Warden
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@Wardenlist available skills"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Warden — the trusted skill brain for open agents
Connect your open-source agent to one endpoint, and it gains a curated, cryptographically-signed, sandboxed set of skills — without poisoning it.
Live → https://warden-8c4.pages.dev/ · browse the trust-graded registry · mirror
The world has thousands of places to find agent skills and almost nowhere trustworthy to run them. Warden is the run-trust layer: not a bigger directory, a vouched-for one. It is OSS-native, local-first, and opinionated about curation — and it treats trust as a signal, not a guarantee.
This repository is the trust core (Phase 0) — the Agent Skill Trust Spec, a curated hardened skill-pack, and a working reference local node — plus the Phase 1–4 capabilities built as reference implementations (sandboxed execution, private encrypted memory, knowledge packs, governance, the Scan API). Pure Python standard library — zero third-party dependencies. Nothing leaves your box.
The magic moment
One config line points any MCP-speaking agent at Warden. Within a minute it has a curated skill set where every skill is visibly signed, sandboxed, and trust-scored — capability and provenance in the same breath:
$ py examples/mcp_client_smoke.py
[warden] pinned curator key warden:cd015c720e6027fd
[warden] transparency log: 5 entries, root sha256:491104b0…, integrity OK
[warden] VERIFIED build-brain/build-product [Warden PROVISIONAL A/99 ✓]
[warden] VERIFIED build-brain/ship-gate [Warden A/100 ✓]
[warden] VERIFIED compliance-brain/secret-sentinel [Warden PROVISIONAL C/79 ✓]
[warden] VERIFIED research-brain/fact-gate [Warden A/100 ✓]
[warden] VERIFIED research-brain/idea-scout [Warden A/100 ✓]
[warden] ready: 5 skill(s) exposed, 0 refused (deny-by-default)…and when the agent calls a skill, it gets the skill with its provenance:
=== WARDEN PROVENANCE ==========================================
skill : research-brain/idea-scout v1.0.0
trust : [Warden A/100 ✓] (a SIGNAL, not a guarantee)
pinned hash : sha256:208b0208cd3c…
capabilities : no network, no filesystem, no shell, no secrets
sandbox : isolated-no-net (deny-by-default; cannot act outside this envelope)
verified now : VERIFIED (11/11 checks)
================================================================Related MCP server: Node9-Proxy
Quickstart (≈60 seconds)
Requires Python 3.8+ (on Windows use the py launcher). No pip install.
# 1. generate your curator key (the root of trust; the private seed is gitignored)
py -m warden keygen
# 2. scan + sign + log + register every curated skill
py -m warden sign-all
# 3. cold-verify everything (re-derives the hash, checks the signature, re-scans,
# recomputes the trust score, checks the transparency log)
py -m warden verify-all
# 4. see the curated set and the public log
py -m warden list
py -m warden audit
# 5. run the reference MCP node (stdio), or drive it with the demo client
py -m warden serve
py examples/mcp_client_smoke.py
# prove the scanner: a deliberately poisoned skill is REJECTED at the door
py -m warden scan skills/_samples/poisoned-weather
# everything verified in one shot
py -m warden selftest # 75/75 (Phase 0–4)Wire it into your agent
Point any MCP client at the node. Claude Desktop style:
{
"mcpServers": {
"warden": { "command": "py", "args": ["-m", "warden", "serve"],
"cwd": "C:/path/to/WARDEN" }
}
}See examples/ for the full config and a smoke client.
Verify the live registry yourself
You don't have to trust us. Check the curator's signature on the public registry from anywhere — this re-derives the canonical bytes and verifies the Ed25519 signature with Warden's own pure-Python verifier:
import urllib.request, base64, json
from warden import ed25519
from warden.canonical import canonicalize
url = "https://warden-8c4.pages.dev/registry/index.json"
req = urllib.request.Request(url, headers={"User-Agent": "warden-verify/1.0"}) # any UA; some CDNs 403 the default
obj = json.load(urllib.request.urlopen(req, timeout=20))
data = obj["index"]
ok = ed25519.verify(bytes.fromhex(data["curator_key"]),
canonicalize(data), base64.b64decode(obj["signature"]))
print("VERIFIED" if ok else "TAMPERED", ed25519.fingerprint(bytes.fromhex(data["curator_key"])))
# -> VERIFIED warden:cd015c720e6027fdChange one byte of the index and the signature fails. The GitHub mirror serves the identical signed bytes.
Phases 1–4 (now built)
The phase capabilities are now built as reference implementations —
local-first, pure standard library, zero third-party dependencies, verified by a
75/75 self-test. The full command surface (py -m warden help):
Capability | Command |
Run a |
|
Private per-agent encrypted memory |
|
Safe auto-update (re-verify + re-score; refuses escalation) |
|
Shareable scan report |
|
Org allow/deny policy (ALLOW/DENY per skill) |
|
Tamper-evident audit log |
|
The Scan API (Trust-as-a-Service) |
|
Trust-graded signed static index → |
|
Signed read-only knowledge packs |
|
Host your own skill (private) |
|
Trust another curator key |
|
What remains is the business rollout, not the code — see Honest scope below
and docs/PHASES.md.
The trust architecture (the moat)
Built to the OWASP Agentic Skills Top 10. Six pillars, all real in this repo:
# | Pillar | Where |
1 | Content-addressed + Ed25519-signed + pinned — you connect to a hash, not a name. Kills rug-pulls. |
|
2 | Intake scanning — tool-poisoning, unsafe-exec, SSRF, secret-exfil, obfuscation, and capability drift. |
|
3 | Capability manifest + deny-by-default — a skill may touch only what it declares. |
|
4 | Sandboxed execution — skills run in a declared profile, never the agent's process. |
|
5 | Behavioral trust score — per-version, time-aware; re-publishing re-evaluates. Not a static badge. |
|
6 | Public transparency log — append-only, hash-linked, Merkle-rooted. Nothing changes silently. |
|
The point the whole project turns on:
Verification of identity is not verification of behavior. A "verified" badge can still turn malicious on its next update. So Warden pins the exact bytes, re-scores every version, scans for drift between what a skill declares and what it does, and writes every change to a public log.
┌───────────┐ ┌─────────────┐ ┌─────────────┐ ┌────────────┐
│ Skills in │──▶│ Scan & sign │──▶│ Skill brain │──▶│ Your agent │
│ any source│ │ OWASP + hash│ │ sandboxed │ │ MCP, local │
└───────────┘ └─────────────┘ └─────────────┘ └────────────┘
untrusted [trust ctrl] [trust ctrl] your side
····················· TRANSPARENCY LOG — every version auditable ··········
[ pinned hash = no rug-pull ] [ sandbox = contained ] [ deny-by-default ]What's in here
WARDEN/
├── TRUST_SPEC.md the standard (start here)
├── THREAT_MODEL.md OWASP Agentic Skills Top 10 → mitigations
├── warden/ the reference node + pipeline (zero-dep stdlib)
├── skills/ curated hardened skill packs + registry + _samples
├── schema/ JSON Schemas (manifest, signature, trust, log entry)
├── keys/ the pinned curator public key
├── examples/ one-config-line setup + magic-moment smoke client
├── docs/ positioning, build path, FAQ
└── site/ the landing + waitlist site (zero-dep static; deploy anywhere)Landing site
A zero-dependency static site (the launch + waitlist funnel) lives in
site/. Run it locally with py -m http.server 4173 --directory site
and open http://localhost:4173. Wire one endpoint (WAITLIST_ENDPOINT in
site/app.js) before deploying — details in site/README.md.
Honest scope
The Phase 0 curated skills are instruction packs: the node serves their
verified text plus a provenance block, and your agent's model follows them. The
Phase 1–4 capabilities are now built as reference implementations — local,
zero-dep, verified — so sandboxed kind:"code" execution, private encrypted
memory, knowledge packs, safe auto-updates, org policy, the audit log, and the
Scan API all run today (see the table above and docs/PHASES.md).
What remains is honest and named:
The business rollout — hosting, the paid tiers (Pro / Team / Scan API as products), billing, SSO (an integration point, not built), and go-to-market. Reference code existing is not the same as the business being validated, so productizing/hosting stays gated behind a cheap test (see
docs/BUILD_PATH.md).Production-grade sandboxing — the
kind:"code"sandbox is defense-in-depth at the Python + process layer, not a hard OS sandbox (no seccomp / namespaces). For untrusted code in production, run it in a container / microVM / WASM and enforce the same policy there. The pure-Python Ed25519 and ChaCha20-Poly1305 are real and interop-verified but not constant-time (sign offline / HSM in production).
We would rather ship small and true than over-promise.
How it makes money (without charging for the core)
The core is free forever — it is the funnel, and devs don't pay for cores. Revenue
comes from governance (teams), the supply side (a Scan API that vouches
for skill authors' and marketplaces' skills), and hosting/convenience. See
docs/BUILD_PATH.md.
Positioning in one breath
Not a directory (mcp.so, Glama, Smithery). Not a memory platform (Mem0, Zep,
Letta) — memory is a supporting feature here, never the headline. Not a hosted
identity-verification play (mcpskills.io, Apigene). Warden is OSS-native +
local-first + behavioral-trust + opinionated curation. Full comparison in
docs/POSITIONING.md.
Trust is a signal, not a guarantee
Read SECURITY.md before you rely on anything here. We never
claim "100% safe"; we claim signed, scanned, contained, scored, and logged.
License
Available Tools
14 toolsbuild_brain__build_productB
[Warden PROVISIONAL A/99 ✓] Turn a validated idea into a complete, verified, shippable digital product to a top-tier bar. [capabilities: no network, no filesystem, no shell, no secrets; sandbox: isolated-no-net; pinned sha256:e7f597211037...]
| Name | Required | Description | Default |
|---|---|---|---|
| task | Yes | What to build, e.g. 'a budgeting workbook for freelancers'. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It does add real value by declaring capability limits (no network, filesystem, shell, or secrets) and the isolated-no-net sandbox, which tells the agent this is a self-contained generation step. It stops short of explaining how the finished product is returned when no filesystem is available, or whether the operation is long-running or resumable.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The core sentence is tight and front-loaded, but it is wrapped in tag-like metadata ('[Warden PROVISIONAL A/99 ✓]', pinned sha256) that consumes attention without helping invocation. Those tokens could be moved out of the description body.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a no-output-schema tool that produces a whole 'shippable product', the agent still doesn't know the return shape — single document, multiple files, bundle, or summary — nor where the artifact goes given the no-filesystem constraint. The sandbox and capability notes are useful, but the deliverable contract is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The single 'task' parameter is fully documented in the schema with an example, so semantics are already covered. The description adds a little meaning by framing the input as a 'validated idea' rather than an arbitrary prompt, which qualifies what belongs in 'task'.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb and outcome: turn a validated idea into a complete, verified, shippable digital product. The schema example ('a budgeting workbook for freelancers') clarifies the deliverable is a content artifact, not code. It does not distinguish the tool from siblings such as build_brain__ship_gate, which sounds like part of the same pipeline.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'Turn a validated idea into...' implies a precondition that upstream validation (e.g. research_brain__idea_scout or fact_gate) should happen first, but this is never stated explicitly. There is no when-not guidance and no naming of the sibling that handles the shipping/gating step.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
build_brain__ship_gateA
[Warden A/100 ✓] An independent GO/NO-GO release gate that trusts no build claim and blocks on unwaivable conditions. [capabilities: no network, no filesystem, no shell, no secrets; sandbox: isolated-no-net; pinned sha256:24e5b3dc3adc...]
| Name | Required | Description | Default |
|---|---|---|---|
| task | Yes | Path or description of the finished deliverable to gate. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the burden. It usefully discloses sandbox constraints (no network, filesystem, shell, secrets; isolated-no-net) and that it blocks on unwaivable conditions, but it does not explain what the returned verdict looks like, what conditions are unwaivable, or how a caller should act on a NO-GO result.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is short and front-loads the core purpose before the capability and sandbox constraints. The bracketed metadata is slightly noisy but does not obscure the main point.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a single-parameter gate with no output schema, the description covers the purpose, trust model, blocking behavior, and sandbox restrictions. It could say more about the verdict output, but it is mostly complete for an agent to decide whether to invoke it.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is one required parameter and schema coverage is 100%, so the schema already documents the task input. The description does not add meaning beyond the schema's path-or-description requirement, making the baseline 3 appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb+resource: an independent GO/NO-GO release gate for a finished deliverable. It is clear what the tool does, but it does not explicitly distinguish itself from siblings like build_brain__build_product or research_brain__fact_gate.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The phrase 'release gate' and 'finished deliverable' implies use before release, but the description gives no explicit when-not conditions and does not name an alternative tool to use instead. The usage context is inferable but not spelled out.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
compliance_brain__secret_sentinelA
[Warden PROVISIONAL C/79 ✓] Review code or a skill bundle for credential-exfiltration patterns and least-privilege violations. [capabilities: no network, no filesystem, no shell, no secrets; sandbox: isolated-no-net; pinned sha256:b4e5fd4b52af...]
| Name | Required | Description | Default |
|---|---|---|---|
| task | Yes | The code or skill bundle to review for secret-handling risk. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full disclosure burden and provides unusually useful constraints: no network, filesystem, shell, or secret access, plus an isolated no-network sandbox and a pinned hash. It does not explain the practical meaning of 'PROVISIONAL C/79' or describe result behavior, so the disclosure is valuable but incomplete.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The definition is compact and places the concrete review purpose before the capability details. However, the leading '[Warden PROVISIONAL C/79 ✓]' label and truncated pinned hash are cryptic metadata that add clutter without clearly helping tool selection or invocation.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter review tool, the accepted subject, security scope, and execution restrictions are adequately covered. Because there is no output schema, the missing explanation of whether the result is a findings list, severity assessment, pass/fail verdict, or remediation guidance is a meaningful gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, and the description largely reinforces the schema's statement that task contains code or a skill bundle, while adding the two specific review categories. It does not clarify whether task should contain raw source, serialized bundle content, or a path, nor provide size or formatting expectations.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb and resource: reviewing code or a skill bundle for credential-exfiltration patterns and least-privilege violations. This clearly establishes the security-review niche, but it does not explicitly distinguish the tool from siblings such as warden__audit or build_brain__ship_gate.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The input types and risk categories imply when the tool is useful, particularly before trusting or shipping code that handles credentials. There is no explicit when-to-use guidance, prerequisite, exclusion, or routing rule for choosing this tool over warden__audit, warden__trust, or other gate tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
research_brain__fact_gateA
[Warden A/100 ✓] Verify every factual, legal, or financial claim against a dated primary source before anything ships. [capabilities: no network, no filesystem, no shell, no secrets; sandbox: isolated-no-net; pinned sha256:a47d1120ec74...]
| Name | Required | Description | Default |
|---|---|---|---|
| task | Yes | The text/draft whose claims must be verified. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden. It does add real value by declaring capability limits (no network, no filesystem, no shell, no secrets) and an isolated-no-net sandbox, which tells the agent the tool cannot fetch sources itself. However, it never says what the gate returns (pass/fail verdict, per-claim list, citations) or how it behaves on unverifiable claims, which is the critical missing behavior for a gate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The actionable instruction is front-loaded in one efficient sentence, but the surrounding bracket metadata ('Warden A/100 ✓', 'pinned sha256:a47d1120ec74...') is machine-ish boilerplate that consumes space without guiding invocation. Roughly half the text does not earn its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter tool with full schema coverage and no output schema, the description covers what to feed it and its sandbox constraints. The main remaining gap is the shape of the verdict it produces, which an agent would want before routing work through a 'gate'.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Only one parameter with 100% schema coverage, so the baseline is already high. The description adds a little by narrowing the intent to claims that are factual, legal, or financial, telling the agent what kind of text belongs in 'task'.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The core sentence gives a specific verb and object: verify factual, legal, or financial claims against a dated primary source. An agent can grasp the function immediately, though the bracketed '[Warden A/100 ✓]' prefix and the sha256 pin are opaque noise that don't help identify the tool. No sibling (e.g., ship_gate) is named to sharpen the boundary.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'before anything ships' implies the trigger point, which is useful timing guidance, but there are no explicit when-not conditions and no named alternatives such as ship_gate or idea_scout. Usage is inferable rather than stated.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
research_brain__idea_scoutA
[Warden A/100 ✓] Find and rigorously score a net-new idea before building, with evidence gates and a mandatory pre-mortem. [capabilities: no network, no filesystem, no shell, no secrets; sandbox: isolated-no-net; pinned sha256:208b0208cd3c...]
| Name | Required | Description | Default |
|---|---|---|---|
| task | Yes | The domain or question, e.g. 'what tracker should I build next for nurses'. | |
| constraints | No | Optional budget/time/audience constraints. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries the full burden. It does usefully disclose the execution environment (no network, no filesystem, no shell, no secrets, isolated-no-net) and that the process is gated with a pre-mortem, but it never says what the tool returns, how the score is structured, or whether it is deterministic.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The core sentence is tight and front-loaded enough, but the bracketed '[Warden A/100 ✓]' prefix and the capability/sandbox/sha256 block consume roughly half the text with operational metadata rather than guidance on using the tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With two simple parameters and no output schema, the description should explain what a scored idea looks like and what the evidence gates produce, since that is the tool's whole value. It gestures at the process but leaves the agent unable to predict the result shape.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so both 'task' and 'constraints' are already documented with examples in the schema. The description adds no further meaning about the parameters, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific compound verb ('Find and rigorously score') plus the resource ('a net-new idea') and its timing ('before building'). This distinguishes it from build_brain__build_product by signalling a pre-build phase, though it never names or contrasts siblings explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
'before building' and 'net-new idea' give a clear situational trigger, and 'evidence gates and a mandatory pre-mortem' hints at the process it runs. There is no explicit when-not or named alternative (e.g. fact_gate for verifying existing claims), so routing is inferred rather than spelled out.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
util_brain__word_countA
[Warden PROVISIONAL B/82 ✓] A tiny code skill: counts words, characters, and lines in text. Runs sandboxed with every capability denied. [capabilities: no network, no filesystem, no shell, no secrets; sandbox: isolated-no-net; pinned sha256:d1353e332702...]
| Name | Required | Description | Default |
|---|---|---|---|
| text | Yes | The text to measure. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Despite having no annotations, the description supplies substantial behavioral context: sandboxed execution, no network, filesystem, shell, or secrets access, and a pinned artifact. These details communicate isolation and likely side-effect constraints well, though input limits and error behavior are not addressed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The core functional sentence is concise, but the opaque "Warden PROVISIONAL B/82" prefix prevents the purpose from being front-loaded. The repeated no-network statements, extensive capability list, and truncated hash add provenance clutter rather than selection or invocation guidance.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Invocation requirements are clear for this simple one-parameter tool, and its execution environment is unusually well documented. Because there is no output schema, however, the missing result structure and counting conventions—such as word-boundary rules and whether characters include whitespace—leave meaningful gaps for consuming the result.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, and the sole parameter is already clearly documented as "The text to measure." The description's reference to measuring text adds no parameter meaning beyond that schema, so the high-coverage baseline of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description precisely states that the tool "counts words, characters, and lines in text," giving a clear operation, resource, and set of metrics. This purpose is readily distinguishable from all listed siblings, none of which appears to provide text measurement.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is implied: choose this tool when word, character, or line counts are needed. There is no explicit when-to-use guidance, exclusion, or comparison with alternatives, although the lack of overlapping siblings reduces the selection burden.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
warden__auditB
The append-only transparency log (every publish) + current Merkle root.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description still conveys useful behavioral traits: 'append-only' implies the data is immutable and read-only, and 'every publish' scopes the content. However, it says nothing about volume (an unbounded log of every publish with no pagination parameters), response format, or whether the Merkle root is a separate field — real risks for a zero-parameter call.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single compact sentence with zero filler and the core scope front-loaded. It reads as a fragment rather than a statement of action, which costs a little clarity but no words are wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple no-parameter tool with no output schema, the description adequately indicates both what is returned (the log) and the Merkle root. It is still thin on whether the result is truncated or how large the log can get, which matters for a tool that implicitly returns everything ever published.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so the baseline is 4 and the description creates no confusion about required input. There is nothing extra to document.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names the exact resource — the append-only transparency log covering every publish — plus the current Merkle root, which is specific enough to know what data comes back. It lacks an explicit verb (read/list/fetch) and does not distinguish itself from warden__list, which an agent may plausibly confuse it with.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance, no mention of alternatives such as warden__list or warden__recall, and no stated trigger or prerequisite. The agent must infer that this is for auditing published artifacts rather than general listing.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
warden__knowledgeA
List the signed, read-only knowledge packs available to mount.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are provided, so the description carries the full behavioral burden. It usefully discloses that the listed packs are signed and read-only, but it omits details such as authentication requirements, result ordering, pagination, or whether listing has any side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The definition is a single front-loaded sentence with no wasted wording. The key qualifiers 'signed, read-only' and 'available to mount' are communicated efficiently.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter list operation with no output schema, the description covers the core purpose and relevant safety/trust properties. The main remaining gap is return-shape information, such as what fields each knowledge pack entry contains.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool has zero parameters, so there are no parameter semantics to explain. The baseline score of 4 applies because the description does not need to compensate for an input schema gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('List') and resource ('signed, read-only knowledge packs available to mount'), making the tool's scope clear. It implicitly differs from warden__knowledge_read, but it does not explicitly name that sibling or otherwise distinguish itself from it.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Usage is only implied: an agent can infer this is the discovery step before reading or mounting a pack. The description provides no explicit when-to-use guidance, exclusions, or alternative tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
warden__knowledge_readB
Read a file from a verified knowledge pack (reference, not instructions).
| Name | Required | Description | Default |
|---|---|---|---|
| file | Yes | ||
| pack | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries the full burden. It does add one genuinely useful behavioral note — "(reference, not instructions)" signals the returned content is untrusted data rather than directives, which is a real safety disclosure. However, it says nothing about permissions, what happens with an unknown or unverified pack, whether reads are logged, or what the returned content looks like.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with no filler, and the parenthetical caveat is placed where it will be read. It is efficient, though its brevity is partly under-specification rather than pure economy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no annotations, no output schema, and two undocumented required parameters, the definition leaves key questions unanswered: valid pack identifiers, error behavior for missing files or unverified packs, and the shape of the returned content. For a read tool in a security-themed server, that is a meaningful gap.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0% and neither parameter is described in the schema, so the description must compensate. It only implies that `pack` identifies a knowledge pack and `file` a path within it, without format, case sensitivity, path syntax, or how to obtain a valid pack identifier.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ("Read") and a specific resource ("a file from a verified knowledge pack"), which is more precise than the bare name suggests. It does not differentiate itself from nearby siblings such as warden__knowledge, warden__recall, or warden__list, so an agent must infer which one retrieves pack contents.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit when-to-use guidance, no when-not-to-use condition, and no named alternative. The agent is left to infer that this is the retrieval path for packs discovered via warden__list or vetted by warden__trust, but the description never says so.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
warden__listB
List every verified skill with its trust badge and capability envelope.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries the full burden. It discloses useful behavior in stating that the result includes both a trust badge and a capability envelope, and that only 'verified' skills appear, which implies a filtering scope. It does not state result size, pagination, ordering, or whether verification is a prerequisite the caller must have satisfied.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single sentence with no filler, and the core action is front-loaded before the description of entry contents. The phrase 'capability envelope' is jargon that is not defined anywhere, which is the only real cost.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a zero-parameter read tool with no annotations and no output schema, the description covers the gist but omits the return shape details an agent would want: entry fields beyond the two named, result volume, and ordering. It is adequate but leaves clear gaps given nothing else documents the output.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there is no parameter semantics to explain and the baseline is 4. The description correctly implies the listing is unfiltered and unscoped.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description gives a specific verb ('List') and a specific resource ('every verified skill'), plus what each entry carries (trust badge, capability envelope). It stops short of distinguishing this from close siblings such as warden__knowledge or warden__trust, so an agent still has to infer which one surfaces the skill registry.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no explicit when-to-use or when-not guidance and no named alternative among the many warden__ siblings. The only implied usage is discovering available skills, which the agent must infer from the word 'List'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
warden__recallC
Search your private encrypted memory for relevant notes.
| Name | Required | Description | Default |
|---|---|---|---|
| query | Yes |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations, the description carries the full behavioral burden, and it only discloses that the store is private and encrypted. It does not say whether matching is semantic or keyword, whether results come back decrypted in plaintext, whether there is a result cap or pagination, or what access/prerequisites are needed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One front-loaded sentence with no filler and no redundant restatement of the name. Brevity here is efficient, though it verges on under-specification.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
A search tool with no annotations, no output schema, and an undocumented parameter needs the description to say what comes back and under what conditions. It says nothing about result format, ranking, limits, or failure modes, leaving key details unavailable anywhere in the definition.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 0%, so the schema documents nothing about the single 'query' parameter; the description only implies it is a relevance query for notes. There is no guidance on natural-language vs keyword phrasing, length, or how the string is matched, so it fails to compensate for the coverage gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: searches 'private encrypted memory' and returns 'relevant notes'. That distinguishes it reasonably well from sibling warden__remember (the write counterpart) and warden__list, though the boundary against warden__knowledge / warden__knowledge_read is not drawn.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The word 'relevant' implies this is a relevance-ranked lookup rather than an exhaustive dump, which hints at when to prefer it over a listing tool, but no alternative is named and no condition for use or non-use is stated explicitly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
warden__rememberB
Save a note to your PRIVATE, local, encrypted memory.
| Name | Required | Description | Default |
|---|---|---|---|
| tags | No | ||
| text | Yes | the note to remember |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
With no annotations at all, the description carries the full burden, and it does disclose meaningful traits: the store is private, local, and encrypted, which matters for an agent deciding what to write. But it omits whether saves are deduplicated or overwritten, whether the write persists across sessions, any size limits, and what the call returns.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single eleven-word sentence with zero filler; the privacy qualifiers are front-loaded and capitalized so they register before the agent commits to writing sensitive content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a mutation tool with no annotations and no output schema, the description should say what happens on save (confirmation, identifier, overwrite behavior) and how tags interact with later recall. Neither is covered, and the undocumented `tags` parameter leaves the write-side contract underspecified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 50%: `text` is documented as "the note to remember" while `tags` has no description anywhere. The description does not compensate by explaining what tags are for (retrieval via warden__recall, categorization), so half the parameters remain semantically opaque.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
"Save a note ... memory" is a specific verb plus resource, and the qualifiers (PRIVATE, local, encrypted) tell the agent this is a personal persistent store rather than a shared knowledge base. It is distinguishable from warden__recall or warden__knowledge by the write verb, though it never names those siblings explicitly.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no when-to-use guidance at all: nothing says when to remember versus writing to warden__knowledge, when to look something up with warden__recall first, or what content belongs here. The only implicit cue is the verb "save" itself.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
warden__trustB
Full trust detail (score, grade, rationale, provenance) for one skill.
| Name | Required | Description | Default |
|---|---|---|---|
| skill | Yes | skill id, e.g. research-brain/idea-scout |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations exist, so the description carries the full burden, but it does disclose the returned fields (score, grade, rationale, provenance), which is real behavioral content for a read. It does not say what happens for an unknown skill id (error vs empty), whether the call is side-effect free, or whether results are cached/stale — meaningful gaps for a tool with zero annotation coverage.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
A single front-loaded sentence with the resource and the exact payload fields; no filler, no restatement of the tool name, nothing extraneous to trim.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter read with no output schema, the description does the important work of enumerating what comes back, which is exactly what the missing output schema would otherwise have to say. Only the unknown-id behavior and sibling differentiation are absent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is a single required parameter at 100% schema coverage, and the schema already gives an example identifier format (research-brain/idea-scout). The description only reinforces that exactly one skill is expected, adding no new syntax or lookup guidance, so the baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
"Full trust detail (score, grade, rationale, provenance) for one skill" states a specific retrieval action, the resource (trust record), the cardinality (one skill), and enumerates the payload fields. It is clear what the tool yields, though it does not name how it differs from near neighbors like warden__audit or warden__list.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No when-to-use or when-not-to-use guidance is given, and no alternative is named. An agent must infer that this is the drill-down for a skill surfaced by warden__list, and gets no hint about how it relates to warden__audit or when a full detail fetch is warranted over a summary.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
warden__whoamiC
Node identity, pinned curator key fingerprint, and log root.
| Name | Required | Description | Default |
|---|---|---|---|
No parameters | |||
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
No annotations are supplied, so the description carries the full burden. It implies a read-only informational call but never states that it has no side effects, requires no authentication, or is safe to call at any time. The three return fields are named but not characterized (formats, sensitivity of the key fingerprint).
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
It is a single fragment with zero waste, but it is a label rather than a sentence and lacks front-loaded structure. Terseness here shades into under-specification rather than efficient communication.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no annotations and no output schema, the description is the only source of return-value information, and it gives an unexplained three-item list. Terms like 'pinned curator key fingerprint' and 'log root' are opaque to an agent that has not seen this system.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The tool takes zero parameters, so there is nothing for the description to disambiguate. Baseline 4 applies; the description correctly avoids inventing parameter details.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description is a noun phrase listing three returned artifacts (node identity, pinned curator key fingerprint, log root) rather than a verb+resource statement. It does convey what information the tool surfaces and is distinguishable from siblings like warden__list or warden__trust, but it never says what the tool does (e.g., 'returns' or 'reports').
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to call this versus warden__list, warden__trust, or warden__audit, and no stated preconditions. An agent must infer usage from the name 'whoami' alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
14 tool updates
v0.2.0- First observed
build_brain__build_product - First observed
build_brain__ship_gate - First observed
compliance_brain__secret_sentinel - First observed
research_brain__fact_gate - First observed
research_brain__idea_scout - First observed
util_brain__word_count - First observed
warden__audit - First observed
warden__knowledge - First observed
warden__knowledge_read - First observed
warden__list - First observed
warden__recall - First observed
warden__remember - First observed
warden__trust - First observed
warden__whoami
TDQS
Scored across 14 tools
Most tools have clearly distinct purposes: skill registry/trust, audit/identity, private memory, knowledge packs, and specialized skill workflows. There is mild overlap among provenance-adjacent tools (trust/audit/whoami) and between list and knowledge (both list something), but descriptions make the boundaries readable.
All names use snake_case with a predictable namespace__function pattern, grouping related capabilities under build_brain, research_brain, compliance_brain, util_brain, and warden. The minor inconsistency is that skill tools are noun-like (fact_gate, ship_gate, word_count) while warden tools use verbs (list, remember, recall), but the set remains easy to parse.
The 14 tools sit comfortably in the well-scoped range, with each tool earning a place across registry, memory, knowledge, and skill workflows. No obviously redundant or filler tools are present.
The surface covers core read/inspect workflows for skills, memory save/search, knowledge listing/reading, and several specialized build/research/compliance skills. However, there are notable gaps: no forget/delete for private memory, no publish/register/update operation for skills despite the audit log covering publishes, and no knowledge-pack search or mount operation beyond read.
Maintenance
Related MCP Connectors
Pre-execution governance for AI agents. Deterministic PASS/FAIL/REVIEW verdicts, replayable proof.
Context and control for any AI. Agent identity, scoped access, and proof across tools.
AI-agent trust infrastructure for discovery, authority, execution, verification, and receipts.
Security gateway for AI agents: policy, approval, and audited execution, no secrets shared.
Related MCP Servers
- FlicenseNot gradedqualityDmaintenanceOn-chain trust verification for AI agent tools. Agents query skill attestations, audit levels, and risk scores before running third-party MCP servers, so you know what's safe before you execute.-
- AlicenseNot gradedqualityAmaintenanceThe Execution Security Layer for the Agentic Era. Providing deterministic "Sudo" governance and audit logs for autonomous AI agents.3,587 npm223Apache 2.0
- AlicenseNot gradedqualityCmaintenanceProvides isolated sandbox environments for AI agents to execute code securely, generating signed receipts for every execution to ensure auditability and trust.5 npm4MIT
- AlicenseNot gradedqualityFmaintenanceA local-first skill runtime for AI coding agents that defines skills as verifiable, composable units with sandboxed execution, and exposes them as MCP tools over HTTP.9 npm31Apache 2.0