Plumbline — a trust layer for LLM answers

Run Sandboxed JavaScript (Unverified)

run_code

Read-only

Run YOUR OWN JavaScript in the in-tenant coderunner sandbox with the read-only, snapshot-scoped plumb.query() SDK. No filesystem, environment, or general network access. Read plumbline://sandbox-api.d.ts before writing code. The raw-SQL server opt-in is enabled, but results still bypass the trust path and are UNVERIFIED. Returns stdout/stderr plus metadata-only host-call trace evidence.

Input Schema

TableJSON Schema

Name	Required	Description
`code`	Yes	JavaScript source to execute in the in-tenant coderunner sandbox. No filesystem, environment, or general network access. When the server explicitly enables raw SQL and uses the local grant-capable runner, a read-only snapshot-scoped SDK is preloaded as global 'plumb' and plumbline://sandbox-api.d.ts is listed; otherwise the sandbox is airtight and plumb is undefined. console.log output is returned as stdout.
`concepts`	No	optional: the fact concepts this code computes, as claimable fact keys (e.g. median_income_cents) or free-form names. The server reports per concept whether a registered seed exists (cross_check can corroborate figures) or not (cross_check will return unmapped: the verified store can never corroborate them).
`acknowledge_unverified`	No	set true to confirm you understand results BYPASS the trust plane and are UNVERIFIED, and that you will label them so to the user. On deployments with the acknowledgment gate the FIRST raw call of a session is refused without it; one acknowledgment covers the rest of the session.

Output Schema

TableJSON Schema

Name	Required	Description	Default
`value`	No
`prompto`	Yes

TDQS

A4.3/5.0

Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description exposes key behaviors well beyond the annotations, including sandbox restrictions (no filesystem, environment, or network), the read-only snapshot-scoped SDK, the UNVERIFIED trust-path bypass, the raw-SQL option with its trust caveat, and the metadata-only nature of the host-call trace evidence. This is detailed and useful.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description contains just four sentences, each serving a distinct role: operation+SDK, constraints, preparation tip, trust/result note. It is front-loaded with the core miss and wastes no words.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description plus schema annotation covers the full calling context: what the sandbox is, what constraints exist, what the returned evidence will look like, and what preconditions are needed. The acknowledgement gate and return details are documented in the input/output schema, so the description need not repeat them.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema already covers all parameters at 100% coverage, so the description does not need to repeat parameter-level docs. The description does add a little context around the 'code' parameter by explaining the sandbox and SDK, but it does not add significant value beyond the schema for parameter comprehension.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific action ('Run YOUR OWN JavaScript'), a specific resource ('in-tenant coderunner sandbox'), and a distinctive scope ('read-only, snapshot-scoped plumb.query() SDK'). It also implicitly differentiates from the sibling run_sql by focusing on JavaScript execution rather than direct SQL, so an agent can tell what this tool is for.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies when the tool should be used: when you need to run your own JavaScript in the sandbox. It also provides a clear predecessor by saying 'Read plumbline://sandbox-api.d.ts before writing code'. However, it stops short of naming alternatives or explaining when NOT use this tool (for example, when plain SQL is intended and run_sql would be more appropriate).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

All Plumbline — a trust layer for LLM answers tools Inspect

Try in Browser

RayrunBuild, deploy, and operate MCP servers without becoming an infrastructure team.ray.runAd

Glama MCP Gateway

Add one secure layer between your agents and this server.

TDQS

A4.4/5.0

Disambiguation4/5

Most tools occupy clearly different lifecycle slots: ask_prepare/ask_submit_draft/ask_result form the verification flow, run_sql/run_code/query_fact are distinct execution paths, and cross_check/trust_finalize handle trust outcomes. The main ambiguity is that the ready-made domain tools (search_employee, compare_departments, etc.) resemble a generic ask_prepare flow, but their descriptions explicitly route around this, so the boundary is recoverable.

Naming Consistency5/5

All tool names use lowercase snake_case and are almost uniformly verb-first: ask_, get_, run_, search_, compare_, query_, summarize_, find_, and trust_. Even compound names like ask_submit_draft and get_answer_queries follow the same predictable action-oriented pattern.

Tool Count4/5

Eighteen tools is at the upper end of what is comfortable for an agent, but each maps to a distinct surface area: question preparation, submission, raw query, execution, verification, audit, transparency, and documentation. A few convenience tools could arguably be merged into the generic ask_prepare flow, which keeps this from being a perfect score.

Completeness5/5

The trust-layer lifecycle is fully covered: ask_prepare → draft generation → ask_submit_draft → ask_result/trust_finalize, plus cross_check for corroboration and get_answer_queries/get_evidence_document for audit. There are no obvious dead ends for the intended verified-answer workflow; intentionally restricted browsing and listing are security features rather than missing operations.

Resources

Need Help?