Problem

nemoclaw <sandbox> mcp status <server> verifies the managed provider, policy, credential readiness, and agent-adapter registration.

However, it does not verify whether the MCP endpoint exposes the tools the agent actually needs.

I reproduced this with two endpoints for the same vendor MCP service. Both registered successfully and appeared healthy, but:

• one exposed only 3 tools;
• the other exposed 18 tools, including the Jira JQL search capability required by the agent.

Nothing in the current mcp status output distinguished them.

This is the same class of gap #6379 called out ("mcp status stays all-green" while the server is unusable at runtime); the --probe flag added in #6382 closed it for credential resolution, and --tools would close it for tool availability.

The current OpenClaw workaround is:

nemoclaw <sandbox> exec -- \
  mcporter list <server> --schema

This requires adapter-specific knowledge and prints full remote schemas when only the tool inventory is needed.

Proposal

Add an opt-in live discovery flag:

nemoclaw <sandbox> mcp status <server> --tools

It would perform the required MCP initialization and tools/list request through the existing managed-MCP path and append a concise result:

tool discovery: successful
tools discovered: 18
  - getJiraIssue
  - searchJiraIssuesUsingJql
  - createJiraIssue
  ...

With --json:

{
  "toolDiscovery": {
    "ok": true,
    "count": 18,
    "tools": [
      "getJiraIssue",
      "searchJiraIssuesUsingJql",
      "createJiraIssue"
    ],
    "truncated": false
  }
}

The default mcp status behavior would remain unchanged. Live network activity would occur only when --tools is explicitly requested for a named server.

Security boundary

The diagnostic would:

• use the existing sandbox, credential provider, policy, and adapter path;
• call only the MCP methods required for initialization and tools/list — both already allowlisted in the generated per-server policy (MCP_BRIDGE_ALLOWED_METHODS), so no policy change is needed;
• never invoke tools/call or any discovered tool;
• extract and display tool names only;
• discard descriptions, schemas, annotations, and other untrusted content;
• never print credentials, authorization headers, placeholders, environment values, arguments, or results;
• enforce bounded timeout, response-size, pagination, and tool-count limits.

Questions

1. Should this be mcp status <server> --tools or a separate mcp tools <server> command?

2. Should the first implementation be OpenClaw-specific, or should it begin with an adapter-neutral discovery interface? The fix(mcp): probe wire-level credential resolution in mcp status and add (#6379) #6382 probe transport (in-sandbox request wrapped in the adapter runtime, with the gateway resolving the credential placeholder) appears adapter-neutral already, so I'd propose starting there.

3. Should the initial JSON output contain tool names only?

I reproduced this with a working managed-MCP setup and would be happy to implement the agreed approach, including tests and documentation.