ClickHouse Loom

Official

Overview Schema Source Related Servers Discussions Admin

loom_memory_lock

Locks a stored memory against a class of writes: read_only blocks value, expiry and deletion changes, while no_delete permits edits but refuses deletion or redaction. Guarded writes return 423 LOCKED.

Instructions

WHAT: Lock one memory against a class of writes. read_only refuses a changed value, a changed expiry and deletion; no_delete lets the value change but refuses tombstone/redact/clear/consolidate-away. Guarded ops answer 423 LOCKED with the reason. Only an admin loosens. WHEN: 'make sure this never changes', 'freeze the deploy window', 'this must not be deleted / forgotten', 'protect this fact', 'legal hold on X', 'keep this exactly as is'. WHEN NOT: To keep a fact ahead of later conflicting writes (that is memory.pin) or to share it (memory.promote, via loom_op). Never lock on inferred intent. ARGS: memory_key, mode (read_only | no_delete), reason (required), optional until / ttl_seconds. Server fills identity.

Tool call template

Replace each placeholder with a value matching the input schema. Only required parameters are included; add optional parameters as needed.

{
  "id": 1,
  "jsonrpc": "2.0",
  "method": "tools/call",
  "params": {
    "arguments": {
      "memory_key": "<memory_key>",
      "reason": "<reason>"
    },
    "name": "loom_memory_lock"
  }
}

Input Schema

Name	Required	Default
`mode`	No	read_only
`until`	No
`reason`	Yes
`run_id`	No
`locked_by`	No
`namespace`	No
`memory_key`	Yes
`ttl_seconds`	No

Schema Changelog

Changes observed during successful MCP inspections.

First observedv1.1.0Nov 12, 2026

TDQS

A4.6/5.0

Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Goes well beyond the annotations by disclosing the failure contract (guarded ops return 423 LOCKED with a reason), the precise semantic difference between read_only and no_delete (value/expiry/deletion vs tombstone/redact/clear/consolidate-away), and the authorization asymmetry ('Only an admin loosens'). It does not state what happens if the memory_key is unknown or whether re-locking an already-locked key succeeds, which is notable given idempotentHint=false.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Structured as WHAT/WHEN/WHEN NOT/ARGS with the defining statement front-loaded. Despite being dense, every line carries actionable information — the mode semantics, the error code, the admin constraint, and the sibling routing are all load-bearing.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For an 8-parameter mutation tool with no output schema and only generic annotations, the description supplies the semantics, guardrails, and failure mode an agent needs. The remaining gaps are the undocumented namespace parameter and the absence of any mention of how a lock is released (presumably out of scope, via loom_op/admin).

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 0% schema description coverage across 8 parameters, the description carries the full burden and largely succeeds: it explains mode's enum values behaviorally, marks reason required, and clarifies until/ttl_seconds as optional while noting the server fills identity (covering locked_by/run_id implicitly). namespace is never explained, and the relationship between until and ttl_seconds (mutually exclusive? combinable?) is left ambiguous.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Opens with a specific verb+resource: 'Lock one memory against a class of writes,' then immediately defines the two lock modes so the agent knows the exact scope of protection. It also names the sibling operations it is not (memory.pin, memory.promote via loom_op), so it is distinguishable from related tools without opening their schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides explicit WHEN triggers in user-intent phrasing ('make sure this never changes', 'legal hold on X') and a WHEN NOT section that routes to memory.pin for conflicting-write precedence and memory.promote for sharing. It also adds a negative guardrail ('Never lock on inferred intent'), which is exactly the kind of exclusion an agent needs.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Deploy Server