Skip to main content
Glama

chaos-core-mcp

AIがツールを公開するのではなく、AI自身が意思決定のカーネルとなるMCPサーバーです。呼び出し元クライアント(Claude、ChatGPT、Codexなど)は低レベルのエンドポイントを列挙するのではなく、Chaos Coreに目的を渡し、Cognitive Coreがその目的について推論し、ケイパビリティを発見し、計画し、決定論的ポリシーをチェックし、実行し、評価し、記憶する、という流れを任せます。

v0.2の時点で、cognitive coreはトランスポート非依存です。コア、ツール、ポリシー、メモリ、ケイパビリティレジストリはすべて、ローカルMCPクライアント向けのstdioと、ClaudeカスタムコネクタなどのリモートMCPクライアント向けのStreamable HTTP(/mcp)という2つの経路からアクセスできます。

                     CHAOS CORE
                         │
                  Cognitive Core
                         │
        ┌────────────────┴────────────────┐
        │                                 │
     stdio                         Streamable HTTP
        │                                 │
        ▼                                 ▼
 Local MCP clients                Remote MCP clients
                                     /mcp

認知処理のHTTP版は存在しません。src/transport/stdio.ts と src/transport/http.ts は、どちらも単一のサーバーファクトリ createChaosCoreServer() を呼び出します。トランスポートは認知レイヤーからは不可視であり、http_reason / remote_plan のような重複もありません。

Cognitive Core ループ

objective
   ↓
context
   ↓
AI planning
   ↓
policy
   ↓
capability execution
   ↓
evaluation
   ↓
result

V1では各段階が独自のMCPツールとして公開されるため、すべてのステップを検査可能に保ちながら、呼び出し元AIが段階間の制御を維持できます。

Tool

用途

chaoscore_reason

計画が存在する前に目的とコンテキストを分析する(Intent Analyzer)

chaoscore_plan

目的を順序付けされたケイパビリティ基盤の計画に変換する

chaoscore_execute

計画を実行する:ポリシーチェック → ケイパビリティ選択 → 実行 → 評価

chaoscore_inspect

読み取り専用のイントロスペクション:ケイパビリティ、ポリシー、プロバイダー、メモリ、監査証跡、セッション

chaoscore_remember

永続的なセマンティックメモリに事実を保存する

chaoscore_recall

セマンティックメモリから取得する

両方のトランスポートはこの同一のリストを提供します。これは、各トランスポート上で実際のMCPクライアントを介してツールを列挙し、定義を比較するテストによって保証されています。

core/brain.ts はまた、全体 ループを単一の合成可能な関数(runCognitiveCore)として実装しています。目的から結果までを一気に処理し、ステップ失敗時には自動で再計画し、REQUIRE_APPROVAL が発生すると即座に停止します。V1ではMCPツールとして登録されていません(V1境界 を参照)が、完全に配線済みであり、将来の chaoscore_achieve ツールを書き換えなしで支えられる状態にあります。

Related MCP server: ellmos-homebase-mcp

アーキテクチャ

src/
  index.ts                    transport dispatcher (stdio by default)
  config.ts                   the only file that reads process.env

  server/                     ← composition root; transport-independent
    create-server.ts          createRuntime() + createChaosCoreServer()
    register-tools.ts         the single definition of the V1 tool surface
    types.ts                  RuntimeServices / ChaosCoreDependencies
    schemas.ts                shared Zod schemas
    tools/                    reason plan execute inspect remember recall

  transport/                  ← the ONLY transport-aware code
    stdio.ts                  local subprocess transport (stdout reserved for JSON-RPC)
    http.ts                   Streamable HTTP at /mcp (stateful sessions)

  core/                       brain intent planner evaluator context types
  capabilities/               registry executor types + built-in/
  memory/                     store (factory) sqlite (impl) types (MemoryStore interface)
  policy/                     engine permissions approvals types
  providers/                  ai-provider (AIProvider interface) openai index
  state/                      session (Working Memory) execution (trace assembly)
  observability/              logger events audit
  util/                       to-structured

依存性注入と、それぞれのライフタイム

createRuntime() はプロセス全体のサービスを一度だけ構築します:config、ケイパビリティレジストリ、ポリシーエンジン、メモリストア、プロバイダーレジストリ、監査ログ、loggerです。createChaosCoreServer() はそのランタイムの上にMCPセッションごとに1つの McpServer を構築し、セッションごとの SessionState を追加して、注入された統合コンテナとともにツールを登録します。

コンポーネント

ライフタイム

影響

メモリ、ポリシー、ケイパビリティ、プロバイダー、監査

プロセスごと

同じプロセスに接続するリモートHTTPクライアントとローカルstdioクライアントは同じ状態を参照する

SessionState(ワーキングメモリ:直前のプラン/推論/トレース)

MCPセッションごと

あるクライアントの plan_id を別のクライアントが実行することはできない

コアモジュールは依存コンテナをインポートしません。core/intent.ts、core/planner.ts、capabilities/executor.ts はそれぞれ、コンテナがたまたま充足する狭い構造的インターフェース(IntentDeps、PlannerDeps、ExecutorDeps)を宣言しています。そのため、コアは単体でテスト可能で、サーバー層やトランスポート層について本当に知らない状態が保たれます。

ポリシーはAIの外側にある

AI proposes action
      ↓
deterministic policy engine
      ↓
ALLOW / DENY / REQUIRE_APPROVAL

モデルはどのような直接的なケイパビリティを広い歓迎されるものかもしれません。policy/engine.ts が、ケイパビリティ名とオペレーターが管理するポリシーファイルを純関数(pure function)として決定します。モデルは一切参照されません。次のように分けられます:

  • policy/permissions.ts — 許可/拒否リスト(allowedCapabilities、deniedCapabilities)

  • policy/approvals.ts — 許可されたケイパビリティのうち、どれが人間の承認を必要とするか(requireConfirmationFor)

  • policy/engine.ts — それらを組み合わせ、さらに制限付きリソースを扱う(httpAllowedDomains)

data/policy.json は初回起動時に安全なデフォルトで自動生成されます。

{
  "allowedCapabilities": [],
  "deniedCapabilities": [],
  "requireConfirmationFor": ["http.request"],
  "httpAllowedDomains": []
}

トランスポートがポリシーを迂回することはできません。 capabilities/executor.ts は、プランステップからケイパビリティハンドラへの唯一の経路であり、最初に policy.check() を呼び出し、トランスポート依存の分岐を持ちません。REQUIRE_APPROVAL に解決されるステップは、呼び出し側が confirmed: true を渡さない限りスキップされます。DENY に解決されるステップは一切実行されません。すべての決定はセッションIDとともに監査証跡に書き込まれます。

AIモデルは意図的に置き換え可能

src/providers/openai.ts 以外のどこもAIベンダーSDKをインポートしません。すべては1つのインターフェースを経由します:

// src/providers/ai-provider.ts
interface AIProvider {
  id: string;
  displayName: string;
  generateText(instructions, input, options?): Promise<{ text, model, providerId }>;
  generateJson(instructions, input, jsonShapeDescription, options?): Promise<{ raw, model, providerId }>;
  isConfigured(): boolean;
}

認知ステージは、reason → generateJson、plan → generateJson、evaluate → core/evaluator.ts 内の決定論的コード という形でこのインターフェースに対応します。評価は意図的に プロバイダ呼び出し ではなく、検証が失敗した実行をモデルが成功として評価することは絶対にできません。

モデル/ベンダーを追加するには: AIProvider を実装する src/providers/<name>.ts を作成し、providers/index.ts に登録して、CHAOS_CORE_PROVIDER=<name> を設定します。モデル名自体は OPENAI_MODEL で一度だけ設定され、他のファイルには現れません。

Capability registry — 拡張の接ぎ目

Capability オブジェクトは { name, description, risk, inputSchema (Zod), annotations, handler } です。V1には次の2つが実装されています:

  • cognition.generate_text — アクティブなプロバイダで提供する汎用テキスト生成

  • http.request — GETのみ、policy.httpAllowedDomains で制御

追加するには、外部API、データベース、別のMCPサーバー、または自作アプリなどを問わず、src/capabilities/built-in/ に Capability をエクスポートするファイルを置き、src/capabilities/index.ts に登録します。core/、policy/、server/、transport/ は何も変更されず、ローカルとリモートの両方のクライアントから同時に参照できるようになります。AIはレジストリの説明をもとに、どのケイパビリティがプランのステップを解決できるかを発見します。if (task === "email") ... とハードコードすることはありません。

将来の方向性: このレジストリが成長の道です。ケイパビリティパック(登録グループ)、risk をキーにした過パビリティ単位のポリシー(名前の列挙ではなく)、リモートMCPクライアントをラップしてChaos Coreが他のMCPサーバーを連携できるようにするアダプタケーパビリティ、そして、反復目的のために成功するケイパビリティの並びを学習する永続的な手続きメモリなどが考えられます。

メモリ

V1は永続的なセマンティックメモリ層を実装しています。背後にあるのは MemoryStore インターフェース(src/memory/types.ts)で、SQLite実装(src/memory/sqlite.ts)がファクトリ(src/memory/store.ts)によって選択されます。バックエンドは node:sqlite(Node 22.5+ 組み込み、ネイティブ依存ゼロ)で、タグ、TTL、部分一致検索、改ページを備えたキーバリュー型です。

SQLiteをPostgreSQLやベクターストアに置き換えるには、sqlite.ts の隣に1ファイル追加してファクトリを変えるだけで十分です。MCPツール、プランナー、Cognitive Core、ポリシーエンジンはSQLiteを参照していないため、変更は不要です。

同じデータベースがリクエストの到着方法によらず使用されます。stdioで書き込まれた事実はHTTPでも potential参照でき、再起動後も残ります。

ワーキングメモリ(現在のセッションコンテキスト)は src/state/session.ts です。エピソードメモリ(過去のタスクで発生したこと)と手続きメモリ(学習された成功したステップ列)はアーキテクチャ上では言及されていますが、V1では実装されていません。

セットアップ

npm install
cp .env.example .env    # then fill in OPENAI_API_KEY
npm run build

stdioで実行する(ローカルクライアント、開発)

npm start

npm run start:stdio がその明示的な並存です。npm start はstdioのままなので、既存のローカルセットアップには影響しません。

stdioでは、standard output は MCPプロトコル専用です。コードベース内のすべての診断は observability/logger.ts を経由。stdioトランスポート害は、CHAOS_CORE_LOG_STREAM=stdout が設定されている場合でも、ロガーを強制的にstderrにします。

Streamable HTTPで実行(リモートクライアント)

npm run start:http

HOST:PORT(デフォルト: 127.0.0.1:3000)でリッスンし、以下を公開します:

メソッド

パス

目的

POST

/mcp

クライアント → サーバー JSON-RPC(initialize, tools/list, tools/call, …)

GET

/mcp

既存セッションのサーバー → クライアント SSE 通知ストリーム

DELETE

/mcp

明示的なセッション終了

GET

/health

liveness チェックと アクティブセッション数(MCPの一部ではない)

ローカルエンドポイント: http://localhost:3000/mcp

HTTPトランスポートはステートフルです。各 initialize は Mcp-Session-Id を作成し、後続のリクエストはそれを保持している必要があります。これにより chaoscore_plan が plan_id を chaoscore_execute に渡せる一方、リモートクライアント間でプランを泄漏しません。未知のセッションIDの要求は 404、セッションIDを持たない非initialize要求は 400 になります。

環境変数

変数

デフォルト

目的

OPENAI_API_KEY

—

OpenAIプロバイダ上で必須。サーバーだけが読取り、MCPクライアントへは公開されない

OPENAI_MODEL

gpt-5.6

デフォルトのモデル。モデル名を設定する唯一の場所

OPENAI_REASONING_EFFORT

medium

「none」|「low」|「medium」|「high」|「xhigh」|「max」

CHAOS_CORE_PROVIDER

openai

reason/plan 呼び出しに応答する登録済み AIProvider

PORT

3000

HTTPトランスポートのポート

HOST

127.0.0.1

HTTPトランスポートのbindアドレス

MCP_HTTP_PATH

/mcp

MCPエンドポイントがマウントされるパス

MCP_ALLOWED_HOSTS

—

カンマ区切り;設定するとDNSリバンディング保護が有効になります

MCP_ALLOWED_ORIGINS

—

カンマ区切り;上記と同じ

MCP_HTTP_MAX_BODY

4mb

/mcp で受け付ける最大JSONボディサイズ

CHAOS_CORE_DB_PATH

./data/chaos-core.db

remember/recall 用のSQLiteファイル

CHAOS_CORE_POLICY_PATH

./data/policy.json

ポリシー設定ファイル

CHAOS_CORE_LOG_STREAM

stderr

stderr|stdout;stdioモードでは常に stderr に強制される

CHAOS_CORE_RESPONSE_LIMIT

25000

ツール応答ごとの文字数上限

MCP_TRANSPORT

stdio

stdio|http; --stdio/--http が優先される

作業ディレクトリの .env は自動的にロードされます(Node組み込みのローダー — 依存不要)。.env.example はプレースホルダーだけを含みます。実際の資格情報をコミットしてはなりません。

0.2以前のCOGNITION_*変数名は、フォールバックとして引き続き機能します。

ローカルMCPクライアントの接続

Claude Desktop / Claude Code / 任意のstdioクライアント:

{
  "mcpServers": {
    "chaos-core": {
      "command": "node",
      "args": ["F:/Chaos-Origins/chaos-core-mcp/dist/index.js", "--stdio"],
      "env": { "OPENAI_API_KEY": "sk-..." }
    }
  }
}

またはMCP Inspectorを使う場合:

npm run inspector:stdio

リモートMCPクライアントの接続

HTTPトランスポートを起動し、クライアントをエンドポイントURLに向けます:

http://localhost:3000/mcp

Claudeのカスタムコネクタの場合は、そのURLをリモートMCPサーバーとして追加します(公開デプロイには公開HTTPS URLが必要です。下記のセキュリティ警告を参照してください)。手動で試してみるには:

npm run inspector:http

次に「Streamable HTTP」を選択して、URLを入力します。

⚠️ リモートデプロイのセキュリティ警告

V1には認証が一切搭載されていません。 これは意図的なものであり、HTTPトランスポートがデフォルトで127.0.0.1にバインドされるためにのみ安全です。このレイヤーは、認証ミドルウェアをきれいに組み込めるように構造化されています(src/transport/http.ts内のAuthMiddlewareは、MCP処理の前にMCPルートに適用されます)— ただし、偽物は一切提供されません。スタブのOAuth、ハードコードされたシークレット、セキュリティらしく見えるだけのベアラートークンはありません。

localhost以外に公開する前に、必ず追加する必要があります:

  • /mcpルートへの認証(MCP認証仕様に沿ったOAuth 2.1リソースサーバー、またはアイデンティティを終端するゲートウェイ)

  • TLS — サーバーはプレーンなHTTPで通信します。リバースプロキシでTLSを終端してください

  • レート制限とリクエストサイズ制限 — reason/plan呼び出しのたびにOpenAIのクォータを消費します

  • DNSリバインディング保護 — MCP_ALLOWED_HOSTS / MCP_ALLOWED_ORIGINSを設定します

  • レビュー済みのpolicy.json — デフォルトでは、確認が必要なものを除くすべての登録済みケーパビリティを許可します

  • 永続的な監査ストレージ — V1の監査トレイルはインメモリリングバッファです

ミドルウェアなしで非ループバックアドレスにバインドすると、サーバーは起動時にこの内容のまま警告をログに記録します。完全なチェックリストはdocs/remote-deployment.mdを参照してください。

OpenAI APIキーはproviders/openai.ts内でサーバーの環境から読み取られ、ツール出力、インスペクションペイロード、監査エントリ、HTTPレスポンスのいずれにも返されません。

V1のケービリティと境界

含まれているもの:

  • TypeScript/Node、MCP SDK、デフォルトで利用可能な(交換可能な)プロバイダーとしてのOpenAI Responses API

  • デュアルトランスポート: stdio + /mcpでのStreamable HTTP、および共有された単一の認知コア

  • 6ツールで構成される認知的サーフェス。両方のトランスポートで同一

  • ケービリティレジストリ + 決定論的ポリシーエンジン + 構造化された監査イベント

  • 交換可能なMemoryStoreインターフェースの背後にあるSQLite Semantic Memory

  • すべてのツール入力とすべてのケービリティ入力に対するZodでの検証

意図的に含めていないもの:

  • UIなし

  • エージェントスウォーム / マルチエージェントアーキテクチャなし

  • 自律的なバックグラウンド実行なし — chaoscore_executeは与えられた手順をそのまま実行するだけです。core/brain.tsの完全ループの再プランニングは存在しますが、ツールとしては公開されていません

  • OAuth実装なし、マルチテナンシーなし、マーケットプレイスなし

  • MCPサーバーのフェデレーションなし(レジストリはアダプタ・ケービリティをホストできますが、同梱されているものはありません)

ビルドとテスト

npm run build
npm test

このスイートはビルドの生成物に対して実行され、以下をカバーしています: ポリシーの決定性と非バイパス性、シミュレートした再起動をまたいだメモリの永続性、そしてライブMCPクライアントが両方のトランスポートに接続して、同一のツールサーフェスと共有メモリを検証し、拒否されたケービリティが各トランスポートでブロックされることを確認します。

Available Tools

6 tools
chaoscore_executeExecute PlanA
Destructive

Run a plan (or inline steps) through the remaining stages of the Cognitive Core loop: policy check -> capability selection -> execution -> evaluation. This is the only tool in this server that can have side effects, and only insofar as the capabilities it invokes do.

Each step is policy-checked individually before it runs (ALLOW / DENY / REQUIRE_APPROVAL — see chaoscore_inspect target="policy"). Steps that are DENY, or REQUIRE_APPROVAL and not yet confirmed, are reported as failed/skipped rather than silently dropped — read each step's error field. Every policy decision and capability call is recorded to the audit trail (chaoscore_inspect target="audit"). This is identical over stdio and over remote HTTP: there is no transport that can reach a capability without passing the policy engine.

Args:

  • plan_id (string, optional): id from a prior chaoscore_plan call in this session

  • steps (array, optional): inline steps [{description, capability, input, rationale}], alternative to plan_id

  • confirmed (boolean): set true to also run steps that resolve to REQUIRE_APPROVAL (default: false)

  • dry_run (boolean): if true, validates policy + input schema per step without calling any handler (default: false)

  • response_format ('markdown' | 'json'): Output format (default: 'markdown')

Returns: For JSON format: { "planId": string, "objective": string, "steps": [ { "stepId": string, "capability": string, "success": boolean, "output"?: any, "error"?: string, "policyDecision": { "decision": "allow"|"deny"|"require_approval", "allowed": boolean, "requiresConfirmation": boolean, "reason": string }, "durationMs": number } ], "evaluation": { "success": boolean, "summary": string, "notes": string[] }, "completedAt": string }

Examples:

  • Use when: You have a plan_id from chaoscore_plan and are ready to run it -> chaoscore_execute(plan_id="...")

  • Use when: A step came back REQUIRE_APPROVAL and you've now confirmed with the user -> re-run with confirmed=true

  • Don't use when: You just want to see what a plan would do without side effects -> use dry_run=true

Error Handling:

  • Returns "Error: plan_id not found in this session" if the plan wasn't created in the current MCP session

  • Individual step failures do NOT throw — they appear in the steps array with success=false

ParametersJSON Schema
NameRequiredDescriptionDefault
stepsNoInline steps to execute directly, as an alternative to plan_id
dry_runNoIf true, validate policy + input schema for every step but never call any capability handler
plan_idNoid of a plan previously returned by chaoscore_plan in this MCP session
confirmedNoSet true to also run steps whose capability policy resolves to REQUIRE_APPROVAL
response_formatNoOutput format: 'markdown' for human-readable or 'json' for machine-readablemarkdown

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

The description discloses that the tool can have side effects, aligns with destructiveHint=true, and adds depth: each step is policy-checked individually, DENY/REQUIRE_APPROVAL steps are reported as failed/skipped, and all decisions are recorded to an audit trail. It even states transport invariance (stdio/HTTP) regarding policy enforcement, which is valuable context beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but every part serves a purpose: core functionality, policy details, parameter explanations, return structure, usage examples, and error handling. It is front-loaded with the primary purpose and logically organized. No wasted sentences.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is exhaustive for a complex tool: it covers side effects, policy behavior, both invocation modes, output format details, error handling (plan_id not found), and the fact that step failures don't throw. It even provides a full JSON response structure. Nothing an agent needs to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

While the schema already describes all parameters (100% coverage), the description adds meaningful nuance: the relationship between plan_id and steps (alternatives), the confirmed flag's role in running REQUIRE_APPROVAL steps, and the dry_run option to avoid side effects. It also clarifies the response_format's human vs. machine readability. This enriches the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the tool's function: executing a plan or inline steps through the Cognitive Core loop. It distinguishes from siblings by noting it's the only tool that can have side effects, and it specifies the pipeline (policy check, capability selection, execution, evaluation). This is a specific verb+resource with clear differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit usage scenarios: 'Use when: You have a plan_id from chaoscore_plan and are ready to run it', and 'Use when: A step came back REQUIRE_APPROVAL and you've now confirmed with the user'. It also gives a clear exclusion: 'Don't use when: You just want to see what a plan would do without side effects -> use dry_run=true'. This is excellent guidance.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

chaoscore_inspectInspect Chaos Core StateA
Read-onlyIdempotent

Read-only introspection into Chaos Core's current state: registered capabilities, active policy, registered AI providers (and which one is answering reason/plan calls), the audit trail, memory store stats, and this session's most recent reasoning/plan/execution results. Never modifies anything, and never reveals credentials.

Capabilities, policy, memory, and audit are process-wide — a remote HTTP client and a local stdio client inspecting the same running server see the same values. The last_* targets and 'session' are scoped to your own MCP session.

Args:

  • target ('capabilities'|'policy'|'providers'|'memory'|'audit'|'session'|'last_reasoning'|'last_plan'|'last_execution'): what to inspect

  • response_format ('markdown' | 'json'): Output format (default: 'markdown')

Returns: Varies by target. 'capabilities': list of {name, description, risk, inputSummary, readOnly, destructive}. 'policy': the active PolicyConfig. 'providers': list of {id, displayName, configured, active}. 'memory': {recordCount, backend}. 'audit': recent {type, ts, sessionId, planId, stepId, capability, ...}[] entries. 'session': {sessionId, startedAt}. For the last_* targets: the most recent ReasoningResult / Plan / ExecutionTrace produced in this session, or null if none yet.

Examples:

  • Use when: "What can this server actually do?" -> target="capabilities"

  • Use when: "Which model is actually answering my reason/plan calls right now?" -> target="providers"

  • Use when: "Why did that step get blocked?" -> target="policy" or target="audit"

Error Handling:

  • Never errors under normal use; unknown target values are rejected by schema validation before this tool runs

ParametersJSON Schema
NameRequiredDescriptionDefault
targetYesWhich part of Chaos Core state to inspect: 'capabilities' (registry), 'policy' (active policy config), 'providers' (registered AI providers and which is active), 'memory' (record count), 'audit' (recent policy decisions + capability executions), 'session' (this MCP session's id and transport), 'last_reasoning', 'last_plan', or 'last_execution' (this session's most recent result of each stage)
response_formatNoOutput format: 'markdown' for human-readable or 'json' for machine-readablemarkdown

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

While annotations already declare readOnlyHint=true and destructiveHint=false, the description adds critical context beyond those: it never reveals credentials, and clarifies process-wide vs session-scoped state (e.g., capabilities are global, last_* are per-session). It also discloses error behavior ('never errors under normal use'). This enriches the agent's understanding of side effects and safety without contradicting annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections (main purpose, Args, Returns, Examples, Error Handling). It front-loads the core purpose and scope, then provides just enough detail per target. Every sentence earns its place—examples are actionable and error handling is concise. It is comprehensive without being redundant.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's 2 parameters with full enum coverage, no output schema, and read-only annotations, the description is remarkably complete. It explains return values for every target, clarifies session vs process-wide scope, addresses credential safety, and covers error handling. An agent has everything needed to invoke it correctly and interpret results.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema already fully describes both parameters with enums and descriptions (schema coverage 100%). The description's Args section restates the targets but adds value by coupling each target to its return shape in the Returns section (e.g., 'capabilities' returns {name, description, risk, ...}). This goes beyond the schema's generic phrasing and helps the agent anticipate output, though the schema already handles the basic parameter semantics.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it is a read-only introspection tool for Chaos Core's state, listing specific targets (capabilities, policy, providers, memory, audit, session, last_*). It explicitly says 'Never modifies anything' and differentiates from sibling tools (reason/plan/execute) by focusing on inspection. The verb and resource are precise, and the scope is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides explicit examples of when to use this tool: 'What can this server actually do?' -> capabilities, 'Which model is actually answering...' -> providers, 'Why did that step get blocked?' -> policy/audit. This gives clear usage conditions and implicitly contrasts with the mutating siblings. It also states the tool is read-only, reinforcing appropriate use cases.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

chaoscore_planPlan ObjectiveA
Read-only

Produce an ordered, executable plan for an objective, using ONLY capabilities currently in the capability registry (capability discovery). Uses the active AI provider to select capabilities and construct step inputs. This is the Planner stage of the Cognitive Core loop.

The returned plan.id must be passed to chaoscore_execute to run it, and is scoped to your MCP session. Planning does NOT execute anything and is NOT authorization to act — policy checks happen at execution time, per step.

Args:

  • objective (string): The goal to produce a plan for

  • context (array): Background info as [{source, content}, ...]. Include prior chaoscore_reason output here if you called it first.

  • reasoning_effort (optional): Override the active provider's default reasoning effort

  • response_format ('markdown' | 'json'): Output format (default: 'markdown')

Returns: For JSON format: { "id": string, // pass this to chaoscore_execute "objective": string, "steps": [ { "id": string, "description": string, "capability": string, "input": object, "rationale": string } ], "createdAt": string, "model": string, "providerId": string }

Examples:

  • Use when: "Draft a summary of these release notes" -> plan with a step using capability "cognition.generate_text"

  • Don't use when: You want to actually run the plan -> follow up with chaoscore_execute(plan_id=...)

Error Handling:

  • Returns "Error: OPENAI_API_KEY is not set" (or the active provider's equivalent) if the provider isn't configured

  • If the model references an unregistered capability name, chaoscore_execute reports that step as failed with an "Unknown capability" error — call chaoscore_inspect(target="capabilities") to see what's available

ParametersJSON Schema
NameRequiredDescriptionDefault
contextNoRelevant background information to ground the reasoning/plan. Empty array if none.
objectiveYesThe goal to produce an executable plan for
response_formatNoOutput format: 'markdown' for human-readable or 'json' for machine-readablemarkdown
reasoning_effortNoOverride the active provider's default reasoning effort for this call

TDQS

A4.3/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true and openWorldHint=true, and the description adds valuable context beyond them: planning is explicitly 'NOT authorization to act — policy checks happen at execution time, per step', and it clarifies that no execution occurs. It also discloses provider-configuration error behavior ('OPENAI_API_KEY is not set'). No contradiction with any annotation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is long but every section earns its place: since no output schema exists, the 'Returns' JSON block is essential, and the error-handling section covers realistic failure modes. It is well-structured with clear headers and front-loads the core purpose before details. Slight redundancy between the Returns block and the parameter glossary keeps it from a 5.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a moderately complex tool (4 params, 2 enums, no output schema, with 5 siblings), the description covers purpose, usage boundaries, return shape, and errors comprehensively. It explains the capability-registry constraint and how to discover valid capabilities via chaoscore_inspect. Minor gaps remain (e.g., no mention of plan length limits or cancellation), but nothing an agent needs to call it correctly is missing.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all four parameters, giving a baseline of 3. The description adds marginal value by hinting that context should include prior chaoscore_reason output, but repeats most parameter purpose verbatim rather than deepening it. Adequate given the schema's completeness.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb-resource pair ('Produce an ordered, executable plan for an objective') plus a hard scoping constraint ('using ONLY capabilities currently in the capability registry'). It explicitly positions itself as 'the Planner stage of the Cognitive Core loop' and states what it is not — 'Planning does NOT execute anything' — which cleanly distinguishes it from the sibling chaoscore_execute.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description contains explicit 'Use when' and 'Don't use when' examples, names chaoscore_execute as the follow-up, tells the agent to pass the returned plan.id to it, and instructs that prior chaoscore_reason output should be placed into the context parameter. Guidance on when to use vs. alternatives is fully spelled out with no inference required.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

chaoscore_reasonReason About ObjectiveA
Read-only

Analyze an objective and its context BEFORE committing to a plan (the Intent Analyzer stage of the Cognitive Core loop: objective -> context -> AI planning -> policy -> capability execution -> evaluation -> result). Uses whichever AI provider is currently active (see chaoscore_inspect target="providers") to produce structured analysis: key considerations, risks, and a recommended approach.

Does NOT produce an executable plan or take any action — call chaoscore_plan next for that.

Args:

  • objective (string): The goal or question to reason about

  • context (array): Background info as [{source, content}, ...]. Empty array if none.

  • reasoning_effort (optional): Override the active provider's default reasoning effort ('none'|'low'|'medium'|'high'|'xhigh'|'max')

  • response_format ('markdown' | 'json'): Output format (default: 'markdown')

Returns: For JSON format: { "objective": string, "analysis": string, "keyConsiderations": string[], "risks": string[], "recommendedApproach": string, "model": string, "providerId": string }

Examples:

  • Use when: "Should I migrate memory storage before or after the staging cutover?" -> reason about tradeoffs first

  • Don't use when: You already know the approach and just need an executable plan -> use chaoscore_plan directly

Error Handling:

  • Returns "Error: OPENAI_API_KEY is not set" (or the active provider's equivalent) if the provider isn't configured

ParametersJSON Schema
NameRequiredDescriptionDefault
contextNoRelevant background information to ground the reasoning/plan. Empty array if none.
objectiveYesThe goal or question to reason about
response_formatNoOutput format: 'markdown' for human-readable or 'json' for machine-readablemarkdown
reasoning_effortNoOverride the active provider's default reasoning effort for this call

TDQS

A4.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Beyond the readOnlyHint annotation, the description discloses that the tool does not take action, uses the active AI provider, and includes specific error-handling behavior if the provider is not configured. It also describes the return structure for JSON format. This adds significant richness beyond the annotations and fully explains the tool's non-mutating, provider-dependent nature.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections: purpose, pipeline placement, what it does not do, args, returns, examples, and error handling. It is front-loaded with the primary purpose and every section adds value. The length is justified by the inclusion of a return schema (since no output schema is provided) and error handling, making it efficient rather than verbose.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description is complete for an agent to call this tool correctly. It covers the input parameters, provides a return schema for JSON format, explains the provider dependency and how to inspect it (see chaoscore_inspect), gives usage examples, and documents error cases. With no output schema present, the included return structure is essential and well-provided.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so baseline is 3. The description adds a bit of extra clarity, e.g., for 'context' it specifies the exact structure '[source, content]' and for 'response_format' it notes the default. It also explicitly lists enum values and says 'empty array if none.' While mostly redundant with the schema, it provides a slightly more concise and action-oriented explanation, justifying a 4.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action ('Analyze an objective and its context BEFORE committing to a plan') with a clear resource (the objective and context) and delivers structured analysis. It explicitly distinguishes itself from siblings: 'Does NOT produce an executable plan... call chaoscore_plan next.' The purpose is unambiguous and differentiates well from chaoscore_plan, chaoscore_execute, etc.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Provides concrete when-to-use and when-not-to-use guidance with an example ('Should I migrate memory storage...?') and explicitly references the alternative ('use chaoscore_plan directly'). It also frames this as the first stage in the Cognitive Core loop, giving clear context for when this tool should be invoked.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

chaoscore_recallRecallA
Read-onlyIdempotent

Search Semantic Memory records previously stored with chaoscore_remember. Supports exact key lookup, substring search over keys/values, and tag filtering. Expired records (past their ttl_seconds) are never returned. Reads the same durable store regardless of which transport you connected through.

Args:

  • key (string, optional): Exact key to fetch one record directly

  • query (string, optional): Substring to match against keys/values

  • tags (array of strings): Only return records with ALL of these tags (default: [])

  • limit (number, 1-100): Max results (default: 20)

  • offset (number): Pagination offset (default: 0)

  • response_format ('markdown' | 'json'): Output format (default: 'markdown')

Returns: For JSON format (key lookup): { "key": string, "value": string, "tags": string[], ... } or null if not found For JSON format (search): { "total": number, "count": number, "offset": number, "records": [...], "has_more": boolean, "next_offset"?: number }

Examples:

  • Use when: "What do we know about staging?" -> query="staging"

  • Use when: "Get the exact record for key X" -> key="staging.region"

  • Don't use when: You want to write/update a memory -> use chaoscore_remember instead

Error Handling:

  • Returns "No memory found for key ''" (not an error) if an exact key lookup misses

  • Returns empty records array (not an error) if a search finds nothing

ParametersJSON Schema
NameRequiredDescriptionDefault
keyNoExact key to fetch a single record. If set, other filters are ignored.
tagsNoOnly return records that have ALL of these tags
limitNoMax results to return
queryNoSubstring to match against memory keys and values
offsetNoNumber of results to skip for pagination
response_formatNoOutput format: 'markdown' for human-readable or 'json' for machine-readablemarkdown

TDQS

A5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds valuable behavioral context beyond these: expired records are never returned, the store is durable across transports, and miss returns are non-error strings/empty arrays. No contradictions with annotations are present.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-organized into sections (Args, Returns, Examples, Error Handling) with the core purpose front-loaded. Every sentence serves a purpose; there is no fluff or repetition. Despite its length, it remains efficient and scannable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with six parameters and no output schema, the description fully covers behavior: it documents both markdown and JSON return structures, error handling for misses, pagination fields, and example use cases. An agent has all necessary information to call it correctly without external documentation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters5/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, but the description enriches parameter understanding by explaining interaction effects (e.g., 'key' ignores other filters), pagination semantics (offset, has_more, next_offset), and response format differences. It also provides concrete examples that map parameters to real queries, going well beyond bare schema types.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb ('Search') and resource ('Semantic Memory records'), and explicitly distinguishes itself from chaoscore_remember ('previously stored with chaoscore_remember'). It lists the three supported search modes (exact key, substring, tag filtering), leaving no ambiguity about what the tool does.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It provides explicit use cases with examples ('What do we know about staging?' -> query='staging') and a clear exclusion ('Don't use when: You want to write/update a memory -> use chaoscore_remember instead'). This gives an agent precise decision criteria for choosing this tool over its sibling.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

chaoscore_rememberRememberA
Idempotent

Persist a key/value record to Semantic Memory (durable, SQLite-backed), so it can be retrieved later with chaoscore_recall — in this session, in a future session, after a server restart, and from either transport. Writing to an existing key overwrites its value and updates its timestamp, making chaoscore_remember idempotent for a given key/value pair.

Memory is a property of the deployment, not of the connection: a record written over stdio is readable over HTTP and vice versa, provided both point at the same database file.

Args:

  • key (string, 1-200 chars): Unique identifier for this memory

  • value (string): The content to remember

  • tags (array of strings): Optional tags for filtering later (default: [])

  • ttl_seconds (number, optional): If set, the record is treated as expired (and excluded from chaoscore_recall) after this many seconds

  • response_format ('markdown' | 'json'): Output format (default: 'markdown')

Returns: For JSON format: { "key": string, "value": string, "tags": string[], "createdAt": string, "updatedAt": string, "expiresAt": string | null }

Examples:

  • Use when: "Remember that the staging DB uses the Melbourne region" -> key="staging.region", value="Melbourne (australiaeast)"

  • Don't use when: You need to search existing memories -> use chaoscore_recall instead

Error Handling:

  • Returns "Error: ..." with the underlying SQLite error message if the write fails (e.g. disk full, path unwritable)

ParametersJSON Schema
NameRequiredDescriptionDefault
keyYesUnique key for this memory. Writing an existing key overwrites its value.
tagsNoOptional tags for later filtering with chaoscore_recall
valueYesThe content to remember
ttl_secondsNoOptional time-to-live in seconds. Omit for a record that never expires.
response_formatNoOutput format: 'markdown' for human-readable or 'json' for machine-readablemarkdown

TDQS

A4.7/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate idempotent, non-read-only, and non-destructive. The description goes further: it explains durable SQLite-backed storage, persistence across sessions/restarts/transports, overwrite semantics with timestamp updates, TTL behavior (exclusion from recall), and error handling. This exceeds annotation coverage without contradiction.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is well-structured with clear sections (Args, Returns, Examples, Error Handling) and front-loads the core purpose. Every sentence conveys necessary information without redundancy, making it appropriately concise for a tool with this complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool's complexity (5 params, TTL, transport independence, output formats) and lack of an output schema, the description covers all needed aspects: purpose, usage, params, return format, error handling, and examples. An agent can confidently invoke this tool correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the schema already documents all parameters. The description repeats most parameter details and adds minor clarifications (e.g., TTL expiration behavior, key uniqueness), but does not significantly augment the schema. Baseline 3 is appropriate when schema handles the heavy lifting.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states it persists key/value records to Semantic Memory for later retrieval via chaoscore_recall. It specifies the resource (Semantic Memory), the verb (persist), and distinguishes itself from the recall sibling by explicitly naming it as the retrieval counterpart.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

An explicit 'Examples' section provides a concrete use case ('Remember that the staging DB uses the Melbourne region') and a don't-use case ('You need to search existing memories -> use chaoscore_recall instead'). This directly instructs when to use versus when to use the sibling, leaving no ambiguity.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 6 tool updatesv0.2.0
    • First observedchaoscore_execute
    • First observedchaoscore_inspect
    • First observedchaoscore_plan
    • First observedchaoscore_reason
    • First observedchaoscore_recall
    • First observedchaoscore_remember

TDQS

A4.7/5.0

Scored across 6 tools

Disambiguation5/5

Each tool has a clearly distinct role in the cognitive core loop: reason analyzes before planning, plan produces an executable plan, execute runs it, inspect provides read-only introspection, and remember/recall handle persistent memory. There is no overlap in purpose; even reason and plan, which share similar arguments, are explicitly differentiated by what they produce.

Naming Consistency5/5

All tools follow a consistent naming pattern: the 'chaoscore_' prefix followed by a lowercase verb (reason, plan, execute, inspect, remember, recall). No mixing of camelCase or inconsistent verb styles; the pattern is uniform and predictable.

Tool Count5/5

With 6 tools, the server is well-scoped. Each tool corresponds to a necessary stage of the cognitive core workflow (reason, plan, execute, inspect) plus persistent memory operations (remember/recall). There are no redundant or extraneous tools, and the count is well within the ideal 3-15 range.

Completeness4/5

The tool surface covers the full lifecycle: analyze (reason), plan (plan), execute (execute), observe (inspect), and persist/retrieve knowledge (remember/recall). Minor gaps exist, such as no explicit delete tool for memory (though overwrite covers updates) and no dedicated cancel/abort for plans, but these are not critical to the core loop. Overall, the domain is well-covered.

Maintenance

ActivitySlowing
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    Not graded
    quality
    A
    maintenance
    Deterministic execution engine for AI agents. 412 modules across 78 categories including browser automation, file I/O, Docker, data parsing, crypto, and scheduling. Supports STDIO and Streamable HTTP transport with execution trace, evidence snapshots, and replay from any step.
    760 PyPI
    484
    Apache 2.0
  • A
    license
    C
    quality
    B
    maintenance
    Enables local-first LLM orchestration with persistent memory, knowledge management, routing, swarm patterns, API probing, tests, automation planning, and plugin discovery via a stdio MCP server, using SQLite for offline storage.
    51
    62 npm
    1
    MIT
  • A
    license
    B
    quality
    A
    maintenance
    Enables AI agents to maintain a local, event-sourced long-term memory with semantic retrieval, decision confidence checks, and proactive recalls, ensuring data never leaves the machine.
    23
    3
    MIT
  • A
    license
    Not graded
    quality
    B
    maintenance
    Enables personal AI agents to perceive ambient context, retain episodic memory with decay, act proactively, and route routine decisions through fast System-1 reflexes while escalating ambiguous multi-hop plans to frontier LLMs. Includes reversible execution checkpoints, token budgets, and local-first memory retention, and plugs into MCP clients like Claude Desktop, Cursor, and Windsurf.
    7
    MIT