MELRA
MELRA is a local, policy-governed execution server for AI-agent tool calls, providing plan/approve/execute, verification, receipts, and durable workflows.
Discover available capabilities, policy posture, and limits with
melra_capabilities.Plan bounded operations and execute them only after policy checks and any required scoped approval (
melra_plan,melra_execute).Run file operations, shell-free terminal commands, browser automation, computer-use actions, HTTP requests, operational memory actions, and system-info queries.
Require declared evidence for non-read operations and verify outcomes; successful adapters with failed evidence are marked partial.
Track task status, cancel tasks, and retrieve redacted receipts plus execution certificates (
melra_task_status,melra_task_cancel,melra_receipt).Create and advance durable, restart-safe workflows using operations, approvals, conditions, parallel branches, bounded loops, checkpoints, compensation, human input, and delegation.
Inspect, pause, resume, suspend, or cancel workflows (
melra_workflow_status,melra_workflow_control,melra_workflow_cancel).Govern mutations at most once per task; uncertain outcomes are parked for reconciliation rather than blindly replayed.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@MELRAPlan and execute a verified file read from /tmp/data.txt"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
MELRA
Modular Execution Layer for Reliable Autonomy
Your AI agent decides what to do. MELRA governs how tool calls are authorized, verified, and recovered.
An open-source local execution runtime for agent tool calls you route through MELRA. It checks each call against policy, requests approval when needed, verifies declared evidence, and keeps a redacted receipt of what runs to an outcome. For each task, MELRA dispatches mutations at most once; uncertain outcomes are parked for reconciliation instead of replay. Exactly-once external effects still depend on the provider. Calls made through other tools remain outside MELRA's control.
Works with
26-second demo · Quick start · How it works · See what it is doing · Docs · Contribute · Discussions · Product Hunt launch
26-second demo
https://github.com/user-attachments/assets/e5cf895d-7ea6-4797-a1ef-e69cc5860d3f
MELRA is alpha software. The local runtime is tested end to end, but APIs may
change before 1.0. Use an isolated workspace, keep domain and command allowlists
narrow, and read every approval before you give it.
Quick start
You need Node.js 22.13 or newer, or 23.4 or newer. From the project the agent should work in, one command sets everything up:
cd ~/project
npx @melra/cli@alpha setupThat directory becomes the agent's workspace, the boundary for its file and command
operations. setup shows it, and asks before making your home directory, a directory
holding it, or / the workspace; set MELRA_WORKSPACE to choose another.
In a terminal, setup is a short wizard. It writes a safe local policy, finds the
agent apps on your machine, asks which one should use MELRA, and writes MELRA into
that app's own config file, keeping everything else in it (and saving a .bak first):
Which MCP client should use MELRA?
1) Claude Code detected: 'claude' on PATH
2) Cursor detected: config file found
3) Gemini CLI detected: config folder found
...
Choose 1-26 [1]: 1
Write it into ~/project/.mcp.json? [Y/n]
✓ Workspace ~/project
✓ Policy ~/.melra/policy.json
✓ Claude Code ~/project/.mcp.json
Next: Start claude in this workspace and approve the 'melra' server when it asks; 'claude mcp list' then shows it connected. Or start it with 'melra launch claude-code', so MELRA's are the only tools it has that change anything.Then restart your agent app (Claude Code asks you to approve a project's server once) and ask it to do something, for example "use melra to show me the system info". That's it.
How | Command |
One client, no questions |
|
Print the config instead of writing it |
|
Install globally |
|
Container (no Node needed) |
|
Prebuilt release | download from releases, verify against |
From source |
|
One file, no Node needed (experimental) | from a checkout: |
Check what you installed |
|
Every command prints readable output in a terminal and plain JSON when piped or with
--json, so scripts keep working. MELRA creates <MELRA_HOME>/payload.key with
private permissions on first start; back it up with the SQLite files, because losing
it makes persisted payloads unreadable. See installation for
every install path, environment variable, and the hardened Docker invocation.
This project publishes only under the@melra/ npm scope (@melra/cli is the CLI)
and on its releases, where the Python
SDK's wheel is. An unscoped npm package melra or a PyPI package melra is
not this project's. Install from that scope, from this repository, or from the
releases.
If MELRA helps, star the repository so other
agent builders can find it. Trying it in Cursor or another client? Share the client
and its version, your OS, and your MELRA version (npx @melra/cli@alpha version) in
issue #184; partial test results are
useful too.
Related MCP server: Vizier
What is MELRA?
AI agents no longer just talk. They edit files, run commands, click through websites and call APIs on your behalf. Four questions come with that, and most agents answer them differently, or not at all:
🛡️ Is it allowed?
Every action MELRA receives is checked against your policy, and checked again at the moment it runs. Risky changes wait for your exact approval.
✅ Did it really work?
"No error" is not success. An action counts only when the evidence you declared holds: the file exists, the exit code is 0, the page says what it should. For a file change or a memory delete MELRA also checks the end state itself: a written file holds exactly the bytes sent.
🔁 What if it crashes?
Every mutation MELRA dispatches is recorded before it runs and runs at most
once. After a crash, MELRA settles it from its evidence or the provider; what it
cannot settle waits in recovery_required and is never replayed.
🧾 What happened?
Every action MELRA runs to an outcome leaves a redacted, append-only receipt and a certificate that carries its own digest, so you can audit what ran, who asked, and why it was allowed.
MELRA answers those questions in one place for tool calls routed through it, across supported agents. It sits underneath your agent for those calls, the way an operating system sits underneath your apps:
The LLM reasons. The harness manages the loop. MELRA governs the effect lifecycle for calls routed through it. Swap the model or the agent; MELRA's policies, approvals, credentials, history and receipts can stay in place.
Works with your agent
MELRA speaks the Model Context Protocol, so any MCP
client can use it. For these, melra setup --client <name> writes the config in the
client's own format and location, and melra doctor tells you whether each one is
pointed at MELRA:
Agent |
| Config it writes | Tested |
Claude Code |
|
| connected by hand |
Claude Desktop |
|
| config checked against docs |
OpenAI Codex CLI |
|
| config checked against docs (its own CLI parsed it) |
Cursor |
|
| config checked against docs |
🟦 VS Code (Copilot agent mode) |
|
| config checked against docs |
Gemini CLI |
|
| config checked against docs |
Windsurf |
|
| config checked against docs |
Zed |
| Zed | config checked against docs |
🧩 Cline |
| Cline's | config checked against docs |
⬛ OpenCode |
|
| connected by hand |
👻 Kiro |
|
| config checked against docs |
🪿 Goose |
|
| config checked against docs |
▶️ Continue |
|
| config checked against docs |
⚡ Amp |
|
| config checked against docs |
🦞 OpenClaw |
|
| config checked against docs |
⚕️ Hermes Agent (Nous Research) |
|
| connected by hand |
GitHub Copilot CLI |
|
| config checked against docs |
🐉 Qwen Code |
|
| config checked against docs |
🅰️ Auggie (Augment) |
|
| config checked against docs |
Warp |
|
| config checked against docs |
Junie (JetBrains) |
|
| config checked against docs |
🤖 Factory Droid |
|
| config checked against docs |
🌙 Kimi Code |
|
| config checked against docs |
🪁 Kilo Code |
|
| config checked against docs |
🧪 LM Studio |
|
| config checked against docs |
🔌 Anything else |
| prints the standard | documented only |
Tested says how far each one has been taken: run in CI (an automated suite drives it), connected by hand (its own CLI connected to a packed release over MCP, but no task was run from inside it; see COMPATIBILITY.md), config checked against docs (the file and format come from its documentation or source, and the CLI tests write and read them back), or documented only.
Building your own agent? Use the TypeScript SDK or the
Python SDK. Both can spawn MELRA or connect to one that is already running
over loopback HTTP or a private Unix socket. For agent frameworks, see the
framework examples: the official MCP SDKs',
LangChain / LangGraph, OpenAI Agents SDK and Vercel AI SDK snippets all run in CI
with no model, as far as listing MELRA's tools and calling melra_capabilities.
A named client is markedverified only after the released package, not a source checkout, passes discovery, planning, approval, execution, cancellation and receipt retrieval in that client. Per-client status lives in COMPATIBILITY.md.
How it works
An effect is one bounded operation an agent routes through MELRA: file.write,
terminal.run, browser.click, http.request, and so on. MELRA handles each routed
effect in nine stages, split between a plan step and an execute step (for a single
task, melra_plan then melra_execute) so that nothing runs at planning time:
Here is one change from start to finish, in developer mode. In
enforced mode the challenge carries no
phrase: you approve with melra approve <task-id> outside the conversation,
and the agent's melra_execute sends no approval at all.
sequenceDiagram
autonumber
participant A as Your agent
participant M as MELRA
participant You
participant W as Your system
A->>M: melra_plan: write notes.md, evidence "file contains 'done'"
M->>M: type, classify, check policy, record
M-->>A: awaiting_approval + challenge "APPROVE 3f9c…"
A->>You: May I write notes.md?
You-->>A: yes
A->>M: melra_execute with the exact phrase
M->>M: policy again, not already done?
M->>W: write the file (under a budget)
M->>W: read it back, independently
M-->>A: verified_success + receiptWhat the final status means, and what an agent should do next:
Status | Meaning | Next step |
🟢 | It ran and every declared check passed, and so did MELRA's own for a file change or memory delete | Done |
🟡 | It ran, but the evidence, declared or MELRA's own, did not hold, or a | Look at the evidence, then decide; a change answered no stays in place, so fixing it takes a new plan |
🔴 | Refused before anything ran | Read the reason; the same request will be refused again |
🔵 | A change is waiting for your approval | Developer mode: approve it from the agent that planned it. Enforced mode: |
⏳ | It ran and every check MELRA can make passed; a | A principal other than the one that planned it answers with |
🟣 | A change may or may not have happened, or happened and its | Check the world first; never re-run blindly |
⚪ | It did not complete | Safe to plan again |
The agent resolves "run the checks" into one bounded operation, plus the evidence that would prove it worked:
{
"goal": "Run the repository checks",
"operation": { "kind": "terminal", "action": "run", "command": "pnpm", "args": ["check"] },
"requiredEvidence": [{ "type": "exit_code", "value": 0 }]
}The task reaches verified_success only if the process exits 0. A process that runs
and exits 1 completed the action but failed the evidence, so it is reported as
partial. MELRA never receives a goal like "fix the production server": that needs
judgement, which belongs to the model. A kernel that interpreted sentences would be a
kernel whose guarantees depended on a model.
When an agent connects, MELRA also sends it a short guide to this loop (the MCP
server's instructions), so a model knows to declare evidence, read the status, and
never blindly retry an unknown outcome, without anyone prompt-engineering it.
See what it is doing
You can see each action MELRA handled and its policy decision, and, for each that ran to an outcome, its evidence and receipt, from the terminal or the browser. Nothing here can approve or start work, and approval phrases are never displayed.
From the terminal
$ melra status
MELRA 0.4.0-alpha.2 developer mode
Tasks 3 total: 1 awaiting_approval,
1 policy_blocked, 1 verified_success
Waiting 1 waiting for approval
HTTP 127.0.0.1:7457 not running
$ melra tasks
ID STATUS OPERATION UPDATED
64199678 awaiting_approval file.write 0s ago
ca4aec7a policy_blocked terminal.run 1s ago
a1285e0f verified_success system.info 1s ago
$ melra watch # live, until Ctrl-C
6:07:21 PM task 882cf55c verified_success
6:07:22 PM task f813364c awaiting_approvalmelra doctor checks Node, SQLite, the browser and policy, and reports which of your
agent apps point at MELRA, with the one command that fixes anything wrong.
In the browser: melra serve --http --open
An overview, a searchable task list, and durable workflows with a live event stream. It works at phone width and in light and dark, and it is served with a strict Content-Security-Policy.
Safe by default
Default | |
🏠 | Local only. stdio, loopback HTTP behind a token, or a mode- |
📴 | Telemetry is off. |
✍️ | Changes need two things: declared evidence and an exact, expiring, task-scoped approval: a phrase in developer mode, an operator's |
📁 | Paths stay inside your workspace, including terminal working directories; symlink escapes are refused. |
🚫 | Shells, |
🌐 | Private, link-local and cloud-metadata addresses are blocked by the browser and HTTP adapters themselves, after DNS resolution, before any allowlist is consulted; loopback too in enforced mode, unless the policy opens it. |
⚠️ | Web page content is marked untrusted and can never change policy. |
🔑 | Secrets are redacted before anything is stored, and agents get capabilities, never your raw credentials. |
⏱️ | Every call is bounded by a budget and a cancel signal; a stalled browser fails with a clear error instead of hanging. |
What actually guards an effect depends on the mode:
|
| |
Approving a change | The agent can, with the phrase its own plan response carries: a record, not a boundary | Only an operator, out of band ( |
An approved command | Runs in an OS sandbox where one works (Seatbelt on macOS, bubblewrap on Linux): it writes only the workspace and temp, cannot read MELRA's files or the login files MELRA lists (see INSTALLATION; the rest of home stays readable), and has no network without the | The same sandbox (in the container pair, another account), and MELRA will not start without one unless the policy file records the opt-out |
The agent's own tools | Untouched: a native shell or editor goes around MELRA | Yours to remove; MELRA's server cannot see them, |
melra doctor says which of these hold on its protection line, and
melra_capabilities reports approvals and sandbox beside mode.
Every row above can be switched off at once with melra serve --unsafe-local (or
MELRA_UNHINGED=1): no policy, no approvals, no evidence requirement, no workspace
confinement, no destination checks. The agent gets the reach your OS user has, apart
from a few fixed file checks that hold in every mode.
The mode announces itself on stderr, in melra doctor and in melra_capabilities,
and receipts still record what ran. See
unsafe-local mode.
The honest gap in a default install is that MELRA governs the effects it is asked
for. An agent holding both a MELRA terminal and a native one makes the kernel
optional. MELRA_MODE is where you say which situation you are in:
Mode | Meaning |
| MELRA governs what it is asked for; the agent may have another path, and you accept that. This is why MELRA can be tried in thirty seconds. |
| You assert the alternative is gone: the agent is sandboxed, holds no privileged secrets, and reaches these systems only through here. |
MELRA cannot verify that assertion from inside its own process, and it does not
pretend to; the isolation is the operating system's job. What enforced mode does is
close every door MELRA owns: --unsafe-local is refused outright, nothing binds
outside loopback (a 0600 Unix socket is allowed), no client can register itself,
every command MELRA runs gets an OS sandbox of its own that keeps it out of MELRA's
data and your logins (MELRA will not start where none works, unless the policy file
records the opt-out), and mode is stamped on every receipt. For the operating-system side,
examples/deploy has a hardened Docker run, a systemd
unit and a Compose pair that puts the agent in a container of its own, each checked
in CI, melra doctor reports which restrictions are actually in
effect, and melra probe, run inside the
agent's box, checks that it stops a workspace write, a read of MELRA's data, outbound
and local connections, and starting a shell. See
deployment modes,
the threat model and the security policy.
For Claude Code, melra launch claude-code takes the other path away for the
session it starts: Read, Glob and Grep are its only built-in tools and melra its
only MCP server, so the only tools it has that change anything are MELRA's. In
developer mode the agent approves its own changes, and a command MELRA runs for
it has your rights wherever no sandbox
works, so --mode enforced is how you decide each one. The
server it starts leaves node, npm, npx and pnpm out of the default
allowlist, unless the policy file lists them, as one melra setup wrote does:
remove the ones the agent does not need. A claude started any other way is
unchanged. See
launching an agent.
For OpenClaw and Hermes Agent,
melra setup --client openclaw --exclusive --write (or --client hermes)
turns the agent's own shell, web and file-changing tools off (Hermes's file
reads too) in its own config, through the switch each one documents, and
melra doctor says whether its exec or terminal is still enabled. That is
a default the agent's OS user can edit, not a boundary. See
OpenClaw's and Hermes Agent's tools.
Why MELRA
An LLM decides what to do. A harness runs the loop that gets it there. Something still has to decide whether the resulting effect is allowed, avoid replaying uncertain mutations, prove what happened, and survive a crash in the middle. Today that machinery is rebuilt inside every agent harness, and it dies with the harness. MELRA is that machinery, factored out and made agent-independent.
Tool call executes immediately
Success = no exception thrown
Policy, if any, checked once
Changes look the same as reads
Output is trusted
No durable record
Rules live inside one agent
Plan and execute are separate calls
Success = declared evidence and MELRA's own checks passed
Policy checked again at execution time
Changes need evidence and an exact approval
Page content is explicitly untrusted
Redacted receipt + SHA-256 execution certificate
Rules outlive the agent that used them
Next to the two layers it is most often mistaken for:
Agent harness | MCP server | MELRA | |
Model loop and reasoning | ✓ | ✗ | ✗ |
Tools | ✓ | ✓ | via adapters |
Agent-independent policy | usually ✗ | possible | core |
Durable effect state | sometimes | rarely | core |
Idempotency across restarts | varies | rare | core |
Crash recovery without replay | varies | rare | core |
Independent verification | uncommon | possible | core |
Evidence receipts | uncommon | possible | core |
Works across agents | ✗ | ✓ | ✓ |
Credential isolation | varies | varies | core |
Hard capability boundary | varies | usually ✗ | partly shipped |
Plenty of MCP servers can do these things; this is not a claim that none of them do.
The difference is that in MELRA they are the execution contract rather than a per-tool
option. The boundary is partly shipped: MELRA_MODE=enforced closes every door
MELRA owns, but the OS isolation that stops a harness reaching the filesystem around
the kernel is the operator's to build; runnable hardened deployment recipes are still
to come (#52).
The feature test. Anything that would still make sense if the request came from ordinary deterministic software belongs in MELRA: authorisation, idempotency, credential isolation, recovery, verification, effect history. Prompt optimisation, LLM memory, model selection, a planner and agent personality belong to the harness above. That is why nothing in MELRA's execution path ever calls a model.
What it can do
Effect adapters
The kernel is the contract; these are its shipped implementations. Every one passes through the same policy, approval, budget, verification, receipt and certificate pipeline; an adapter that skipped it would not be an adapter.
Adapter | What is implemented | |
🗂️ | Files | Root-confined read, hash, atomic write, move, mkdir and delete, with symlink-escape defenses |
💻 | Terminal | Shell-free foreground and supervised background processes with allowlists, traits, timeouts, interactive input, cancellation and redaction |
🌐 | Browser | Isolated Playwright sessions, semantic DOM targets, bounded artifacts, network and popup policy, opt-in profiles, condition-based settling, and every browser call bounded so a stalled page fails clearly |
🖥️ | Computer | Capability discovery, accessibility-tree and OCR inspection, and governed screenshot, pointer, drag, keyboard and scroll on macOS, Windows and supported Linux/X11 setups |
📡 | HTTP |
|
🧠 | Operational memory | A kernel service, not an adapter: scoped SQLite storage of what MELRA knows about its own effects, with hybrid ranking, freshness, expiry, supersession, provenance and redaction |
Database, cloud and SaaS adapters are designed and on the roadmap, not shipped today. Semantic memory about the user (preferences, conversation history) belongs to the harness, not here.
A deliberately small tool surface
Twelve tools in front of the adapters and one durable workflow controller. The CLI, both SDKs, loopback HTTP and the Unix socket reach the same twelve operations; this list is the kernel contract, not an MCP-specific API.
Tool | Purpose |
| Discover operations, platform support, limits and policy posture |
| Validate, persist and policy-check one bounded operation |
| Execute an approved plan and verify the declared outcome |
| Read durable task state |
| Cooperatively cancel pending or running work |
| Retrieve redacted evidence and the execution certificate |
| Answer a waiting task's |
| Validate, preflight, encrypt and persist a bounded workflow |
| Execute one ready scheduling wave |
| Read the durable workflow projection |
| Cooperatively cancel nonterminal workflow work |
| Pause, resume or suspend a run without losing its place |
A verdict records its judge as declared, and the certificate carries it beside
executedBy, the receipt's declared principal. Over MCP even
a human: judge is the harness's claim; only a cli: judge, from melra judge, came
through an operator surface.
Prefer tool names your model already knows? Set MELRA_HARNESS_TOOLS=1 and thirteen
more appear alongside these (read_file, write_file, run_command, browser_click,
approve, …). They are not a second path: each one builds an ordinary task and runs
the same pipeline. See ordinary tool names.
Durable, restart-safe workflows
Workflows compose operation, approval, condition, parallel, bounded_loop,
checkpoint, compensation, human_input and delegation nodes, and every effect
still travels through the task pipeline. Each CLI call below is a new process, so this
exercises restart persistence with no daemon:
melra workflow plan --definition examples/workflows/restart-safe.json # save the id
melra workflow advance <workflow-id>
melra workflow advance <workflow-id> # exits 3 with the write's approval challenge
# developer mode echoes the phrase; enforced mode runs `melra approve <task-id>` instead
melra workflow advance <workflow-id> --approval '<approval-id>:<exact phrase>'
melra workflow advance <workflow-id>planned stateVersion=2
running stateVersion=4 inspect=verified_complete
awaiting_approval stateVersion=6 phrase="APPROVE <digest prefix>" (developer mode)
running stateVersion=8 write=verified_complete
verified_complete stateVersion=11 checkpoint=verified_completeStop the process after any line and the next command resumes from the same
MELRA_HOME. Interrupted reads may retry; interrupted changes are never silently
repeated. They are settled by re-observation, or they park in recovery_required.
workflow advance and resume exit 0 while the run is fine, 3 while it waits on an
approval, 4 while it waits on an --input, and 2 once it has failed, ended
partially_complete or cancelled, or needs recovery. workflow plan, pause and
suspend exit 0 when they plan or halt the run; pausing or suspending a run that is
complete, cancelled or failed is refused. workflow inspect exits 0 in any state.
workflow cancel exits 0 when it leaves the run cancelled and 1 when it does not,
as for a run already complete. Errors exit 1.
Shipped in | Evidence |
Restart-safe bounded workflows across nine node kinds | A real MCP process is stopped, replaced and resumed in E2E |
Encrypted exact task, workflow and result payloads | AES-256-GCM storage plus plaintext-leak checks across SQLite/WAL and public projections |
Recovery without silent mutation replay | 8/8 deterministic recovery scenarios, zero duplicates, zero false success |
Loopback HTTP, a | Same runtime as stdio, token on every route, |
A client authenticates itself and is named on every receipt | OAuth 2.1 registration through approval to a token |
Two deployment modes |
|
HTTP and API calls as a first-class effect | A mutation whose reply never arrived is reported unknown, not failed |
Agents receive capabilities, not credentials | The kernel holds the secret and scopes it by host and capability; grants carry a size and an expiry |
Evidence says how it is known |
|
Independent-channel verification |
|
Your own evidence types | A registered verifier answers |
Setup for 26 agent apps |
|
OS isolation you can check |
|
A self-authored governance benchmark | GovBench: 362 cases through the real runtime, safety |
See the full CHANGELOG.
Evidence and benchmarks
Numbers come from committed scripts and JSON artifacts, with dataset hashes and claim boundaries. They are component measurements, not a claim that MELRA is "the best" or that unlike benchmarks are comparable.
What | Result | What it means | |
✅ | Safety and execution evals | 55/55 | Deterministic policy, capability-grant, credential-scope, traversal, terminal, memory, computer, HTTP, cancellation and verification scenarios |
🔁 | Durable Core eval | 8/8 | 100% expected recovery, 0 duplicate execution, 0 false success, 100% event consistency |
🛡️ | GovBench (self-authored) | 312/312 safety, 50/50 utility | 362 model-free cases through the real runtime: containment, approval integrity, verification honesty, exactly-once, redaction, and false positives on legitimate work. Its first run found two real bugs (293/307), both fixed; governance adds about 0.5–1.4 ms per action |
🧠 | LoCoMo retrieval | 0.7597 coverage@20 | 1,982 evidence-bearing questions with zero model, embedding or network calls; re-run on 2026-10-14 and identical on every metric |
🧠 | Synthetic recall | 100/100 Recall@1 | Planted-fact regression over 1,000 records |
🌐 | Static-page settle | 183.7 ms p50 vs 301.3 ms | 39% less waiting with identical 10/10 correct reads |
🌐 | Slow-render settle | 10/10 vs 0/10 correct | Condition-based waiting sees the final DOM; a fixed 300 ms wait reads too early |
💻 | Terminal | 30/30 verified | Shell-free process launch, 48.1 ms p50 on the measured machine |
🖥️ | Computer control plane | 30/30 probes | 0.032 ms p50 adapter discovery; this is not a desktop task-success score |
Raw artifacts: core microbenchmarks, LoCoMo and GovBench.
The repository also contains a pre-registered browser-agent harness (MiniWoB-125 and the WebArena-Verified Hard-30 registered subset) whose task IDs, upstream revisions and dataset hashes are frozen. Its score is not yet claimed: it will be published only after a full fixed-denominator run passes the publication gate. MELRA has not run an official OSWorld, WebArena or LongMemEval submission.
# the full validation gate
pnpm check && pnpm evals && pnpm e2e && pnpm pack:check && pnpm security:audit
pnpm --filter @melra/evals evaluate:durable-core -- --publishable
# memory, browser, terminal and computer microbenchmarks
pnpm benchmark:core
# governance benchmark: 363 model-free cases, loopback fixtures only
pnpm benchmark:govbench
# LoCoMo (dataset not vendored: CC BY-NC 4.0)
git clone https://github.com/snap-research/locomo.git /tmp/locomo
pnpm benchmark:locomo -- --dataset /tmp/locomo/data/locomo10.json \
--output docs/research/results/locomo-retrieval.json
# browser-agent harness contract checks (no model, no network)
pnpm benchmark:browser:check
pnpm benchmark:browser:verify-upstream
# hardened container and a real MCP smoke test
docker build -t melra:local . && docker run --rm melra:local doctor && pnpm docker:smokeThe MiniWoB suite also needs the pinned MiniWoB++ assets and an agent configuration; see the research index and the methodology. Run outputs (HAR, screenshots, video, transcripts) are git-ignored and must never be committed.
For developers
SDKs
Package | |
TypeScript | |
Python |
|
📜 JSON contracts |
Both SDKs spawn a local server or connect to a running one over HTTP or a Unix socket. The token is always passed explicitly, and plain HTTP to a remote host is refused unless you opt in.
CLI at a glance
Goal | Command |
Guided setup |
|
Check this machine |
|
Serve (stdio / HTTP / socket) |
|
See activity |
|
Run one task |
|
Approve a task an agent planned |
|
Answer a task's semantic question |
|
Inspect a receipt |
|
Test a policy |
|
Check conformance |
|
apps/cli/ CLI and stdio entrypoint
kernel services
packages/protocol/ strict task, workflow, event and operation schemas
packages/runtime-core/ task/workflow lifecycle, events, recovery
packages/policy-core/ local policy and scoped approvals
packages/storage-sqlite/ transactional tasks, workflows, events, evidence
packages/verifier-core/ deterministic evidence predicates
packages/receipt-schema/ receipts and execution certificates
packages/memory/ operational memory: scoped retrieval and lifecycle
packages/server/ runtime composition, MCP, loopback HTTP and Unix socket
reference effect adapters
packages/file-runtime/ confined filesystem operations
packages/terminal-runtime/ shell-free process supervision
packages/browser-runtime/ isolated browser automation and stable-DOM wait
packages/computer-runtime/ governed local computer-use adapters
packages/http-runtime/ governed HTTP and API calls
clients and evidence
packages/sdk-ts/ TypeScript client SDK
sdk-py/ Python client SDK
benchmarks/browser-agent/ pre-registered browser-agent evaluation harness
evals/ safety and durable crash-recovery evaluations
scripts/ benchmark and release checks
docs/research/ methods, findings and raw results
examples/ runnable task examplesMELRA is capability-driven, not language-restricted: Rust, Go, Swift, C# or another language can be added when measurement shows a real benefit and the same conformance suite passes.
Runnable examples cover a read-only system task, a verified file write, a terminal check, browser inspection, scoped memory, computer capability discovery, a governed API call, independent verification, and a restart-safe workflow.
Documentation
🏛️ Architecture | ||
🛡️ Threat model | 🗺️ Roadmap | |
Contributing
Code, adapters, client integrations, benchmark harnesses, verifier predicates, documentation and threat analysis are all welcome.
Start here | What it is |
Scoped, with the files to touch named in the issue | |
Larger, still well defined | |
Comment on open questions before implementation; see semantic verification #54 | |
How the pipeline fits together and which files one change touches |
Read CONTRIBUTING.md and the Code of Conduct.
Sign your commits under the DCO (
git commit -s), and sign the CLA once, on your first pull request.Run
pnpm checkbefore opening a pull request; it also checks links, the environment-variable table and the CHANGELOG shape.Report vulnerabilities through private vulnerability reporting, never in a public issue.
License
The MELRA kernel, CLI and documentation are licensed under the
GNU Affero General Public License v3.0 only, and XAGI Labs Private
Limited also offers the kernel under a commercial license. The SDKs
(@melra/sdk, @melra/protocol and the melra Python package), the examples
and the code samples in the documentation stay under the
Apache License 2.0, so code that only calls MELRA can
use any license. Releases up to and including 0.3.0-alpha.22 were Apache-2.0
and stay so. LICENSING.md maps each path to its license and
explains what the AGPL asks of a modified MELRA run as a network service.
The MELRA name and logo are covered by TRADEMARKS.md; the official logo and hero artwork are all rights reserved. Third-party benchmark datasets keep their own licenses and are not included in this repository.
Built in the open by XAGI Labs.
MELRA brand assets © XAGI Labs Private Limited, all rights reserved.
Available Tools
11 toolsmelra_capabilitiesMELRA capabilitiesARead-onlyIdempotent
Discover available local execution capabilities, policy defaults, and runtime limits.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, destructiveHint=false, and openWorldHint=false, so the safety profile is fully covered. The description adds value by naming the categories of information surfaced (capabilities, policy defaults, runtime limits), which hints at return content, but says nothing about behavior such as cost, side effects, or freshness.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler; every word carries information about what is discovered.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description must hint at what comes back, and it does by enumerating the three result categories. It is largely complete for a zero-parameter discovery call, though it could say whether this is a prerequisite for the other melra tools.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters and the schema is fully described, so the baseline for this dimension is 4. There is no parameter syntax the description needs to compensate for.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb (Discover) and a concrete set of resources (local execution capabilities, policy defaults, runtime limits). It clearly distinguishes this read-only introspection tool from actionable siblings like melra_plan and melra_execute, though it does not explicitly name a sibling.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to call this versus the other melra tools. The agent can infer it is an initialization/discovery step, but nothing states that it should be called before planning or that it is safe to call at any time.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
melra_executeExecute a planned MELRA taskADestructive
Execute one previously planned task through policy, runtime, verification, and receipt generation. If melra_plan returned an approval challenge, pass its id and its exact phrase; the phrase is scoped to that one task and expires. Policy is re-evaluated here, so a plan made under a looser policy is still refused. Only reads are retried.
| Name | Required | Description | Default |
|---|---|---|---|
| taskId | Yes | ||
| approval | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructive=true, idempotent=false and openWorld=true; the description adds non-obvious behavior on top: policy is re-evaluated at execution time so a looser-policy plan is still refused, the approval phrase is single-task scoped and expires, and only reads are retried. It does not describe what side effects occur or what failure returns, but the added context is genuinely useful.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four tight sentences with no filler; the core action is front-loaded and the approval/policy caveats follow in priority order. Every sentence carries distinct information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive, non-idempotent, no-output-schema tool this covers the crucial operational context: the execution pipeline, approval challenge handling, and re-validation of policy. It omits failure semantics and return behavior, but the receipt-generation mention partially signals the outcome.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, so the description has to carry parameter meaning. It explains approval well (id plus exact phrase, scoped to one task, expiring), but says nothing about taskId beyond the schema's uuid format/pattern. Partial compensation for the coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (execute) on a specific resource (one previously planned task) and enumerates the pipeline stages it runs: policy, runtime, verification, receipt generation. This cleanly separates it from melra_plan (which plans rather than executes) and from melra_task_status/melra_receipt.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives a clear precondition (must be previously planned) and an explicit conditional workflow: if melra_plan returned an approval challenge, pass its id and exact phrase. It stops short of naming sibling alternatives such as melra_workflow_advance or stating when not to call it, so it is strong but not exhaustive.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
melra_planPlan a MELRA taskARead-only
Persist a bounded task, evaluate policy, and return any scoped approval challenge without executing. Nothing runs until melra_execute. A policy denial comes back as a normal result with status policy_blocked and a reason, not as an error. Any operation that is not a read needs requiredEvidence, and constraints must stay empty.
| Name | Required | Description | Default |
|---|---|---|---|
| goal | Yes | Why this task is being run, in one human-readable sentence. | |
| budget | No | ||
| identity | No | Who is asking, and on whose behalf. Recorded on the task and every receipt, and matched against policy.capabilities when the operator has issued grants. Omitted means the implicit local principal. | |
| operation | Yes | ||
| constraints | No | Leave empty. Freeform prose cannot be enforced, so a non-empty array is denied with freeform_constraints_not_enforceable. Express real limits as forbiddenEffects, budget, or requiredEvidence. | |
| reconciliation | No | How to settle this effect if MELRA never learns whether it happened — a request that went out and was never answered, or a crash mid-flight. Read against the facts that were true before the call (idempotencyKey, url, method), never against a response, because there is none. Declaring these makes the executionGuarantee reconciliation-required instead of at-most-once. | |
| forbiddenEffects | No | Effects this task must never take. Denied before the adapter runs, and honoured even in unhinged mode. | |
| requiredEvidence | No | Predicates that must hold after execution for the task to be verified_success. Required for any non-read operation: a mutation with none is denied with mutation_requires_evidence. An adapter that succeeded while a predicate failed is partial, never success. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Adds real behavior beyond the annotations: policy denials return as normal results with status policy_blocked and a reason rather than as errors, and nothing is executed until melra_execute. These are non-obvious outcome semantics an agent must know to interpret responses correctly.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four tight sentences, front-loaded with the core action and the no-execution guarantee. Each sentence carries distinct information (what it does, what it doesn't, denial semantics, evidence/constraint rules) with no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given a large nested schema and no output schema, the description covers the essential behavioral facts: no execution, denial-as-result, and the evidence/constraint rules. It does not describe the shape of the returned plan/approval challenge, but for a planning tool that gap is minor.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 75%, so the schema already documents most parameters. The description's parameter-relevant content (requiredEvidence needed for non-read ops, constraints must stay empty) largely restates the existing schema descriptions for those fields, adding little syntax or format detail beyond them.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific compound verb chain (persist a bounded task, evaluate policy, return an approval challenge) plus the key negative: it does not execute. Explicitly contrasts with the sibling melra_execute ('Nothing runs until melra_execute'), so an agent can distinguish the two without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Names the alternative (melra_execute) and the ordering condition that selects it, implying the plan-then-execute workflow. It also states a prerequisite rule (non-read operations need requiredEvidence). It stops short of an explicit 'use this when X, use execute when Y' routing sentence, so it is strong but not exhaustive.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
melra_receiptRead MELRA evidenceCRead-onlyIdempotent
Retrieve action receipts and the execution certificate.
| Name | Required | Description | Default |
|---|---|---|---|
| taskId | No | ||
| receiptId | No |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, destructiveHint=false and openWorldHint=false, so safety is covered. The description adds nothing beyond that: it does not say what happens with zero arguments, whether both IDs may be supplied together, or what an 'execution certificate' contains.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single short sentence with the verb front-loaded; nothing is wasted. It is concise but underspecified rather than complete, so it cannot score higher.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a retrieval tool with no output schema, the description should at minimum say what comes back (receipt contents, certificate fields) and how the two optional lookup keys relate. Neither is present, leaving key caller questions unanswered.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% for two UUID parameters, and the description never mentions taskId or receiptId. It does not clarify whether the caller should pass one or the other or both, nor what each lookup key returns, so the description fails to compensate for the coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('Retrieve') and specific resources ('action receipts and the execution certificate'), which is clearer than the title's generic 'Read MELRA evidence'. However, it does nothing to distinguish this from siblings like melra_task_status or melra_workflow_status, which an agent could easily confuse it with.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no statement of when to call this tool, when not to, or what alternative covers the same need. With ten sibling tools in the MELRA family, the absence of any routing guidance leaves the agent to guess.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
melra_task_cancelCancel a MELRA taskBIdempotent
Cooperatively cancel a running or pending task.
| Name | Required | Description | Default |
|---|---|---|---|
| taskId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false, idempotentHint=true and destructiveHint=false, so the safety profile is covered. The description adds genuine context the annotations cannot convey: cancellation is 'cooperative' (a request rather than a forced kill) and applies only to running or pending tasks. It stops short of describing post-cancel state transition or returned status.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One short, front-loaded sentence with no filler – the verb and scope appear immediately. It is efficient rather than excessive, though its brevity is close to under-specification for the usage question above.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter, well-annotated mutation the definition is close to sufficient, but it omits the task-versus-workflow-routing decision that the sibling list makes necessary, and says nothing about permissions or the result of a successful cancellation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is a single parameter with 0% schema description coverage, so the description technically carries the full burden, but 'taskId' is self-documenting by name. The description adds nothing about the UUID format or the semantics of the identifier, leaving any added value to the schema's pattern alone.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb (cancel) and resource (task), and the adverb 'cooperatively' plus the state qualifier 'running or pending' sharpen the scope beyond the bare title. It does not, however, distinguish itself from the sibling melra_workflow_cancel, leaving an agent to guess whether task-level and workflow-level cancellation are the same operation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The only usage signal is the implicit one embedded in 'running or pending' – there is no explicit when-to-use guidance, no statement about what happens if the task is already finished, and no mention of the alternative melra_workflow_cancel despite it being an obvious sibling for the cancellation use case.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
melra_task_statusInspect MELRA task statusBRead-onlyIdempotent
Read the current durable state of a task.
| Name | Required | Description | Default |
|---|---|---|---|
| taskId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, openWorldHint=false and destructiveHint=false, so the safety profile is fully covered by structured data. The description's only added disclosure is the word 'durable', hinting the state survives beyond a single call, which is marginal context. With annotations carrying the load, this meets the lower bar but adds little.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single seven-word sentence with no filler and the action front-loaded. It is efficient, though so terse that it borders on under-specification rather than true conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description carries the burden of explaining what 'durable state' actually contains — statuses, progress, error fields, terminal vs in-flight states. 'Read the current durable state of a task' leaves the return contract entirely unspecified for a tool whose whole purpose is inspection.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0%, but the single taskId parameter is self-documenting via type=string, format=uuid and an explicit pattern, so the agent knows exactly what to supply. The description adds no meaning about taskId (e.g. where to obtain it) beyond the schema's regex and format constraints.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Read) and a specific resource (current durable state of a task), which is clearer than a tautology like 'inspect task status'. However, it does not explicitly differentiate itself from the nearby melra_workflow_status sibling, leaving the task-vs-workflow distinction to be inferred from the name.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance on when to call this versus melra_workflow_status, melra_receipt, or melra_task_cancel, and no note about polling cadence for a status-check tool. The agent must infer usage entirely from the name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
melra_workflow_advanceAdvance a MELRA workflowCDestructive
Execute one ready workflow scheduling wave through governed MELRA tasks.
| Name | Required | Description | Default |
|---|---|---|---|
| inputs | No | ||
| approvals | No | ||
| workflowId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true, idempotentHint=false, and openWorldHint=true, so the safety profile is partly covered. The description adds almost no behavioral context beyond "governed": it does not warn that this is a non-idempotent mutation that can destroy prior workflow state, nor explain what "governed" means (approval gating) or what happens on partial failure. "One wave" is the only incremental-behavior hint offered.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is a single front-loaded sentence with no padding, which is structurally sound. But it is terse to the point of under-specification rather than genuinely concise, and the jargon-laden wording costs clarity per word.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a destructive, non-idempotent workflow-execution tool with approval inputs, zero schema description coverage, and no output schema, one sentence is not enough. The agent lacks the workflow-stage context and approval mechanics needed to call it correctly, though the destructive annotation and "one wave" phrasing at least convey that this is a consequential step.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% across three parameters, including two nested arrays (inputs, approvals) with structural constraints like maxItems and UUID/phrase pairing, and the description mentions no parameter at all. It does not compensate for the coverage gap in any way — an agent gets no guidance on what inputs or approvals must contain. Only the word "governed" faintly gestures at the approvals concept.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a verb ("Execute") and a resource ("one ready workflow scheduling wave"), so the general intent is graspable. However, "scheduling wave" and "governed MELRA tasks" are unexplained jargon, and it gives no differentiation from close siblings like melra_execute or melra_workflow_control. An agent can guess it advances a workflow but cannot confidently separate it from those siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no statement of when to use this tool versus melra_execute, melra_workflow_control, or melra_workflow_status, and no prerequisites (e.g., that the workflow must first be planned, or that approvals are needed). The phrase "one ready ... wave" hints at incremental stepping, but the agent must infer everything about invocation context.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
melra_workflow_cancelCancel a MELRA workflowBIdempotent
Cooperatively cancel nonterminal workflow nodes and their tasks.
| Name | Required | Description | Default |
|---|---|---|---|
| workflowId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare non-read-only, non-destructive, idempotent, closed-world behavior. The description adds real context beyond that: 'cooperatively' tells the agent this is a graceful request rather than an immediate hard kill, and the scope statement shows the cancellation cascades to child tasks of nonterminal nodes only.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler. It is sized correctly for the operation, though the extreme brevity leaves useful detail (parameter, post-cancel state) unstated.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with no output schema, the description covers the what and the cooperative nature but omits whether cancellation can partially fail, what state the workflow ends in, and how to verify with melra_workflow_status. Adequate but with clear gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter workflowId has 0% schema description coverage - only a UUID format and regex pattern - and the description never mentions it, its format, or the requirement that it reference a nonterminal workflow. With one undocumented parameter, the description should compensate but does not.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (cancel) and a precise resource (nonterminal workflow nodes and their tasks), which implicitly separates it from the single-task sibling melra_task_cancel by noting the cascade to tasks. It stops short of naming any sibling for explicit differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied rather than stated: 'nonterminal' signals the precondition that only active/running workflows can be cancelled, but the description never says when to prefer this over melra_task_cancel or melra_workflow_control, nor what to do afterwards.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
melra_workflow_controlPause, resume, or suspend a MELRA workflowBIdempotent
Halt a running workflow without losing node state, or lift a halt. Node progress is untouched, so a resumed workflow continues where it stopped.
| Name | Required | Description | Default |
|---|---|---|---|
| action | Yes | ||
| workflowId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare the safety profile (readOnlyHint=false, destructiveHint=false, idempotentHint=true), but the description adds genuinely useful behavioral context: node state is preserved and a resumed workflow continues from where it stopped, which is the key non-destructive guarantee an agent needs. It still omits auth requirements or whether halting affects in-flight nodes.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two tight sentences, front-loaded with the core action and the state-preservation guarantee; no filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Annotations carry the safety profile and there is no output schema, so the remaining burden is action semantics — which the description leaves incomplete. An agent can call the tool, but cannot reliably choose between pause and suspend from the definition alone.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the description adds no parameter meaning: it never explains the action enum values (pause/resume/suspend) or what workflowId refers to. The phrase 'halt... or lift a halt' only loosely implies two of the three enum options, leaving the distinction between pause and suspend undefined.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a general verb+resource ('Halt a running workflow... or lift a halt'), which signals a control operation, but it collapses the schema's three distinct actions (pause, resume, suspend) into two vague modes and never defines what 'suspend' means or how it differs from 'pause'. It also does not distinguish this tool from siblings like melra_workflow_cancel or melra_workflow_advance.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance: nothing tells the agent when to choose pause vs suspend vs resume, nor when to prefer this tool over melra_workflow_cancel. The only usage hint is implicit in the word 'halt'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
melra_workflow_planPlan a MELRA workflowCRead-only
Validate, preflight, encrypt, and persist a bounded workflow without executing it.
| Name | Required | Description | Default |
|---|---|---|---|
| definition | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint=true, but the description states the tool 'encrypt[s], and persist[s]' a workflow, which is a write to the plan store and therefore modifies its environment; idempotentHint=false reinforces that each call creates state. This is a direct contradiction of the read-only annotation in the dangerous direction (an agent may call it believing there are no side effects).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence enumerating the pipeline stages with zero filler. It is efficient, though arguably under-specified rather than concise given the tool's complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool whose schema spans many node kinds, budgets, evidence predicates and reconciliation rules, one sentence omits what preflight actually checks, what a denial looks like, what the persisted plan's identity/return is, and how the artifact feeds melra_execute/melra_workflow_advance. No output schema exists to fill those gaps.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is a single required 'definition' parameter with 0% schema description coverage at the top level, and the description says nothing about what a valid definition must contain (required schemaVersion/id/version/name/nodes, allowed node types, forbiddenEffects/requiredEvidence rules). The enormous nested schema carries all the meaning, so the description fails to compensate for the coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names four concrete operations (validate, preflight, encrypt, persist) on a specific resource (a bounded workflow), which is far more informative than the title alone. The clause 'without executing it' distinguishes it from melra_execute and melra_workflow_advance, though no sibling is named explicitly and 'bounded workflow' is never defined.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The 'without executing it' clause implies when the tool is appropriate (before execution) versus melra_execute, but no alternative is named and no prerequisites are stated — e.g. whether a plan must exist before melra_workflow_advance or melra_workflow_control. Usage is implied rather than specified.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
melra_workflow_statusInspect a MELRA workflowCRead-onlyIdempotent
Read the current durable workflow projection.
| Name | Required | Description | Default |
|---|---|---|---|
| workflowId | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, destructiveHint=false and a closed world, so the safety profile is fully covered without the description. The description only adds that the read is of the "current durable" projection, implying a persisted latest-state snapshot, which is modest extra context but no detail on latency, staleness, or what happens for unknown IDs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One short sentence with no filler and the core action front-loaded. It is efficient, though the brevity borders on under-specification rather than genuine conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
There is no output schema, so the description carries the burden of explaining what the "workflow projection" contains, yet it never says what fields or states are returned. For a state-inspection tool with an undocumented required parameter, this is too thin.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single parameter workflowId has 0% schema description coverage; the schema only supplies a UUID format and regex. The description adds nothing about the parameter, so the agent gets no plain-language meaning, source, or expected value for workflowId beyond the raw pattern.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
"Read the current durable workflow projection" names a verb (read) and a resource (workflow), but the term "projection" is unexplained jargon and does not distinguish this tool from siblings like melra_task_status or melra_workflow_control. An agent cannot tell from the description alone what state this returns versus those neighbors.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no prerequisites, and no mention of alternatives among the ten siblings (e.g., melra_task_status for task-level state, melra_workflow_control or melra_workflow_cancel for actions). The agent must infer usage purely from the name.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
11 tool updates
- First observed
melra_capabilities - First observed
melra_execute - First observed
melra_plan - First observed
melra_receipt - First observed
melra_task_cancel - First observed
melra_task_status - First observed
melra_workflow_advance - First observed
melra_workflow_cancel - First observed
melra_workflow_control - First observed
melra_workflow_plan - First observed
melra_workflow_status
TDQS
Scored across 11 tools
The set is organized into two parallel families (task-level and workflow-level) with clearly distinct plan/execute/status/cancel roles, so most tools are easy to tell apart. A few pairs invite confusion: melra_workflow_control (halt/resume, state preserved) vs melra_workflow_cancel (terminate), and melra_execute vs melra_workflow_advance (both perform execution at different granularities).
All names use snake_case with a consistent melra_ prefix, which is highly predictable. The deviation is structural rather than stylistic: task operations are unprefixed (melra_plan, melra_execute) while the analogous workflow operations are domain-prefixed (melra_workflow_plan, melra_workflow_advance), so the two parallel families don't mirror each other exactly.
Eleven tools is well within the sweet spot and each one maps to a real step in the governed task/workflow lifecycle (discover, plan, execute, status, cancel, control, receipt). No tool appears redundant or trivially included.
The surface covers task and workflow lifecycles well: plan, execute/advance, status, cancel, control, and receipts, plus capability discovery. Minor gaps exist, such as no enumeration/list operation for existing tasks or workflows and no workflow-level receipt retrieval, which an agent would have to work around via status projections.
Maintenance
Related MCP Connectors
Pre-execution governance for AI agents. Deterministic PASS/FAIL/REVIEW verdicts, replayable proof.
Governed MCP: agent audit, provenance, deterministic checks, and receipt-backed FragGate execution.
Agent routing, safety preflight, execution receipts, best execution and verified outcomes.
Context and control for any AI. Agent identity, scoped access, and proof across tools.
Related MCP Servers
- FlicenseNot gradedqualityBmaintenanceEnables deterministic task routing, contract enforcement, and effect authorization across domain owners while exposing a minimal MCP interface and read-only observability.-
- AlicenseAqualityBmaintenanceOwner-signed authorization before agent actions. Hosted Vizier v0.5.13 MCP: https://vizier.agendamcp.dpdns.org/mcp. ALLOW/BLOCK/REVIEW; anonymous calls never ALLOW. Your integration enforces the decision. SDK v0.5.13: https://www.npmjs.com/package/@agenda-intelligence/vizier-sdk. Grants are signed; legacy receipts are unsigned. Python stdio is a separate catalog.36 npmMIT
- AlicenseNot gradedqualityBmaintenanceProvides a governed execution boundary for AI agents, enforcing deterministic policy, one-shot human approvals, and signed receipts for MCP tool effects.MIT
- FlicenseNot gradedqualityBmaintenanceEnables autonomous agents and MCP-compatible clients to enforce policy-approved actions using risk tiers, reversible checkpoints, and token approval bounds.7-