Skip to main content
Glama

brain-v42

Persistent, typed project memory exposed through the Model Context Protocol (MCP). It stores decisions, learnings, snippets, runbooks, architecture decision records (ADRs), project focus, tickets, claims, and delivery evidence. PostgreSQL is the source of truth; PostgreSQL full-text search and pgvector provide retrieval, with optional reranking. Production uses hosted Mistral embeddings and hosted Voyage reranking with an OpenRouter Cohere fallback. Neo4j is an optional relationship projection.

brain-v42 is a Python 3.12 application built with FastMCP 3.x, SQLAlchemy's async engine, Pydantic, and Alembic. Release 0.7.3 ships no migration and keeps recovery contract v26: session relay and start answers return the project focus once instead of twice, with an optional compact briefing, on top of 0.7.2 (an explicit, tested bound on held MCP sessions (MCP_HTTP_MAX_SESSIONS, default 6000) that evicts the least recently active idle session at the cap instead of refusing every new one, the restore drill's asyncpg database URL scheme, and 4g/2g memory limits for the red-base MCP and PostgreSQL containers), 0.7.1 (migration 068 with recovery contract v26: merge chains are refused at commit by a deferred constraint trigger on the six tables carrying merged_into, the migrate preflight refuses the upgrade while any chain remains, and the chain repair also flattens cross-project chains under a separate expected count; it also ships the knowledge lifecycle run orchestration, its command line and real adapters, and a bounded wait for a lifecycle batch, still dormant (nothing schedules them), and mcp 1.30.0 (CVE-2026-59951)), 0.7.0 (migrations 066 and 067, recovery contract v25: the knowledge lifecycle tables and their dormant repository, pure decision, facts registry and batch extraction client (nothing runs them yet), exact project scopes with an own-focus grant for scoped writers, the relay shrink override requiring an elevation, feature chains covered by the historical chain repair, lifecycle refusals that name the corrective call, embedding transport errors degraded instead of raised, one shared stderr logging setup for the MCP server and the gateway, red-cockpit allowed on the metrics read routes through METRICS_READ_CLIENTS, and sharded CI test suites), 0.6.18 (search and consolidation hardening, MCP ergonomics, operability fixes, an hourly embedding backlog runner shipped dry and authenticated metrics reads for peers, with no migration and recovery contract v23), 0.6.17 (metrics M1 and MCP ergonomics), 0.6.16 (security and integrity follow-ups of lot 0.6.11), 0.6.15 (rerank budget), 0.6.14 (direct Voyage rerank) and 0.6.13 (programmes/v1, migration 065, recovery contract v23), and migrations 063 to 068. See Architecture, MCP tool reference, and Operations for detailed contracts and procedures.

Architecture

MCP clients ── authenticated HTTP BIND_ADDRESS:8765/mcp (production)
               or loopback HTTP /mcp (local) or stdio (dev/fallback)
                    │
              brain-v42 / FastMCP
               ├── PostgreSQL 16 + pgvector (source of truth)
               ├── hosted Mistral embeddings (OpenAI-compatible API)
               ├── hosted Voyage rerank → OpenRouter Cohere fallback
               └── Neo4j 5 (optional relationship projection)

MCP transport: production (red-base) = HTTP on the host's WireGuard address (BIND_ADDRESS, port 8765, path /mcp) in credentials mode, every call authenticated; local HTTP (workstation/dev) = loopback http://127.0.0.1:8765/mcp (the configuration default bind); configuration default and dev/fallback transport = stdio.

PostgreSQL is the single source of truth. Neo4j is a disposable projection fed by a relational ledger/outbox — it can always be rebuilt from PostgreSQL, never the other way around. The canonical path is active in production since 22 July 2026; design and evidence live in docs/ARCHITECTURE.md and the graph ledger runbook.

Embeddings are optional. When the configured service is unavailable, search falls back to full-text retrieval and writes can be stored without an embedding for later backfill. Production configures hosted Mistral codestral-embed-2505 embeddings and hosted reranking through deploy/compose.yaml. Hosted providers receive the text sent for embedding or reranking. The shim code defaults support an optional, local endpoint; the development docker-compose.yml can start one (embedding-shim) for local use only. The openai backend supports OpenAI-compatible embeddings; voyage uses Voyage directly and cohere supports Cohere-style APIs such as OpenRouter, TEI, Jina and vLLM. See the production contracts below.

EMBEDDING_DIMENSION defaults to 1536 and must be at most 2000 for pgvector's HNSW index. The ORM supports another dimension, but migrations 002, 005, 009, and 014 create 1536-dimensional columns. A non-default dimension therefore needs a deliberate schema adjustment and index rebuild after migration. Changing the document prefix on an existing corpus requires regenerating embeddings with scripts/regen_embeddings.py.

Related MCP server: Cortex MCP Server

Quick start

git clone https://github.com/hawkixs/brain-v42
cd brain-v42
uv sync --extra dev --python 3.12
source .venv/bin/activate
cp .env.example .env

Set POSTGRES_URL in .env for your PostgreSQL instance. For the repository's local Compose stack, set its PostgreSQL password consistently in .env, prepare the Compose-required Neo4j and embedding bearer secret files, and create the external brain-net network. Start the database services with docker compose up -d postgres neo4j; the optional embedding services require their model and GPU setup. See docker-compose.yml and Operations for the complete local service setup and secret handling.

For a local Compose setup, create its external network and secret files:

docker network create brain-net
install -d -m 0700 .secrets
read -rsp "Neo4j password: " PW
(umask 0022; printf 'neo4j/%s\n' "$PW" > .secrets/neo4j-auth)
unset PW
(umask 0177; openssl rand -hex 32 > .secrets/embedding-shim-bearer)

Run migrations and start the stdio server:

export POSTGRES_URL="$(grep -E '^POSTGRES_URL=' .env | cut -d= -f2-)"
BRAIN_ALEMBIC_ALLOW_PROD=1 alembic upgrade head
python -m brain_v42.mcp.server

The opt-in is required only when the database name is exactly brain; never export it persistently.

Alembic reads its URL from the environment, not directly from .env, and rejects DSN query parameters: use the plain postgresql+asyncpg://user:password@host:port/db form. Local HTTP in the default shared_token mode requires bearer authentication; an empty token is refused unless the explicit development-only unauthenticated option is enabled. Production (red-base) uses credentials mode instead, where MCP_HTTP_TOKEN must be absent. For local stdio MCP configuration:

claude mcp add brain-v42 -- python -m brain_v42.mcp.server

MCP tools

The compact profile is the default. It keeps the nine session lifecycle tools visible; other tools are discovered through the catalog search gateway and invoked through the catalog call gateway. The native profile exposes the registered tools directly. Inputs are bounded and HTTP request bodies have a configured size cap. Graph traversal tools require graph support to be enabled.

Domain

Tools

Search and generic CRUD

brain_search, brain_get, brain_list, brain_update, brain_delete

Graph traversal

brain_get_neighbors, brain_graph_path

Session lifecycle

brain_session_start, brain_session_capture, brain_session_heartbeat, brain_session_checkpoint, brain_session_end, brain_session_relay, brain_session_list, brain_session_resume, brain_session_bind, brain_session_abandon

Focus slots

brain_slot_open, brain_slot_list, brain_slot_close

Programme progress

brain_programme_upsert, brain_programme_gate_upsert, brain_programme_gate_report, brain_programme_request, brain_programme_list

Project context

brain_focus_history, brain_project_focus_get, brain_set_project_context, brain_project_archive, brain_project_unarchive, brain_list_projects, brain_update_project_focus, brain_list_project_groups

Decisions

brain_log_decision, brain_supersede_decision, brain_get_supersession_chain

Learnings

brain_learn, brain_validate_learning

Snippets

brain_save_snippet, brain_use_snippet

Runbooks

brain_create_runbook, brain_promote_runbook, brain_get_runbook, brain_execute_runbook

ADRs

brain_propose_adr, brain_promote_adr, brain_accept_adr, brain_deprecate_adr

Tickets and planning

brain_ticket_create, brain_ticket_reply, brain_ticket_transition, brain_ticket_plan, brain_ticket_list, brain_ticket_get, brain_reindex_plans

Observable delivery

brain_delivery_contract_set, brain_delivery_bind_pr, brain_delivery_get, brain_delivery_list, brain_delivery_refresh, brain_delivery_claim, brain_delivery_claim_renew, brain_delivery_claim_release, brain_delivery_accept, brain_delivery_attest, brain_delivery_attestation_list

Dream and graph maintenance

brain_backfill_links_batch, brain_get_clusters, brain_list_orphans_for_classification, brain_assign_domain, brain_list_curation_proposals, brain_reject_curation_proposals, brain_apply_curation_proposal, brain_decay_status, brain_refresh_entity, brain_consolidation_candidates, brain_merge_entities

Roadmap

brain_feature_create, brain_get_roadmap, brain_feature_update

Measured facts

brain_fact_list, brain_fact_get

Claims

brain_claim_verify, brain_claim_list, brain_claim_history

Workflow guidance

brain_workflow_guide

Full catalog, signatures, authorization behavior, and limits: docs/MCP_TOOLS.md. The two catalog gateways of the compact profile, brain_find_tool and brain_call_tool, are provided by the profile rather than registered as tools, so they are not counted above.

Observable delivery

Delivery records connect a ticket contract, pull request binding, persisted CI and integration observations, and requester acceptance. The observer is a separate process. Reads use persisted observations; they do not call GitHub. Delivery mutations can be disabled while reads and completion checks for existing contracts remain available. Tickets can carry a planned target_release.

Ledger and policy: the boundary with red-rail

Brain is the ledger; red-rail is policy. Brain stores attestation facts and validates their shape: the kind syntax, bounded JSON payload, and server-computed digest. It does not judge what a kind means or derive a completion refusal from an attestation. Attestations are append-only. red-rail reads the rows to calculate delivery policy and DORA metrics. The API contract is published as docs/contracts/delivery_attestations.json for consumers that must not import brain_v42.

Sessions

The user controls every session boundary: start, resume, end and abandon are explicit commands, never inferred by a hook, an agent or a client. Sessions capture the durable artifacts they produced into an exclusive ledger, and closing is fail-closed: captured knowledge or an explicit "nothing to capture" reason, never silence.

HTTP connections also have server-managed agent trace sessions. See docs/OPERATIONS.md, "Agent traces and the inactivity sweep", for their lifecycle. Derived capture and exact absorption are limited to the connections on which an operator session was observed. Operator sessions can bind to focus slots and relay their focus. Unbound session end and project-focus updates reject a shrink below 70 percent unless the operator explicitly overrides the guard.

After 24 hours without a heartbeat, an open session exposes is_stale=true; the marker is derived, the persistent status stays open, and only the 7-day server-side sweep ever abandons a session without an explicit user command.

See docs/MCP_TOOLS.md for the full lifecycle and slot contracts.

Configuration (.env)

The settings surface is defined in src/brain_v42/config.py. Common settings:

# Required
POSTGRES_URL=postgresql+asyncpg://brain:change-me-locally@localhost:5433/brain

# Optional local search endpoint, supplied separately (not production)
EMBEDDING_SERVICE_URL=http://localhost:8003
EMBEDDING_DIMENSION=1536
BRAIN_EMBEDDING_BACKEND=shim       # shim or openai
BRAIN_EMBEDDING_MODEL=qodo
BRAIN_EMBEDDING_QUERY_PREFIX=
BRAIN_EMBEDDING_DOCUMENT_PREFIX=
RERANKER_URL=http://localhost:8003
BRAIN_RERANK_BACKEND=shim          # shim, cohere, voyage or none

# Optional graph features
GRAPH_ENABLED=false
GRAPH_LEDGER_WRITE_ENABLED=false

# MCP behavior
BRAIN_MCP_PROFILE=compact          # compact or native
BRAIN_MCP_TRANSPORT=stdio          # stdio or http

# Optional services
METRICS_ENABLED=false
BRAIN_DELIVERY_ENABLED=false
LOG_LEVEL=INFO

For a no-GPU setup, point the OpenAI-compatible backend at a local endpoint such as Ollama: set BRAIN_EMBEDDING_BACKEND=openai, EMBEDDING_SERVICE_URL to its URL, BRAIN_EMBEDDING_MODEL to a model it serves, and EMBEDDING_DIMENSION=768.

Local HTTP binds to loopback by default; the default shared_token auth mode requires a non-empty MCP_HTTP_TOKEN. Production (red-base) uses BRAIN_MCP_AUTH_MODE=credentials: every MCP call needs a valid client credential, and MCP_HTTP_TOKEN must be absent. Never place MCP_HTTP_TOKEN or MCP_HTTP_DREAM_TOKENS in the shared .env; keep them in private, permission-restricted secret files such as mcp-token.env. GRAPH_PROJECTOR_*, provider API keys, and delivery observer credentials also require private configuration. Set EMBEDDING_DIMENSION unprefixed: the ORM reads it from the environment directly. See docs/OPERATIONS.md for the complete variable and secret reference.

Network trust model

The deployment targets personal agents on a trusted LAN. Production (red-base) publishes MCP on BIND_ADDRESS:8765 in credentials mode and metrics on BIND_ADDRESS:9200; PostgreSQL and Neo4j publish no host port. Local HTTP and development database publishes default to loopback, as do metrics and automation.

Embedding topology: production uses hosted embeddings via deploy/compose.yaml (x-embedding-env: EMBEDDING_BACKEND=openai, Mistral codestral-embed-2505, 1536 dimensions). The local endpoint http://localhost:8003 is optional for development only; the former workstation deployment is retired.

Reranker: production uses hosted Voyage rerank-3-lite with OpenRouter cohere/rerank-4-fast fallback via deploy/compose.yaml (x-rerank-env). Rollback replaces that block with BRAIN_RERANK_BACKEND="none" alone.

Production calls hosted HTTPS APIs with separate provider credentials. If you run a local endpoint on :8003, verify its bind and authentication before using it. Never expose a local shim or the MCP port to the Internet. Repository configuration alone does not prove the live firewall state.

Dream mode

Nightly agent pipeline (scripts/dream.sh: scan → clean → connect → synth → promote → reorg) plus server-side ticket-extraction, roadmap-curation and session-sweep jobs. Mutating phases are guarded by per-phase settings and capability scopes. They ship disabled and dry by default; operators can arm or suspend them. Provider chains can be configured, and phase execution records which provider served it. See Architecture and Operations. Each phase writes logs/dream/<date>_<project>_<phase>.chain.json; read it, because a green night on the first provider proves nothing about fallthrough.

Production state

The repository migration target is migration 068 (merge-chain guards; recovery contract v26 candidate). No page in this repository proves a live schema head — measure it, do not read it here:

docker exec brain_v42_postgres psql -U brain -d brain -Atc "select version_num from alembic_version;"

The running build names itself: GET /health returns version (the installed distribution) and alembic_head (the revision shipped with it), both measured, never written by hand.

Measured facts

The sentence above — measure it, do not read it here — is the rule. The facts registry is the mechanism that enforces it, so the session briefing can state the live schema head, the running release and the declared Dream killswitches without anyone retyping them into a document.

A fact is a named, versioned reader. Each one declares its target, its TTL, its timeout, its policies and the exact shape of the value it returns, and the catalogue is closed: probes are registered once at composition and then frozen, so no runtime caller can install a reader of its own.

What makes a reading trustworthy is not the probe but the source identity, and the identity a probe is checked against is declared independently by the operator — never derived from the connection the probe uses. A PostgreSQL reading must match a cluster system identifier, database, address and port the operator wrote down; a live_release reading must match the release SHA and package version the release tooling rendered; a host reading must match a declared hostname. Undeclared means no fact: the probe is refused at registration and the briefing says which one is missing and why, rather than leaving a silent gap. This closes the obvious hole — a probe that reports its own DSN back to you proves nothing about which database it reached.

A measurement has exactly two shapes and no third: Measured, carrying a bounded canonical JSON value and a digest over it, or Unreadable, carrying a closed error_code. A timeout, an unexpected identity or an over-large value each produce an Unreadable that renders as such — never a stale value dressed up as current.

Three targets ship today (production, live_release, host) and the catalogue is declared in src/brain_v42/facts/composition.py. Read it with brain_fact_list and brain_fact_get; facts declared briefing=true also render as lines in the session briefing.

Development

pytest tests/unit -v
pytest --cov=brain_v42 --cov-report=term-missing
ruff check src/ tests/
ruff format --check src/ tests/
mypy src/

The project requires Python 3.12.7 or newer; CI targets Python 3.12. Install with uv sync --extra dev --python 3.12 so the locked Git dependency and interpreter match CI. Unit tests do not require PostgreSQL. Tests that need a database require an isolated test database through BRAIN_V42_TEST_DB_URL and refuse production database targets. A session also refuses to start when the filesystem holding its temporary files (--basetemp, else PYTEST_DEBUG_TEMPROOT, else the system temp directory) has less free space than 5 % of its size, at least 5 GiB: a disk filled by old test directories once took a PostgreSQL on the same disk down. BRAIN_V42_TEST_MIN_FREE_GB sets the floor explicitly; 0 disables it.

Project layout

brain-v42/
├── src/brain_v42/
│   ├── config.py              # settings
│   ├── db/                    # SQLAlchemy engine and tables
│   ├── models/                # Pydantic models and contracts
│   ├── repositories/          # PostgreSQL, search, and graph adapters
│   ├── services/              # business logic, delivery, search, and Dream
│   ├── facts/                 # measured-fact registry
│   ├── metrics/               # sidecar and collectors
│   ├── automation/            # webhook and dedup runtime
│   └── mcp/                   # FastMCP server and tools
├── tests/{unit,integration}
├── alembic/versions/          # migrations shipped in the wheel
├── scripts/                   # operational commands
├── services/                  # embedding services and supervisor
├── deploy/                    # service definitions and installers
└── docs/                      # architecture, schema, tools, and operations

The high-level module graph is acyclic and checked in CI by scripts/check_module_layering.py. The check is static; runtime imports are not visible to it.

CI/CD

GitHub Actions is the CI/CD authority. Pull requests run lint, tests, security checks, and a Docker image build and smoke check on hosted runners. Pushes to main build and publish the container image; this rail does not deploy it. Version tags build and publish the wheel and source distribution after verifying that the wheel contains Alembic migrations and that the tag matches the package version. No rail deploys a release automatically.

Roadmap

Production runs on red-base through deploy/compose.yaml, deployed by the red-rail release rail as one Compose project: PostgreSQL, Neo4j, the MCP server, metrics sidecar, delivery observer, a one-shot migration service that proves the recovery contract, and Compose-scheduled work. Clients reach MCP over a private WireGuard network in credentials mode; MCP_HTTP_TOKEN must be absent. Only MCP (BIND_ADDRESS:8765) and metrics (BIND_ADDRESS:9200) publish host ports, and unauthenticated POST /mcp returns 401. The former workstation systemd deployment is retired. Each client service uses a scoped credential (read, write, delivery, or admin), with admin access granted only through time-boxed operator elevation. Delivery attestation issuers are planned to be proven against their credential in attestation API v1.1. Priorities are search and embedding quality, disaster-recovery proof, and metrics. Operators can suspend Dream and re-arm it later.

Versioning

  • The shipped version is 0.7.3, and it stays 0.x on purpose: a 1.0.0 would promise a stable interface and a way back, and this project has neither yet.

  • No lossless downgrade is promised, at any version. Several migrations protect stored history: 037 refuses when a session capture would be lost, 039 requires an explicit operator opt-in, 053 refuses once delivery workflow history exists, 054 refuses once a delivery attestation exists, 055 refuses once a claim, a verdict or a fact definition exists, 056 refuses while a project is archived (those two accept a named operator opt-in), 058 refuses once a server-extracted claim exists, 059 refuses while a ticket carries a target_release, and 060 refuses while a focus slot, a slot history row or a slot-bound session exists (both accept a named operator opt-in).

  • Follow the release's operator runbook for recovery. Keep the repository's migration target in place: the head the release ships, never a lower one. Rollback means selecting a release that supports that head or deploying a forward fix; it never means alembic downgrade, and never means restoring an older dump over a live database.

  • 0.6.0 introduced the headless-agents dependency. It is maintained in hawkixs/red-ha and pinned to tag v0.5.4 in pyproject.toml.

License

Source code: Apache-2.0.

Model weights are not covered by that license. No weights are stored in or distributed by this repository; operators download models from their publishers and accept the applicable terms. See NOTICE before redistributing anything.

Available Tools

11 tools
brain_call_toolA

Call a tool by name with the given arguments.

Use this to execute tools discovered via search_tools.

ParametersJSON Schema
NameRequiredDescriptionDefault
nameYesThe name of the tool to call
argumentsNoArguments to pass to the tool

TDQS

A3.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries full responsibility for behavioral disclosure. It only says 'Call a tool by name' and does not mention potential side effects, error behavior, dynamic execution risk, or that it can invoke arbitrary tools with arbitrary consequences. This is a significant gap for an execution tool.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, zero filler, action stated first. The second sentence provides essential context (use after search_tools) without redundancy. Excellent front-loading.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple 2-parameter tool, the description covers the core action and usage context. However, without an output schema or annotations, it omits return value behavior and error handling, which an agent might need when invoking arbitrary tools. It is adequate but not comprehensive.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100%, so the schema already documents both parameters. The description adds marginal value by linking parameters to 'given arguments' from search_tools, but does not enrich semantics beyond the schema. Baseline 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states a specific verb ('Call') and resource ('a tool by name with the given arguments'), and differentiates itself from discovery tools by positioning it as the execution step after search_tools. This makes it unambiguous against siblings like brain_find_tool.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The phrase 'Use this to execute tools discovered via search_tools' gives clear context of when to invoke it (after discovery) and implies it is not for searching. It does not explicitly exclude session-management siblings, but the usage context is sufficient for a generic dispatcher.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

brain_find_toolA

Search for tools using natural language.

Returns up to 5 matching tools ranked by relevance, each as a summary: name, one-line description, required parameters with types, optional parameter names. Pass an exact tool name to get that tool's full input schema.

ParametersJSON Schema
NameRequiredDescriptionDefault
queryYesNatural language query to search for tools

Output Schema

ParametersJSON Schema
NameRequiredDescription
resultYes

TDQS

A4.4/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden and does well: it discloses the hard result cap (up to 5), relevance ranking, the summary fields returned, and the exact-name mode that escalates to a full schema. It does not address auth or rate limits, but for a read-only search those are minor.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose is front-loaded in the first sentence, and the following sentences add return-format and mode details with no redundancy. Every sentence earns its place for a 1-param tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be re-explained, and the single parameter is fully documented. The description is complete enough to invoke the tool correctly, with only the downstream relationship to brain_call_tool left implicit.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% for the single query param, so the schema baseline is 3. The description adds real meaning by explaining that the same field drives two behaviors (natural language vs. exact tool name), which the schema alone does not convey.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb (search) and resource (tools) with the query modality (natural language), plus the result shape. It is trivially distinguishable from the brain_session_* siblings and brain_call_tool, which handle sessions and invocation rather than discovery.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description conveys two usage modes clearly: a natural-language query returns ranked summaries, while an exact tool name returns the full input schema. It does not explicitly name brain_call_tool as the downstream step or state when to prefer discovery over direct invocation, but the context is clear.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

brain_session_abandonB
DestructiveIdempotent

Abandon a session only from an explicit user command.

An agent tracer is the only session the server opens or closes on its own; no hook and no auto-close may invoke this lifecycle boundary.

ParametersJSON Schema
NameRequiredDescriptionDefault
reasonYes
session_idYes
expected_client_keyYesClient identity expected for the addressed session UUID. The pair must match before any session mutation. This is an isolation guard, not authentication.

TDQS

B3.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint=true and idempotentHint=true, which cover the destructive nature. The description adds the explicit-user-command constraint and notes that only an agent tracer session is server-managed. However, it does not describe consequences (e.g., irreversibility, impact on session data) beyond the annotation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two concise sentences, front-loaded with the primary action and constraint. The second sentence adds relevant context about the agent tracer without bloat.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a mutation tool with three required parameters and no output schema, the description is sparse. It does not explain what 'abandon' entails versus brain_session_end, what the response contains, or prerequisites beyond the schema. The annotation and schema cover only part of the operational context.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 33% (only expected_client_key has a description). The tool description provides no parameter information, failing to compensate for the low coverage. An agent receives no guidance on session_id or reason beyond the schema's minimal type constraints.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear action ('abandon a session') and resource, and adds a critical constraint ('only from an explicit user command'). It does not explicitly differentiate from the sibling brain_session_end, but the user-command qualifier hints at a distinct lifecycle role.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives explicit when-to-use guidance ('only from an explicit user command') and when-not-to-use ('no hook and no auto-close may invoke this lifecycle boundary'). It does not name alternative tools directly, but the constraint is unambiguous.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

brain_session_bindA
Idempotent

Bind an open operator session to one focus slot, from an explicit user command.

Once per session; binding the same slot again is a replay. From then on the session's end writes that slot only, never the project base: expected_focus_revision is the slot revision returned here. Refusals: session_not_open, session_is_agent_trace, session_already_bound, slot_not_found, slot_closed, slot_project_mismatch, slot_busy.

An agent tracer is the only session the server opens or closes on its own; no hook and no auto-close may invoke this lifecycle boundary.

ParametersJSON Schema
NameRequiredDescriptionDefault
slot_idYes
session_idYes
expected_client_keyYesClient identity expected for the addressed session UUID. The pair must match before any session mutation. This is an isolation guard, not authentication.

Output Schema

ParametersJSON Schema
NameRequiredDescription
slot_idYes
slot_bodyYes
session_idYes
slot_revisionYes

TDQS

A3.9/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations cover the safety profile (readOnly=false, idempotent=true, destructive=false), and the description goes further: it explains the downstream effect that `end` writes only the bound slot and never the project base, enumerates all seven refusal codes, and states the replay rule. This is unusually rich disclosure and consistent with the idempotentHint.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The key action and trigger are front-loaded in the first sentence, then constraints and refusals follow. The prose is dense with internal jargon and the refusal list is unglossed, but every sentence carries substantive information rather than filler.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, return values need not be described, and the description adequately covers lifecycle rules, replay behavior, and failure modes. Its one real gap is the near-total absence of input-parameter meaning, which is left to a thin schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is only 33%, with just `expected_client_key` documented inline. The description explains none of the three input parameters (slot_id, session_id, expected_client_key); the only parameter it references, `expected_focus_revision`, is not an input at all. It therefore fails to compensate for the coverage gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening clause states a specific verb and resource: 'Bind an open operator session to one focus slot.' It clearly belongs to the session lifecycle family, though it never names a sibling (e.g. brain_session_end/start) to disambiguate which lifecycle call to pick, so it stops short of full sibling differentiation.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives a clear triggering condition ('from an explicit user command') and a negative constraint ('no hook and no auto-close may invoke this lifecycle boundary'), plus once-per-session/replay semantics. What is missing is an explicit comparison to the adjacent lifecycle siblings an agent might otherwise choose.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

brain_session_captureA
Idempotent

Attach durable artifacts from an explicit user command — to repair or refine.

No longer a compulsory ritual. With derived capture armed, artifacts created during the session are attributed without this call, and end no longer demands a receipt. What this tool is for now: attaching something the derivation could not see — created outside the window, on another connection, or in another project — and saying so on the record.

It never steals: an artifact already attributed stays where it is.

An agent tracer is the only session the server opens or closes on its own; no hook and no auto-close may invoke this lifecycle boundary.

ParametersJSON Schema
NameRequiredDescriptionDefault
session_idYes
knowledge_idsYes
expected_client_keyYesClient identity expected for the addressed session UUID. The pair must match before any session mutation. This is an isolation guard, not authentication.

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already cover idempotency and non-destructiveness; the description adds that already-attributed artifacts are left in place and that this is not a compulsory step. It does not disclose return behavior, permissions, or failure modes, so with annotations lowering the bar, this is adequate but not rich.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Purpose and usage are front-loaded in the first paragraphs, but the explanation includes redundant historical context ('No longer a compulsory ritual' followed by the derived-capture explanation) and a final lifecycle sentence that is tangential. It is readable but not every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a side-effecting 3-parameter tool with no output schema and with annotations, the description provides enough usage context to call correctly, including scope and idempotent ownership behavior. It lacks explicit statements about return values or errors and uses jargon like 'derived capture' and 'receipt' without definition, so completeness is only moderate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema describes only expected_client_key; the description adds meaning for knowledge_ids as durable artifacts and specifies their suitability (outside window/connection/project), plus the 'never steals' rule for already-attributed IDs. It does not discuss session_id or expected_client_key beyond schema, so it only partially compensates for the 33% schema description coverage.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The first sentence identifies a specific action ('Attach durable artifacts') and trigger ('from an explicit user command'). Later text narrows the scope to artifacts the derivation could not see, which differentiates it from automatic capture, though it does not name sibling tools.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description explicitly states when to use the tool: for artifacts created outside the session window, on another connection, or in another project. It also says when it is not needed, because derived capture attributes normal session artifacts and `end` no longer requires a receipt. It stops short of naming sibling alternatives, but the when/when-not guidance is strong.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

brain_session_endA
DestructiveIdempotent

End a session from an explicit user command, on judgement alone.

nothing_to_capture_reason is now OPTIONAL. The old rule — a non-empty ledger XOR a written reason — measured whether the client had DECLARED its work. Derived capture feeds that signal from the server, and a check is hollow the moment the thing it checks can influence its own signal; worse, it made a session whose ledger the server had filled impossible to close. Give a reason if you have one to give; a blank one is still refused, because saying nothing and saying " " are not the same act.

What end still requires is what the server cannot produce for you: a summary and a next focus. It REPORTS unattributed_in_window — artifacts of this project created during the session that belong to no ledger — as a measure, never a gate. It cannot refuse a close, and a session cannot improve it by doing nothing.

For a bound session, expected_focus_revision is the SLOT revision (from bind, resume, or relay's slot.revision), never started_focus_revision.

For an UNBOUND session, next_focus REPLACES the project's whole base focus under a compare-and-swap on expected_focus_revision. SHRINK GUARD: a next_focus under 70% of the current base focus is refused before any write (base_focus_shrink, current, proposed and floor in the message) and the session stays open, so carry the durable content over and call again. A bound end REPLACES the whole slot body and meets the same 70% guard (slot_focus_shrink). allow_focus_shrink = true requires an active /brain-admin elevation for this credential and MCP connection; otherwise focus_shrink_override_refused is raised before any mutation. Shared-token and stdio callers cannot override; an operator relay can. A stale revision is still recorded as a conflict and closes the session, since nothing is written.

An agent tracer is the only session the server opens or closes on its own; no hook and no auto-close may invoke this lifecycle boundary.

ParametersJSON Schema
NameRequiredDescriptionDefault
summaryYes
next_focusYesREPLACES the whole project base focus for an unbound session, or the whole slot body for a bound session. A replacement under 70% of the current length is refused (`base_focus_shrink` or `slot_focus_shrink`), leaving the session open. The override is operator-only: an end requires an active /brain-admin elevation for this credential and MCP connection; an operator relay may also override. Carry all durable judgement and commitments forward, including decisions and deadlines with their reasons. Do not copy measurable state: each briefing recalculates it from its source.
session_idYes
allow_focus_shrinkNoThe override is operator-only and requires an active /brain-admin elevation for this credential and MCP connection, checked before any mutation (`focus_shrink_override_refused`). True allows a replacement under 70% of the whole base focus or slot body (`base_focus_shrink` or `slot_focus_shrink`); shared-token and stdio callers cannot override. An operator relay is also permitted.
expected_client_keyYesClient identity expected for the addressed session UUID. The pair must match before any session mutation. This is an isolation guard, not authentication.
expected_focus_revisionYes
nothing_to_capture_reasonNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
sessionYesPersistent state of one explicitly controlled concurrent session.
replayedYes
focus_diffNo
focus_at_endYes
current_focusYes
focus_outcomeYesPersisted outcome of the one focus update attempted while ending.
focus_revision_at_endNo
current_focus_revisionYes
unattributed_in_windowYes
remaining_open_session_countYes

TDQS

A4.2/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Despite rich annotations (destructive, idempotent, openWorld=false), the description adds substantial behavior the annotations cannot convey: the 70% shrink guard, the specific error codes raised (base_focus_shrink, slot_focus_shrink, focus_shrink_override_refused), the CAS on expected_focus_revision, and the fact that a stale revision is recorded as a conflict but still closes the session. It also clarifies that unattributed_in_window is a report and never a gate, and that the nothing_to_capture_reason rule was relaxed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose is front-loaded and the prose is dense with actionable detail, but it is well overlong and repeats the shrink-guard logic already present in the parameter descriptions. Passages like the justification of why the ledger XOR reason check was removed are rationale rather than invocation guidance.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a high-stakes mutation with an output schema available, the description supplies everything an agent needs: required inputs, guard thresholds, override authorization, failure codes, and conflict semantics. Return-value format is correctly left to the output schema.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With schema coverage at 43%, the description does real work: it defines what next_focus replaces for bound vs unbound sessions, distinguishes expected_focus_revision (slot revision) from started_focus_revision, and explains the operator-only nature of allow_focus_shrink. It adds less meaning for summary and nothing_to_capture_reason, which the schema largely covers.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The opening line states a specific verb and resource ("End a session") plus the trigger condition (explicit user command). It also distinguishes this lifecycle boundary from automatic machinery ("no hook and no auto-close may invoke this"). It never names the obvious sibling alternative (brain_session_abandon), so sibling differentiation is only partial.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It gives a clear when-to-use rule (explicit user command, on judgement alone) and an explicit when-not (no hook, no auto-close may call it). It also describes the preconditions for the override path (active /brain-admin elevation) and the compare-and-swap requirements. It stops short of routing the agent between end, abandon, and relay.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

brain_session_heartbeatA

Refresh an open session from an explicit user command.

An agent tracer is the only session the server opens or closes on its own; no hook and no auto-close may invoke this lifecycle boundary.

ParametersJSON Schema
NameRequiredDescriptionDefault
session_idYes
expected_client_keyYesClient identity expected for the addressed session UUID. The pair must match before any session mutation. This is an isolation guard, not authentication.

TDQS

A4.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=false, so the mutation is known. The description adds that this is a lifecycle boundary and only for explicit commands, but it does not explain what 'refresh' does to the session (e.g., extends timeout) or any side effects. It adds some context but not deep behavioral detail.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two sentences, zero wasted words. The main purpose is front-loaded, and the critical usage constraint is stated immediately after. Perfectly concise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a mutation with no output schema, the description is somewhat bare. It does not specify behavior for a closed session, failure modes, or the return value. The agent can infer that the session must be open from the phrase 'open session', but it is not explicitly guaranteed. Given the simplicity, this is adequate but not complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 50%: session_id has only a format, while expected_client_key has a detailed description. The tool description itself does not elaborate on either parameter. Since the missing session_id is self-explanatory (a UUID), the description does not need to compensate much, but it still adds no meaning beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description uses a specific verb ('refresh') with a clear resource ('an open session') and immediately distinguishes itself from siblings by stating it is the only lifecycle boundary invoked by explicit user command, not by hooks or auto-close. This fully differentiates it from brain_session_start/end/resume.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines5/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

It explicitly states when to use the tool ('from an explicit user command') and, more importantly, when not to use it ('no hook and no auto-close may invoke this lifecycle boundary'). This gives the agent a clear decision rule, even though alternatives are not named directly.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

brain_session_listA
Read-onlyIdempotent

List sessions only in response to an explicit user command.

An agent tracer is the only session the server opens or closes on its own; no hook and no auto-close may invoke this lifecycle boundary.

ParametersJSON Schema
NameRequiredDescriptionDefault
limitNo
offsetNo
statusNoopen
project_keyNo

TDQS

A3.7/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint and idempotentHint, so the safe read-only nature is established. The description adds meaningful behavioral context beyond those annotations: the server only auto-opens/closes an agent tracer session, and hooks/auto-close must never invoke this boundary. This is valuable context, though it does not describe list ordering, pagination, or return shape.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences with no filler. The primary action is front-loaded, and the critical invocation restriction is placed in the supporting sentence. Every sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The description fully covers the unusual invocation policy, which is likely the highest-risk aspect of this tool. However, with no output schema and no parameter descriptions, the agent still lacks context about what a session entry contains, which status filters mean, and what the list response looks like. Adequate for basic invocation but with meaningful gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, and the description does not compensate for any of the four parameters. The schema provides names, types, defaults, and the status enum, but meanings like 'stale', 'abandoned', and 'closed_inactive' are left unexplained, and project_key semantics are not addressed. With zero coverage, the description should add parameter context but does not.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a clear verb and resource ('List sessions') and adds a distinctive policy constraint: it runs only on explicit user command. It does not explain what kinds of sessions are returned or how this differs from sibling read tools, but the core purpose is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives an explicit when-to-use condition ('only in response to an explicit user command') and an explicit when-not-to-use condition ('no hook and no auto-close may invoke this lifecycle boundary'). It does not mention sibling alternatives, but the trigger and exclusion are clear enough for an agent to decide.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

brain_session_relayA
DestructiveIdempotent

Relay an open session onto its slot, or its project base: capture, end, restart.

One transaction: the named knowledge_ids are captured into the old session, the handover is written under a compare-and-swap, the old session ends, and a successor opens under new_client_key; its briefing follows. Two forms, and exactly one revision per call.

briefing defaults to full detail; compact returns counts and IDs in at most 4,000 characters. Focus text appears only in session.started_focus.

Bound session: send expected_slot_revision; the handover (at most 4,000 characters) REPLACES the whole slot body and the successor stays on the slot. A closed slot or a stale revision changes nothing and leaves the session open.

Unbound session: send expected_focus_revision, the BASE revision; the handover becomes the project's whole base focus and the successor is unbound. A stale revision (focus_revision_conflict) changes nothing and leaves the session open, unlike end, which closes anyway. SHRINK GUARD: a handover under 70% of the current base focus is refused (base_focus_shrink, both lengths in the message), because it REPLACES the whole base: carry the durable content over. An operator relay may pass allow_focus_shrink = true only with an active /brain-admin elevation for this credential and MCP connection; a guard mod never can.

The same 70% guard applies to a bound slot body (slot_focus_shrink). The override is enforced before mutation: only initiator='operator' can pass it, and only with an active /brain-admin elevation for this credential and MCP connection. A guard_mod relay is refused even if elevated.

An equal replay returns the same successor with replayed = true; any other payload on an ended session is terminal_conflict. The successor's next end or relay sends result.slot.revision (bound: the SLOT revision, from bind, resume, or relay) or result.focus_revision (unbound: the new BASE revision), never started_focus_revision for a bound one.

A guard mod the operator explicitly enabled may make this call as a standing user command, and only this one (Amendment — slot relay (ADR #34)); with initiator = 'guard_mod' it is refused while BRAIN_SESSION_RELAY_GUARD_MOD_ENABLED is false.

An agent tracer is the only session the server opens or closes on its own; no hook and no auto-close may invoke this lifecycle boundary.

ParametersJSON Schema
NameRequiredDescriptionDefault
summaryYes
briefingNofull
handoverYesREPLACES the whole project base focus for an unbound session, or the whole slot body for a bound session. A replacement under 70% of the current length is refused (`base_focus_shrink` or `slot_focus_shrink`), leaving the session open. Carry all durable content forward. The override is operator-only: an elevated /brain-admin session may override on end, or a relay with initiator='operator' may pass allow_focus_shrink=true. A guard_mod relay cannot override, even with elevation.
initiatorYes
session_idYes
knowledge_idsNo
new_client_keyYesStable identity for one intended session. Reuse it for every retry of that session; use a distinct stable key for each parallel session.
allow_focus_shrinkNoOperator-only override of the 70% guard for the whole base focus or slot body. Requires an active /brain-admin elevation for this credential and MCP connection; guard_mod is refused in code, even with elevation.
expected_client_keyYesClient identity expected for the addressed session UUID. The pair must match before any session mutation. This is an isolation guard, not authentication.
expected_slot_revisionNo
expected_focus_revisionNo
nothing_to_capture_reasonNo

Output Schema

ParametersJSON Schema
NameRequiredDescription
slotNo
sessionYesPersistent state of one explicitly controlled concurrent session.
briefingNo
replayedYes
focus_revisionNo
ended_session_idYes

TDQS

A4.5/5.0
Behavior5/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare destructiveHint=true, idempotentHint=true, and readOnlyHint=false, and the description corroborates and enriches all three: the handover REPLACES the whole slot body/base, equal replay yields `replayed=true`, and it discloses error names, CAS semantics, the 70% shrink guard, env-var gating, and elevation requirements. It adds substantial behavioral context beyond the annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The purpose is front-loaded but the body is dense and repetitive, restating the operator-only /brain-admin override rule in two separate paragraphs. For a 12-parameter lifecycle tool the length is defensible, but the redundancy costs conciseness.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness5/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given an output schema is present, the description needn't document return values, and it still explains replay and conflict outcomes. Between the description, schema, and annotations, an agent has the CAS, permission, and guard behavior needed to call this correctly.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With only 33% schema description coverage, the description carries the load: it defines `handover` replacement semantics (max 4,000 chars), the distinction between `expected_slot_revision` and the BASE `expected_focus_revision`, `allow_focus_shrink` operator-only behavior, and `briefing` full vs compact. It omits meaning for `summary` and `nothing_to_capture_reason`, so it does not fully compensate for the coverage gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb+resource (relay a session onto its slot or project base) and enumerates the composite effect: capture, end, restart. It explicitly differentiates from siblings, e.g. contrasting its stale-revision behavior with `end` and noting the capture of `knowledge_ids`, so an agent can place it against brain_session_end/brain_session_capture without opening schemas.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Clearly splits the two forms and the condition selecting each: bound sessions send `expected_slot_revision`, unbound send `expected_focus_revision`. It also names the guard_mod/operator gating condition. It lacks a crisp top-level 'use relay instead of capture+end+start when...' statement, so usage is well-contextualized but not framed as an explicit choice against all alternatives.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

brain_session_resumeB
Read-onlyIdempotent

Resume an open session from an explicit user command.

An agent tracer is the only session the server opens or closes on its own; no hook and no auto-close may invoke this lifecycle boundary.

ParametersJSON Schema
NameRequiredDescriptionDefault
session_idYes
expected_client_keyYesClient identity expected for the addressed session UUID. The pair must match before any session mutation. This is an isolation guard, not authentication.

Output Schema

ParametersJSON Schema
NameRequiredDescription
sessionYesPersistent state of one explicitly controlled concurrent session.
briefingNo
slot_closedNo
current_focusYes
open_session_countYes
current_focus_revisionYes

TDQS

B3/5.0
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations declare readOnlyHint=true and destructiveHint=false, yet the description calls this a "lifecycle boundary" that the server "opens or closes," and the schema states the client-key pair must match "before any session mutation." Resuming a session is an intentional state change, so the description directly contradicts the readOnly annotation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Two short sentences with the primary action stated first and the lifecycle constraint second; no filler. Slightly cryptic phrasing ("agent tracer") costs it a point but the structure is sound.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

An output schema exists, so return values need not be explained, and the description covers the invocation precondition (explicit user command). However, for a mutating lifecycle operation it omits what state changes on resume, error behavior for a closed/unknown session, and any detail on the undocumented session_id parameter.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 50%: expected_client_key is well documented in-schema, but session_id carries no description anywhere. The description adds no meaning about either argument (e.g., which session UUIDs are valid, what happens if the client key mismatches), so it fails to compensate for the coverage gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb (resume) and resource (an open session) and scopes it to explicit user commands, which separates it from the lifecycle-start path in siblings like brain_session_start. It does not name any sibling explicitly, so differentiation still requires inference from names alone.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

"From an explicit user command" gives a clear when-to-use trigger, and the second sentence effectively says when NOT to use it (no hooks, no auto-close). It stops short of naming the alternative to call for a brand-new session, so the routing guidance is good but not complete.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

brain_session_startA
Idempotent

Start or replay a concurrent session from an explicit user command.

briefing defaults to full detail; compact returns counts and IDs in at most 4,000 characters. Focus text appears only in session.started_focus.

An agent tracer is the only session the server opens or closes on its own; no hook and no auto-close may invoke this lifecycle boundary.

ParametersJSON Schema
NameRequiredDescriptionDefault
briefingNofull
client_keyYesStable identity for one intended session. Reuse it for every retry of that session; use a distinct stable key for each parallel session.
project_keyYes

Output Schema

ParametersJSON Schema
NameRequiredDescription
sessionYesPersistent state of one explicitly controlled concurrent session.
briefingNo
replayedYes
open_session_countYes

TDQS

A3.9/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare write/idempotent/non-destructive, so the description correctly focuses on non-obvious behavior: replay semantics, the briefing size cap, and the fact that no hook or auto-close can drive this lifecycle boundary. That is meaningful context beyond the structured fields, though permission/auth requirements are not covered.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Front-loads the core action in the first sentence and each subsequent sentence carries distinct content (briefing behavior, lifecycle constraints). The third sentence is somewhat dense but not wasteful.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With an output schema present, return values need not be explained, and the description covers the mutation's key semantics and the lifecycle restriction. The only notable gap is the undocumented `project_key` parameter.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is only 33%, so the description must compensate. It does explain the `briefing` semantics well ('full' detail vs. compact counts/IDs capped at 4,000 chars, focus only in session.started_focus), but `project_key` remains undocumented in both schema and description.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('Start or replay a concurrent session') and adds a scope qualifier ('from an explicit user command'). It is fairly distinguishable from siblings, though the boundary against brain_session_resume (vs. 'replay') is not made explicit.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

Gives a positive trigger ('from an explicit user command') and a clear exclusion ('no hook and no auto-close may invoke this lifecycle boundary'), which is real when/when-not guidance. It stops short of naming which sibling to use for the non-explicit cases.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 2 tool updatesv0.7.3
    • Changedbrain_session_relay1 field changed
      • addedInput schema / properties / briefing
        Added value: +{
        +  "default": "full",
        +  "enum": [
        +    "full",
        +    "compact"
        +  ],
        +  "type": "string"
        +}
    • Changedbrain_session_start1 field changed
      • addedInput schema / properties / briefing
        Added value: +{
        +  "default": "full",
        +  "enum": [
        +    "full",
        +    "compact"
        +  ],
        +  "type": "string"
        +}
  2. 2 tool updatesv0.7.0
    • Changedbrain_session_end2 fields changed
      • addedInput schema / properties / allow_focus_shrink
        Added value: +{
        +  "default": false,
        +  "description": "The override is operator-only and requires an active /brain-admin elevation for this credential and MCP connection, checked before any mutation (`focus_shrink_override_refused`). True allows a replacement under 70% of the whole base focus or slot body (`base_focus_shrink` or `slot_focus_shrink`); shared-token and stdio callers cannot override. An operator relay is also permitted.",
        +  "type": "boolean"
        +}
      • changedInput schema / properties / next_focus / description
        Previous value: -"Jugement et engagements pour la session suivante — ce qui n'est pas dérivable automatiquement (ex : ne pas publier ce brouillon et pourquoi, une échéance et sa raison, une décision opérateur à respecter). N'y recopie pas l'état mesurable (révision de schéma, HEAD git, arbre propre, résultat de suite de tests) : il est déjà recalculé à chaque briefing depuis la source réelle, et une copie manuelle se périme en silence."New value: +"REPLACES the whole project base focus for an unbound session, or the whole slot body for a bound session. A replacement under 70% of the current length is refused (`base_focus_shrink` or `slot_focus_shrink`), leaving the session open. The override is operator-only: an end requires an active /brain-admin elevation for this credential and MCP connection; an operator relay may also override. Carry all durable judgement and commitments forward, including decisions and deadlines with their reasons. Do not copy measurable state: each briefing recalculates it from its source."
    • Changedbrain_session_relay2 fields changed
      • addedInput schema / properties / allow_focus_shrink / description
        Added value: +"Operator-only override of the 70% guard for the whole base focus or slot body. Requires an active /brain-admin elevation for this credential and MCP connection; guard_mod is refused in code, even with elevation."
      • addedInput schema / properties / handover / description
        Added value: +"REPLACES the whole project base focus for an unbound session, or the whole slot body for a bound session. A replacement under 70% of the current length is refused (`base_focus_shrink` or `slot_focus_shrink`), leaving the session open. Carry all durable content forward. The override is operator-only: an elevated /brain-admin session may override on end, or a relay with initiator='operator' may pass allow_focus_shrink=true. A guard_mod relay cannot override, even with elevation."
  3. 3 tool updatesv0.6.7
    • Addedbrain_session_bind
    • Addedbrain_session_relay
    • Changedbrain_session_resume1 field changed
      • addedOutput schema / properties / slot_closed
        Added value: +{
        +  "default": false,
        +  "type": "boolean"
        +}
  4. 9 tool updatesv0.6.1
    • First observedbrain_call_tool
    • First observedbrain_find_tool
    • First observedbrain_session_abandon
    • First observedbrain_session_capture
    • First observedbrain_session_end
    • First observedbrain_session_heartbeat
    • First observedbrain_session_list
    • First observedbrain_session_resume
    • First observedbrain_session_start

TDQS

A3.6/5.0

Scored across 11 tools

Disambiguation3/5

The nine brain_session_* tools each nominally target a distinct lifecycle action, and the verbose descriptions clarify nuances, but several boundaries overlap heavily — relay internally performs capture+end+start, making it confusable with end/start, and start vs resume vs bind blur together. An agent could plausibly pick the wrong lifecycle tool for a given situation.

Naming Consistency4/5

All names are snake_case with a consistent brain_ prefix, so the set is readable. There is a minor structural deviation: session tools use brain_<noun>_<verb> (brain_session_start) while the meta tools use brain_<verb>_<noun> (brain_call_tool, brain_find_tool), but the pattern is still predictable.

Tool Count4/5

11 tools is within the well-scoped 3-15 range. The session lifecycle legitimately needs many operations, though nine session tools plus two meta tools is on the heavier side for what is essentially one domain.

Completeness4/5

The session lifecycle is thoroughly covered — start, heartbeat, capture, resume, bind, relay, end, abandon, list — plus meta tools for discovery and invocation. The only notable gap is that slots/focus are referenced extensively in relay/end but no tool here creates or manages slots, leaving a potential dead end for that sub-resource.

Maintenance

ActivityActive
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    B
    maintenance
    Provides persistent memory for AI coding agents via MCP, enabling teams to share and recall facts across sessions. Automatically captures, classifies, and curates knowledge from supported transcript sources.
    18
    8 npm
    1
    AGPL 3.0
  • A
    license
    Not graded
    quality
    A
    maintenance
    Provides persistent, searchable memory across coding projects and machines, letting agents record and retrieve projects, reusable assets, sessions, decisions, commits, and handoffs via MCP.
    19 PyPI
    2
    Apache 2.0
  • F
    license
    Not graded
    quality
    C
    maintenance
    Enables AI coding agents and IDEs to capture conversations, extract structured knowledge into a queryable graph database, and recall past decisions, patterns, files, and errors across all projects and workspaces. Provides persistent memory tools for saving, searching, and cleaning up knowledge via MCP.
    2
    -