chaos-core-mcp
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@chaos-core-mcpTake this objective: reduce Azure spend by 20% without impacting performance."
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
chaos-core-mcp
An MCP server where the AI is the decision-making kernel, not a tool it exposes. A calling client (Claude, ChatGPT, Codex, whatever) doesn't enumerate low-level endpoints — it hands Chaos Core an objective and lets the Cognitive Core reason about it, discover capabilities, plan, check deterministic policy, execute, evaluate, and remember.
As of v0.2 the cognitive core is transport-agnostic. The same core, tools, policies, memory,
and capability registry are reachable two ways: over stdio for local MCP clients, and over
Streamable HTTP at /mcp for remote MCP clients such as Claude custom connectors.
CHAOS CORE
│
Cognitive Core
│
┌────────────────┴────────────────┐
│ │
stdio Streamable HTTP
│ │
▼ ▼
Local MCP clients Remote MCP clients
/mcpThere is no HTTP variant of the cognition. src/transport/stdio.ts and src/transport/http.ts
both call the single server factory createChaosCoreServer() — the transport is invisible to
the cognitive layer, and there are no http_reason / remote_plan duplicates.
The Cognitive Core loop
objective
↓
context
↓
AI planning
↓
policy
↓
capability execution
↓
evaluation
↓
resultV1 exposes each stage as its own MCP tool, so every step stays inspectable and the calling AI stays in control between stages:
Tool | Purpose |
| Analyze an objective + context before any plan exists (Intent Analyzer) |
| Convert an objective into an ordered, capability-grounded plan |
| Run a plan: policy check → capability selection → execution → evaluation |
| Read-only introspection: capabilities, policy, providers, memory, audit trail, session |
| Persist a fact to durable Semantic Memory |
| Retrieve from Semantic Memory |
Both transports serve this identical list — enforced by a test that lists tools over a real MCP client on each transport and compares the definitions.
core/brain.ts also implements the full loop as one composable function (runCognitiveCore)
— objective straight through to result, with automatic replanning on step failure and an
immediate halt on REQUIRE_APPROVAL. It is not registered as an MCP tool in V1 (see
V1 boundary) but exists fully wired, ready to back a future chaoscore_achieve
tool without a rewrite.
Related MCP server: Flyto Core
Architecture
src/
index.ts transport dispatcher (stdio by default)
config.ts the only file that reads process.env
server/ ← composition root; transport-independent
create-server.ts createRuntime() + createChaosCoreServer()
register-tools.ts the single definition of the V1 tool surface
types.ts RuntimeServices / ChaosCoreDependencies
schemas.ts shared Zod schemas
tools/ reason plan execute inspect remember recall
transport/ ← the ONLY transport-aware code
stdio.ts local subprocess transport (stdout reserved for JSON-RPC)
http.ts Streamable HTTP at /mcp (stateful sessions)
core/ brain intent planner evaluator context types
capabilities/ registry executor types + built-in/
memory/ store (factory) sqlite (impl) types (MemoryStore interface)
policy/ engine permissions approvals types
providers/ ai-provider (AIProvider interface) openai index
state/ session (Working Memory) execution (trace assembly)
observability/ logger events audit
util/ to-structuredDependency injection, and what has which lifetime
createRuntime() builds the process-wide services once: config, capability registry, policy
engine, memory store, provider registry, audit log, logger. createChaosCoreServer() builds one
McpServer per MCP session on top of that runtime, adds a per-session SessionState, and
registers the tools with the combined container injected.
Component | Lifetime | Consequence |
memory, policy, capabilities, providers, audit | per process | A remote HTTP client and a local stdio client hitting the same process see the same state |
| per MCP session | A |
No core module imports the dependency container. core/intent.ts, core/planner.ts, and
capabilities/executor.ts each declare a narrow structural interface (IntentDeps,
PlannerDeps, ExecutorDeps) that the container happens to satisfy — so the core is testable
in isolation and genuinely unaware of the server and transport layers.
Policy sits outside the AI
AI proposes action
↓
deterministic policy engine
↓
ALLOW / DENY / REQUIRE_APPROVALThe model may propose any capability; policy/engine.ts decides, as a pure function of the
capability name and the operator-controlled policy file. No model is consulted. Split into:
policy/permissions.ts— allow/deny lists (allowedCapabilities,deniedCapabilities)policy/approvals.ts— which allowed capabilities still need a human (requireConfirmationFor)policy/engine.ts— composes them, plus bounded resources (httpAllowedDomains)
data/policy.json is auto-created with safe defaults on first run:
{
"allowedCapabilities": [],
"deniedCapabilities": [],
"requireConfirmationFor": ["http.request"],
"httpAllowedDomains": []
}Transport cannot bypass policy. capabilities/executor.ts is the only path from a plan step
to a capability handler, it calls policy.check() first, and it contains no transport-conditional
branch. Steps that resolve to REQUIRE_APPROVAL are skipped unless the caller passes
confirmed: true; steps that resolve to DENY never run at all. Every decision is written to
the audit trail with its session id.
The AI model is replaceable — by design
Nothing outside src/providers/openai.ts imports an AI vendor SDK. Everything goes through one
interface:
// src/providers/ai-provider.ts
interface AIProvider {
id: string;
displayName: string;
generateText(instructions, input, options?): Promise<{ text, model, providerId }>;
generateJson(instructions, input, jsonShapeDescription, options?): Promise<{ raw, model, providerId }>;
isConfigured(): boolean;
}The cognitive stages map onto it as reason → generateJson, plan → generateJson, and
evaluate → deterministic code in core/evaluator.ts. Evaluation is deliberately not a
provider call, so a model can never grade its own failed execution into a success.
To add a model/vendor: write src/providers/<name>.ts implementing AIProvider, register it
in providers/index.ts, set CHAOS_CORE_PROVIDER=<name>. The model name itself is configured
once, via OPENAI_MODEL — it appears in no other file.
Capability registry — the extension seam
Capability objects are { name, description, risk, inputSchema (Zod), annotations, handler }.
Two ship in V1:
cognition.generate_text— general-purpose text generation via the active providerhttp.request— GET-only, gated bypolicy.httpAllowedDomains
To add one — an external API, a database, another MCP server, or one of your own apps: create a
file in src/capabilities/built-in/ exporting a Capability, register it in
src/capabilities/index.ts. Nothing in core/, policy/, server/, or transport/ changes,
and it becomes visible to local and remote clients simultaneously. The AI reasons over the
registry's descriptions to discover what solves a plan step — you never hardcode
if (task === "email") ....
Future direction: the registry is the growth path — capability packs (registered groups),
per-capability policy keyed on risk rather than on names one at a time, an adapter capability
that wraps a remote MCP client so Chaos Core can federate other MCP servers, and durable
procedural memory that learns which capability sequences succeed for recurring objectives.
Memory
V1 implements the durable Semantic Memory layer, behind a MemoryStore interface
(src/memory/types.ts) with a SQLite implementation (src/memory/sqlite.ts) chosen by a factory
(src/memory/store.ts). Backed by node:sqlite — built into Node 22.5+, zero native deps:
key/value with tags, TTL, substring search, pagination.
Swapping SQLite for Postgres or a vector store means adding one file next to sqlite.ts and
changing the factory. The MCP tools, planner, cognitive core, and policy engine don't change,
because none of them reference SQLite.
The same database is used regardless of how a request arrived — a fact written over stdio is recallable over HTTP, and survives a restart.
Working Memory (current session context) is src/state/session.ts. Episodic Memory (what
happened during past tasks) and Procedural Memory (learned successful step sequences) are
named in the architecture but not implemented in V1.
Setup
npm install
cp .env.example .env # then fill in OPENAI_API_KEY
npm run buildRun over stdio (local clients, development)
npm startnpm run start:stdio is the explicit equivalent; npm start remains stdio so existing local
setups are unaffected.
Under stdio, stdout belongs to the MCP protocol. Every diagnostic in the codebase goes
through observability/logger.ts, and the stdio transport forces that logger to stderr even if
CHAOS_CORE_LOG_STREAM=stdout is set.
Run over Streamable HTTP (remote clients)
npm run start:httpListens on HOST:PORT (default 127.0.0.1:3000) and exposes:
Method | Path | Purpose |
|
| client → server JSON-RPC (initialize, tools/list, tools/call, …) |
|
| server → client SSE notification stream for an existing session |
|
| explicit session termination |
|
| liveness + active session count (not part of MCP) |
Local endpoint: http://localhost:3000/mcp
The HTTP transport is stateful: each initialize mints an Mcp-Session-Id, and subsequent
requests must carry it. That is what lets chaoscore_plan hand a plan_id to
chaoscore_execute without leaking plans between remote clients. A request with an unknown
session id gets 404; a non-initialize request with no session id gets 400.
Environment variables
Variable | Default | Purpose |
| — | Required by the OpenAI provider. Read by the server only; never exposed to MCP clients |
|
| Default model. The single place a model name is configured |
|
|
|
|
| Which registered |
|
| HTTP transport port |
|
| HTTP transport bind address |
|
| Path the MCP endpoint is mounted at |
| — | Comma-separated; setting it enables DNS-rebinding protection |
| — | Comma-separated; same |
|
| Max JSON body accepted on |
|
| SQLite file for remember/recall |
|
| Policy config file |
|
|
|
|
| Character ceiling per tool response |
|
|
|
A .env in the working directory is loaded automatically (Node's built-in loader — no
dependency). .env.example contains placeholders only; never commit real credentials.
The pre-0.2 COGNITION_* variable names still work as fallbacks.
Connecting a local MCP client
Claude Desktop / Claude Code / any stdio client:
{
"mcpServers": {
"chaos-core": {
"command": "node",
"args": ["F:/Chaos-Origins/chaos-core-mcp/dist/index.js", "--stdio"],
"env": { "OPENAI_API_KEY": "sk-..." }
}
}
}Or with the MCP Inspector:
npm run inspector:stdioConnecting a remote MCP client
Start the HTTP transport, then point the client at the endpoint URL:
http://localhost:3000/mcpFor a Claude custom connector, add it as a remote MCP server with that URL (a public deployment needs a public HTTPS URL — see the security warning below). To poke at it manually:
npm run inspector:httpthen choose "Streamable HTTP" and enter the URL.
⚠️ Security warning for remote deployment
V1 ships no authentication. That is deliberate and is only safe because the HTTP transport
binds to 127.0.0.1 by default. The layer is structured so authentication middleware drops in
cleanly (AuthMiddleware in src/transport/http.ts, applied to the MCP route before any MCP
handling) — but nothing fake is provided: no stub OAuth, no hard-coded secrets, no bearer token
that only looks like security.
Before exposing this beyond localhost you must add:
Authentication on the
/mcproute (OAuth 2.1 resource server per the MCP auth spec, or a gateway that terminates identity)TLS — the server speaks plain HTTP; terminate TLS at a reverse proxy
Rate limiting and request-size limits — every
reason/plancall spends your OpenAI quotaDNS-rebinding protection — set
MCP_ALLOWED_HOSTS/MCP_ALLOWED_ORIGINSA reviewed
policy.json— the default allows every registered capability except those requiring confirmationDurable audit storage — the V1 audit trail is an in-memory ring buffer
If you bind to a non-loopback address without middleware, the server logs a warning at startup
saying exactly this. See docs/remote-deployment.md for the full checklist.
The OpenAI API key is read from the server's environment inside providers/openai.ts and is
never returned in tool output, inspect payloads, audit entries, or HTTP responses.
V1 capabilities and boundary
What's in:
TypeScript/Node, MCP SDK, OpenAI Responses API as the default (swappable) provider
Dual transport: stdio + Streamable HTTP at
/mcp, one shared cognitive coreSix-tool cognitive surface, identical on both transports
Capability registry + deterministic policy engine + structured audit events
SQLite Semantic Memory behind a swappable
MemoryStoreinterfaceZod validation on every tool input and every capability input
What's deliberately out:
No UI
No agent swarms / multi-agent architecture
No autonomous background execution —
chaoscore_executeruns exactly the steps it's given;core/brain.ts's full-loop replanning exists but isn't exposed as a toolNo OAuth implementation, no multi-tenancy, no marketplace
No MCP-server federation (the registry could host an adapter capability; none ships)
Build & test
npm run buildnpm testThe suite runs against the built output and covers: policy determinism and non-bypassability, memory persistence across a simulated restart, and a live MCP client connecting over both transports to verify identical tool surfaces, shared memory, and that a denied capability is blocked on each.
Available Tools
6 toolschaoscore_executeExecute PlanADestructive
Run a plan (or inline steps) through the remaining stages of the Cognitive Core loop: policy check -> capability selection -> execution -> evaluation. This is the only tool in this server that can have side effects, and only insofar as the capabilities it invokes do.
Each step is policy-checked individually before it runs (ALLOW / DENY / REQUIRE_APPROVAL — see chaoscore_inspect target="policy"). Steps that are DENY, or REQUIRE_APPROVAL and not yet confirmed, are reported as failed/skipped rather than silently dropped — read each step's error field. Every policy decision and capability call is recorded to the audit trail (chaoscore_inspect target="audit"). This is identical over stdio and over remote HTTP: there is no transport that can reach a capability without passing the policy engine.
Args:
plan_id (string, optional): id from a prior chaoscore_plan call in this session
steps (array, optional): inline steps [{description, capability, input, rationale}], alternative to plan_id
confirmed (boolean): set true to also run steps that resolve to REQUIRE_APPROVAL (default: false)
dry_run (boolean): if true, validates policy + input schema per step without calling any handler (default: false)
response_format ('markdown' | 'json'): Output format (default: 'markdown')
Returns: For JSON format: { "planId": string, "objective": string, "steps": [ { "stepId": string, "capability": string, "success": boolean, "output"?: any, "error"?: string, "policyDecision": { "decision": "allow"|"deny"|"require_approval", "allowed": boolean, "requiresConfirmation": boolean, "reason": string }, "durationMs": number } ], "evaluation": { "success": boolean, "summary": string, "notes": string[] }, "completedAt": string }
Examples:
Use when: You have a plan_id from chaoscore_plan and are ready to run it -> chaoscore_execute(plan_id="...")
Use when: A step came back REQUIRE_APPROVAL and you've now confirmed with the user -> re-run with confirmed=true
Don't use when: You just want to see what a plan would do without side effects -> use dry_run=true
Error Handling:
Returns "Error: plan_id not found in this session" if the plan wasn't created in the current MCP session
Individual step failures do NOT throw — they appear in the steps array with success=false
| Name | Required | Description | Default |
|---|---|---|---|
| steps | No | Inline steps to execute directly, as an alternative to plan_id | |
| dry_run | No | If true, validate policy + input schema for every step but never call any capability handler | |
| plan_id | No | id of a plan previously returned by chaoscore_plan in this MCP session | |
| confirmed | No | Set true to also run steps whose capability policy resolves to REQUIRE_APPROVAL | |
| response_format | No | Output format: 'markdown' for human-readable or 'json' for machine-readable | markdown |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses that the tool can have side effects, aligns with destructiveHint=true, and adds depth: each step is policy-checked individually, DENY/REQUIRE_APPROVAL steps are reported as failed/skipped, and all decisions are recorded to an audit trail. It even states transport invariance (stdio/HTTP) regarding policy enforcement, which is valuable context beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is long but every part serves a purpose: core functionality, policy details, parameter explanations, return structure, usage examples, and error handling. It is front-loaded with the primary purpose and logically organized. No wasted sentences.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is exhaustive for a complex tool: it covers side effects, policy behavior, both invocation modes, output format details, error handling (plan_id not found), and the fact that step failures don't throw. It even provides a full JSON response structure. Nothing an agent needs to call it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
While the schema already describes all parameters (100% coverage), the description adds meaningful nuance: the relationship between plan_id and steps (alternatives), the confirmed flag's role in running REQUIRE_APPROVAL steps, and the dry_run option to avoid side effects. It also clarifies the response_format's human vs. machine readability. This enriches the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: executing a plan or inline steps through the Cognitive Core loop. It distinguishes from siblings by noting it's the only tool that can have side effects, and it specifies the pipeline (policy check, capability selection, execution, evaluation). This is a specific verb+resource with clear differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit usage scenarios: 'Use when: You have a plan_id from chaoscore_plan and are ready to run it', and 'Use when: A step came back REQUIRE_APPROVAL and you've now confirmed with the user'. It also gives a clear exclusion: 'Don't use when: You just want to see what a plan would do without side effects -> use dry_run=true'. This is excellent guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
chaoscore_inspectInspect Chaos Core StateARead-onlyIdempotent
Read-only introspection into Chaos Core's current state: registered capabilities, active policy, registered AI providers (and which one is answering reason/plan calls), the audit trail, memory store stats, and this session's most recent reasoning/plan/execution results. Never modifies anything, and never reveals credentials.
Capabilities, policy, memory, and audit are process-wide — a remote HTTP client and a local stdio client inspecting the same running server see the same values. The last_* targets and 'session' are scoped to your own MCP session.
Args:
target ('capabilities'|'policy'|'providers'|'memory'|'audit'|'session'|'last_reasoning'|'last_plan'|'last_execution'): what to inspect
response_format ('markdown' | 'json'): Output format (default: 'markdown')
Returns: Varies by target. 'capabilities': list of {name, description, risk, inputSummary, readOnly, destructive}. 'policy': the active PolicyConfig. 'providers': list of {id, displayName, configured, active}. 'memory': {recordCount, backend}. 'audit': recent {type, ts, sessionId, planId, stepId, capability, ...}[] entries. 'session': {sessionId, startedAt}. For the last_* targets: the most recent ReasoningResult / Plan / ExecutionTrace produced in this session, or null if none yet.
Examples:
Use when: "What can this server actually do?" -> target="capabilities"
Use when: "Which model is actually answering my reason/plan calls right now?" -> target="providers"
Use when: "Why did that step get blocked?" -> target="policy" or target="audit"
Error Handling:
Never errors under normal use; unknown target values are rejected by schema validation before this tool runs
| Name | Required | Description | Default |
|---|---|---|---|
| target | Yes | Which part of Chaos Core state to inspect: 'capabilities' (registry), 'policy' (active policy config), 'providers' (registered AI providers and which is active), 'memory' (record count), 'audit' (recent policy decisions + capability executions), 'session' (this MCP session's id and transport), 'last_reasoning', 'last_plan', or 'last_execution' (this session's most recent result of each stage) | |
| response_format | No | Output format: 'markdown' for human-readable or 'json' for machine-readable | markdown |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
While annotations already declare readOnlyHint=true and destructiveHint=false, the description adds critical context beyond those: it never reveals credentials, and clarifies process-wide vs session-scoped state (e.g., capabilities are global, last_* are per-session). It also discloses error behavior ('never errors under normal use'). This enriches the agent's understanding of side effects and safety without contradicting annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with clear sections (main purpose, Args, Returns, Examples, Error Handling). It front-loads the core purpose and scope, then provides just enough detail per target. Every sentence earns its place—examples are actionable and error handling is concise. It is comprehensive without being redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's 2 parameters with full enum coverage, no output schema, and read-only annotations, the description is remarkably complete. It explains return values for every target, clarifies session vs process-wide scope, addresses credential safety, and covers error handling. An agent has everything needed to invoke it correctly and interpret results.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already fully describes both parameters with enums and descriptions (schema coverage 100%). The description's Args section restates the targets but adds value by coupling each target to its return shape in the Returns section (e.g., 'capabilities' returns {name, description, risk, ...}). This goes beyond the schema's generic phrasing and helps the agent anticipate output, though the schema already handles the basic parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it is a read-only introspection tool for Chaos Core's state, listing specific targets (capabilities, policy, providers, memory, audit, session, last_*). It explicitly says 'Never modifies anything' and differentiates from sibling tools (reason/plan/execute) by focusing on inspection. The verb and resource are precise, and the scope is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit examples of when to use this tool: 'What can this server actually do?' -> capabilities, 'Which model is actually answering...' -> providers, 'Why did that step get blocked?' -> policy/audit. This gives clear usage conditions and implicitly contrasts with the mutating siblings. It also states the tool is read-only, reinforcing appropriate use cases.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
chaoscore_planPlan ObjectiveARead-only
Produce an ordered, executable plan for an objective, using ONLY capabilities currently in the capability registry (capability discovery). Uses the active AI provider to select capabilities and construct step inputs. This is the Planner stage of the Cognitive Core loop.
The returned plan.id must be passed to chaoscore_execute to run it, and is scoped to your MCP session. Planning does NOT execute anything and is NOT authorization to act — policy checks happen at execution time, per step.
Args:
objective (string): The goal to produce a plan for
context (array): Background info as [{source, content}, ...]. Include prior chaoscore_reason output here if you called it first.
reasoning_effort (optional): Override the active provider's default reasoning effort
response_format ('markdown' | 'json'): Output format (default: 'markdown')
Returns: For JSON format: { "id": string, // pass this to chaoscore_execute "objective": string, "steps": [ { "id": string, "description": string, "capability": string, "input": object, "rationale": string } ], "createdAt": string, "model": string, "providerId": string }
Examples:
Use when: "Draft a summary of these release notes" -> plan with a step using capability "cognition.generate_text"
Don't use when: You want to actually run the plan -> follow up with chaoscore_execute(plan_id=...)
Error Handling:
Returns "Error: OPENAI_API_KEY is not set" (or the active provider's equivalent) if the provider isn't configured
If the model references an unregistered capability name, chaoscore_execute reports that step as failed with an "Unknown capability" error — call chaoscore_inspect(target="capabilities") to see what's available
| Name | Required | Description | Default |
|---|---|---|---|
| context | No | Relevant background information to ground the reasoning/plan. Empty array if none. | |
| objective | Yes | The goal to produce an executable plan for | |
| response_format | No | Output format: 'markdown' for human-readable or 'json' for machine-readable | markdown |
| reasoning_effort | No | Override the active provider's default reasoning effort for this call |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=true, and the description adds valuable context beyond them: planning is explicitly 'NOT authorization to act — policy checks happen at execution time, per step', and it clarifies that no execution occurs. It also discloses provider-configuration error behavior ('OPENAI_API_KEY is not set'). No contradiction with any annotation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is long but every section earns its place: since no output schema exists, the 'Returns' JSON block is essential, and the error-handling section covers realistic failure modes. It is well-structured with clear headers and front-loads the core purpose before details. Slight redundancy between the Returns block and the parameter glossary keeps it from a 5.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a moderately complex tool (4 params, 2 enums, no output schema, with 5 siblings), the description covers purpose, usage boundaries, return shape, and errors comprehensively. It explains the capability-registry constraint and how to discover valid capabilities via chaoscore_inspect. Minor gaps remain (e.g., no mention of plan length limits or cancellation), but nothing an agent needs to call it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all four parameters, giving a baseline of 3. The description adds marginal value by hinting that context should include prior chaoscore_reason output, but repeats most parameter purpose verbatim rather than deepening it. Adequate given the schema's completeness.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb-resource pair ('Produce an ordered, executable plan for an objective') plus a hard scoping constraint ('using ONLY capabilities currently in the capability registry'). It explicitly positions itself as 'the Planner stage of the Cognitive Core loop' and states what it is not — 'Planning does NOT execute anything' — which cleanly distinguishes it from the sibling chaoscore_execute.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description contains explicit 'Use when' and 'Don't use when' examples, names chaoscore_execute as the follow-up, tells the agent to pass the returned plan.id to it, and instructs that prior chaoscore_reason output should be placed into the context parameter. Guidance on when to use vs. alternatives is fully spelled out with no inference required.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
chaoscore_reasonReason About ObjectiveARead-only
Analyze an objective and its context BEFORE committing to a plan (the Intent Analyzer stage of the Cognitive Core loop: objective -> context -> AI planning -> policy -> capability execution -> evaluation -> result). Uses whichever AI provider is currently active (see chaoscore_inspect target="providers") to produce structured analysis: key considerations, risks, and a recommended approach.
Does NOT produce an executable plan or take any action — call chaoscore_plan next for that.
Args:
objective (string): The goal or question to reason about
context (array): Background info as [{source, content}, ...]. Empty array if none.
reasoning_effort (optional): Override the active provider's default reasoning effort ('none'|'low'|'medium'|'high'|'xhigh'|'max')
response_format ('markdown' | 'json'): Output format (default: 'markdown')
Returns: For JSON format: { "objective": string, "analysis": string, "keyConsiderations": string[], "risks": string[], "recommendedApproach": string, "model": string, "providerId": string }
Examples:
Use when: "Should I migrate memory storage before or after the staging cutover?" -> reason about tradeoffs first
Don't use when: You already know the approach and just need an executable plan -> use chaoscore_plan directly
Error Handling:
Returns "Error: OPENAI_API_KEY is not set" (or the active provider's equivalent) if the provider isn't configured
| Name | Required | Description | Default |
|---|---|---|---|
| context | No | Relevant background information to ground the reasoning/plan. Empty array if none. | |
| objective | Yes | The goal or question to reason about | |
| response_format | No | Output format: 'markdown' for human-readable or 'json' for machine-readable | markdown |
| reasoning_effort | No | Override the active provider's default reasoning effort for this call |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnlyHint annotation, the description discloses that the tool does not take action, uses the active AI provider, and includes specific error-handling behavior if the provider is not configured. It also describes the return structure for JSON format. This adds significant richness beyond the annotations and fully explains the tool's non-mutating, provider-dependent nature.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with clear sections: purpose, pipeline placement, what it does not do, args, returns, examples, and error handling. It is front-loaded with the primary purpose and every section adds value. The length is justified by the inclusion of a return schema (since no output schema is provided) and error handling, making it efficient rather than verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is complete for an agent to call this tool correctly. It covers the input parameters, provides a return schema for JSON format, explains the provider dependency and how to inspect it (see chaoscore_inspect), gives usage examples, and documents error cases. With no output schema present, the included return structure is essential and well-provided.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline is 3. The description adds a bit of extra clarity, e.g., for 'context' it specifies the exact structure '[source, content]' and for 'response_format' it notes the default. It also explicitly lists enum values and says 'empty array if none.' While mostly redundant with the schema, it provides a slightly more concise and action-oriented explanation, justifying a 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('Analyze an objective and its context BEFORE committing to a plan') with a clear resource (the objective and context) and delivers structured analysis. It explicitly distinguishes itself from siblings: 'Does NOT produce an executable plan... call chaoscore_plan next.' The purpose is unambiguous and differentiates well from chaoscore_plan, chaoscore_execute, etc.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides concrete when-to-use and when-not-to-use guidance with an example ('Should I migrate memory storage...?') and explicitly references the alternative ('use chaoscore_plan directly'). It also frames this as the first stage in the Cognitive Core loop, giving clear context for when this tool should be invoked.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
chaoscore_recallRecallARead-onlyIdempotent
Search Semantic Memory records previously stored with chaoscore_remember. Supports exact key lookup, substring search over keys/values, and tag filtering. Expired records (past their ttl_seconds) are never returned. Reads the same durable store regardless of which transport you connected through.
Args:
key (string, optional): Exact key to fetch one record directly
query (string, optional): Substring to match against keys/values
tags (array of strings): Only return records with ALL of these tags (default: [])
limit (number, 1-100): Max results (default: 20)
offset (number): Pagination offset (default: 0)
response_format ('markdown' | 'json'): Output format (default: 'markdown')
Returns: For JSON format (key lookup): { "key": string, "value": string, "tags": string[], ... } or null if not found For JSON format (search): { "total": number, "count": number, "offset": number, "records": [...], "has_more": boolean, "next_offset"?: number }
Examples:
Use when: "What do we know about staging?" -> query="staging"
Use when: "Get the exact record for key X" -> key="staging.region"
Don't use when: You want to write/update a memory -> use chaoscore_remember instead
Error Handling:
Returns "No memory found for key ''" (not an error) if an exact key lookup misses
Returns empty records array (not an error) if a search finds nothing
| Name | Required | Description | Default |
|---|---|---|---|
| key | No | Exact key to fetch a single record. If set, other filters are ignored. | |
| tags | No | Only return records that have ALL of these tags | |
| limit | No | Max results to return | |
| query | No | Substring to match against memory keys and values | |
| offset | No | Number of results to skip for pagination | |
| response_format | No | Output format: 'markdown' for human-readable or 'json' for machine-readable | markdown |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds valuable behavioral context beyond these: expired records are never returned, the store is durable across transports, and miss returns are non-error strings/empty arrays. No contradictions with annotations are present.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-organized into sections (Args, Returns, Examples, Error Handling) with the core purpose front-loaded. Every sentence serves a purpose; there is no fluff or repetition. Despite its length, it remains efficient and scannable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with six parameters and no output schema, the description fully covers behavior: it documents both markdown and JSON return structures, error handling for misses, pagination fields, and example use cases. An agent has all necessary information to call it correctly without external documentation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, but the description enriches parameter understanding by explaining interaction effects (e.g., 'key' ignores other filters), pagination semantics (offset, has_more, next_offset), and response format differences. It also provides concrete examples that map parameters to real queries, going well beyond bare schema types.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb ('Search') and resource ('Semantic Memory records'), and explicitly distinguishes itself from chaoscore_remember ('previously stored with chaoscore_remember'). It lists the three supported search modes (exact key, substring, tag filtering), leaving no ambiguity about what the tool does.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides explicit use cases with examples ('What do we know about staging?' -> query='staging') and a clear exclusion ('Don't use when: You want to write/update a memory -> use chaoscore_remember instead'). This gives an agent precise decision criteria for choosing this tool over its sibling.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
chaoscore_rememberRememberAIdempotent
Persist a key/value record to Semantic Memory (durable, SQLite-backed), so it can be retrieved later with chaoscore_recall — in this session, in a future session, after a server restart, and from either transport. Writing to an existing key overwrites its value and updates its timestamp, making chaoscore_remember idempotent for a given key/value pair.
Memory is a property of the deployment, not of the connection: a record written over stdio is readable over HTTP and vice versa, provided both point at the same database file.
Args:
key (string, 1-200 chars): Unique identifier for this memory
value (string): The content to remember
tags (array of strings): Optional tags for filtering later (default: [])
ttl_seconds (number, optional): If set, the record is treated as expired (and excluded from chaoscore_recall) after this many seconds
response_format ('markdown' | 'json'): Output format (default: 'markdown')
Returns: For JSON format: { "key": string, "value": string, "tags": string[], "createdAt": string, "updatedAt": string, "expiresAt": string | null }
Examples:
Use when: "Remember that the staging DB uses the Melbourne region" -> key="staging.region", value="Melbourne (australiaeast)"
Don't use when: You need to search existing memories -> use chaoscore_recall instead
Error Handling:
Returns "Error: ..." with the underlying SQLite error message if the write fails (e.g. disk full, path unwritable)
| Name | Required | Description | Default |
|---|---|---|---|
| key | Yes | Unique key for this memory. Writing an existing key overwrites its value. | |
| tags | No | Optional tags for later filtering with chaoscore_recall | |
| value | Yes | The content to remember | |
| ttl_seconds | No | Optional time-to-live in seconds. Omit for a record that never expires. | |
| response_format | No | Output format: 'markdown' for human-readable or 'json' for machine-readable | markdown |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate idempotent, non-read-only, and non-destructive. The description goes further: it explains durable SQLite-backed storage, persistence across sessions/restarts/transports, overwrite semantics with timestamp updates, TTL behavior (exclusion from recall), and error handling. This exceeds annotation coverage without contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with clear sections (Args, Returns, Examples, Error Handling) and front-loads the core purpose. Every sentence conveys necessary information without redundancy, making it appropriately concise for a tool with this complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (5 params, TTL, transport independence, output formats) and lack of an output schema, the description covers all needed aspects: purpose, usage, params, return format, error handling, and examples. An agent can confidently invoke this tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters. The description repeats most parameter details and adds minor clarifications (e.g., TTL expiration behavior, key uniqueness), but does not significantly augment the schema. Baseline 3 is appropriate when schema handles the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it persists key/value records to Semantic Memory for later retrieval via chaoscore_recall. It specifies the resource (Semantic Memory), the verb (persist), and distinguishes itself from the recall sibling by explicitly naming it as the retrieval counterpart.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
An explicit 'Examples' section provides a concrete use case ('Remember that the staging DB uses the Melbourne region') and a don't-use case ('You need to search existing memories -> use chaoscore_recall instead'). This directly instructs when to use versus when to use the sibling, leaving no ambiguity.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
6 tool updates
v0.2.0- First observed
chaoscore_execute - First observed
chaoscore_inspect - First observed
chaoscore_plan - First observed
chaoscore_reason - First observed
chaoscore_recall - First observed
chaoscore_remember
TDQS
Scored across 6 tools
Each tool has a clearly distinct role in the cognitive core loop: reason analyzes before planning, plan produces an executable plan, execute runs it, inspect provides read-only introspection, and remember/recall handle persistent memory. There is no overlap in purpose; even reason and plan, which share similar arguments, are explicitly differentiated by what they produce.
All tools follow a consistent naming pattern: the 'chaoscore_' prefix followed by a lowercase verb (reason, plan, execute, inspect, remember, recall). No mixing of camelCase or inconsistent verb styles; the pattern is uniform and predictable.
With 6 tools, the server is well-scoped. Each tool corresponds to a necessary stage of the cognitive core workflow (reason, plan, execute, inspect) plus persistent memory operations (remember/recall). There are no redundant or extraneous tools, and the count is well within the ideal 3-15 range.
The tool surface covers the full lifecycle: analyze (reason), plan (plan), execute (execute), observe (inspect), and persist/retrieve knowledge (remember/recall). Minor gaps exist, such as no explicit delete tool for memory (though overwrite covers updates) and no dedicated cancel/abort for plans, but these are not critical to the core loop. Overall, the domain is well-covered.
Maintenance
Related MCP Connectors
Deterministic reasoning stack for AI agents: simulate, decide & compute, plus cross-domain tools.
Hosted runtime for persistent agent teams, durable workflows, memory, schedules, and goals.
Durable, user-controlled goals and governed plans for AI agents.
Persistent memory for AI agents. Semantic search, memory graph, W3C DID identity.
Related MCP Servers
- FlicenseNot gradedqualityDmaintenanceEnables deployment of autonomous AI agents with memory and tool execution capabilities through a WebSocket-based MCP protocol. Provides production-ready infrastructure with REST API access, persistent state management, and extensible function registry for building self-hosted AI systems.-
- AlicenseNot gradedqualityAmaintenanceDeterministic execution engine for AI agents. 412 modules across 78 categories including browser automation, file I/O, Docker, data parsing, crypto, and scheduling. Supports STDIO and Streamable HTTP transport with execution trace, evidence snapshots, and replay from any step.271 PyPI480Apache 2.0

Nouva MCP Serverofficial
FlicenseNot gradedqualityAmaintenanceCentralized repository for modular, portable skills and memory, enabling AI agents and IDEs to access personalized tools and memory via stdio or SSE transport.1-
ellmos-homebase-mcpofficial
AlicenseNot gradedqualityBmaintenanceEnables local-first LLM orchestration with persistent memory, knowledge management, routing, swarm patterns, API probing, tests, automation planning, and plugin discovery via a stdio MCP server, using SQLite for offline storage.41 npm1MIT