscalls — for one-shot commands and forshell_spawnPTY sessions, where the filter rides the session child for the session's whole life. It never blocks a syscall and installs only withCAP_SYS_ADMIN(never latchingno_new_privs), so set-uid/sudoposture is preserved verbatim — visibility added, capability untouched.Tiered authority - every call is classified Tier 0..3 (
docs/adr/0003-tiered-authority.md).RELAY_SHELL_POLICY_MODEselectsopen(default),guarded, orreadonly.Redaction - audited arguments are scrubbed for tokens, keys, and
Authorizationmaterial.Bounds - timeout and output caps on every tool; bounded session count and buffers; idle/lifetime reaping.
Optional OAuth 2.1 - DCR with single-client lockdown, PKCE, file-backed rotating tokens, lazy expiry (HTTP transport; opt-in, off by default). See
docs/auth.mdfor the authentication lifecycle.Edge - parameterized Caddy config restricts the endpoint to known CIDRs with security headers and automated TLS (ACME / Let's Encrypt) installed via
deploy/install-edge.sh; systemd unit applies resource caps.
This server grants real administrative power. Run it only as a scoped service
account, only on hosts you are authorized to administer, behind the network
controls in docs/deployment.md. See
SECURITY.md for the threat model and reporting.
If your use case requires maximum model capability, relay-shell also supports
an explicit privileged posture (root/sudo workflows). Use that only on isolated
administrative hosts with strict network controls and full audit shipping.
Layout
src/relay_shell/ server, config, audit, policy, redaction, sessions,
shelltools, sshpool, inventory, errors, util, auth
deploy/ systemd unit + hardening drop-in, Caddyfile, logrotate, installers
docs/ architecture, tool reference, deployment, ADRs
tests/ unit + integration (in-process SSH server, no network)Development
ruff check . && ruff format --check .
mypy
pytestContributing
See CONTRIBUTING.md for scope, branch naming,
the local development loop, and how security-sensitive PRs are
reviewed. docs/runbook.md is the canonical
procedure for audit, review, validate, enhance, and extend tasks.
Participation is governed by the
Code of Conduct.
AI contributor guidance
AGENTS.md- repository-wide agent operating contractCLAUDE.md- Claude-focused development and review guidancedocs/runbook.md- executable audit / review / validate / enhance / extend procedures plus the prioritized backlog
License
Available Tools
18 toolsserver_infoA
Report version, effective limits, policy mode, and audit status.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. It states it reports information (non-destructive), but doesn't disclose any behavioral traits like rate limits or auth requirements. Adequate for a simple read tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence with no wasted words. Every part is meaningful and front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given that there is an output schema (not shown), description doesn't need to explain return values. For a parameterless info tool, the description is complete and sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist, so schema coverage is 100%. The description adds meaning by detailing what information is reported. Baseline is 4 due to zero params.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description uses specific verb 'report' and resource 'server' with concrete items (version, effective limits, policy mode, audit status). It clearly distinguishes from sibling tools which are all action-oriented (session, shell, ssh).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool vs alternatives. The description implies it's for checking server status, but doesn't provide context or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
session_killA
Signal a session and (by default) close and reap it.
| Name | Required | Description | Default |
|---|---|---|---|
| session_id | Yes | ||
| signal_name | No | TERM | |
| close | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description bears the full burden of transparency. It discloses that a signal is sent and the session is closed and reaped by default, but lacks details on side effects, permissions, or what 'reap' entails. The description provides a basic overview but is not comprehensive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that is front-loaded with the action. No extraneous words or redundant information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 3 parameters, an output schema, and multiple siblings, the description is too sparse. It lacks guidance on return values, valid signal names, and what happens to the session's state. More detail is needed for complete understanding.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. However, it only mentions 'session' and 'signal' without explaining any parameters: session_id, signal_name (default TERM), or close. The description adds no value beyond the schema fields, leaving the agent uninformed about parameter usage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action 'Signal a session' and includes the default behavior 'close and reap it'. This distinguishes it from siblings like session_list or session_send, which have different purposes.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for sending signals to terminate or manage a session, but it does not explicitly state when to use this tool over related siblings like session_send (which sends input) or session_resize. No exclusions or alternatives are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
session_listA
List active sessions with size, age, idle, and byte counters.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description must convey behavior. It indicates a read-only operation ('List active sessions') with no side effects, but does not mention permissions, limits, or sorting. For a listing tool, this is minimally sufficient.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, well-structured sentence with no extraneous words. Every word contributes to clarity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given no parameters and an output schema present, the description fully covers the tool's purpose and outputs. It satisfies the needs for effective selection and invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0 parameters with 100% coverage, so the description adds value by specifying the exact counters included (size, age, idle, byte). This meaningfully supplements the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('List'), identifies the resource ('active sessions'), and enumerates the output fields (size, age, idle, byte counters). This clearly distinguishes the tool from siblings like session_kill or session_send.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies the tool is for viewing session details but lacks explicit guidance on when to use it versus alternatives. No exclusions or prerequisites are provided, making it adequate but not strong.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
session_recvA
Read buffered/new output from a session, waiting up to timeout seconds.
| Name | Required | Description | Default |
|---|---|---|---|
| session_id | Yes | ||
| timeout | No | ||
| max_bytes | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full burden. It discloses the timeout behavior and that it reads buffered/new output, which is transparent for a read operation. However, it does not mention any side effects or blocking nature beyond timeout.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with 12 words, front-loaded with the main action. Every word earns its place, making it concise and efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's simplicity and the presence of an output schema, the description adequately covers the core behavior (reading output with timeout). It could mention that the tool is non-destructive or clarify the meaning of 'buffered/new', but overall it is complete enough.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It only explains the timeout parameter, while session_id and max_bytes are not described. Although parameter names are somewhat self-explanatory, the description does not add sufficient meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action: 'Read buffered/new output from a session'. It uses a specific verb and resource, and distinguishes from sibling tools like session_send or session_kill.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description does not explicitly state when to use this tool or when not to, nor does it mention alternatives. The usage is implied from the action, but lacks explicit guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
session_resizeC
Resize a session's PTY.
| Name | Required | Description | Default |
|---|---|---|---|
| session_id | Yes | ||
| cols | Yes | ||
| rows | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided; description only states the basic operation. Lacks details on side effects (e.g., content clipping), error conditions, or required permissions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, no wasted words. It is appropriately sized for the simple operation, though could benefit from additional context without becoming verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple operation and presence of an output schema, the description is too sparse. It omits prerequisites, error handling, and behavioral details that would aid an agent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, yet the description adds no meaning to the parameters. It does not clarify what cols and rows represent (e.g., character columns vs pixels) or any constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (resize) and the resource (session's PTY). It is specific and distinguishes from sibling tools like session_kill or session_list.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool, prerequisites (e.g., session must be active), or when not to use. No mention of alternatives.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
session_sendC
Send input to a session (local or SSH). enter appends a newline.
| Name | Required | Description | Default |
|---|---|---|---|
| session_id | Yes | ||
| data | Yes | ||
| enter | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must disclose all behavioral traits. It only mentions that the `enter` option appends a newline, leaving out important details like whether the call is blocking, what happens if the session is inactive, or any side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is very short with two sentences, no unnecessary words. However, the brevity sacrifices completeness, and a more structured layout could improve clarity without adding length.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 3 parameters (2 required) and no schema descriptions, the description should be more comprehensive. It does not explain how to obtain a session_id, what constitutes valid data, or how the output behaves (though an output schema exists). The context is incomplete for effective use.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description should explain all parameters. It only partially explains the `enter` parameter by noting it appends a newline. The `session_id` and `data` parameters are implied by the overall purpose but lack explicit definition or constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it sends input to a session (local or SSH), specifying the verb and resource. However, it does not explicitly differentiate from sibling tools like shell_exec or ssh_exec, which also deal with input.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. There is no mention of prerequisites, such as ensuring the session exists, or when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
shell_execB
Run a shell command on the local host and return its combined output.
Timeout and output size are clamped to the server limits. Set
use_shell=false to exec an argv without a shell.
| Name | Required | Description | Default |
|---|---|---|---|
| command | Yes | ||
| timeout | No | ||
| max_output | No | ||
| cwd | No | ||
| stdin | No | ||
| merge_stderr | No | ||
| use_shell | No | ||
| env_json | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations are absent, so the description must cover behavior. It notes clamping and the use_shell option, but omits security implications, blocking behavior, error handling, and other safety concerns for running shell commands.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short (three sentences) and front-loaded with the main purpose. However, it could be more structured to cover parameters better without becoming verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (8 params, no schema descriptions), the description is too minimal. It only addresses the core use case and one parameter, leaving the agent to guess about others. Output schema exists but doesn't compensate for missing param docs.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 0% schema description coverage and 8 parameters, only 'use_shell' is mentioned. The meaning of parameters like cwd, stdin, merge_stderr, env_json, and how they affect execution is not explained.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool runs a shell command locally and returns combined output. It distinguishes from sibling tools like shell_spawn (interactive) and ssh_* (remote execution).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description mentions timeout/output clamping and the use_shell flag, but does not explicitly state when to use this tool vs alternatives like shell_script or shell_spawn. Some guidance is present but incomplete.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
shell_scriptA
Run a multi-line script (bash/sh/python) fed on stdin.
With strict and a shell interpreter, set -euo pipefail is
prepended so failures abort early.
| Name | Required | Description | Default |
|---|---|---|---|
| script | Yes | ||
| interpreter | No | bash | |
| strict | No | ||
| timeout | No | ||
| cwd | No | ||
| env_json | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description partially covers behavior by noting the strict mode and error handling with set -euo pipefail. However, it omits important details like output capture, error propagation, security implications, or side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise with two sentences, front-loading the core purpose. Every sentence adds value, though additional parameter details might be needed.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (6 parameters, script execution), the description lacks coverage of return values, logging, error handling specifics, and environmental setup. An output schema exists but is not described, limiting completeness.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 0% description coverage, so the description must compensate. It only clarifies the 'strict' parameter's effect, leaving script, interpreter, timeout, cwd, and env_json unexplained. This adds minimal value beyond the schema defaults.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool runs multi-line scripts via stdin, specifying interpreters like bash/sh/python. This distinguishes it from sibling tools such as shell_exec and shell_spawn.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for script execution and mentions strict mode behavior, but does not explicitly state when to use this tool over alternatives like shell_exec or ssh_exec, nor when not to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
shell_spawnB
Start a persistent local PTY session; returns a session id.
Drive it with session_send / session_recv.
| Name | Required | Description | Default |
|---|---|---|---|
| command | No | ||
| cols | No | ||
| rows | No | ||
| cwd | No | ||
| env_json | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided, so description carries full burden. It mentions 'persistent' and 'local PTY session', but lacks details on resource cleanup, auth requirements, or state management. Minimal behavioral disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Extremely concise with two sentences. First sentence states the primary action; second sentence directs usage. No wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Despite having 5 parameters and no output schema details, the description ignores parameter semantics and return format. It mentions session_id but not its type or structure. Incomplete for effective tool selection and invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%. The description adds no information about any of the 5 parameters (command, cols, rows, cwd, env_json) beyond what the schema provides (defaults and types).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool starts a persistent local PTY session and returns a session id. It distinguishes from siblings by specifying that it is driven by session_send/session_recv, implying persistence.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly says to drive the session with session_send/session_recv, providing clear workflow context. However, no mention of when not to use this tool versus alternatives like shell_exec.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_checkC
Probe connectivity to the given hosts (or the whole inventory).
| Name | Required | Description | Default |
|---|---|---|---|
| hosts | No | ||
| timeout | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, and the description does not disclose behavioral details such as what the probe entails (e.g., ping, SSH handshake), how errors are reported, or the effect of the timeout parameter. It lacks transparency beyond the basic purpose.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise (one sentence) with no fluff. It is front-loaded with the core action. It could be more structured but is appropriately sized for a simple tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 2 parameters, no annotations, and an output schema, the description is incomplete. It does not explain the effect of leaving hosts empty (probing all inventory) or the role of timeout. An output schema exists but the description does not hint at the return format.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has 0% description coverage, and the description does not mention or explain any parameters (hosts, timeout). The description adds no meaning beyond the parameter names and types already in the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool probes connectivity to hosts or the whole inventory, using a specific verb and resource. However, it does not differentiate from sibling tools like ssh_exec or ssh_hosts, though the purpose is distinct enough.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for checking SSH connectivity but provides no explicit guidance on when to use this tool versus alternatives like ssh_hosts or ssh_exec. No when-not-to-use or prerequisites are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_downloadC
Download a file or tree from a remote host via SFTP.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | ||
| remote_path | Yes | ||
| local_path | Yes | ||
| recursive | No | ||
| user | No | ||
| port | No | ||
| key_path | No | ||
| known_hosts | No | ||
| jump | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description must disclose behavior. It only mentions downloading via SFTP, missing details on authentication, overwrite behavior, error handling, or return value. Minimal additional context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single short sentence, front-loaded with the action. It is concise but lacks essential details, resulting in under-specification rather than efficient conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given 9 parameters, no annotations, and no parameter descriptions, the one-line description is severely incomplete. It fails to explain required vs optional parameters, protocol details, or output schema content.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, meaning parameters have no descriptions. The tool description adds no meaning to the 9 parameters; it only restates the general purpose.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it downloads a file or tree from a remote host via SFTP, using a specific verb and resource. It distinguishes from sibling tools like ssh_upload and ssh_exec.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives, nor any prerequisites or exclusions. It only states the action.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_execA
Run a command on a remote host over SSH and return its output.
host may be an inventory/ssh_config alias or user@host.
known_hosts is strict | accept-new | ignore.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | ||
| command | Yes | ||
| timeout | No | ||
| user | No | ||
| port | No | ||
| key_path | No | ||
| known_hosts | No | ||
| jump | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must disclose behavior. It mentions output return and gives parameter constraints (host format, known_hosts policy), but does not cover authentication, connection lifecycle, side effects of command execution, or error handling. This is adequate but not comprehensive.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is extremely concise: two short sentences conveying core usage and key parameter details. No redundant information, and critical points are front-loaded. Every sentence adds value.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 8 parameters, no annotations, and an output schema (not shown), the description is somewhat incomplete. It fails to explain the return format, error behavior, authentication requirements, or how the timeout and jump host work. It covers the most essential parts but leaves gaps for a complex SSH execution tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the description adds crucial meaning for two of eight parameters (host and known_hosts). It explains host can be an alias or user@host, and known_hosts accepts specific values. However, six parameters (command, timeout, user, port, key_path, jump) lack any description, limiting overall semantic clarity.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Run a command on a remote host over SSH and return its output,' which is a specific verb and resource. It distinguishes from siblings like ssh_check (connectivity check) and ssh_download (file transfer), making its purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives (e.g., shell_exec for local commands, ssh_spawn for interactive sessions). The description does not mention prerequisites, limitations, or exclusions, leaving the agent without decision support.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_forwardC
Create a port forward.
Spec: L:lport:dhost:dport (local), R:rport:dhost:dport
(remote), or D:lport (dynamic SOCKS).
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | ||
| spec | Yes | ||
| user | No | ||
| port | No | ||
| key_path | No | ||
| known_hosts | No | ||
| jump | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries full burden. It mentions creation but does not disclose behavioral traits like what happens on invalid spec, if it blocks, how to close, or any side effects. Only 'create' is indicated, leaving many aspects ambiguous.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is brief (two sentences plus a code block) and front-loaded with the purpose. The spec format is well-structured. However, it could be improved by listing or summarizing parameters instead of leaving them to the schema alone.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a complex SSH port forwarding tool with 7 parameters and an output schema, the description is too minimal. It omits error conditions, default values, return value explanation, and usage scenarios. Significant gaps remain for an agent to use it reliably.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%. The description only explains the 'spec' parameter via format examples. Other parameters (host, user, port, key_path, known_hosts, jump) are not described, failing to compensate for the lack of structured definitions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states 'Create a port forward' with a verb and resource. It also explains the spec format for local, remote, and dynamic forwarding, distinguishing it from sibling tools like ssh_forward_close (close) and ssh_forward_list (list).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool vs alternatives, prerequisites (e.g., need an active SSH connection), or context such as whether the forward is persistent or how to manage it. The spec format is shown but usage conditions are omitted.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_forward_closeB
Close an SSH port forward by id.
| Name | Required | Description | Default |
|---|---|---|---|
| forward_id | Yes |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description should disclose behavioral details like effects on SSH connections, required permissions, or error behavior. It only states the action without any such context, leaving ambiguity.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence that is front-loaded with the verb and resource. Every word is necessary, and there is no extraneous information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simplicity of the tool and the existence of an output schema, the description is minimally adequate. However, it could benefit from mentioning that the forward must be active or that the id comes from ssh_forward_list.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema has no parameter descriptions, and the tool description only mentions 'by id', which adds little beyond the parameter name. It does not explain how to obtain a valid forward_id or its format.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action (close), the resource (SSH port forward), and the method (by id). It effectively distinguishes from siblings like ssh_forward (create) and ssh_forward_list (list).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies that the user needs to know the forward_id, likely from listing, but does not provide explicit guidance on when to use this tool versus other operations or prerequisites. The context of sibling tools partially compensates.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_forward_listB
List active SSH port forwards.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided; description only states purpose without any behavioral traits (e.g., read-only, authentication needs, side effects).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single, clear sentence with no waste. Could be slightly more informative, but efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Output schema exists, so return values are not required in description. However, no extra context beyond purpose; minimal for a simple tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters defined in schema; schema coverage is 100%. Description adds no additional param info, but baseline for 0 params is 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description uses a specific verb 'list' and resource 'active SSH port forwards', clearly distinguishing it from sibling tools like ssh_forward (create) and ssh_forward_close (close).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use vs. alternatives. Implicit from name, but no explicit context or exclusions provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_hostsA
Show the resolved host inventory (ssh_config + inventory file).
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations provided; description only says 'Show' implying read-only, but lacks details on resolution behavior, caching, or performance implications. Minimal disclosure.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Single sentence, front-loaded with action and resource, no wasted words.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given zero parameters and presence of output schema (not shown), description adequately conveys purpose and data sources. Could mention output format but not required.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
No parameters exist (schema coverage 100%), so description does not need to add parameter info. Baseline score of 4 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description uses specific verb 'Show' and resource 'resolved host inventory' with clear indication of combining ssh_config and inventory file, distinguishing it from sibling tools like ssh_exec or ssh_check.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to use this tool versus alternatives (e.g., checking specific hosts) or when not to use it. The description provides no context for selection.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_spawnB
Open a persistent interactive PTY on a remote host; returns a session id.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | ||
| command | No | ||
| cols | No | ||
| rows | No | ||
| user | No | ||
| port | No | ||
| key_path | No | ||
| known_hosts | No | ||
| jump | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description must disclose behavioral traits. It mentions 'persistent interactive' but omits key details like authentication requirements, error handling, timeout behavior, and how to manage the session (e.g., session_kill).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single sentence with no wasted words. It is front-loaded with the core purpose. Could potentially be expanded to include parameter details without losing conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the complexity (9 parameters, 1 required) and no annotations, the description is insufficient. It does not cover parameter semantics, prerequisites, or session lifecycle, though the output schema likely documents the returned session id.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description must compensate. It provides no explanation for any of the 9 parameters (host, command, cols, etc.), leaving their purpose and valid values entirely undefined.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Open', the resource 'persistent interactive PTY', and the output 'returns a session id'. It effectively distinguishes from sibling tools like ssh_exec (non-interactive) and shell_spawn (local PTY).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for interactive remote sessions but does not provide explicit when-to-use or alternatives. No exclusions or prerequisites are mentioned, leaving the agent to infer from context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
ssh_uploadB
Upload a file or tree to a remote host via SFTP.
| Name | Required | Description | Default |
|---|---|---|---|
| host | Yes | ||
| local_path | Yes | ||
| remote_path | Yes | ||
| recursive | No | ||
| user | No | ||
| port | No | ||
| key_path | No | ||
| known_hosts | No | ||
| jump | No |
Output Schema
| Name | Required | Description |
|---|---|---|
| result | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations provided, the description carries the full burden of behavioral disclosure. It states 'Upload' (a write operation) but does not mention destructive potential (overwriting files), authentication requirements, error handling, or other behaviors beyond the basic action.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no wasted words. It efficiently conveys the core purpose, earning its place without any fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (9 parameters, no annotations, 0% schema coverage), the description is too sparse. It does not cover authentication, prerequisites, or parameter relationships, leaving significant gaps for the agent to handle properly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds minimal meaning beyond the schema: 'file or tree' hints at the recursive parameter, but it does not explain any other parameters (host, user, key_path, etc.). With 0% schema description coverage, the description fails to compensate adequately.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'Upload' and the resource 'a file or tree to a remote host via SFTP'. It distinguishes this tool from siblings like ssh_download (download) and ssh_exec (execute command) by specifying the action and protocol.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives like ssh_download or ssh_exec. It does not mention prerequisites (e.g., SSH access) or scenario-specific advice, leaving the agent without context for decision-making.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
18 tool updates
v0.1.0- First observed
server_info - First observed
session_kill - First observed
session_list - First observed
session_recv - First observed
session_resize - First observed
session_send - First observed
shell_exec - First observed
shell_script - First observed
shell_spawn - First observed
ssh_check - First observed
ssh_download - First observed
ssh_exec - First observed
ssh_forward - First observed
ssh_forward_close - First observed
ssh_forward_list - First observed
ssh_hosts - First observed
ssh_spawn - First observed
ssh_upload
TDQS
Most tools target distinct operations (e.g., session vs shell vs SSH), but shell_exec and shell_script overlap in running commands, and session_send/recv are closely tied to shells. Overall, an agent can distinguish them with careful reading.
Naming is predominantly <domain>_<action> with underscores, e.g., ssh_upload, session_kill. A few exceptions like server_info (reverse order) and ssh_hosts (noun) break the pattern slightly, but consistency is high overall.
18 tools cover a well-scoped domain of remote execution and session management without being excessive. Each tool serves a clear purpose, and the count feels appropriate for the functionality offered.
The set covers local and remote execution, interactive sessions, file transfer, port forwarding, and server info. Minor gaps exist (e.g., no remote file listing, no SSH key management), but core workflows are supported.
Maintenance
Resources
Unclaimed servers have limited discoverability.
Looking for Admin?
If you are the server author, to access and configure the admin panel.
Related MCP Connectors
Scoped, audited SSH exec, sessions, and SFTP on your saved servers without exposing credentials
MCP server for mandates, delegation, policy-gated execution, credential grants, and audit.
111Run commands and read/write files on your servers over Termalin's keyless tunnels (hosted MCP).
A comprehensive Model Context Protocol (MCP) server that enables AI assistants to interact with yo…
Related MCP Servers
- AlicenseCqualityDmaintenanceA secure server that implements the Model Context Protocol (MCP) to enable controlled execution of authorized shell commands with stdin support.1MIT
- AlicenseBqualityDmaintenanceA server that enables remote command execution over SSH through the Model Context Protocol (MCP), supporting both password and private key authentication.112MIT
- FlicenseAqualityDmaintenanceA local Model Context Protocol server that allows LLMs to securely execute shell commands on remote Linux and Windows systems via SSH connections.6172-
- AlicenseAqualityAmaintenanceA Model Context Protocol server that allows LLMs to securely execute shell commands on remote Linux and Windows systems via SSH. It supports password and key-based authentication, command timeouts, and sudo elevation for administrative tasks.1114,123688MIT
Latest Blog Posts
- Who's Calling? MCP Hosts Are an Identity Blind Spot (And the Spec Knows It)By Om-Shree-0709 on .mcpAgent IdentityOAuth 2.1
- Your AI Chatbot Just Exposed Your CEO's Salary to an InternBy Om-Shree-0709 on .Agent IdentityMCP SecurityOAuth Delegation
- Why MCP Servers Need Execution Sandboxing (And Why Your Current Stack Isn't Enough)By Om-Shree-0709 on .Agentic AiPrompt InjectionWebAssembly
MCP directory API
We provide all the information about MCP servers via our MCP API.
curl -X GET 'https://glama.ai/api/mcp/v1/servers/rmednitzer/relay-shell'
If you have feedback or need assistance with the MCP directory API, please join our Discord server