Tupper MCP provides 6 tools with clear verb-noun naming (create_sandbox, list_sandboxes, run_command, read_file, write_file, kill_sandbox). All tools have descriptions (10-60 chars) and input schemas with typed parameters. However, descriptions are minimal (below the 194-char baseline for production tools), parameter descriptions lack detail about constraints and formats, and output schemas are not documented. No error handling guidance, no idempotent hints, and no recovery paths for destructive operations. Tool composition is sound (each does one thing), but descriptions do not explain WHEN to use each tool or what to expect in responses.
Create and start a new sandbox, returning its id and info.
Stop and remove a sandbox.
List existing sandboxes.
Read a UTF-8 text file from a sandbox.
Run a shell command inside a sandbox and return its output.
Write a UTF-8 text file into a sandbox.
Descriptions are too brief (10-60 chars vs. 194-char baseline). They state WHAT but not WHEN to use or what to expect. E.g., 'Create and start a new sandbox, returning its id and info' lacks context on when to call this vs. list_sandboxes, what 'info' contains, or how to use the returned id.
Output schemas are not documented. LLMs cannot plan downstream calls or extract required fields. E.g., create_sandbox returns 'id and info' but the structure of 'info' is unknown, does it include status, created_at, image_name? This forces agents to guess.
Parameter descriptions lack constraint details. 'image' is described as 'OCI image reference' but no format, length limits, or examples. 'command' is 'shell command to run' but no guidance on timeout, output size limits, or shell type (bash, sh, zsh?). Agents cannot validate inputs.
| Scored | Grade | Overall | Spec posture | Rubric |
|---|---|---|---|---|
| 2026-09-23 | D | 53 | 2026-07-28+ | v2 |
Destructive operations (kill_sandbox) lack confirmation or dry-run support. No error handling guidance for recovery. If an agent accidentally kills the wrong sandbox, there is no undo path or warning.
No tool annotations (readOnlyHint, destructiveHint, idempotentHint). Agents cannot infer which tools are safe to retry, which modify state, or which are read-only. This is critical for sandbox operations where retrying a write_file could duplicate content.