UNITARES
UNITARES is a self-hosted accountability server for long-running AI agents, giving them a shared, operator-owned record of identity, findings, reviews, governance decisions, and outcomes across restarts and handoffs.
Register sessions and manage agent identity/lineage, including resume/rebind and parent succession.
Record work check-ins and receive
proceed/guide/pausegovernance decisions with reasons and EISV state.Preview check-ins, read current governance state/verdicts, and inspect metrics without advancing state.
Search the cross-agent knowledge graph and store durable findings with evidence, tags, severity, and provenance.
Revise or supersede findings and link responses/corrections so replaced claims point to replacements.
Record outcomes such as test/tool/task results and bind them to prior predictions/check-ins for grading.
Request governed on-record reviews with issues, conditions, reasoning, and recusal declarations.
Consult connected/advisory models for second opinions under local/cloud privacy policy.
Recover an agent from a pause via check, quick, or review flows with reflection and safety checks.
Discover and invoke the broader governance tool catalog, connect agents over MCP/HTTP, and use the dashboard.
Click on "Deploy Server".
Wait a few minutes for the server to deploy. Once ready, it will show a "Started" state.
In the chat, type
@followed by the MCP server name and your instructions, e.g., "@UNITARESshow fleet health summary"
That's it! The server will respond to your query, and you can continue using it as needed.
Here is a step-by-step guide with screenshots.
Accountability infrastructure for long-running AI agents.
A self-hosted record your agents write to. After a restart or handoff, the next agent can look up who claimed what, on what evidence, who disputed it, and what replaced it.
Agent work outlives the process that started it. A coding session restarts, a research agent loses its context, a task moves to another runtime. Logs show each run, but not the thread between them. Without that thread, the next agent can repeat a dead end, act on a claim that was already corrected, or lose the evidence behind an earlier decision.
UNITARES is a server you run that keeps that thread. Agents connect over MCP or HTTP (with ready integrations for Claude Code, Codex, and Hermes Agent) and write their findings, reviews, and results to one operator-owned record. A later agent, or you, can read it back and see where each piece came from.
What the record answers
Question | Mechanism |
Who said it? | Identity and lineage: every write to the record is bound to the process that made it, and a successor can declare which process it continues. |
What supports it? | Claims and evidence: findings keep their sources and corrections outside any single context window. When a newer finding replaces an older one, the older one links to it. |
Who challenged it? | Governed review: objections, conditions, and their resolution stay on the work they concern. Asking for review is not the same as passing it. |
What happened? | Outcome grounding: test, build, and task results are recorded against the check-ins that predicted them. |
What can a successor recover? | Reconstruction: a new process can search or export prior findings, open review conditions, and outcomes before it acts. |
Two more pieces sit around the record. Runtime policy: each check-in returns
proceed, guide, or pause, with a reason; a pause refuses that process's
check-ins and new findings until review or recovery lifts it or it expires.
Second opinions: consult asks another connected model (Claude, Codex, Antigravity,
or local Ollama) and keeps the answer with the task.
Related MCP server: hejdar-mcp
See it
Agent A (Codex) finds a bug, records it, and exits. Agent B (Claude Code) later finds the real cause and records a finding that supersedes A's. Agent C (Hermes Agent) picks up A's task after a restart and reads the record before touching the code (reading needs no identity): its search returns A's finding marked superseded, with a link to B's. C then declares that it continues A's task.
# Agent A (Codex)
start_session {"force_new": true} -> agent A's id
store_finding {"summary": "upload retry test is flaky", ...} -> finding a
record_result {"outcome_type": "test_failed", ...}
# Agent B (Claude Code), in its own session, later
start_session {"force_new": true} -> agent B's id
store_finding {"summary": "upload retry fails on clock skew", ...} -> finding b
use_tool {"tool_name": "knowledge", "arguments": {"action": "supersede", "discovery_id": "<b>", "supersedes_id": "<a>"}, ...}
# Agent C (Hermes Agent), after A's restart
search_shared_memory {"query": "upload retry test"} -> finding a (superseded, points to b), finding b
start_session {"force_new": true, "parent_agent_id": "<A's id>", "spawn_reason": "explicit"}Nothing forces an agent to read the record; the Claude Code and Codex plugin's session start points it there. A simpler handoff, call by call: the captured two-process walkthrough.
Install
Docker Compose, on any platform: with Git, curl, and Docker Compose installed, one command starts the latest published release of the local stack (the server, PostgreSQL with AGE and pgvector, Redis, and the coordination plane; the core profile runs only the first two):
v=$(curl -fsSL https://raw.githubusercontent.com/cirwel/unitares/master/PUBLISHED_VERSION) && git clone --branch "v$v" --depth 1 https://github.com/cirwel/unitares.git && cd unitares && docker compose up -d --waitHomebrew preview, recommended for an Apple Silicon desktop Mac: the cirwel/unitares tap installs the services natively; follow its install and first-time setup.
The packaged unitares update coordinates writer shutdown, verified backup, migrations, prior-state restoration, and deep health when writers restart (schema verification when they remain stopped); kegs that predate it use the tap's one-time manual transition.
The preview label remains while the tap builds from source and supports Apple Silicon macOS only.
Either way, connect MCP clients at http://localhost:8767/mcp/, or open the dashboard at http://localhost:8767/dashboard. Pick one path; they keep separate data (installation choices). One stack per machine: container names are fixed, so run docker compose down (without -v) in an earlier checkout before starting another (stop is not enough, because stopped containers still hold their fixed container_name values, and restart: unless-stopped revives un-stopped containers when the Docker daemon restarts), or use the managed launcher (scripts/install/launch.sh), which checks ownership first. No model connection is configured by default. Ports, volumes, models, and Docker upgrades: Docker quickstart.
Connect your agents (Integrating agents):
Claude Code and Codex:
unitares-governance-pluginwires MCP, lifecycle hooks, and edit leases.Hermes Agent and OpenAI-compatible clients: the host adapter.
Anything else: Streamable HTTP MCP, the Python SDK (
pip install unitares-sdk), or the resident agent runtime.
Who it is for
For an operator running several long-lived AI agents, across vendors, on infrastructure they control, who needs the agents' shared account of the work to survive restarts and handoffs.
If your agents all work in one repository, git and an issue tracker may be enough. UNITARES is for work that spans runtimes and outlives any one repository or session.
Not a sandbox, an output validator, or a hosted agent platform. It runs beside your evals and guardrails and replaces neither. It does not run the agent's loop: the plugin's hooks and edit leases coordinate around the agent's work, and a pause refuses only that process's check-ins and new findings.
How it fits together
UNITARES is self-hosted accountability infrastructure for operators running multiple AI agents. Its single-operator federation kernel connects independent runtimes to one operator-controlled server over MCP or HTTP, where they share a durable record while keeping their own models, tools, and runtimes. They interoperate with each other over their own transports or A2A; UNITARES is the record behind them, not the transport between them. Together this is an operator-owned accountability layer for coding, research, background, and resident agents. What it adds to an activity log is lineage and supersession: claims and evidence, reviews, and outcomes stay bound to the process that recorded them, and a replaced claim points to its replacement, for review and for reconstruction later.
Storage is PostgreSQL and Redis, with no required external model API. The
quickstart runs the AGE backend, which stores the links between findings; the
plain postgres backend has no supersession links and full-text search only.
The check-in's policy action comes from a behavioral state estimate, a form of
runtime proprioception.
What each claim has been measured to do, and what has not been measured, is in Evidence and limits and the Reviewer Guide.
Start here
Goal | Guide |
Try it | |
Connect an agent or application | |
Operate a deployment | |
Understand the product and architecture | |
Research behind it | |
Contribute | |
Everything else |
Citation and license
Kenny Wang (ORCID 0009-0006-7544-2374),
CIRWEL Systems. See CITATION.cff for the versioned citation.
@misc{wang2026unitares,
author = {Wang, Kenny},
title = {{UNITARES}: Information-Theoretic Governance of Heterogeneous Agent Fleets},
year = {2026},
doi = {10.5281/zenodo.19647159}
}Available Tools
13 toolscheck_working_stateARead-onlyIdempotent
Read your current governance state and verdict without running a cycle, writing, or minting an identity. Only proof sent with the call reads your state (start_session's client_session_id, an X-Session-ID header or a verified continuity_token), never an inferred binding; otherwise a self-read is unbound and next_action says how to recover. agent_id, dropped on /mcp/, names the agent to read through use_tool or REST unless you are bound as a different agent (identity_mismatch); that read is marked identity_assurance.caller_proven=false on an inferred session. verbosity='standard' adds mode and basin with their meanings under raw_governance; verbosity='full' (alias lite=false) returns the full canonical diagnostics. sync_state also logs work and returns proceed or pause. get_governance_metrics returns this read's raw payload. With behavioral-sensor inputs, EISV fields: E=Energy [0,1] (observations and prior judgments); I=Information Integrity [0,1] (calibration and consistency features); S=Entropy [0,1] (deviations and activity features); V=Valence [-1,1] (separate EMA of raw E_obs-I_obs; positive=positive smoothed gap, negative=negative smoothed gap). Read primary_eisv_source / measurement_source for the producer; other producers share these field names.
| Name | Required | Description | Default |
|---|---|---|---|
| lite | No | If true (default), returns minimal essential metrics only. Set lite=false for full diagnostic data. verbosity, when given, takes precedence. | |
| verbosity | No | Tier: minimal (default); standard: bare EISV and risk, verdict/basin/mode with meanings, guidance; full: diagnostics. | |
| include_state | No | Retained for compatibility; has no effect on any tier. Use verbosity to choose what is returned. Accepts boolean or string ('true'/'false'). | |
| continuity_token | No | Same-process rebind proof only; never a cross-process resume. | |
| client_session_id | No | Binding id for calls in this process; not a cross-process proof. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnly/idempotent/non-destructive, yet the description adds substantial behavioral context beyond them: which proofs are honored (client_session_id, X-Session-ID, verified continuity_token), the fallback to an unbound self-read with next_action recovery, identity_mismatch handling, and identity_assurance.caller_proven=false on inferred sessions. This is well beyond what the safety hints convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Core purpose is front-loaded, but the body is a dense wall of run-on clauses mixing auth rules, routing, verbosity tiers, and EISV field definitions into long semicolon chains. It is information-rich but hard to scan, and the EISV definitions and agent_id note are not clearly separated from the call-critical instructions.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description carries the return-value burden and mostly meets it, documenting next_action, identity_assurance, raw_governance contents, basin/mode, and EISV field meanings. Gaps remain around the overall response envelope, but it is complete enough to call the tool correctly across its verbosity tiers.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, establishing a 3 baseline, but the description adds real meaning: verbosity='standard' adds mode and basin with meanings under raw_governance, verbosity='full' is aliased to lite=false, and verbosity takes precedence over lite. It also explains the EISV field semantics that the schema never touches, exceeding what the schema provides.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource — 'Read your current governance state and verdict' — and immediately bounds scope with 'without running a cycle, writing, or minting an identity.' It distinguishes itself from sync_state (which logs work) and get_governance_metrics (raw payload), so an agent can separate it from siblings without opening schemas.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Names specific alternatives and their differentiators: sync_state 'also logs work and returns proceed or pause,' and get_governance_metrics 'returns this read's raw payload.' It also spells out the proof conditions that select the bound vs. unbound path. What's missing is an explicit 'when not to use this' or a direct 'use X instead if...' routing statement, so it stays at 4 rather than 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
consultA
Ask a model for advice, no review record; effort='thorough' needs cloud privacy and an operator extension; on-record: request_review.
| Name | Required | Description | Default |
|---|---|---|---|
| brief | Yes | Question or material to send for advisory model help. | |
| model | No | Standard lane: a model ollama:local lists. | |
| effort | No | Omit: thorough for a CLI host_id or host_ids, else standard. Explicit effort must match. | |
| host_id | No | Pin a host; omitted effort follows it. External needs cloud_allowed; no fallback. | |
| privacy | No | local confines routing to the configured local inference service; cloud_allowed permits, but does not require, external processing. | local |
| purpose | No | Desired advisory operation. critique remains model advice, not a governed peer-review verdict. | answer |
| agent_id | No | UUID; leave unset for yourself. | |
| host_ids | No | Council of 2-3 CLI hosts; needs cloud_allowed. | |
| response_mode | No | compact returns the advisory result and policy outcome; full adds a single diagnostics object with route and inference provenance. | compact |
| allow_degraded | No | Allow thorough effort to fall back to standard local inference. This never weakens the requested privacy policy. | |
| continuity_token | No | Same-process rebind proof only; never a cross-process resume. | |
| client_session_id | No | Binding id for calls in this process; not a cross-process proof. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare readOnlyHint=false, openWorldHint=true and non-idempotent, and the description adds context the annotations cannot: no review record is produced, and 'thorough' effort requires cloud privacy plus an operator extension, i.e. a real prerequisite that can block the call. It stops short of stating cost, latency or failure behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two clauses, front-loaded with the action and the key exclusion; nothing is padding. The compression costs some readability – semicolon-separated policy fragments read like notes rather than a sentence – but no information is wasted.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 12-parameter tool with no output schema, the description covers the pivotal routing and precondition but says nothing about what comes back (response_mode, continuity_token semantics, degraded fallback behavior) beyond what the schema already documents. Adequate, not thorough.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3; the description earns above baseline by disclosing the cross-parameter constraint (thorough effort needs cloud privacy enabled and an operator extension) that the per-parameter enum descriptions only partially imply.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a concrete verb+resource ('Ask a model for advice') and immediately scopes it with 'no review record', which tells the agent this is an advisory, non-governed consultation. It does not name a near-identical sibling beyond request_review, and the phrasing is telegraphic, but the core action is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly routes the agent: use this for untracked advice, use request_review when the interaction must be on-record. The alternative and its selection condition are stated, though 'no review record' is compressed enough that the contrast requires a second read.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
describe_toolARead-onlyIdempotent
Return one named tool's description, stability tier, operation, examples, and advertised JSON input schema. Use list_tools(lite=true) for the compact capability-name index or list_tools(lite=false) to browse rich catalog metadata. An unqualified describe call returns the full record because lite=false is the advertised default; pass lite=true for a first-line-plus-key-parameters summary. On a consolidated router, action=... narrows the response to that action's parameters.
| Name | Required | Description | Default |
|---|---|---|---|
| lite | No | If true, return simplified schema with examples. | |
| action | No | For a consolidated router (knowledge, dialectic, observe, agent, ...): narrow the returned schema to the parameters this one action uses. | |
| agent_id | No | UUID; leave unset for yourself. | |
| tool_name | Yes | Exact name of the tool to describe. | |
| include_schema | No | Full mode only (lite=false): include the tool's inputSchema (default true). | |
| continuity_token | No | Same-process rebind proof only; never a cross-process resume. | |
| client_session_id | No | Binding id for calls in this process; not a cross-process proof. | |
| include_full_description | No | Full mode only (lite=false): include the full description; false keeps the first line (default true). |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish the safety profile (readOnly, idempotent, non-destructive, closed-world), so the bar is lower. The description still adds real behavioral context beyond them: the lite=false default means an unqualified call returns the full record, and lite=true downgrades to a summary. It doesn't cover error behavior for an unknown tool_name, which keeps it from a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four sentences, each load-bearing: what is returned first, then sibling routing, then default-mode behavior, then router nuance. No filler and the most decision-relevant information is front-loaded.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With no output schema, the description correctly enumerates the return payload and the mode-dependent variations. Combined with 100% schema coverage and existing annotations, an agent has everything needed to call this correctly for a read-only inspection tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3, but the description adds genuine meaning: it clarifies that lite=true yields a 'first-line-plus-key-parameters summary' and that action narrows the response to that action's parameters. The remaining params (agent_id, continuity_token, client_session_id) are left to the schema, but the mode-defining params are well covered.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Return) and resource (one named tool's record) and enumerates exactly what the record contains: description, stability tier, operation, examples, and input schema. It is clearly distinguishable from the sibling list_tools, which returns many tools rather than one.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicitly routes the agent to alternatives with conditions: list_tools(lite=true) for the compact index, list_tools(lite=false) for rich catalog metadata. It also explains what an unqualified call returns and how action=... behaves on a consolidated router, leaving nothing to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
identityA
Resolve which agent this MCP session is bound to, or set a cosmetic display name. Not a plain read: a call carrying no proof argument at all is gated to a fresh mint, so it persists a new agent and reports on that one, marked caller_proven=false. A call carrying only a cosmetic name= — with no session or ownership signal and no explicit session header — is also gated to a fresh mint — pass client_session_id to read or rename your own session. name= persists a cosmetic label only and never looks an agent up. For a fresh process call onboard(force_new=true). continuity_token is per-process ownership proof, not a transport-level claim: carrying it into another process re-opens silent resurrection.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | Optional COSMETIC display name; sets display_name only, never `agent_id` or `uuid`. Thread `uuid` across tools, not this. | |
| resume | No | Explicitly resume existing identity | |
| agent_id | No | UUID; leave unset for yourself. | |
| force_new | No | Force new identity creation | |
| agent_uuid | No | Resume a known identity by UUID directly. Skips session/name resolution. Returns error if not found. | |
| model_type | No | Optional model type for distinct identity | |
| continuity_token | No | Same-process rebind proof only; never a cross-process resume. | |
| client_session_id | No | Binding id for calls in this process; not a cross-process proof. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations declare non-readOnly, non-destructive, non-idempotent, so the safety bar is lower, yet the description still adds substantial behavioral detail: no-proof calls mint a fresh agent marked caller_proven=false, name-only calls also mint, name= is purely cosmetic and never looks up an agent, and continuity_token across processes 're-opens silent resurrection.' That is unusually candid mutation/resurrection disclosure. It stops short of describing the return shape, hence 4.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core purpose, then the gating behavior, then the client_session_id escape hatch. Every sentence carries a distinct constraint, though the em-dash-heavy phrasing with parentheticals makes it denser than necessary and mildly hard to parse.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For an 8-parameter, non-idempotent mutation tool with no output schema, the description covers the minting semantics, the cosmetic-name pitfall, and the cross-process token hazard. It names caller_proven as a returned flag, but does not describe the full return payload, leaving a small gap for a tool with no output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3; the description adds relationship-level meaning beyond the per-field schema text, explaining name= default behavior, that client_session_id gates read/rename, and that continuity_token is per-process ownership proof rather than a transport claim. It clarifies how the arguments interact, which the flat schema does not.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The opening sentence states a specific verb and resource: resolve the agent bound to the session, or set a cosmetic display name. It immediately qualifies the operation as 'not a plain read,' which distinguishes it from the read-oriented siblings and tells the agent this call can create/persist state.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives explicit selection rules: 'pass client_session_id to read or rename your own session,' and 'for a fresh process call onboard(force_new=true).' The when-to-use guidance is strong, but the recommended alternative 'onboard' does not appear in the sibling list, which weakens the routing advice slightly.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
list_toolsARead-onlyIdempotent
Discover the complete governance capability catalog, including names omitted from the initial progressive tools/list advertisement. The default lite=true response is the compact federation handshake: every public capability appears once as a name-only record beside the interface contract. Use lite=false for descriptions, categories, tiers, workflows, relationships, and direct-advertisement status. Use describe_tool for one capability's parameters, then use_tool to invoke a capability absent from the initial listing. Callable before an identity is bound.
| Name | Required | Description | Default |
|---|---|---|---|
| lite | No | If true (default), return capability names and the interface contract; false adds descriptions, categories and tiers. | |
| tier | No | Filter by tier: 'essential', 'common', 'advanced', or 'all' (case-insensitive; blank means 'all'). | all |
| verbose | No | Ignored; accepted for compatibility. | |
| agent_id | No | UUID; leave unset for yourself. | |
| category | No | Filter tools by category. | |
| progressive | No | If true, order tools by usage frequency. | |
| essential_only | No | If true, return only Tier 1 (essential) tools. | |
| continuity_token | No | Same-process rebind proof only; never a cross-process resume. | |
| include_advanced | No | If false, exclude Tier 3 (advanced) tools. | |
| client_session_id | No | Binding id for calls in this process; not a cross-process proof. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, non-destructive and closed-world, so the safety profile is covered. The description adds genuinely useful context beyond that: the two response modes and their contents, and the important operational fact that the tool can be called before identity binding.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core purpose and scoping, and most sentences carry routing value. Slightly dense with several chained instructions, but there is little outright waste.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 10-parameter read-only catalog tool with no output schema, the description covers mode selection, scope, and the identity precondition adequately, and routes to the correct follow-up tools. It does not describe pagination or volume limits, a minor gap given the breadth of the catalog.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so all 10 parameters are already documented, and the schema even explains the lite default. The description largely restates the lite semantics and adds only marginal detail (workflows, relationships, direct-advertisement status) not covered elsewhere, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Discover') and resource ('complete governance capability catalog'), and immediately clarifies it includes names omitted from the initial progressive tools/list advertisement. It is clearly distinguished from sibling tools describe_tool and use_tool, which it explicitly references.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit branching guidance: use the default lite=true for the compact handshake, lite=false for the richer catalog, describe_tool for one capability's parameters, and use_tool to invoke capabilities missing from the initial listing. It also states the precondition that it is callable before an identity is bound.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
record_resultA
Record a measurable outcome and pair it with this agent's EISV snapshot so verdicts can be graded against what really happened. Pass the prediction_id from a sync_state reply to bind the outcome to that check-in's confidence; it is consumed on first use and TTL-bound (an hour by default). Needs a bound or explicit agent_id, and refuses under strict identity from an ephemeral session. Provenance cannot be self-attested here: verification_source is forced and provenance keys in detail are stripped. Use store_finding for durable knowledge. outcome_event is the canonical twin; this name adds a digest envelope and keeps the raw payload under raw_governance only with response_mode='full' or include_semantics=true, or when the write returned no outcome_id. EISV field definitions: describe_tool(tool_name='check_working_state').
| Name | Required | Description | Default |
|---|---|---|---|
| detail | No | Type-specific metadata (e.g., mark_count, test_name, error_message) | |
| is_bad | No | Whether this is a negative outcome. Inferred from type if omitted. | |
| agent_id | No | Agent ID. Falls back to session-bound agent_id if omitted. | |
| confidence | No | Agent confidence at outcome time (0-1). Looked up from last check-in if omitted. | |
| session_id | No | Optional session id; falls back to client_session_id and then to context. | |
| outcome_type | Yes | Type of outcome event | |
| outcome_score | No | Quality score 0.0 (worst) to 1.0 (best). Inferred from type if omitted. | |
| prediction_id | No | Tactical prediction id from a prior process_agent_update response. | |
| response_mode | No | 'full' is an alias for include_semantics=true; 'lite' (default) returns the small snapshot. | |
| decision_action | No | The decision the agent took (e.g. 'proceed', 'pause'). | |
| continuity_token | No | Same-process rebind proof only; never a cross-process resume. | |
| client_session_id | No | Binding id for calls in this process; not a cross-process proof. | |
| include_semantics | No | If true, the response's eisv_snapshot carries the full EISV ontology (state_semantics role table + hierarchy). | |
| verification_source | No | Provenance of this outcome. | agent_reported_tool_result |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Adds substantial behavior beyond the annotations: prediction_id is consumed on first use and TTL-bound (~1 hour), a bound or explicit agent_id is needed, it refuses under strict identity from an ephemeral session, and provenance cannot be self-attested (verification_source forced, provenance keys stripped). This is exactly the write-safety and state-mutation context an agent needs, and it is consistent with idempotentHint=false and destructiveHint=false.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads purpose, then layers binding, TTL, identity, and provenance rules in a compact sequence where each clause carries real information. It is dense and occasionally hard to parse (the outcome_event/raw_governance sentence), keeping it from a 5.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Appropriately complete for a 14-parameter mutation tool with no output schema: it covers binding lifecycle, identity requirements, provenance constraints, response-mode effects, and points to describe_tool for EISV field definitions. Nothing critical to invoking it correctly appears missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is already 100%, so the baseline is 3; the description earns above baseline by explaining why prediction_id exists (bind to a check-in's confidence), how response_mode/include_semantics gate the digest envelope and raw payload, and the forced verification_source. One minor wrinkle: description says prediction_id comes from a sync_state reply while the schema says process_agent_update response.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Record a measurable outcome') plus the reason it exists ('pair it with this agent's EISV snapshot so verdicts can be graded'). It explicitly differentiates from siblings by naming 'store_finding for durable knowledge' and 'outcome_event is the canonical twin', so an agent can distinguish it without opening another schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives clear routing context: pass prediction_id from a sync_state reply, use store_finding for durable knowledge, and it clarifies the relationship to the outcome_event twin. It stops short of a crisp 'use this when X, use outcome_event when Y' rule, leaving the digest-envelope vs raw-payload distinction somewhat implicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
request_reviewA
Open a governed, on-record review. issue_description is the thesis by default; set use_brief_as_thesis=false for two calls. Proxy-filed reviews should pass reviewed_work_author_agent_ids to recuse declared authors. Requires a session-owned registered identity; refuses with SESSION_EXISTS if one is active, and skips without a session while waiting_input. dialectic advances the session; consult is advisory.
| Name | Required | Description | Default |
|---|---|---|---|
| reason | No | Reason (for action=request/reassign, or required when reconcile_effect marks an effect uncertain/applied) | |
| agent_id | No | Filter by agent (for action=get or list) | |
| reasoning | No | Explanation/reasoning | |
| root_cause | No | Root cause analysis (for action=thesis/synthesis/consult) | |
| continuity_token | No | Same-process rebind proof only; never a cross-process resume. | |
| client_session_id | No | Binding id for calls in this process; not a cross-process proof. | |
| issue_description | No | Issue description (action=request/quick) | |
| proposed_conditions | No | Conditions for resumption (for action=thesis/synthesis/consult) | |
| use_brief_as_thesis | No | For action=request or thesis, reuse the issue description or saved session brief as the thesis instead of repeating it. | |
| reviewed_work_author_agent_ids | No | Requester-declared author UUIDs to recuse |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already mark this as a non-read-only, non-idempotent, open-world mutation, and the description adds real behavioral detail beyond them: the registered-identity precondition, the SESSION_EXISTS refusal, and the wait-state skip behavior. It stops short of describing what a successful review returns or its lifecycle.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Short and front-loaded, leading with the core action before conditions. However, the telegraphic phrasing packs several distinct ideas per sentence and leans on undefined internal jargon, which costs some readability.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a ten-parameter, destructive-capable, open-world tool with no output schema, the description covers preconditions and a few key parameters but leaves most parameter semantics and the outcome of a review unaddressed. It is viable but not complete given the tool's complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3, but the description adds meaning the schema lacks: issue_description acts as the thesis by default, use_brief_as_thesis=false changes call behavior, and reviewed_work_author_agent_ids triggers author recusal. Several of the ten parameters still get no narrative treatment, keeping it short of a 5.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Open a governed, on-record review') and contrasts itself with the consult sibling ('dialectic advances the session; consult is advisory'). The jargon 'governed review' is not self-explanatory, but an agent can identify the action and roughly separate it from alternatives.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Provides concrete trigger conditions: proxy-filed reviews should pass reviewed_work_author_agent_ids, and it requires a session-owned registered identity. It also gives mode-selection hints (dialectic vs consult) and the use_brief_as_thesis=false path, though it stops short of explicit 'use X instead of Y' exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
self_recoveryADestructive
Lifts a pause or other hold on your own agent. action='check', the default, changes no stored state, and both resuming actions verify you own the agent. Neither resume path runs while a void is active; quick also caps risk at 0.40, review at 0.65 plus a written reflection (20+ characters) on what happened, which is recorded in the shared knowledge graph under your agent whether or not it resumes. An attempt that reaches the safety checks stamps a fresh recovery_attempt_at even when they refuse it, so a retry is not a no-op; a missing reflection is rejected before that stamp. To resume an agent you do not own use operator_resume_agent.
| Name | Required | Description | Default |
|---|---|---|---|
| action | No | Recovery action: check (diagnose), quick (fast resume), review (with reflection) | check |
| reason | No | Brief reason (optional for action=quick) | |
| agent_id | No | UUID; leave unset for yourself. | |
| conditions | No | Recovery conditions (optional for action=review) | |
| reflection | No | What went wrong and what you'll change (required for action=review) | |
| continuity_token | No | Same-process rebind proof only; never a cross-process resume. | |
| client_session_id | No | Binding id for calls in this process; not a cross-process proof. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Despite annotations covering the safety profile (destructiveHint=true, idempotentHint=false), the description adds substantive behavior: check is a pure no-op, neither resume path runs while a void is active, a refused attempt still stamps recovery_attempt_at, a missing reflection is rejected before that stamp, and the reflection is written to the shared knowledge graph regardless of outcome. These are exactly the non-obvious traits an agent needs.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core action, and virtually every clause carries a distinct behavioral fact rather than filler. It is dense and multi-clause, which slightly taxes readability, but nothing is redundant.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 7-parameter, mutation-class tool with no output schema, the description covers triggers, mode selection, constraints, and side effects. The one gap is that it does not describe what action='check' returns diagnostically, which an agent calling the default mode would benefit from knowing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3, but the description adds requirements beyond the schema: the reflection minimum of 20 characters and its graph-recording side effect, and the risk caps attached to quick vs review. It also reinforces that continuity_token is a same-process-only proof, matching the schema hint.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Lifts a pause or other hold on your own agent') with immediate scope narrowing ('your own agent'). It also names the routing alternative operator_resume_agent, so an agent can tell it apart from the resume tools without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives concrete mode semantics (check = no state change, quick = fast resume at 0.40 risk cap, review = 0.65 cap plus a 20+ character reflection) and a clear exclusion ('To resume an agent you do not own use operator_resume_agent'). Slightly implicit on the top-level trigger ('use this when your agent is paused'), which keeps it from a 5.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
start_sessionA
Register this process-instance and mint its agent identity; keep the returned client_session_id for later calls. Call with force_new=true — a bare call with no ownership proof is defaulted to force_new or refused under strict identity, never resumed onto another process's uuid. parent_agent_id claims succession from an EXITED predecessor: naming a still-live parent is rejected as coincidental and the claim cleared, unless spawn_reason marks a dispatched child or a compaction continuation. Use identity to inspect or rename an existing binding. onboard is the canonical twin; this name adds a digest envelope. Read the uuid from agent_uuid; response_mode='full' keeps the raw payload under raw_governance.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | Optional COSMETIC display name; sets display_name only, never `agent_id` or `uuid`. Thread `uuid` across tools, not this. | |
| resume | No | Resume existing identity when a proof signal is present (continuity_token, agent_uuid, agent_id, client_session_id, or name) and … | |
| agent_id | No | UUID; leave unset for yourself. | |
| force_new | No | Force new identity creation. | |
| thread_id | No | Explicit thread ID to join (auto-derived from session if not provided) | |
| model_type | No | Optional model type | |
| client_hint | No | Client hint string | |
| orchestrated | No | Declare that a client_session_id is a thread-stable anchor provisioned by an orchestrator for a headless turn-child. | |
| spawn_reason | No | Why this fork was created. Registered reasons: subagent, dialectic_reviewer, dispatch, compaction, explicit, new_session. | |
| initial_state | No | Optional bootstrap check-in payload. | |
| response_mode | No | Verbosity of the identity envelope. | minimal |
| onboard_origin | No | Adapter-supplied observability label for the onboard entry path: agent, harness_backstop, or orchestrated_resume. | |
| parent_agent_id | No | UUID of predecessor agent (for fork lineage) | |
| continuity_token | No | Same-process rebind proof only; never a cross-process resume. | |
| client_session_id | No | Binding id for calls in this process; not a cross-process proof. | |
| process_fingerprint | No | Optional client-reported execution context: {host_id, pid, pid_start_time, transport, ppid?, tty?, anchor_path_hash?}. | |
| trajectory_signature | No | Trajectory signature dict |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Without relying on annotations, the description discloses non-obvious behavior: a bare call is defaulted to force_new or refused under strict identity, a still-live parent claim is rejected as coincidental and cleared, and response_mode='full' retains the raw payload. That is substantially more than the annotations (readOnly=false, idempotent=false) convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The primary purpose is front-loaded, but the body is a dense run-on of clauses with unexplained jargon ('digest envelope', 'raw_governance', 'coincidental') and references 'agent_uuid' (an output field, not a param) without setup. Much is information-rich, yet parsing cost is high.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 17-param, no-output-schema identity tool this captures the critical behaviors (identity minting, force_new, succession, response envelope) that an agent needs. It does not address numerous auxiliary params, but the schema documents them fully, so little is genuinely missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so baseline is 3, and the description adds genuine meaning for key params: it explains what force_new's default fallback does, the succession semantics of parent_agent_id, and the effect of response_mode='full'. Several other params (thread_id, trajectory_signature, process_fingerprint) get no added explanation, keeping this from a 5.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The opening states a concrete verb+resource ('Register this process-instance and mint its agent identity') and the two related tools (identity, onboard) are named. However, 'this name adds a digest envelope' and the near-synonymy with onboard make it hard to tell precisely which tool an agent should reach for at bootstrap time.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It gives real conditional guidance (force_new coercion, parent_agent_id succession rules, 'use identity to inspect or rename'). But the routing sentence 'onboard is the canonical twin; this name adds a digest envelope' is opaque and leaves the agent unsure whether onboard or start_session is the correct entry point.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
store_findingA
Write a durable finding to the knowledge graph; search first, to revise one use update_finding.
Writes one new finding into the cross-agent knowledge graph and returns its discovery_id. summary is required at call time even though the schema marks every field optional; severity high or critical is refused unless the session is bound to a registered agent, while low and medium fall back to an anonymous writer id. Every call mints a NEW discovery — search_shared_memory first, and revise one with use_tool(tool_name='update_finding', ...). Use it for a discovery, root cause or correction, and record_result for task, tool or test outcomes; budget 20 findings an hour.
| Name | Required | Description | Default |
|---|---|---|---|
| tags | No | Tags for the finding; ephemeral archives it after seven days. | |
| content | No | Extended details; alias of details. | |
| details | No | Extended details. Alias: content. | |
| summary | No | One-line summary of the finding (required). | |
| agent_id | No | Leave unset; the bound session is the writer. | |
| severity | No | low, medium, high or critical. | |
| task_label | No | Optional readable label for the bounded task. | |
| response_to | No | Optional link {discovery_id, response_type}; type: extend, question, disagree, support, answer, follow_up, correction, elaboration, supersedes. | |
| task_outcome | No | Optional outcome label for the bounded task. | |
| comparison_key | No | Optional stable key for comparing the same bounded task across harnesses. | |
| discovery_type | No | One of architectural_decision, learning, pattern, bug_fix, refactoring, documentation, experiment, question, note (default), rule, insight, bug_found, bug, improvement, exploration, observation. | |
| memory_context | No | Optional memory, knowledge-graph or transcript surfaces visible to the writer. | |
| continuity_token | No | Same-process rebind proof only; never a cross-process resume. | |
| client_session_id | No | Binding id for calls in this process; not a cross-process proof. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Goes well beyond the annotations (readOnly=false, idempotent=false, destructive=false) by disclosing runtime behavior: every call mints a NEW discovery, 'summary' is required at call time despite the schema marking all fields optional, high/critical severity is refused unless the session is bound to a registered agent, low/medium fall back to an anonymous writer id, and there is a budget of 20 findings per hour. These are exactly the non-obvious traits an agent needs before calling.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Dense and front-loaded, leading with the write action and the revise alternative. It repeats the search-first/update_finding directive in two places ('search first, to revise one use update_finding' and again in the second paragraph), which is minor redundancy but not bloat.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 14-parameter write tool with no output schema, the description supplies the missing essentials: the return value (discovery_id), the effective required field, the authorization tiers for severity, the rate budget, and the create-vs-revise-vs-record_result decision. Nothing an agent needs to invoke it correctly is absent.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3, but the description adds cross-field semantics the schema cannot express: 'summary' is effectively required contrary to the schema's optional marking, the severity-dependent agent-boundary rule, and why 'agent_id' should be left unset. It does not cover all 14 params (e.g. continuity_token, comparison_key), so it stops short of a 5.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource ('Write a durable finding to the knowledge graph') and immediately distinguishes the create path from the revise path (update_finding) and the search path (search_shared_memory). An agent can tell this apart from its siblings without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit when-to-use routing: use this for a discovery, root cause or correction, use record_result for task/tool/test outcomes, search first, and revise via update_finding. Both the alternative tools and the conditions that select them are named, leaving nothing to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
sync_stateA
Record a work check-in and get a governance decision: it advances and persists this agent's EISV state and returns proceed or pause with a named reason, plus a prediction_id — only when you pass confidence — to grade that check-in later with record_result. The first call auto-binds an identity, except under strict identity, which refuses and points at start_session. simulate_update previews a proposed check-in without advancing state, though it still appends an audit event; check_working_state reads the current verdict without writing. process_agent_update is the canonical twin; this name returns a digest envelope, and a routine check-in omits the raw payload (response_mode='full' adds it under raw_governance). EISV field definitions: describe_tool(tool_name='check_working_state').
| Name | Required | Description | Default |
|---|---|---|---|
| lite | No | Boolean alias for response_mode='compact'. Applies only when response_mode is left at 'auto' (an explicit response_mode always wins). | |
| logprobs | No | Per-token top-k output logprobs, e.g. [[lp, lp, ...], ...]. Grounds S at tier-1 instead of the heuristic; absent for Claude. | |
| task_type | No | Task type. Core types: convergent | divergent | mixed; 'introspection' for self-examination. | mixed |
| complexity | No | Task complexity, strictly 0-1. Check-in aliases also accept 'trivial'|'low'|'medium'|'high'|'very_high'. | |
| confidence | No | Confidence level for this update (0-1, optional). | |
| parameters | No | Agent parameters vector (optional, deprecated). | |
| task_label | No | S22 H5 provenance: human-readable bounded task label | |
| sensor_data | No | Caller-published sensor measurements: `eisv` for a physical E/I/S/V reading, `afferents` for raw dimensions. Telemetry only, never a verdict input. | |
| task_outcome | No | S22 H5 provenance: outcome label for the bounded task | |
| ethical_drift | No | Ethical drift signals (3 components): [primary_drift, declared coherence_loss, complexity_contribution]. | |
| response_mode | No | Response shape. 'auto' (default) or 'compact' for routine check-ins; 'mirror' for actionable signals; 'full' for everything. | auto |
| response_text | No | Agent's response text (optional, for analysis) | |
| comparison_key | No | S22 H5 provenance: stable key for comparing the same bounded task across harnesses | |
| memory_context | No | S22 provenance: memory/KG/transcript surfaces visible to the writer | |
| epistemic_class | No | Storage label for this row: agent_report (default), substrate_observation (measured), substrate_interpretation (derived), prediction (forward claim). | agent_report |
| continuity_token | No | Same-process rebind proof only; never a cross-process resume. | |
| client_session_id | No | Binding id for calls in this process; not a cross-process proof. | |
| provenance_context | No | Situating metadata: harness_type, model_provider, model, transport, tool_surface, governance_mode, verification_source, locus. Descriptive only. | |
| recent_tool_results | No | Self-reported tool outcomes from the agent's most recent actions. | |
| trajectory_signature | No | Trajectory identity signature from anima-mcp. | |
| require_strong_identity | No | If true, reject updates unless identity assurance tier is strong. | |
| include_memory_suggestions | No | Opt in to a KG lookup seeded from this check-in and include a few matching discovery digests. | |
| auto_export_on_significance | No | If true, write a governance history export whenever this check-in is judged significant: a risk spike, a coherence drop, a void threshold … |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations only cover the safety profile (readOnlyHint=false, destructiveHint=false, idempotentHint=false). The description adds substantial behavior beyond that: state advancement and persistence, identity auto-binding and strict-identity refusal, audit-event appending by the preview twin, and the digest-vs-raw envelope tradeoff with response_mode='full'. It does not spell out permission/auth requirements or idempotency semantics, which keeps it below a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core action-and-return, then alternatives and envelope details. It is dense and paragraph-shaped with several clauses packed together, but each clause carries routing or behavioral information rather than filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 23-parameter, zero-required, no-output-schema tool, the description covers the decision semantics, the returned fields (verdict, named reason, prediction_id), identity binding, response-shape modes, sibling routing, and defers EISV field definitions to describe_tool. Nothing an agent needs to invoke it correctly is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is already 100%, so the baseline is 3. The description nonetheless adds real meaning: that prediction_id is returned only when confidence is supplied (a linkage the schema doesn't state), and that response_mode='full' surfaces the raw payload under raw_governance rather than just changing envelope shape.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb ('Record a work check-in') and outcome ('get a governance decision ... proceed or pause with a named reason'), and explicitly distinguishes itself from siblings: simulate_update previews without advancing, check_working_state reads without writing, process_agent_update is the canonical twin. An agent can pick this apart from adjacent tools without opening a schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit routing: use record_result to grade a check-in later, start_session when strict identity refuses, simulate_update to preview, check_working_state for the current verdict. Also states the first-call auto-bind behavior and the one condition (strict identity) under which it fails.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
use_toolADestructive
Invoke one public capability omitted from the initial progressive tools/list advertisement. Find the exact name with list_tools and inspect its arguments with describe_tool, then pass that argument object here. The target's normal identity, validation, authorization, timeout and response middleware all run; this is a discovery gateway, not an authorization bypass. It refuses recursive use_tool calls.
| Name | Required | Description | Default |
|---|---|---|---|
| agent_id | No | UUID; leave unset for yourself. | |
| arguments | No | Arguments for the target capability; inspect its schema with describe_tool before invoking it. | |
| tool_name | Yes | Exact public capability name returned by list_tools. | |
| continuity_token | No | Same-process rebind proof only; never a cross-process resume. | |
| client_session_id | No | Binding id for calls in this process; not a cross-process proof. |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true, readOnlyHint=false, openWorldHint=true, and non-idempotent, so the risk profile is covered. The description adds meaningful context beyond that: the target's own identity, validation, authorization, timeout and response middleware all run, so this gateway is not a privilege escalation path. It stops short of describing error or failure behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Four sentences, front-loaded with the action and the prerequisite chain, then the safety clarification and the recursion exclusion. The middleware enumeration is slightly long but each clause carries a distinct behavioral fact worth keeping.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
No output schema exists, so the description should orient the agent on return expectations, which it only gestures at implicitly. For a five-parameter gateway with nested arguments, it otherwise covers prerequisites, delegation semantics, and the key failure mode (recursive refusal) adequately.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% with all five parameters documented, so the baseline is 3. The description only reinforces that arguments must be built from describe_tool output and that tool_name must be the exact name from list_tools, adding marginal value over the schema's own field descriptions.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb and resource: invoke one public capability discovered via list_tools. It also carves out exactly what it is not ('a discovery gateway, not an authorization bypass'), which distinguishes it from siblings like list_tools, describe_tool, and the session tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Explicit sequence: find the name with list_tools, inspect arguments with describe_tool, then pass the argument object here. It also states an exclusion — it refuses recursive use_tool calls — so the agent knows both when to use it and one case where it will not work.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
1 tool update
v3.5.0- Changed
consult1 field changed- added
Input schema / properties / modelAdded value: +{ + "anyOf": [ + { + "maxLength": 200, + "minLength": 1, + "type": "string" + }, + { + "type": "null" + } + ], + "default": null, + "description": "Standard lane: a model ollama:local lists." +}
5 tool updates
v3.4.0- Changed
consult4 fields changed- removed
Input schema / properties / effort / defaultRemoved value: -"standard" - changed
Input schema / properties / effort / descriptionPrevious value: -"standard uses the lower-overhead inference lane; thorough requests the operator-authorized strong-model lane."New value: +"Omit: thorough for a CLI host_id or host_ids, else standard. Explicit effort must match." - added
Input schema / properties / host_idAdded value: +{ + "anyOf": [ + { + "maxLength": 128, + "minLength": 1, + "type": "string" + }, + { + "type": "null" + } + ], + "default": null, + "description": "Pin a host; omitted effort follows it. External needs cloud_allowed; no fallback." +} - added
Input schema / properties / host_idsAdded value: +{ + "anyOf": [ + { + "items": { + "type": "string" + }, + "type": "array" + }, + { + "type": "null" + } + ], + "default": null, + "description": "Council of 2-3 CLI hosts; needs cloud_allowed." +}
- Changed
request_review2 fields changed- changed
Input schema / properties / reason / descriptionPrevious value: -"Reason (for action=request/reassign)"New value: +"Reason (for action=request/reassign, or required when reconcile_effect marks an effect uncertain/applied)" - added
Input schema / properties / reviewed_work_author_agent_idsAdded value: +{ + "anyOf": [ + { + "items": { + "type": "string" + }, + "type": "array" + }, + { + "type": "null" + } + ], + "default": null, + "description": "Requester-declared author UUIDs to recuse" +}
- Changed
search_shared_memory2 fields changed- changed
Input schema / properties / authority_mode / descriptionPrevious value: -"prefer_governed (default) down-ranks imported memory; all keeps raw order."New value: +"prefer_governed (default) down-ranks imported memory and omits it from queryless listings; all keeps raw order." - changed
Input schema / properties / include_details / descriptionPrevious value: -"Inline details need response_mode='full'; else open one with knowledge(action='details')."New value: +"Inline details need response_mode='full'; else open one via use_tool(tool_name='knowledge', arguments={'action': 'details', ...})."
- Changed
start_session1 field changed- changed
Input schema / properties / resume / descriptionPrevious value: -"Resume existing identity when a proof signal is present (continuity_token, agent_uuid, agent_id, client_session_id, or name)."New value: +"Resume existing identity when a proof signal is present (continuity_token, agent_uuid, agent_id, client_session_id, or name) and …"
- Changed
store_finding11 fields changed- changed
Input schema / properties / comparison_key / descriptionPrevious value: -"S22 H5 provenance: stable key for comparing the same bounded task across harnesses"New value: +"Optional stable key for comparing the same bounded task across harnesses." - changed
Input schema / properties / content / descriptionPrevious value: -"Extended content/details (for action=store, note, or promote)"New value: +"Extended details; alias of details." - changed
Input schema / properties / details / descriptionPrevious value: -"Extended details for discovery (for action=store or promote). Alias: content"New value: +"Extended details. Alias: content." - changed
Input schema / properties / discovery_type / descriptionPrevious value: -"action=store; one of architectural_decision, learning, pattern, bug_fix, refactoring, documentation, experiment, question, note, rule, insight, bug_found, bug, improvement, exploration, observation."New value: +"One of architectural_decision, learning, pattern, bug_fix, refactoring, documentation, experiment, question, note (default), rule, insight, bug_found, bug, improvement, exploration, observation." - changed
Input schema / properties / memory_context / descriptionPrevious value: -"S22 provenance: memory/KG/transcript surfaces visible to the writer"New value: +"Optional memory, knowledge-graph or transcript surfaces visible to the writer." - added
Input schema / properties / response_toAdded value: +{ + "anyOf": [ + { + "additionalProperties": true, + "type": "object" + }, + { + "type": "null" + } + ], + "default": null, + "description": "Optional link {discovery_id, response_type}; type: extend, question, disagree, support, answer, follow_up, correction, elaboration, supersedes." +} - changed
Input schema / properties / severity / descriptionPrevious value: -"Severity: low, medium, high, critical (for action=store or action=update)"New value: +"low, medium, high or critical." - changed
Input schema / properties / summary / descriptionPrevious value: -"Discovery summary (for action=store or promote)"New value: +"One-line summary of the finding (required)." - changed
Input schema / properties / tags / descriptionPrevious value: -"Tags (action=store, note); for action=search an exact any-of filter in every search mode."New value: +"Tags for the finding; ephemeral archives it after seven days." - changed
Input schema / properties / task_label / descriptionPrevious value: -"S22 H5 provenance: human-readable bounded task label"New value: +"Optional readable label for the bounded task." - changed
Input schema / properties / task_outcome / descriptionPrevious value: -"S22 H5 provenance: outcome label for the bounded task"New value: +"Optional outcome label for the bounded task."
1 tool update
v3.2.0- Changed
search_shared_memory3 fields changed- changed
Input schema / properties / agent_id / descriptionPrevious value: -"Filter by agent (for action=get, search; omit when using discovery_id readback)"New value: +"Filter by author agent; agent_id_filter wins if both are set." - changed
Input schema / properties / query / descriptionPrevious value: -"Search query (for action=search)"New value: +"Search text." - changed
Input schema / properties / status / descriptionPrevious value: -"Status filter/update value (open, resolved, archived, superseded)"New value: +"Filter by status: open, resolved, archived, superseded."
16 tool updates
v3.1.0- Changed
check_working_state5 fields changed- changed
Input schema / properties / client_session_id / descriptionPrevious value: -"In-session binding id from start_session()/identity(); pass it on same-process calls. Not a cross-process proof."New value: +"Binding id for calls in this process; not a cross-process proof." - changed
Input schema / properties / continuity_token / descriptionPrevious value: -"Ownership proof from onboard()/identity(), for same-live-process rebinds only. Not a cross-process resume credential."New value: +"Same-process rebind proof only; never a cross-process resume." - changed
Input schema / properties / include_state / descriptionPrevious value: -"Include nested state dict in response (can be large). Default false to reduce context bloat. Accepts boolean or string ('true'/'false')."New value: +"Retained for compatibility; has no effect on any tier. Use verbosity to choose what is returned. Accepts boolean or string ('true'/'false')." - changed
Input schema / properties / lite / descriptionPrevious value: -"If true (default), returns minimal essential metrics only. Set lite=false for full diagnostic data."New value: +"If true (default), returns minimal essential metrics only. Set lite=false for full diagnostic data. verbosity, when given, takes precedence." - added
Input schema / properties / verbosityAdded value: +{ + "anyOf": [ + { + "enum": [ + "minimal", + "standard", + "full" + ], + "type": "string" + }, + { + "type": "null" + } + ], + "default": null, + "description": "Tier: minimal (default); standard: bare EISV and risk, verdict/basin/mode with meanings, guidance; full: diagnostics." +}
- Changed
consult3 fields changed- changed
Input schema / properties / agent_id / descriptionPrevious value: -"UNIQUE agent identifier; optional when session-bound (auto-injected)."New value: +"UUID; leave unset for yourself." - changed
Input schema / properties / client_session_id / descriptionPrevious value: -"In-session binding id from start_session()/identity(); pass it on same-process calls. Not a cross-process proof."New value: +"Binding id for calls in this process; not a cross-process proof." - changed
Input schema / properties / continuity_token / descriptionPrevious value: -"Ownership proof from onboard()/identity(), for same-live-process rebinds only. Not a cross-process resume credential."New value: +"Same-process rebind proof only; never a cross-process resume."
- Changed
describe_tool3 fields changed- changed
Input schema / properties / agent_id / descriptionPrevious value: -"UNIQUE agent identifier; optional when session-bound (auto-injected)."New value: +"UUID; leave unset for yourself." - changed
Input schema / properties / client_session_id / descriptionPrevious value: -"In-session binding id from start_session()/identity(); pass it on same-process calls. Not a cross-process proof."New value: +"Binding id for calls in this process; not a cross-process proof." - changed
Input schema / properties / continuity_token / descriptionPrevious value: -"Ownership proof from onboard()/identity(), for same-live-process rebinds only. Not a cross-process resume credential."New value: +"Same-process rebind proof only; never a cross-process resume."
- Removed
health_check - Changed
identity4 fields changed- changed
Input schema / descriptionPrevious value: -"Who am I? Auto-creates identity if first call."New value: +"Resolve this session's bound agent (pass client_session_id), or set a cosmetic display name." - changed
Input schema / properties / agent_id / descriptionPrevious value: -"UNIQUE agent identifier; optional when session-bound (auto-injected)."New value: +"UUID; leave unset for yourself." - changed
Input schema / properties / client_session_id / descriptionPrevious value: -"In-session binding id from start_session()/identity(); pass it on same-process calls. Not a cross-process proof."New value: +"Binding id for calls in this process; not a cross-process proof." - changed
Input schema / properties / continuity_token / descriptionPrevious value: -"Ownership proof from onboard()/identity(), for same-live-process rebinds only. Not a cross-process resume credential."New value: +"Same-process rebind proof only; never a cross-process resume."
- Removed
knowledge - Added
list_tools - Changed
record_result3 fields changed- changed
Input schema / descriptionPrevious value: -"Parameters for outcome_event"New value: +"Outcome record parameters." - changed
Input schema / properties / client_session_id / descriptionPrevious value: -"In-session binding id from start_session()/identity(); pass it on same-process calls. Not a cross-process proof."New value: +"Binding id for calls in this process; not a cross-process proof." - changed
Input schema / properties / continuity_token / descriptionPrevious value: -"Ownership proof from onboard()/identity(), for same-live-process rebinds only. Not a cross-process resume credential."New value: +"Same-process rebind proof only; never a cross-process resume."
- Changed
request_review6 fields changed- changed
Input schema / descriptionPrevious value: -"Parameters for dialectic"New value: +"Review session parameters." - changed
Input schema / properties / client_session_id / descriptionPrevious value: -"In-session binding id from start_session()/identity(); pass it on same-process calls. Not a cross-process proof."New value: +"Binding id for calls in this process; not a cross-process proof." - changed
Input schema / properties / continuity_token / descriptionPrevious value: -"Ownership proof from onboard()/identity(), for same-live-process rebinds only. Not a cross-process resume credential."New value: +"Same-process rebind proof only; never a cross-process resume." - changed
Input schema / properties / issue_description / descriptionPrevious value: -"Issue description (for action=request)"New value: +"Issue description (action=request/quick)" - changed
Input schema / properties / proposed_conditions / descriptionPrevious value: -"Conditions for resumption (for action=thesis/synthesis)"New value: +"Conditions for resumption (for action=thesis/synthesis/consult)" - changed
Input schema / properties / root_cause / descriptionPrevious value: -"Root cause analysis (for action=thesis/synthesis)"New value: +"Root cause analysis (for action=thesis/synthesis/consult)"
- Changed
search_shared_memory37 fields changed- changed
Input schema / descriptionPrevious value: -"Parameters for knowledge"New value: +"Knowledge graph parameters." - added
Input schema / properties / agent_id_filterAdded value: +{ + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ], + "default": null, + "description": "Author agent UUID filter; wins over agent_id." +} - added
Input schema / properties / authority_modeAdded value: +{ + "anyOf": [ + { + "enum": [ + "prefer_governed", + "all" + ], + "type": "string" + }, + { + "type": "null" + } + ], + "default": null, + "description": "prefer_governed (default) down-ranks imported memory; all keeps raw order." +} - changed
Input schema / properties / client_session_id / descriptionPrevious value: -"In-session binding id from start_session()/identity(); pass it on same-process calls. Not a cross-process proof."New value: +"Binding id for calls in this process; not a cross-process proof." - removed
Input schema / properties / closure_classRemoved value: -{ - "anyOf": [ - { - "type": "string" - }, - { - "type": "null" - } - ], - "default": null, - "description": "Closing standard for action=update: fix_verified | unobserved | not_reproducible | obsolete | duplicate. 'fix_verified' needs a deployed change whose effect was observed." -} - removed
Input schema / properties / closure_evidenceRemoved value: -{ - "anyOf": [ - { - "additionalProperties": true, - "type": "object" - }, - { - "type": "null" - } - ], - "default": null, - "description": "Evidence for closure_class. Required keys: fix_verified needs {deployed, observed}; unobserved needs {window, instrument_check}." -} - removed
Input schema / properties / confidenceRemoved value: -{ - "anyOf": [ - { - "type": "number" - }, - { - "type": "string" - }, - { - "type": "null" - } - ], - "default": null, - "description": "Writer-supplied confidence for action=store, validated to 0-1; not independently verified or adjusted by governance metrics" -} - changed
Input schema / properties / continuity_token / descriptionPrevious value: -"Ownership proof from onboard()/identity(), for same-live-process rebinds only. Not a cross-process resume credential."New value: +"Same-process rebind proof only; never a cross-process resume." - added
Input schema / properties / created_afterAdded value: +{ + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ], + "default": null, + "description": "search: created after ISO time." +} - added
Input schema / properties / created_beforeAdded value: +{ + "anyOf": [ + { + "type": "string" + }, + { + "type": "null" + } + ], + "default": null, + "description": "search: created before this ISO time." +} - changed
Input schema / properties / discovery_type / descriptionPrevious value: -"action=store; one of architectural_decision, learning, pattern, bug_fix, refactoring, documentation, experiment, question, note, rule, insight, bug_found, bug, improvement, exploration, observation."New value: +"Filter by discovery type, e.g. bug_found." - removed
Input schema / properties / dry_runRemoved value: -{ - "anyOf": [ - { - "type": "boolean" - }, - { - "type": "string" - }, - { - "type": "null" - } - ], - "default": null, - "description": "Dry run mode (for action=cleanup, synthesize)" -} - removed
Input schema / properties / epoch_scopeRemoved value: -{ - "anyOf": [ - { - "enum": [ - "current", - "all" - ], - "type": "string" - }, - { - "type": "null" - } - ], - "default": null, - "description": "Stats/list scope: current epoch only or all epochs" -} - changed
Input schema / properties / include_archived / descriptionPrevious value: -"Include archived discoveries in search results (default: excluded)"New value: +"Include archived rows." - changed
Input schema / properties / include_cold / descriptionPrevious value: -"Include cold-storage (long-term) discoveries in search results (default: excluded)"New value: +"Include cold-storage rows." - changed
Input schema / properties / include_details / descriptionPrevious value: -"Expand results inline only with response_mode='full'; otherwise open one with knowledge(action='details')."New value: +"Inline details need response_mode='full'; else open one with knowledge(action='details')." - changed
Input schema / properties / include_provenance / descriptionPrevious value: -"Include provenance and lineage chain fields in search/details results"New value: +"Add provenance fields." - removed
Input schema / properties / include_response_chainRemoved value: -{ - "anyOf": [ - { - "type": "boolean" - }, - { - "type": "string" - }, - { - "type": "null" - } - ], - "default": null, - "description": "Include typed response chain for action=details" -} - removed
Input schema / properties / including_coldRemoved value: -{ - "anyOf": [ - { - "type": "boolean" - }, - { - "type": "string" - }, - { - "type": "null" - } - ], - "default": null, - "description": "Include cold-storage discoveries in action=list raw status aggregates" -} - removed
Input schema / properties / lengthRemoved value: -{ - "anyOf": [ - { - "type": "integer" - }, - { - "type": "null" - } - ], - "default": null, - "description": "Maximum details characters returned for action=details" -} - changed
Input schema / properties / limit / descriptionPrevious value: -"Max results (for action=search: min 1, values above 100 are capped, 0 or negative is rejected)"New value: +"Max results, 1-100 (more is capped)." - removed
Input schema / properties / max_chain_depthRemoved value: -{ - "anyOf": [ - { - "type": "integer" - }, - { - "type": "null" - } - ], - "default": null, - "description": "Maximum response-chain traversal depth for action=details" -} - removed
Input schema / properties / memory_contextRemoved value: -{ - "anyOf": [ - { - "type": "string" - }, - { - "type": "null" - } - ], - "default": null, - "description": "S22 provenance: memory/KG/transcript surfaces visible to the writer" -} - removed
Input schema / properties / min_membersRemoved value: -{ - "anyOf": [ - { - "type": "integer" - }, - { - "type": "null" - } - ], - "default": null, - "description": "Minimum discoveries a topic needs before it is rolled up (for action=synthesize, default 3)" -} - changed
Input schema / properties / min_similarity / descriptionPrevious value: -"Minimum cosine similarity for semantic retrieval modes"New value: +"Semantic similarity floor." - removed
Input schema / properties / offsetRemoved value: -{ - "anyOf": [ - { - "type": "integer" - }, - { - "type": "null" - } - ], - "default": null, - "description": "Character offset for action=details pagination" -} - added
Input schema / properties / recency_half_life_daysAdded value: +{ + "anyOf": [ + { + "exclusiveMinimum": 0, + "maximum": 36500, + "type": "number" + }, + { + "type": "null" + } + ], + "default": null, + "description": "search: score halves per N days." +} - removed
Input schema / properties / scopeRemoved value: -{ - "anyOf": [ - { - "enum": [ - "open", - "all", - "by_agent" - ], - "type": "string" - }, - { - "type": "null" - } - ], - "default": null, - "description": "KG audit scope for action=audit" -} - changed
Input schema / properties / search_mode / descriptionPrevious value: -"Force retrieval mode for action=search. 'semantic' and 'hybrid' fail honestly when unsupported by the active backend."New value: +"auto, or force fts/semantic/hybrid." - changed
Input schema / properties / semantic / descriptionPrevious value: -"Legacy action=search toggle to force or skip semantic retrieval when supported"New value: +"Legacy semantic on/off toggle." - changed
Input schema / properties / severity / descriptionPrevious value: -"Severity: low, medium, high, critical (for action=store or action=update)"New value: +"Filter by severity: low, medium, high, critical." - added
Input schema / properties / sort_byAdded value: +{ + "anyOf": [ + { + "enum": [ + "relevance", + "created_at" + ], + "type": "string" + }, + { + "type": "null" + } + ], + "default": null, + "description": "search order: relevance, or created_at (newest matches first)." +} - changed
Input schema / properties / tags / descriptionPrevious value: -"Tags (action=store, note); for action=search an exact any-of filter in every search mode."New value: +"Exact any-of tag filter." - removed
Input schema / properties / top_nRemoved value: -{ - "anyOf": [ - { - "type": "integer" - }, - { - "type": "null" - } - ], - "default": null, - "description": "Maximum stale entries returned by action=audit" -} - removed
Input schema / properties / topicRemoved value: -{ - "anyOf": [ - { - "type": "string" - }, - { - "type": "null" - } - ], - "default": null, - "description": "Synthesize just this one tag/topic (for action=synthesize). Omit to sweep the densest topics." -} - removed
Input schema / properties / use_llmRemoved value: -{ - "anyOf": [ - { - "type": "boolean" - }, - { - "type": "string" - }, - { - "type": "null" - } - ], - "default": null, - "description": "Use the local LLM for the rollup narrative (for action=synthesize, default true; falls back to deterministic when unreachable)" -} - removed
Input schema / properties / use_modelRemoved value: -{ - "anyOf": [ - { - "type": "boolean" - }, - { - "type": "string" - }, - { - "type": "null" - } - ], - "default": null, - "description": "Use the local model to assess stale entries for action=audit" -}
- Changed
self_recovery3 fields changed- changed
Input schema / properties / agent_id / descriptionPrevious value: -"UNIQUE agent identifier; optional when session-bound (auto-injected)."New value: +"UUID; leave unset for yourself." - changed
Input schema / properties / client_session_id / descriptionPrevious value: -"In-session binding id from start_session()/identity(); pass it on same-process calls. Not a cross-process proof."New value: +"Binding id for calls in this process; not a cross-process proof." - changed
Input schema / properties / continuity_token / descriptionPrevious value: -"Ownership proof from onboard()/identity(), for same-live-process rebinds only. Not a cross-process resume credential."New value: +"Same-process rebind proof only; never a cross-process resume."
- Changed
start_session3 fields changed- changed
Input schema / properties / agent_id / descriptionPrevious value: -"UNIQUE agent identifier; optional when session-bound (auto-injected)."New value: +"UUID; leave unset for yourself." - changed
Input schema / properties / client_session_id / descriptionPrevious value: -"In-session binding id from start_session()/identity(); pass it on same-process calls. Not a cross-process proof."New value: +"Binding id for calls in this process; not a cross-process proof." - changed
Input schema / properties / continuity_token / descriptionPrevious value: -"Ownership proof from onboard()/identity(), for same-live-process rebinds only. Not a cross-process resume credential."New value: +"Same-process rebind proof only; never a cross-process resume."
- Changed
store_finding7 fields changed- changed
Input schema / descriptionPrevious value: -"Parameters for knowledge"New value: +"Knowledge graph parameters." - changed
Input schema / properties / agent_id / descriptionPrevious value: -"Filter by agent (for action=get, search; omit when using discovery_id readback)"New value: +"Leave unset; the bound session is the writer." - changed
Input schema / properties / client_session_id / descriptionPrevious value: -"In-session binding id from start_session()/identity(); pass it on same-process calls. Not a cross-process proof."New value: +"Binding id for calls in this process; not a cross-process proof." - changed
Input schema / properties / content / descriptionPrevious value: -"Extended content/details (for action=store or action=note)"New value: +"Extended content/details (for action=store, note, or promote)" - changed
Input schema / properties / continuity_token / descriptionPrevious value: -"Ownership proof from onboard()/identity(), for same-live-process rebinds only. Not a cross-process resume credential."New value: +"Same-process rebind proof only; never a cross-process resume." - changed
Input schema / properties / details / descriptionPrevious value: -"Extended details for discovery (for action=store). Alias: content"New value: +"Extended details for discovery (for action=store or promote). Alias: content" - changed
Input schema / properties / summary / descriptionPrevious value: -"Discovery summary (for action=store)"New value: +"Discovery summary (for action=store or promote)"
- Changed
sync_state6 fields changed- changed
Input schema / descriptionPrevious value: -"Share your work and get supportive feedback. Your main tool for checking in."New value: +"Record a work check-in and get a governance decision." - changed
Input schema / properties / auto_export_on_significance / descriptionPrevious value: -"If true, automatically export governance history when thermodynamically significant events occur."New value: +"If true, write a governance history export whenever this check-in is judged significant: a risk spike, a coherence drop, a void threshold …" - changed
Input schema / properties / client_session_id / descriptionPrevious value: -"In-session binding id from start_session()/identity(); pass it on same-process calls. Not a cross-process proof."New value: +"Binding id for calls in this process; not a cross-process proof." - changed
Input schema / properties / complexity / anyOfPrevious value: -[ - { - "anyOf": [ - { - "type": "number" - }, - { - "type": "string" - } - ], - "ge": 0, - "le": 1 - }, - { - "type": "null" - } -]New value: +[ + { + "maximum": 1, + "minimum": 0, + "type": "number" + }, + { + "anyOf": [ + { + "pattern": "^(0(\\.\\d+)?|1(\\.0+)?|\\.\\d+)$", + "type": "string" + }, + { + "enum": [ + "complex", + "critical", + "high", + "low", + "medium", + "minimal", + "moderate", + "simple", + "trivial", + "very_high" + ], + "type": "string" + } + ], + "type": "string" + }, + { + "type": "null" + } +] - changed
Input schema / properties / confidence / anyOfPrevious value: -[ - { - "anyOf": [ - { - "type": "number" - }, - { - "type": "string" - } - ], - "ge": 0, - "le": 1 - }, - { - "type": "null" - } -]New value: +[ + { + "maximum": 1, + "minimum": 0, + "type": "number" + }, + { + "pattern": "^(0(\\.\\d+)?|1(\\.0+)?|\\.\\d+)$", + "type": "string" + }, + { + "type": "null" + } +] - changed
Input schema / properties / continuity_token / descriptionPrevious value: -"Ownership proof from onboard()/identity(), for same-live-process rebinds only. Not a cross-process resume credential."New value: +"Same-process rebind proof only; never a cross-process resume."
- Removed
update_finding - Added
use_tool
14 tool updates
- First observed
check_working_state - First observed
consult - First observed
describe_tool - First observed
health_check - First observed
identity - First observed
knowledge - First observed
record_result - First observed
request_review - First observed
search_shared_memory - First observed
self_recovery - First observed
start_session - First observed
store_finding - First observed
sync_state - First observed
update_finding
TDQS
Scored across 13 tools
Core tools target distinct governance actions, but several boundaries overlap: start_session vs identity, sync_state vs check_working_state vs record_result, and consult vs request_review can be confused. The verbose descriptions help clarify intended use, but an agent must read carefully to avoid misselection.
All names use snake_case, but the convention is mixed between verb_noun phrases (search_shared_memory, start_session) and bare nouns or verbs (identity, self_recovery, consult). It remains readable, but it is not a predictable verb_noun pattern throughout.
The 13 tools fit the governance/identity/knowledge-graph scope well and stay within a reasonable range. Each tool covers a distinct capability area, including discovery gateway tools needed for progressive advertisement.
The surface covers session/identity, state checks, findings, results, reviews, recovery, and progressive discovery via list_tools/describe_tool/use_tool. Some important operations such as update_finding and operator_resume_agent are only reachable indirectly through the gateway, which is workable but adds friction.
Maintenance
Related MCP Connectors
Autonomous and governed SRE & MLOps control plane for AI agent platforms.
Pre-execution governance for AI agents. Deterministic PASS/FAIL/REVIEW verdicts, replayable proof.
Connect, monitor, and control AI agents — tasks, approvals, schedules, and governance.
Deterministic runtime safety for AI agents: scan PII, gate tool actions, verify LLM output.
Related MCP Servers
- FlicenseAqualityFmaintenanceProvides policy-based access control, incident tracking, and compliance monitoring to govern AI agent behavior. It enables organizations to enforce security rules and maintain audit trails by validating agent actions against trust levels and pattern-based policies.61-
- AlicenseAqualityCmaintenanceRuntime policy enforcement for AI agents. Evaluate every agent action against your organization's policies before execution, with observe and enforce modes.11MIT

@vorionsys/mcp-serverofficial
AlicenseAqualityDmaintenanceMCP server for AI-agent governance using trust scoring, behavioral signals, and pre-flight action checks.1010 npm1Apache 2.0
Rigour MCPofficial
AlicenseNot gradedqualityBmaintenanceEnables AI agents to self-govern by scanning code for hardcoded secrets, structural violations, and AI drift in real-time, providing fix packets for automatic remediation.28MIT