chaos-core-mcp
chaos-core-mcp
一个 MCP 服务器,AI 是决策内核,而不是它暴露的工具。调用方(Claude、ChatGPT、Codex 等)不需要枚举底层接口——它把一个目标交给 Chaos Core,让 Cognitive Core 对其推理、发现能力、制定计划、检查确定性策略、执行、评估,然后记忆。
自 v0.2 起,认知核心是与传输无关的(transport-agnostic)。同一套核心、工具、策略、记忆和能力注册表可以通过两种方式访问:本地 MCP 客户端走 stdio,远程 MCP 客户端(例如 Claude 自定义连接器)走位于 /mcp 的 Streamable HTTP。
CHAOS CORE
│
Cognitive Core
│
┌────────────────┴────────────────┐
│ │
stdio Streamable HTTP
│ │
▼ ▼
Local MCP clients Remote MCP clients
/mcp认知过程没有 HTTP 变体。src/transport/stdio.ts 和 src/transport/http.ts 都调用同一个服务器工厂 createChaosCoreServer()——传输层对认知层是不可见的,而且没有 http_reason / remote_plan 之类的重复实现。
认知核心循环
objective
↓
context
↓
AI planning
↓
policy
↓
capability execution
↓
evaluation
↓
resultV1 把每个阶段作为独立的 MCP 工具暴露出来,因此每一步都可被检查,且调用方 AI 在阶段之间保持控制权:
工具 | 用途 |
| 在任何计划产生之前,分析目标 + 上下文(Intent Analyzer) |
| 把目标转换为一个有序的、有实际能力支撑的计划 |
| 执行计划:策略检查 → 能力选择 → 执行 → 评估 |
| 只读自省:能力、策略、提供者、记忆、审计轨迹、会话 |
| 将一条事实持久化到语义记忆中 |
| 从语义记忆中检索 |
两种传输方式都提供完全相同的工具列表——这是由它支持的:每种传输都通过真实的 MCP 客户端列出工具并比较定义。
core/brain.ts 还实现了完整循环,且作为一个可组合函数(runCognitiveCore)——从目标直接到结果,在步骤失败时自动重规划,并在遇到 REQUIRE_APPROVAL 时立即停止。它没有在 V1 中注册为 MCP 工具(见 V1 边界),但它已经完全接好,随时可以支持未来 chaoscore_achieve 工具,而无需重写。
Related MCP server: ellmos-homebase-mcp
架构
src/
index.ts transport dispatcher (stdio by default)
config.ts the only file that reads process.env
server/ ← composition root; transport-independent
create-server.ts createRuntime() + createChaosCoreServer()
register-tools.ts the single definition of the V1 tool surface
types.ts RuntimeServices / ChaosCoreDependencies
schemas.ts shared Zod schemas
tools/ reason plan execute inspect remember recall
transport/ ← the ONLY transport-aware code
stdio.ts local subprocess transport (stdout reserved for JSON-RPC)
http.ts Streamable HTTP at /mcp (stateful sessions)
core/ brain intent planner evaluator context types
capabilities/ registry executor types + built-in/
memory/ store (factory) sqlite (impl) types (MemoryStore interface)
policy/ engine permissions approvals types
providers/ ai-provider (AIProvider interface) openai index
state/ session (Working Memory) execution (trace assembly)
observability/ logger events audit
util/ to-structured依赖注入,以及其生命周期
createRuntime() 构建进程级服务一次:配置、能力注册表、策略引擎、内存存储、提供者注册表、审计日志、日志记录器。运行时之上,createChaosCoreServer() 为每个 MCP 会话构建一个 McpServer,增加一个 per-session 的 SessionState,并注册这些工具(注入的是组合后的依赖容器)。
组件 | 生命周期 | 后果 |
记忆、策略、能力、提供者、审计 | 每个进程 | 一个远程 HTTP 客户端和一个本地 stdio 客户端,访问同一个进程时看到相同状态 |
| 每个 MCP 会话 | 一个 |
没有任何核心 module 导入依赖容器。core/intent.ts、core/planner.ts 和 capabilities/executor.ts 每个都声明一个窄的结构化接口(IntentDeps、PlannerDeps、ExecutorDeps),而容器恰好满足这些接口——因此核心可以独立测试,并且真正地不感知服务器和传输层。
策略独立于 AI 之外
AI proposes action
↓
deterministic policy engine
↓
ALLOW / DENY / REQUIRE_APPROVAL模型可以提出任何能力;policy/engine.ts 以纯函数的方式,以能力名称和 operator 控制的策略文件为输入来决定是否允许。整个过程对模型是不可咨询的。拆分为:
policy/permissions.ts— allow/deny 列表(allowedCapabilities、deniedCapabilities)policy/approvals.ts— 哪些被允许的能力仍需要人工确认(requireConfirmationFor)policy/engine.ts— 组合上述两者,再加上有界资源(httpAllowedDomains)
data/policy.json 会在首次运行时自动用安全默认值创建。
{
"allowedCapabilities": [],
"deniedCapabilities": [],
"requireConfirmationFor": ["http.request"],
"httpAllowedDomains": []
}传输无法绕过策略。 capabilities/executor.ts 是从计划步骤到能力处理器的唯一路径,它会先调用 policy.check(),并且没有针对传输类型的条件分支。解析为 REQUIRE_APPROVAL 的步骤会被跳过,除非调用方传了 confirmed: true;解析为 DENY 的步骤根本不会执行。每一步决策都会连同其 session id 记录到一个审计式的事件流中。
AI 模型可以被替换,这是刻意设计
在 src/providers/openai.ts 之外,没有任何地方导入 AI 提供商的 SDK。一切都要通过一个接口:
// src/providers/ai-provider.ts
interface AIProvider {
id: string;
displayName: string;
generateText(instructions, input, options?): Promise<{ text, model, providerId }>;
generateJson(instructions, input, jsonShapeDescription, options?): Promise<{ raw, model, providerId }>;
isConfigured(): boolean;
}认知阶段到它的映射是 reason → generateJson、plan → generateJson,以及 evaluate → core/evaluator.ts 中的确定性代码。eval` 特意不是提供商调用,因此模型永远无法将自己一次失败的执行“判为”成功。
要添加一个模型/提供商: 编写实现 AIProvider 的 src/providers/<name>.ts,在 providers/index.ts 注册它,设置 CHAOS_CORE_PROVIDER=<name>。模型名本身只通过 OPENAI_MODEL 配置一次——它在其他文件中都不出现。
能力注册表——扩展缝
Capability 对象是 { name, description, risk, inputSchema, annotations, handler }。V1 包含:
cognition.generate_text— 通过默认 provider 进行通用文本生成http.request— 只支持 GET,受策略policy.httpAllowedDomains限制
要再加一个——外部 API、数据库、另一个 MCP 服务器,或你自己的应用:在 src/capabilities/built-in/ 中创建一个文件,导出 Capability,然后在 src/capabilities/index.ts 注册它即可。core/、policy/、server/ 或 transport/ 都不用改,而且本地和远程客户端会同时对它可见。AI 根据注册表中的 item 描述推理出哪个能力能完成计划步骤——你永远不会在代码里写死 if (task === "email") ... 这样的逻辑。
未来方向: 注册表就是扩展的路径——能力 包(一组注册的能力)、基于 risk 而不是逐个名称的按能力策略、一个包装远端 MCP 客户端使 Chaos Core 能 federation 其他 MCP 服务器的 adapter 能力,以及持久化的过程性记忆,用于学习哪些能力序列能成功完成重复出现的目标。
记忆
V1 实现了可持久化的语义记忆层,通过 MemoryStore 接口(src/memory/types.ts)和由工厂(src/memory/store.ts)选择的 SQLite 实现(src/memory/sqlite.ts)来支持。底层是 node:sqlite —— 内置在 Node 22.5+ 中,零额外的原生依赖:键值存储,带标签、TTL、子串搜索和分页。
把 SQLite 换成 Postgres 或矢量存储,只需要在 sqlite.ts 旁边增加一个文件并修改工厂调用。MCP 工具、planner、认知核心和策略引擎都不需要动,因为它们都不引用 SQLite。
无论请求通过何种方式到达,使用的数据库都是同一个——stdio 里写入的一条事实,经过 HTTP 也能查到,而且重启之后仍在。
工作记忆(当前会话上下文)位于 src/state/session.ts。情景记忆(过去任务中发生过什么)和程序性记忆(学到的成功步骤序列)在架构中是命名了的,但 V1 没有实现。
环境准备
npm install
cp .env.example .env # then fill in OPENAI_API_KEY
npm run build通过 stdio 运行(本地客户端、开发)
npm startnpm run start:stdio 就是等效的显式命令;npm start 仍走 stdio,所以已有的本地设置不受影响。
在 stdio 下,stdout 专属于 MCP 协议。代码库中的每条诊断信息都通过 observability/logger.ts,并且 stdio 传输会强制日志器写到 stderr,即使设置了 CHAOS_CORE_LOG_STREAM=stdout 也会强制。
通过 Streamable HTTP 运行(远程客户端)
npm run start:http监听在 HOST:PORT(默认 127.0.0.1:3000)并露出:
方法 | 路径 | 用途 |
|
| 客户端 → 服务器 JSON-RPC(initialize、tools/list、tools/call、……) |
|
| 服务器 → 客户端的 SSE 通知流,用一个已有 session |
|
| 显式终止会话 |
|
| liveness + 活跃会话数(不属于 MCP) |
本地端点:http://localhost:3000/mcp
HTTP 传输是带上会话状态的:每一个 initialize 都会签发一个 Mcp-Session-Id,后续请求必须携带它。正是因为这样,chaoscore_plan 才能把 plan_id 交给 chaoscore_execute,而不会计划泄漏给另一个远程会话。带 unknown session id 的请求会得到 404;不带 session id 的非 initialize 请求会得到 400。
环境变量
变量 | 默认值 | 用途 |
| — | OpenAI provider 需要这个 key。只能由服务器读取,绝不暴露给 MCP 客户端 |
|
| 默认模型。模型名唯一配置的地方 |
|
|
|
|
| 提供 reason/plan 调用答案、已注册的 |
|
| HTTP 传输端口 |
|
| HTTP 传输绑定地址 |
|
| 装配了 MCP endpoint 的路径 |
| — | 逗号分隔;设置它以启用 DNS-rebinding 保护 |
| — | 逗号分隔;同上 |
|
|
|
|
| 存储 remember/recall 的 SQLite 文件 |
|
| 策略配置文件 |
|
|
|
|
| 每个工具响应的最大字符数 |
|
|
|
会从工作目录自动加载 .env 文件(Node 内置 loader,无额外依赖)。.env.example 只包含占位符;绝不要把真实凭据提交进去。
0.2 之前的 COGNITION_* 变量名仍可作为回退。
连接本地 MCP 客户端
Claude Desktop / Claude Code / 任意 stdio 客户端:
{
"mcpServers": {
"chaos-core": {
"command": "node",
"args": ["F:/Chaos-Origins/chaos-core-mcp/dist/index.js", "--stdio"],
"env": { "OPENAI_API_KEY": "sk-..." }
}
}
}或者使用 MCP Inspector:
npm run inspector:stdio连接远程 MCP 客户端
启动 HTTP 传输,然后将客户端指向端点 URL:
http://localhost:3000/mcp对于 Claude 自定义连接器,将其作为远程 MCP 服务器添加,使用该 URL(公开部署需要公开的 HTTPS URL —— 请参阅下方的安全警告)。若要手动测试:
npm run inspector:http然后选择“Streamable HTTP”并输入 URL。
⚠️ 远程部署的安全警告
V1 不附带任何认证。 这是有意为之,只因为 HTTP 传输默认绑定到 127.0.0.1 才是安全的。该层的结构设计让认证中间件能够干净地接入(AuthMiddleware 在 src/transport/http.ts 中,在任何 MCP 处理之前应用到 MCP 路由)——但没有提供任何虚假的东西:没有 OAuth 存根,没有硬编码的秘密,没有只是看起来像安全的 bearer token。
在将服务暴露到 localhost 之外之前,你必须添加:
认证,应用于
/mcp路由(根据 MCP 认证规范提供 OAuth 2.1 资源服务器,或者使用终止身份的网关)TLS —— 服务器通信使用纯 HTTP;请在反向代理处终止 TLS
速率限制和请求大小限制 —— 每次
reason/plan调用都会花费你的 OpenAI 配额DNS 重新绑定保护 —— 设置
MCP_ALLOWED_HOSTS/MCP_ALLOWED_ORIGINS经过审查的
policy.json—— 默认配置允许所有已注册的能力,除需要确认的能力之外持久化审计存储 —— V1 的审计轨迹是内存中的环形缓冲区
如果你在没有中间件的情况下绑定到非回环地址,服务器会在启动时记录一条警告,准确说明这一点。请参阅 docs/remote-deployment.md 获取完整检查清单。
OpenAI API 密钥是在 providers/openai.ts 内部从服务器环境中读取的,永远不会出现在工具输出、检查负载、审计条目或 HTTP 响应中。
V1 能力与边界
包含的内容:
TypeScript/Node、MCP SDK,默认(可替换的)提供方为 OpenAI Responses API
纯化和 HTTP 双传输:stdio +
/mcp上的 Streamable HTTP,共享同一认知核心由六个工具组成的认知界面,两种传输上完全一致
能力注册表 + authorize cells + metadata policy engine + structured audit events : 能力注册表 + 确定的策略引擎 + 结构化审计事件
SQLite Semantic Memory,后端是可替换的
MemoryStore接口对每个工具输入和每个能力输入进行 Zod 验证
刻意排除的内容:
无 UI
无 agent 集群 / 多 agent 架构
无序自动后台执行 ——
chaoscore_execute只运行给定的步骤;core/brain.ts中完整循环的重新规划存在,但没有暴露为工具无 OAuth 实现,无 multi-tenancy,无 marketplace
无 MCP 服务器联邦(注册表可以托管一个适配器能力,但没有附带的适配器)
构建与测试
npm run buildnpm test该测试套件针对构建产物运行,并涵盖:策略的确定性与不可绕过性、模拟重启后的记忆持久性,以及一个通过两种传输连接的实时 MCP 客户端,以验证工具界面一致、共享记忆有效,并且被拒绝的能力在每种传输上都被阻止。
Available Tools
6 toolschaoscore_executeExecute PlanADestructive
Run a plan (or inline steps) through the remaining stages of the Cognitive Core loop: policy check -> capability selection -> execution -> evaluation. This is the only tool in this server that can have side effects, and only insofar as the capabilities it invokes do.
Each step is policy-checked individually before it runs (ALLOW / DENY / REQUIRE_APPROVAL — see chaoscore_inspect target="policy"). Steps that are DENY, or REQUIRE_APPROVAL and not yet confirmed, are reported as failed/skipped rather than silently dropped — read each step's error field. Every policy decision and capability call is recorded to the audit trail (chaoscore_inspect target="audit"). This is identical over stdio and over remote HTTP: there is no transport that can reach a capability without passing the policy engine.
Args:
plan_id (string, optional): id from a prior chaoscore_plan call in this session
steps (array, optional): inline steps [{description, capability, input, rationale}], alternative to plan_id
confirmed (boolean): set true to also run steps that resolve to REQUIRE_APPROVAL (default: false)
dry_run (boolean): if true, validates policy + input schema per step without calling any handler (default: false)
response_format ('markdown' | 'json'): Output format (default: 'markdown')
Returns: For JSON format: { "planId": string, "objective": string, "steps": [ { "stepId": string, "capability": string, "success": boolean, "output"?: any, "error"?: string, "policyDecision": { "decision": "allow"|"deny"|"require_approval", "allowed": boolean, "requiresConfirmation": boolean, "reason": string }, "durationMs": number } ], "evaluation": { "success": boolean, "summary": string, "notes": string[] }, "completedAt": string }
Examples:
Use when: You have a plan_id from chaoscore_plan and are ready to run it -> chaoscore_execute(plan_id="...")
Use when: A step came back REQUIRE_APPROVAL and you've now confirmed with the user -> re-run with confirmed=true
Don't use when: You just want to see what a plan would do without side effects -> use dry_run=true
Error Handling:
Returns "Error: plan_id not found in this session" if the plan wasn't created in the current MCP session
Individual step failures do NOT throw — they appear in the steps array with success=false
| Name | Required | Description | Default |
|---|---|---|---|
| steps | No | Inline steps to execute directly, as an alternative to plan_id | |
| dry_run | No | If true, validate policy + input schema for every step but never call any capability handler | |
| plan_id | No | id of a plan previously returned by chaoscore_plan in this MCP session | |
| confirmed | No | Set true to also run steps whose capability policy resolves to REQUIRE_APPROVAL | |
| response_format | No | Output format: 'markdown' for human-readable or 'json' for machine-readable | markdown |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description discloses that the tool can have side effects, aligns with destructiveHint=true, and adds depth: each step is policy-checked individually, DENY/REQUIRE_APPROVAL steps are reported as failed/skipped, and all decisions are recorded to an audit trail. It even states transport invariance (stdio/HTTP) regarding policy enforcement, which is valuable context beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is long but every part serves a purpose: core functionality, policy details, parameter explanations, return structure, usage examples, and error handling. It is front-loaded with the primary purpose and logically organized. No wasted sentences.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is exhaustive for a complex tool: it covers side effects, policy behavior, both invocation modes, output format details, error handling (plan_id not found), and the fact that step failures don't throw. It even provides a full JSON response structure. Nothing an agent needs to call it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
While the schema already describes all parameters (100% coverage), the description adds meaningful nuance: the relationship between plan_id and steps (alternatives), the confirmed flag's role in running REQUIRE_APPROVAL steps, and the dry_run option to avoid side effects. It also clarifies the response_format's human vs. machine readability. This enriches the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: executing a plan or inline steps through the Cognitive Core loop. It distinguishes from siblings by noting it's the only tool that can have side effects, and it specifies the pipeline (policy check, capability selection, execution, evaluation). This is a specific verb+resource with clear differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit usage scenarios: 'Use when: You have a plan_id from chaoscore_plan and are ready to run it', and 'Use when: A step came back REQUIRE_APPROVAL and you've now confirmed with the user'. It also gives a clear exclusion: 'Don't use when: You just want to see what a plan would do without side effects -> use dry_run=true'. This is excellent guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
chaoscore_inspectInspect Chaos Core StateARead-onlyIdempotent
Read-only introspection into Chaos Core's current state: registered capabilities, active policy, registered AI providers (and which one is answering reason/plan calls), the audit trail, memory store stats, and this session's most recent reasoning/plan/execution results. Never modifies anything, and never reveals credentials.
Capabilities, policy, memory, and audit are process-wide — a remote HTTP client and a local stdio client inspecting the same running server see the same values. The last_* targets and 'session' are scoped to your own MCP session.
Args:
target ('capabilities'|'policy'|'providers'|'memory'|'audit'|'session'|'last_reasoning'|'last_plan'|'last_execution'): what to inspect
response_format ('markdown' | 'json'): Output format (default: 'markdown')
Returns: Varies by target. 'capabilities': list of {name, description, risk, inputSummary, readOnly, destructive}. 'policy': the active PolicyConfig. 'providers': list of {id, displayName, configured, active}. 'memory': {recordCount, backend}. 'audit': recent {type, ts, sessionId, planId, stepId, capability, ...}[] entries. 'session': {sessionId, startedAt}. For the last_* targets: the most recent ReasoningResult / Plan / ExecutionTrace produced in this session, or null if none yet.
Examples:
Use when: "What can this server actually do?" -> target="capabilities"
Use when: "Which model is actually answering my reason/plan calls right now?" -> target="providers"
Use when: "Why did that step get blocked?" -> target="policy" or target="audit"
Error Handling:
Never errors under normal use; unknown target values are rejected by schema validation before this tool runs
| Name | Required | Description | Default |
|---|---|---|---|
| target | Yes | Which part of Chaos Core state to inspect: 'capabilities' (registry), 'policy' (active policy config), 'providers' (registered AI providers and which is active), 'memory' (record count), 'audit' (recent policy decisions + capability executions), 'session' (this MCP session's id and transport), 'last_reasoning', 'last_plan', or 'last_execution' (this session's most recent result of each stage) | |
| response_format | No | Output format: 'markdown' for human-readable or 'json' for machine-readable | markdown |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
While annotations already declare readOnlyHint=true and destructiveHint=false, the description adds critical context beyond those: it never reveals credentials, and clarifies process-wide vs session-scoped state (e.g., capabilities are global, last_* are per-session). It also discloses error behavior ('never errors under normal use'). This enriches the agent's understanding of side effects and safety without contradicting annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with clear sections (main purpose, Args, Returns, Examples, Error Handling). It front-loads the core purpose and scope, then provides just enough detail per target. Every sentence earns its place—examples are actionable and error handling is concise. It is comprehensive without being redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's 2 parameters with full enum coverage, no output schema, and read-only annotations, the description is remarkably complete. It explains return values for every target, clarifies session vs process-wide scope, addresses credential safety, and covers error handling. An agent has everything needed to invoke it correctly and interpret results.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema already fully describes both parameters with enums and descriptions (schema coverage 100%). The description's Args section restates the targets but adds value by coupling each target to its return shape in the Returns section (e.g., 'capabilities' returns {name, description, risk, ...}). This goes beyond the schema's generic phrasing and helps the agent anticipate output, though the schema already handles the basic parameter semantics.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it is a read-only introspection tool for Chaos Core's state, listing specific targets (capabilities, policy, providers, memory, audit, session, last_*). It explicitly says 'Never modifies anything' and differentiates from sibling tools (reason/plan/execute) by focusing on inspection. The verb and resource are precise, and the scope is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides explicit examples of when to use this tool: 'What can this server actually do?' -> capabilities, 'Which model is actually answering...' -> providers, 'Why did that step get blocked?' -> policy/audit. This gives clear usage conditions and implicitly contrasts with the mutating siblings. It also states the tool is read-only, reinforcing appropriate use cases.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
chaoscore_planPlan ObjectiveARead-only
Produce an ordered, executable plan for an objective, using ONLY capabilities currently in the capability registry (capability discovery). Uses the active AI provider to select capabilities and construct step inputs. This is the Planner stage of the Cognitive Core loop.
The returned plan.id must be passed to chaoscore_execute to run it, and is scoped to your MCP session. Planning does NOT execute anything and is NOT authorization to act — policy checks happen at execution time, per step.
Args:
objective (string): The goal to produce a plan for
context (array): Background info as [{source, content}, ...]. Include prior chaoscore_reason output here if you called it first.
reasoning_effort (optional): Override the active provider's default reasoning effort
response_format ('markdown' | 'json'): Output format (default: 'markdown')
Returns: For JSON format: { "id": string, // pass this to chaoscore_execute "objective": string, "steps": [ { "id": string, "description": string, "capability": string, "input": object, "rationale": string } ], "createdAt": string, "model": string, "providerId": string }
Examples:
Use when: "Draft a summary of these release notes" -> plan with a step using capability "cognition.generate_text"
Don't use when: You want to actually run the plan -> follow up with chaoscore_execute(plan_id=...)
Error Handling:
Returns "Error: OPENAI_API_KEY is not set" (or the active provider's equivalent) if the provider isn't configured
If the model references an unregistered capability name, chaoscore_execute reports that step as failed with an "Unknown capability" error — call chaoscore_inspect(target="capabilities") to see what's available
| Name | Required | Description | Default |
|---|---|---|---|
| context | No | Relevant background information to ground the reasoning/plan. Empty array if none. | |
| objective | Yes | The goal to produce an executable plan for | |
| response_format | No | Output format: 'markdown' for human-readable or 'json' for machine-readable | markdown |
| reasoning_effort | No | Override the active provider's default reasoning effort for this call |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and openWorldHint=true, and the description adds valuable context beyond them: planning is explicitly 'NOT authorization to act — policy checks happen at execution time, per step', and it clarifies that no execution occurs. It also discloses provider-configuration error behavior ('OPENAI_API_KEY is not set'). No contradiction with any annotation.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is long but every section earns its place: since no output schema exists, the 'Returns' JSON block is essential, and the error-handling section covers realistic failure modes. It is well-structured with clear headers and front-loads the core purpose before details. Slight redundancy between the Returns block and the parameter glossary keeps it from a 5.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a moderately complex tool (4 params, 2 enums, no output schema, with 5 siblings), the description covers purpose, usage boundaries, return shape, and errors comprehensively. It explains the capability-registry constraint and how to discover valid capabilities via chaoscore_inspect. Minor gaps remain (e.g., no mention of plan length limits or cancellation), but nothing an agent needs to call it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all four parameters, giving a baseline of 3. The description adds marginal value by hinting that context should include prior chaoscore_reason output, but repeats most parameter purpose verbatim rather than deepening it. Adequate given the schema's completeness.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb-resource pair ('Produce an ordered, executable plan for an objective') plus a hard scoping constraint ('using ONLY capabilities currently in the capability registry'). It explicitly positions itself as 'the Planner stage of the Cognitive Core loop' and states what it is not — 'Planning does NOT execute anything' — which cleanly distinguishes it from the sibling chaoscore_execute.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description contains explicit 'Use when' and 'Don't use when' examples, names chaoscore_execute as the follow-up, tells the agent to pass the returned plan.id to it, and instructs that prior chaoscore_reason output should be placed into the context parameter. Guidance on when to use vs. alternatives is fully spelled out with no inference required.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
chaoscore_reasonReason About ObjectiveARead-only
Analyze an objective and its context BEFORE committing to a plan (the Intent Analyzer stage of the Cognitive Core loop: objective -> context -> AI planning -> policy -> capability execution -> evaluation -> result). Uses whichever AI provider is currently active (see chaoscore_inspect target="providers") to produce structured analysis: key considerations, risks, and a recommended approach.
Does NOT produce an executable plan or take any action — call chaoscore_plan next for that.
Args:
objective (string): The goal or question to reason about
context (array): Background info as [{source, content}, ...]. Empty array if none.
reasoning_effort (optional): Override the active provider's default reasoning effort ('none'|'low'|'medium'|'high'|'xhigh'|'max')
response_format ('markdown' | 'json'): Output format (default: 'markdown')
Returns: For JSON format: { "objective": string, "analysis": string, "keyConsiderations": string[], "risks": string[], "recommendedApproach": string, "model": string, "providerId": string }
Examples:
Use when: "Should I migrate memory storage before or after the staging cutover?" -> reason about tradeoffs first
Don't use when: You already know the approach and just need an executable plan -> use chaoscore_plan directly
Error Handling:
Returns "Error: OPENAI_API_KEY is not set" (or the active provider's equivalent) if the provider isn't configured
| Name | Required | Description | Default |
|---|---|---|---|
| context | No | Relevant background information to ground the reasoning/plan. Empty array if none. | |
| objective | Yes | The goal or question to reason about | |
| response_format | No | Output format: 'markdown' for human-readable or 'json' for machine-readable | markdown |
| reasoning_effort | No | Override the active provider's default reasoning effort for this call |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Beyond the readOnlyHint annotation, the description discloses that the tool does not take action, uses the active AI provider, and includes specific error-handling behavior if the provider is not configured. It also describes the return structure for JSON format. This adds significant richness beyond the annotations and fully explains the tool's non-mutating, provider-dependent nature.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with clear sections: purpose, pipeline placement, what it does not do, args, returns, examples, and error handling. It is front-loaded with the primary purpose and every section adds value. The length is justified by the inclusion of a return schema (since no output schema is provided) and error handling, making it efficient rather than verbose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description is complete for an agent to call this tool correctly. It covers the input parameters, provides a return schema for JSON format, explains the provider dependency and how to inspect it (see chaoscore_inspect), gives usage examples, and documents error cases. With no output schema present, the included return structure is essential and well-provided.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so baseline is 3. The description adds a bit of extra clarity, e.g., for 'context' it specifies the exact structure '[source, content]' and for 'response_format' it notes the default. It also explicitly lists enum values and says 'empty array if none.' While mostly redundant with the schema, it provides a slightly more concise and action-oriented explanation, justifying a 4.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action ('Analyze an objective and its context BEFORE committing to a plan') with a clear resource (the objective and context) and delivers structured analysis. It explicitly distinguishes itself from siblings: 'Does NOT produce an executable plan... call chaoscore_plan next.' The purpose is unambiguous and differentiates well from chaoscore_plan, chaoscore_execute, etc.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides concrete when-to-use and when-not-to-use guidance with an example ('Should I migrate memory storage...?') and explicitly references the alternative ('use chaoscore_plan directly'). It also frames this as the first stage in the Cognitive Core loop, giving clear context for when this tool should be invoked.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
chaoscore_recallRecallARead-onlyIdempotent
Search Semantic Memory records previously stored with chaoscore_remember. Supports exact key lookup, substring search over keys/values, and tag filtering. Expired records (past their ttl_seconds) are never returned. Reads the same durable store regardless of which transport you connected through.
Args:
key (string, optional): Exact key to fetch one record directly
query (string, optional): Substring to match against keys/values
tags (array of strings): Only return records with ALL of these tags (default: [])
limit (number, 1-100): Max results (default: 20)
offset (number): Pagination offset (default: 0)
response_format ('markdown' | 'json'): Output format (default: 'markdown')
Returns: For JSON format (key lookup): { "key": string, "value": string, "tags": string[], ... } or null if not found For JSON format (search): { "total": number, "count": number, "offset": number, "records": [...], "has_more": boolean, "next_offset"?: number }
Examples:
Use when: "What do we know about staging?" -> query="staging"
Use when: "Get the exact record for key X" -> key="staging.region"
Don't use when: You want to write/update a memory -> use chaoscore_remember instead
Error Handling:
Returns "No memory found for key ''" (not an error) if an exact key lookup misses
Returns empty records array (not an error) if a search finds nothing
| Name | Required | Description | Default |
|---|---|---|---|
| key | No | Exact key to fetch a single record. If set, other filters are ignored. | |
| tags | No | Only return records that have ALL of these tags | |
| limit | No | Max results to return | |
| query | No | Substring to match against memory keys and values | |
| offset | No | Number of results to skip for pagination | |
| response_format | No | Output format: 'markdown' for human-readable or 'json' for machine-readable | markdown |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds valuable behavioral context beyond these: expired records are never returned, the store is durable across transports, and miss returns are non-error strings/empty arrays. No contradictions with annotations are present.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-organized into sections (Args, Returns, Examples, Error Handling) with the core purpose front-loaded. Every sentence serves a purpose; there is no fluff or repetition. Despite its length, it remains efficient and scannable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a tool with six parameters and no output schema, the description fully covers behavior: it documents both markdown and JSON return structures, error handling for misses, pagination fields, and example use cases. An agent has all necessary information to call it correctly without external documentation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, but the description enriches parameter understanding by explaining interaction effects (e.g., 'key' ignores other filters), pagination semantics (offset, has_more, next_offset), and response format differences. It also provides concrete examples that map parameters to real queries, going well beyond bare schema types.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb ('Search') and resource ('Semantic Memory records'), and explicitly distinguishes itself from chaoscore_remember ('previously stored with chaoscore_remember'). It lists the three supported search modes (exact key, substring, tag filtering), leaving no ambiguity about what the tool does.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It provides explicit use cases with examples ('What do we know about staging?' -> query='staging') and a clear exclusion ('Don't use when: You want to write/update a memory -> use chaoscore_remember instead'). This gives an agent precise decision criteria for choosing this tool over its sibling.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
chaoscore_rememberRememberAIdempotent
Persist a key/value record to Semantic Memory (durable, SQLite-backed), so it can be retrieved later with chaoscore_recall — in this session, in a future session, after a server restart, and from either transport. Writing to an existing key overwrites its value and updates its timestamp, making chaoscore_remember idempotent for a given key/value pair.
Memory is a property of the deployment, not of the connection: a record written over stdio is readable over HTTP and vice versa, provided both point at the same database file.
Args:
key (string, 1-200 chars): Unique identifier for this memory
value (string): The content to remember
tags (array of strings): Optional tags for filtering later (default: [])
ttl_seconds (number, optional): If set, the record is treated as expired (and excluded from chaoscore_recall) after this many seconds
response_format ('markdown' | 'json'): Output format (default: 'markdown')
Returns: For JSON format: { "key": string, "value": string, "tags": string[], "createdAt": string, "updatedAt": string, "expiresAt": string | null }
Examples:
Use when: "Remember that the staging DB uses the Melbourne region" -> key="staging.region", value="Melbourne (australiaeast)"
Don't use when: You need to search existing memories -> use chaoscore_recall instead
Error Handling:
Returns "Error: ..." with the underlying SQLite error message if the write fails (e.g. disk full, path unwritable)
| Name | Required | Description | Default |
|---|---|---|---|
| key | Yes | Unique key for this memory. Writing an existing key overwrites its value. | |
| tags | No | Optional tags for later filtering with chaoscore_recall | |
| value | Yes | The content to remember | |
| ttl_seconds | No | Optional time-to-live in seconds. Omit for a record that never expires. | |
| response_format | No | Output format: 'markdown' for human-readable or 'json' for machine-readable | markdown |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate idempotent, non-read-only, and non-destructive. The description goes further: it explains durable SQLite-backed storage, persistence across sessions/restarts/transports, overwrite semantics with timestamp updates, TTL behavior (exclusion from recall), and error handling. This exceeds annotation coverage without contradiction.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is well-structured with clear sections (Args, Returns, Examples, Error Handling) and front-loads the core purpose. Every sentence conveys necessary information without redundancy, making it appropriately concise for a tool with this complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool's complexity (5 params, TTL, transport independence, output formats) and lack of an output schema, the description covers all needed aspects: purpose, usage, params, return format, error handling, and examples. An agent can confidently invoke this tool correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all parameters. The description repeats most parameter details and adds minor clarifications (e.g., TTL expiration behavior, key uniqueness), but does not significantly augment the schema. Baseline 3 is appropriate when schema handles the heavy lifting.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it persists key/value records to Semantic Memory for later retrieval via chaoscore_recall. It specifies the resource (Semantic Memory), the verb (persist), and distinguishes itself from the recall sibling by explicitly naming it as the retrieval counterpart.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
An explicit 'Examples' section provides a concrete use case ('Remember that the staging DB uses the Melbourne region') and a don't-use case ('You need to search existing memories -> use chaoscore_recall instead'). This directly instructs when to use versus when to use the sibling, leaving no ambiguity.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
6 tool updates
v0.2.0- First observed
chaoscore_execute - First observed
chaoscore_inspect - First observed
chaoscore_plan - First observed
chaoscore_reason - First observed
chaoscore_recall - First observed
chaoscore_remember
TDQS
Scored across 6 tools
Each tool has a clearly distinct role in the cognitive core loop: reason analyzes before planning, plan produces an executable plan, execute runs it, inspect provides read-only introspection, and remember/recall handle persistent memory. There is no overlap in purpose; even reason and plan, which share similar arguments, are explicitly differentiated by what they produce.
All tools follow a consistent naming pattern: the 'chaoscore_' prefix followed by a lowercase verb (reason, plan, execute, inspect, remember, recall). No mixing of camelCase or inconsistent verb styles; the pattern is uniform and predictable.
With 6 tools, the server is well-scoped. Each tool corresponds to a necessary stage of the cognitive core workflow (reason, plan, execute, inspect) plus persistent memory operations (remember/recall). There are no redundant or extraneous tools, and the count is well within the ideal 3-15 range.
The tool surface covers the full lifecycle: analyze (reason), plan (plan), execute (execute), observe (inspect), and persist/retrieve knowledge (remember/recall). Minor gaps exist, such as no explicit delete tool for memory (though overwrite covers updates) and no dedicated cancel/abort for plans, but these are not critical to the core loop. Overall, the domain is well-covered.
Maintenance
Related MCP Connectors
Persistent memory, hybrid search and a goal graph for AI agents, over stdio or remote HTTP.
Deterministic reasoning stack for AI agents: simulate, decide & compute, plus cross-domain tools.
Hosted runtime for persistent agent teams, durable workflows, memory, schedules, and goals.
Durable, user-controlled goals and governed plans for AI agents.
Related MCP Servers
- AlicenseNot gradedqualityAmaintenanceDeterministic execution engine for AI agents. 412 modules across 78 categories including browser automation, file I/O, Docker, data parsing, crypto, and scheduling. Supports STDIO and Streamable HTTP transport with execution trace, evidence snapshots, and replay from any step.760 PyPI484Apache 2.0

ellmos-homebase-mcpofficial
AlicenseCqualityBmaintenanceEnables local-first LLM orchestration with persistent memory, knowledge management, routing, swarm patterns, API probing, tests, automation planning, and plugin discovery via a stdio MCP server, using SQLite for offline storage.5162 npm1MIT- AlicenseBqualityAmaintenanceEnables AI agents to maintain a local, event-sourced long-term memory with semantic retrieval, decision confidence checks, and proactive recalls, ensuring data never leaves the machine.233MIT
- AlicenseNot gradedqualityBmaintenanceEnables personal AI agents to perceive ambient context, retain episodic memory with decay, act proactively, and route routine decisions through fast System-1 reflexes while escalating ambiguous multi-hop plans to frontier LLMs. Includes reversible execution checkpoints, token budgets, and local-first memory retention, and plugs into MCP clients like Claude Desktop, Cursor, and Windsurf.7MIT