Pandaone Guard
Integrates with Git to enforce audit compliance on commits via read-only locks, watchdog rollback, and pre-commit validation, ensuring every committed file has an APPROVED audit record.
Uses GitHub Actions as a final defense layer to validate audit records during CI, rejecting PRs without proper Pandaone approval before merge.
Provides a pre-commit hook that strictly validates every staged file against Pandaone's approved audit records, blocking commits for unapproved changes.
Pandaone
🧑💼 Pandaone is your codebase's personal manager. / Pandaone 是你代码库的专属经理。
Every AI agent is an employee working in your company — your codebase. Without a personal manager, employees do what they want — edit files, push commits, break production — and you have no idea what they did, when, or why.
Pandaone is the personal manager you hired to protect your code. Every AI agent — Claude, Cursor, Trae, or any tool you adopt tomorrow — must report to Pandaone first. Nothing gets written, nothing gets committed, nothing gets deployed until Pandaone approves it with a signed, auditable receipt:
┌─────────────────────────────────────────────┐
│ [APPROVED] 2026-09-11 03:47 │
│ File: src/payment.py │
│ Agent: Claude Code (employee #3) │
│ Reason: "Fix rounding" │
│ Problem: "Charge $50,001 on $50,000 bill" │
│ Approach: "Round before transfer, not after"│
│ Commit: a3f7b2c │
└─────────────────────────────────────────────┘Without a personal manager, your agents move money — er, code — without receipts:
Without Pandaone With Pandaone
────────────── ──────────────
$50,000 ??? $50,000 src/payment.py
Reason: "Fix rounding"
By: Claude Code
When: 2026-09-11 03:47
Commit: a3f7b2cThe left column is how most AI-agent-driven codebases look today. The right column is how yours will look with one command:
pip install pandaone-guardYour personal manager is on duty 24/7 — before, during, and after every code change. Every AI agent — Claude, Cursor, Trae — operates under one auditable protocol. No exceptions. No bypass.
AI Agent 代码审计门禁 — 让每一次代码改动都留下合规、可追溯的证据链。
Related MCP server: SpecLock
中文 / Chinese
是什么? / What is it?
Pandaone 是一个 7 层防御体系,强制 AI Agent(或任何开发者)写代码前必须经过审计:
任何受保护文件的修改都必须通过 pandaone write 命令,留下 reason / problem / approach 三段式审计记录。
适用场景 / Use Cases:
🤖 AI Agent 开发:防止 Agent 绕过审查直接改代码
🏢 企业合规:满足 SOC2 / ISO 27001 等代码变更审计要求
👥 团队协作:所有 PR 必须有审计记录才能合入
核心特性 / Core Features
17 种文本格式 + 24 种二进制格式保护(
.py/.md/.json/.yml/.env/.png/.pdf/ ...)7 层防御体系 / 7-Layer Defense System (see Defense Layers)
MCP Server 原生支持 — Claude / Cursor / Trae 等 AI IDE 直连
13 种审计日志导出格式(Excel / Word / PDF / SQLite / ...)
纯 Python — Windows / macOS / Linux 通吃,无 C 扩展
右键菜单集成 — 一行命令在 3 大平台安装原生右键菜单(HKCU / Quick Action / Nautilus + Dolphin)
i18n 国际化 —
zh-CN/en双语 CLI 自动检测 +--lang强制 + 持久化偏好
快速开始 / Quick Start
安装 / Installation
方式 A:从 PyPI 安装(最简单)
pip install pandaone-guard
# 一键装上右键菜单(Windows / macOS / Linux 自动检测)
pandaone install-context方式 B:从源码一键安装(推荐开发者使用,含最新 i18n + CI lint)
git clone https://github.com/hellob1889/Pandaone-AI-Agent.git
cd pandaone
# Windows
powershell -ExecutionPolicy Bypass -File scripts/install.ps1
# macOS / Linux
./scripts/install.sh安装脚本自动做 / Install script auto-handles:
检测 Python ≥ 3.10
探测 git(不在 PATH 时尝试常见安装路径)
卸载 site-packages 里可能存在的老 pandaone 版本(避免版本冲突)
pip install -e .本地源码 editable 安装验证 pandaone 可用(
python -m pandaone --version)调用
doctor.py --fix --persist-path自动修复剩余问题(依赖、setuptools、指纹、PATH 持久化到 HKCU)
环境诊断(任何时候都能跑)/ Environment Diagnostics (run anytime)
python scripts/doctor.py # 人类可读
python scripts/doctor.py --json # CI 用(返回 pass/fail)
python scripts/doctor.py --quiet # 只显示 WARN / FAIL
python scripts/doctor.py --fix # 自动修复 13 类问题(仅当前会话生效)
python scripts/doctor.py --fix --persist-path # 持久化 PATH 到 HKCU(重启 shell 生效)
python scripts/doctor.py --fix-only # 只跑修复 + 重测,跳过详细诊断检测 9 个项目 + 自动修复 13 类问题(pip / git / pandaone 装在 site-packages / pandaone.exe PATH / 指纹污染 / setuptools / 5 个运行时依赖)。
--fix --persist-path 会做什么:
卸载 site-packages 老版本 → 重装本地源码
删除污染的
~/.pandaone_fp.txt自动
pip install缺失的运行时依赖Windows:用
setx PATH "%PATH%;<Scripts>"持久化到HKCU\Environment\Path(新开的 PowerShell 自动看到)macOS / Linux:追加
export PATH="..."到~/.bashrc/~/.zshrc
初始化项目 / Initialize Project
cd /path/to/your-project
pandaone init --root .
# 自动:
# - 创建 .pandaone/ 目录
# - 生成 config.json(17 文本 + 24 二进制扩展名)
# - 创建 binary_snapshots.json(SHA256 字典)
# - 初始化 .gitignore 排除写代码(合规路径)/ Write Code (Compliant Path)
# 修改 Python 文件
pandaone write \
--file src/main.py \
--reason "修复 user_id 类型注解" \
--problem "原代码用 int,实际可能是 None" \
--approach "改为 Optional[int]" \
--old 'def get_user(user_id: int):' \
--new 'def get_user(user_id: Optional[int]):'
# 替换二进制文件(图片/文档/PDF 等)
pandaone write \
--file assets/logo.png \
--reason "更新品牌 logo" \
--problem "旧 logo 与新品牌色不匹配" \
--approach "用新版 logo 替换" \
--from-file /tmp/new_logo.png查看审计日志 / View Audit Log
# 命令行查看
pandaone log --last 10
# 导出为 Excel
pandaone log --format xlsx --output audit_report.xlsx
# 导出为 PDF(含中文支持)
pandaone log --format pdf --output audit_report.pdf
# 全部 13 种格式:text / csv / tsv / json / yaml / md / html / xlsx / docx / pdf / sqlite / rst / asciidoc项目状态仪表盘 / Project Status Dashboard
pandaone status --root .显示 / Displays:项目路径、配置摘要、L1 锁定状态、二进制快照、最近审计、版本指纹等。 Project path, configuration summary, L1 lock state, binary snapshots, recent audits, version fingerprints, etc.
🆕 Web 实时仪表盘 / Web Real-time Dashboard:
pandaone serve # 浏览器打开 http://localhost:8765防御体系(7 层) / Defense Layers (7 Layers)
层 / Layer | 组件 / Component | 作用 / Function | 被绕过后的兜底 / Fallback if Bypassed |
L1 | file chmod | 文件级只读锁(attrib +r / chmod -w)File-level read-only lock | L2 watchdog |
L2 | watchdog | 实时文件监控 + git checkout 回滚Real-time file monitor + git checkout rollback | L3 hook |
L3 | pre-commit hook | 严格校验每个 staged 文件的 APPROVED 记录Strict validation of APPROVED record for every staged file | L4 / L5 |
L4 | 启动读 READMERead README on startup | CLI 启动时加载项目元数据CLI loads project metadata at startup | L5 |
L5 | 自指纹Self-fingerprint | CLI 自身 SHA256 检测篡改CLI's own SHA256 detects tampering | L6 |
L6 | 二进制 SHA256 snapshotBinary SHA256 snapshot | 检测 .png/.pdf 等二进制篡改Detects tampering of .png/.pdf binaries | L7 |
L7 | GitHub Actions CI | PR 合入前审计验证(最终兜底)Audit verification before PR merge (final fallback) | 人工 reviewManual review |
MCP Server(AI Agent 直连 / AI Agent Native)
// claude_desktop_config.json 或 Cursor MCP 配置
// claude_desktop_config.json or Cursor MCP configuration
{
"mcpServers": {
"pandaone": {
"command": "pandaone-mcp",
"env": {}
}
}
}暴露 11 个工具:pandaone_init / pandaone_lock / pandaone_unlock / pandaone_write / pandaone_log / pandaone_status / pandaone_install_hook / pandaone_watch / pandaone_install_git / pandaone_fingerprint_update / pandaone_ci
所有 11 个工具都已声明完整的 4 个 MCP annotations(readOnlyHint / destructiveHint / idempotentHint / openWorldHint)—— OpenAI 目录合规(v0.7.14 修复)。
在 ChatGPT 中使用 / Use with ChatGPT
ChatGPT Desktop app 的 Developer Mode(开发者模式)原生支持 MCP server。把 pandaone 加进去:
步骤:
打开 ChatGPT Desktop app
Settings→Beta features→ 开启 Developer ModeSettings→Connectors→Create new connector填入以下 JSON(字段名一字不差):
{
"name": "pandaone-guard",
"command": "pandaone-mcp",
"args": [],
"env": {}
}第一次对话前,ChatGPT 会要求安装 pandaone-guard。如未自动装,在终端手动跑:
# macOS / Linux
pip3 install pandaone-guard
# Windows (PowerShell)
pip install pandaone-guard进阶(自定义 venv / Python 路径 / 中文界面):
{
"name": "pandaone-guard",
"command": "/path/to/venv/bin/python",
"args": ["-m", "pandaone_mcp"],
"env": {
"PANDAX_LANG": "zh"
}
}环境变量说明 / Environment variables:
变量 | 类型 | 默认 | 说明 |
| 🔐 secret |
| 仅 |
| config |
| 界面语言( |
| config | unset | 设 |
| config | unset | 设 |
只有一个 secret:PANDAX_FP_PASSWORD。本地配置,永不上传到任何远程。
真实场景测试 / Real-World Validation
完整实战验证报告:实战验证报告.md
包含 / Includes:
7 层防御每层实战证据 / 7-layer defense, each layer with real-world evidence
L3 hook 严重 bug 的发现 + 修复
隐藏文件锁定 bug 的发现 + 修复
13 种导出格式实测 / 13 export formats tested
MCP 协议完整工作流
详细示例集 / Detailed Examples
EXAMPLES.md — 10 个真实工作流 + 终端输出
examples/ — 5 个可运行的 Python demo 脚本
docs/ — 中英双语文档站(mkdocs)
docs/index.html — 交互式 HTML 文档首页(带终端动画)
命令清单 / Command List
命令 / Command | 用途 / Purpose |
| 初始化项目 |
| 锁定 / 解锁所有受保护文件 |
| 核心:审计写入(支持文本/二进制) |
| 查询审计历史(13 种导出格式) |
| 项目状态仪表盘 |
| 安装 L3 pre-commit hook |
| 启动 L2 watchdog 守护进程 |
| 🆕 Web 实时仪表盘(浏览器打开 |
| 自动安装 git |
| L7 CI 验证(git diff vs audit log) |
| 启动 MCP server(stdio JSON-RPC) |
开发与测试 / Development & Testing
git clone https://github.com/hellob1889/Pandaone-AI-Agent
cd pandaone
pip install -e .[dev]
pytest tests/ -v当前测试数:342 passed, 1 skipped(覆盖 i18n / write / status / lock / ci / watchdog / export / init / e2e / serve / desktop-icon / gitignore)
路线图 / Roadmap
版本 / Version | 状态 / Status | 关键能力 / Key Capability |
v0.1.0 | ✅ | Phase 1-3 MVP(5 层防御) |
v0.2.0 | ✅ | 多格式导出(7 种) |
v0.3.0 | ✅ | 17 种文本保护 |
v0.4.0 | ✅ | 24 种二进制 SHA256 |
v0.5.0 | ✅ | MCP Server |
v0.6.0 | ✅ | GitHub Actions CI |
v0.6.1 | ✅ | L3 hook 强化(实战验证) |
v0.6.2 | ✅ | 隐藏文件锁定 bug 修复 |
v0.7.0 | ✅ | Phase 9 OS 右键菜单 + Phase 10 i18n(zh-CN/en)+ doctor.py 环境自检 + auto-fix 13 类 + PATH 持久化 |
v0.7.1 | ✅ | 28 个 bug 全修 + 4 大新功能:P0 安全(#8/#12×2/#22/#23)+ P1(#2/#5/#15/#29)+ P2(#21/#6/#20/#9-#10)+ P3(#13/#4/#26/#39)+ UX(#14/#17/#48/#25/#28)+ 工程化(#版本漂移 / #README 分组标签 / #CRLF 根因)+ 🆕 文件夹熊猫锁图标(desktop.ini + ICO)+ 🆕 Web 实时仪表盘(watchdog + SSE <100ms)+ 🆕 Git 兼容(init 自动写 .gitignore)+ 🆕 右键菜单真实可用验证,298 测试通过 |
v0.7.2 | ✅ | CI 工程化修复:publish.yml Tests job 在干净 ubuntu-latest 容器 25s exit 1(setuptools pin 缺失)→ pin |
v0.7.3 | ✅ | agent 身份 + diff 捕获 + 面板 UI: |
完整历史:CHANGELOG.md
许可 / License
MIT License — 详见 LICENSE
English
What is it?
Pandaone is a 7-layer defense system that forces every code change through an audit gate.
Any modification to a protected file (17 text + 24 binary formats) must go through pandaone write,
which records reason / problem / approach as immutable audit evidence.
Use cases
🤖 AI Agent development: prevent agents from bypassing review
🏢 Enterprise compliance: meet SOC2 / ISO 27001 code change audit requirements
👥 Team collaboration: every PR must have audit records before merging
Install
Option A: from PyPI (easiest)
pip install pandaone-guardOption B: from source (recommended for developers, includes latest i18n + CI lint)
git clone https://github.com/hellob1889/Pandaone-AI-Agent.git
cd pandaone
# Windows
powershell -ExecutionPolicy Bypass -File scripts/install.ps1
# macOS / Linux
./scripts/install.shThe install script automatically:
Checks Python >= 3.10
Locates git (scans common install paths if not in PATH)
Removes stale pandaone from site-packages (prevents version conflicts)
pip install -e .local source editable installVerifies pandaone works (
python -m pandaone --version)Runs
doctor.py --fix --persist-path(auto-fix remaining issues: deps / setuptools / fingerprint / persist PATH to HKCU)
Environment diagnostics (run anytime)
python scripts/doctor.py # human-readable
python scripts/doctor.py --json # CI mode (returns pass/fail)
python scripts/doctor.py --quiet # only WARN / FAIL
python scripts/doctor.py --fix # auto-fix 13 issue classes (session only)
python scripts/doctor.py --fix --persist-path # persist PATH to HKCU (new shell)
python scripts/doctor.py --fix-only # just fix + re-check, skip detailed diagnosisChecks 9 items + auto-fixes 13 issue classes (pip / git / pandaone-in-site-packages / pandaone.exe PATH / fingerprint pollution / setuptools / 5 runtime dependencies).
What --fix --persist-path does:
Uninstall stale site-packages version, reinstall local source
Remove polluted
~/.pandaone_fp.txtAuto
pip installfor missing runtime depsWindows: use
setx PATH "%PATH%;<Scripts>"to persist toHKCU\Environment\Path(new PowerShell shells see it automatically)macOS / Linux: append
export PATH="..."to~/.bashrc/~/.zshrc
Quick start
cd /path/to/your-project
pandaone init --root .
pandaone write \
--file src/main.py \
--reason "Fix user_id type annotation" \
--problem "Original used int, could be None" \
--approach "Change to Optional[int]" \
--old 'def get_user(user_id: int):' \
--new 'def get_user(user_id: Optional[int]):'7 Defense Layers
Layer | Component | Purpose |
L1 | file chmod | File-level read-only lock |
L2 | watchdog | Real-time file monitoring + git checkout rollback |
L3 | pre-commit hook | Strict per-file APPROVED validation |
L4 | startup README | CLI loads project metadata on startup |
L5 | self-fingerprint | CLI's own SHA256 detects tampering |
L6 | binary SHA256 snapshot | Detect .png/.pdf binary tampering |
L7 | GitHub Actions CI | Pre-merge audit verification (final backstop) |
MCP Server
{
"mcpServers": {
"pandaone": {
"command": "pandaone-mcp",
"env": {}
}
}
}Exposes 11 tools for AI agents (Claude / Cursor / Trae).
All 11 tools declare the full set of 4 MCP annotations (readOnlyHint / destructiveHint / idempotentHint / openWorldHint) — OpenAI directory compliant (fixed in v0.7.14).
Use with ChatGPT
ChatGPT Desktop app's Developer Mode natively supports MCP servers. To add pandaone:
Steps:
Open ChatGPT Desktop app
Settings→Beta features→ enable Developer ModeSettings→Connectors→Create new connectorPaste this JSON (field names must match exactly):
{
"name": "pandaone-guard",
"command": "pandaone-mcp",
"args": [],
"env": {}
}ChatGPT will offer to install
pandaone-guardon first use. If it doesn't auto-install, run manually:
# macOS / Linux
pip3 install pandaone-guard
# Windows (PowerShell)
pip install pandaone-guardAdvanced (custom venv / Python path / English interface):
{
"name": "pandaone-guard",
"command": "/path/to/venv/bin/python",
"args": ["-m", "pandaone_mcp"],
"env": {
"PANDAX_LANG": "en"
}
}Environment variables:
Variable | Type | Default | Purpose |
| 🔐 secret |
| Only needed for |
| config |
| UI language ( |
| config | unset | Set to |
| config | unset | Set to |
Only one secret: PANDAX_FP_PASSWORD. Local config only, never sent to any remote.
License
MIT — see LICENSE
Links
Available Tools
11 toolspandaone_ciARead-onlyIdempotent
CI 审计验证:对比 base..head 的所有改动,确认每条变更都通过 pandaone write 审计
| Name | Required | Description | Default |
|---|---|---|---|
| base | No | 基线分支 | origin/main |
| head | No | 对比分支 | HEAD |
| root | Yes | . |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint false. The description adds behavioral context: it diffs all changes in the range and verifies each against the pandaone write audit. It does not mention failure/exit behavior, but safety characteristics are covered by annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One compact sentence conveys purpose, scope, and audit criterion without filler. The tool's role is front-loaded and every part of the sentence earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a read-only, idempotent audit tool with defaults for base and head, the description is mostly sufficient for selection and invocation. However, there is no output schema and the description does not state what happens when an audit fails or what the tool returns, leaving some ambiguity for CI result handling.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description adds useful relational meaning by showing that base and head define the comparison range ('base..head'). However, schema coverage is 67% and the root parameter lacks a description in both the schema and the tool description, so parameter semantics are only partially compensated.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action and resource: CI audit validation that compares base..head and confirms every change passed pandaone write audit. This clearly distinguishes the tool from siblings like pandaone_write (the audited operation) and pandaone_status.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The 'CI 审计验证' framing gives an explicit context for when the tool is appropriate, and the base..head comparison defines its operational scope. It does not name alternatives or exclusions, but the intended usage is clear enough for an agent.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pandaone_fingerprint_updateAIdempotent
更新密码指纹(用于 watch 守护进程鉴权)
| Name | Required | Description | Default |
|---|---|---|---|
| password | Yes | 新密码 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already provide readOnlyHint=false, idempotentHint=true, and destructiveHint=false, indicating a non-destructive, idempotent mutation. The description adds the purpose context (authentication for watch daemon) but does not disclose any additional behavioral details beyond what annotations imply. It does not contradict annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that states the action and purpose, with no redundant wording. It is front-loaded with the core action and immediately clarifies context.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with one parameter, no output schema, and annotations covering idempotency and destructiveness, the description is adequate. It explains what it does and why, leaving no major gaps for an agent to invoke it correctly. A slight gap exists in not specifying any prerequisites or effects on existing fingerprints, but given the tool's simplicity, this is acceptable.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema covers all parameters (password with description '新密码'), and the description does not add extra meaning beyond that. It does not explain password format, encoding, or any constraints, but with 100% schema coverage, the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb (update) and resource (password fingerprint), and clearly mentions the purpose (used for watch daemon authentication). This distinguishes it from all sibling tools, which focus on logging, hooks, git, CI, lock/unlock, init, write, and status operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage by mentioning the watch daemon authentication, but it does not explicitly say when to use this tool vs alternatives, nor does it exclude other tools. There is no mention of when not to use it or any prerequisites, leaving some ambiguity.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pandaone_initB
在指定目录初始化 Pandaone AI Agent(创建 .pandaone/、config.json、pandaone.jsonl、可选 binary_snapshots.json)
| Name | Required | Description | Default |
|---|---|---|---|
| ext | No | 自定义受保护扩展名(如 ['.py', '.md']) | |
| root | Yes | 项目根目录路径 | . |
| no_binary | No | 禁用二进制 SHA256 快照保护 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already signal that this is not read-only, not destructive, and not idempotent. The description adds value by enumerating what files get created, but it does not disclose behavior on repeated runs or whether existing files are preserved/overwritten, which matters given idempotentHint=false.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
One compact sentence conveys the core action and key artifacts with no filler. It is not broken into sections, but for a small tool that is acceptable.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 3-parameter init tool with 100% schema coverage and annotations, the description is mostly sufficient, but it lacks details about rerun behavior, directory existence requirements, and outcome/output, especially with no output schema. It is adequate but not fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the onus on the description is low. The free-text adds little beyond the schema; 'optional binary_snapshots.json' roughly echoes the no_binary flag but is not mapped to parameters, and ext/root are left to the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description opens with a specific verb-resource pair ('initialize Pandaone AI Agent in specified directory') and lists the concrete artifacts it creates (.pandaone/, config.json, pandaone.jsonl, optional binary_snapshots.json). It is clearly distinguishable from siblings like pandaone_status or pandaone_log, though it does not explicitly contrast itself with other setup-like siblings (pandaone_install_hook, pandaone_install_git).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to run init versus the sibling tools, nor when to toggle the optional features. The initialization purpose is implied by the name, but the description contains no explicit 'use when' or exclusion statements.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pandaone_install_gitAIdempotent
安装便携版 git(用于项目内 git hook,无需全局 git)
| Name | Required | Description | Default |
|---|---|---|---|
| probe_only | No | 只探测,不下载 | |
| auto_download | No | 自动下载缺失的 git |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false, idempotentHint=true, and destructiveHint=false. The description adds scope context ('project-internal', 'no global git') but does not disclose behavior such as download source, install location, or what probe_only returns. The description adds some value beyond annotations but not rich behavioral detail.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single compact sentence with no filler. The parenthetical adds meaningful context without redundancy. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple tool with two optional, clearly documented parameters and non-destructive/idempotent annotations, the description plus schema is largely sufficient. The main gap is that there is no output schema and the description does not indicate what the tool returns, especially in probe_only mode.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% — both probe_only and auto_download have clear descriptions. The main description does not add further parameter semantics, so the baseline score of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('安装便携版 git' / install portable git) and the resource (portable git). The parenthetical ('用于项目内 git hook,无需全局 git') adds context that ties it to project-internal hooks, but it does not explicitly differentiate from the sibling tool pandaone_install_hook, so it stops short of a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives a clear usage context: this is for project-internal git hooks and does not require global git. This tells the agent when the tool is appropriate, though it does not explicitly state exclusions or name alternative sibling tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pandaone_install_hookBIdempotent
安装/卸载 pre-commit hook
| Name | Required | Description | Default |
|---|---|---|---|
| root | Yes | . | |
| uninstall | No | True 则卸载 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
注释提供了 idempotentHint=true 和 destructiveHint=false,说明该操作是幂等的且非破坏性,但描述未提供额外行为信息。例如,是否会影响现有配置、是否需要在特定目录下运行等。注释已经涵盖了幂等性和安全性,描述未增加太多,但也没有矛盾。由于描述未补充任何行为细节,评分为 3。
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
描述非常简洁,仅一句话,没有冗余。但信息量较低,未包含任何使用场景或上下文。简洁但可能过度简化,不过仍然清晰地传达了核心功能。
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
工具没有输出模式,注释提供了幂等性和非破坏性,但描述未提供安装/卸载的具体影响、是否需要 root 权限、是否修改配置文件等。对于这样一个可能影响项目配置的工具,描述不够完整,无法让代理完全理解其副作用。考虑到复杂度较低(2 个参数),但缺少关键上下文。
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
输入模式描述了两个参数:root(默认 '.')和 uninstall(默认 false,描述为'True 则卸载')。描述本身没有为参数提供额外语义,但模式中已经包含了必要的描述。覆盖率为 50%,即 uninstall 参数有描述,root 参数仅有默认值但无描述。描述也未在正文中解释参数含义,因此未超出模式本身。基线为 3。
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
描述清晰说明了工具的功能:安装/卸载 pre-commit hook。动词明确(安装/卸载),资源明确(pre-commit hook)。但未与兄弟工具区分,例如 pandaone_install_git 可能涉及类似的安装操作,但此处描述未明确说明与安装 git 或其它安装类工具的区别。
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
描述未提供使用时机指导,例如何时安装 vs 卸载,或者与兄弟工具(如 pandaone_init)的关联。虽然参数 uninstall 暗示了两种用法,但描述未明确说明何时应使用此工具而非其他工具,也未提及任何前提条件或上下文。
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pandaone_lockBIdempotent
锁定所有受保护扩展名的文件(attrib +r / chmod -w)
| Name | Required | Description | Default |
|---|---|---|---|
| root | Yes | . |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already indicate this is a non-read-only, idempotent, non-destructive operation. The description adds the concrete behavior of setting files read-only via attrib +r or chmod -w. However, it does not disclose whether the operation recurses, which extensions are considered protected, or what happens to already-locked files, so the transparency is only partial.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single dense sentence with the operation stated first and the technical mechanism in parentheses. There is no filler, no repetition of the schema, and the format is appropriately sized for a tool of this complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple, but the context remains incomplete: 'protected extensions' is never defined, root semantics are absent, and there is no output schema. The agent would need external knowledge to know exactly which files are affected and what the operation returns or reports.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The only parameter, root, has 0% schema description coverage and is not explained in the description. The phrase 'all files' implies a scope, but the description never connects it to root or clarifies whether root is a directory, a search root, or a direct file target. The description fails to compensate for the schema gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb, '锁定', and a clear target, '所有受保护扩展名的文件', and even gives the mechanism ('attrib +r / chmod -w'). This makes the core purpose clear and distinct from the obvious inverse sibling pandaone_unlock, though it does not explicitly name or differentiate from other siblings.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives no guidance about when to use this tool instead of pandaone_unlock or pandaone_write. It does not state preconditions, exclusions, or contexts where the tool should be avoided. The agent must infer usage purely from the name and the bare operation.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pandaone_logBRead-onlyIdempotent
查看审计日志(按文件/recent/格式过滤)
| Name | Required | Description | Default |
|---|---|---|---|
| file | No | 按文件路径过滤 | |
| root | Yes | . | |
| format | No | ||
| output | No | 导出文件路径 | |
| recent | No | 最近 N 条 | |
| rejected | No | 只看被拒绝的变更 | |
| unauthorized | No | 只看未授权的变更 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description adds that it filters by file/recent/format, which is behavioral but not beyond the parameters. It does not disclose any additional traits such as return format, pagination, or potential performance implications, but given the annotations, a score of 3 is appropriate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence with no filler. It front-loads the core purpose and the main filtering options. Every word earns its place, making it an ideal example of conciseness for a tool with this complexity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the tool has 7 parameters and no output schema, the description is incomplete. It fails to mention the 'rejected', 'unauthorized', and 'output' parameters, which are significant for the tool's functionality. An agent might not know these capabilities exist, and there is no information about the output format or how filters combine. The description is too sparse for full contextual coverage.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 71%, with descriptions for most parameters. The description mentions three filter options (file, recent, format) but does not add new meaning beyond what the schema already provides. It omits the 'rejected' and 'unauthorized' filters and the 'output' parameter, so it does not fully summarize all capabilities. Since coverage is high, the baseline of 3 is correct.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the verb 'view' and the resource 'audit logs', and mentions filtering by file/recent/format. It distinguishes itself from sibling tools because none of the siblings are related to logs, so the purpose is unambiguous. It could be more specific about what the logs contain, but it is not tautological or vague.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides no guidance on when to use this tool versus alternatives. It does not mention exclusions, conditions, or any context where another tool would be preferred. The only implicit usage is that it is the log viewer, but there is no explicit comparison to other tools.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pandaone_statusBRead-onlyIdempotent
查看 Pandaone 状态(保护文件 / 审计次数 / 锁定状态等)
| Name | Required | Description | Default |
|---|---|---|---|
| root | Yes | . |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, and the description's '查看' is consistent with those. It adds useful scope about what status categories are visible, but it does not disclose failure modes, prerequisites, or output behavior. No contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single front-loaded sentence with no filler: it names the action, the resource, and informative status categories. It is appropriately sized for a simple read-only tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a one-parameter read-only tool with strong safety annotations, the description covers the main status contents. However, it omits root semantics and any return/output details despite there being no output schema, which leaves some ambiguity when an agent needs to target a specific root.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 0% and the description never explains the required root parameter or what it means. The parameter name and default provide only minimal inference, so the description does not compensate for the missing schema-level documentation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific action (查看/view) and a clear resource (Pandaone status), with concrete example categories: protected files, audit counts, and lock status. It is unambiguous, though it does not explicitly differentiate itself from sibling tools such as pandaone_log or pandaone_watch by name.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The status-checking wording implies when to use the tool, but the description gives no explicit guidance about alternatives, exclusions, or conditions. It earns the implied-usage level rather than the clear-context level.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pandaone_unlockCIdempotent
解锁所有受保护扩展名的文件
| Name | Required | Description | Default |
|---|---|---|---|
| root | Yes | . |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare idempotentHint=true and destructiveHint=false, and the description adds no behavioral context beyond the literal action of 'unlocking'. It does not disclose side effects (e.g., what changes are made to file permissions), prerequisites, or what 'protected' means. Since annotations carry the safety profile, the description adds minimal value, and no additional behavior is revealed.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, short sentence with no redundant phrases. It is front-loaded with the verb and target. While concise, it is so brief that it sacrifices useful detail, but as a standalone statement it is appropriately sized and has no fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given that this is a mutating operation (readOnlyHint=false) with no output schema and an unexplained parameter, the description is notably incomplete. It does not explain the meaning of 'root', the process of unlocking, any required permissions, or the potential impact on files. The agent would need to guess important details, making the description inadequate for safe and correct invocation.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has one parameter, 'root', with zero description coverage (schema_description_coverage=0%). The tool description does not mention 'root' at all, so the agent has no guidance on what this parameter controls (e.g., directory scope, default behavior, file selection). With no description coverage and no parameter explanation, the agent cannot properly understand how to set this parameter, resulting in a critical gap.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a specific verb ('unlock') and resource ('files with protected extensions'), which clearly distinguishes it from sibling tools like pandaone_lock. It conveys the core action and scope, though it does not explicitly tie the action to the 'root' parameter (it says 'all files' without noting the root scope). Slight ambiguity remains, but the purpose is generally clear.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No explicit guidance on when to use this tool versus alternatives. The sibling pandaone_lock implies the inverse, but the description does not mention it or any conditions for choosing unlock over lock. Usage context is only implied by the name and action, leaving the agent to infer when this is appropriate.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pandaone_watchB
启动 watchdog 守护进程(监控文件改动)
| Name | Required | Description | Default |
|---|---|---|---|
| root | Yes | . | |
| daemon | No | 后台守护模式 |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations are all false and provide no meaningful safety profile, so the description carries most of the behavioral burden. It adds the useful fact that this starts a daemon (long-running watcher), but it does not disclose whether the process blocks, how to stop it, what happens to existing watchers, or whether monitoring has side effects. This is minimal but not contradictory context.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence with the action front-loaded: '启动 watchdog 守护进程' before the explanatory parenthetical. There is no filler or redundant restatement of the tool name.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a state-changing daemon tool with no effective annotation coverage and no output schema, this description is incomplete. It does not explain the root parameter's role, default execution mode, or how an agent should observe or terminate the daemon. The core purpose is stated, but the operational contract is under-specified.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is only 50%: 'root' has no description and only 'daemon' is explained as '后台守护模式' (background daemon mode). The tool description adds no parameter-level meaning, failing to state that root is the directory to watch or clarify the daemon flag's behavior beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description states a specific verb and resource: '启动 watchdog 守护进程' (start watchdog daemon) and clarifies its intent with '监控文件改动' (monitor file changes). This clearly differentiates it from sibling tools like pandaone_status or pandaone_ci, which imply status reporting or CI execution rather than long-running file watching.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives. It does not mention related siblings such as pandaone_install_hook or pandaone_log, even though file-change monitoring could plausibly overlap with hook installation or logging. The agent is left to infer usage context from the name alone.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
pandaone_writeADestructive
审计写入(核心命令):reason/problem/approach 必填;文本用 --old/--new 或 --content;二进制用 --from-file 或 --content-base64
| Name | Required | Description | Default |
|---|---|---|---|
| new | No | 新字符串(仅文本) | |
| old | No | 原字符串(仅文本) | |
| file | Yes | 目标文件路径(相对 root) | |
| root | No | . | |
| reason | Yes | 改动原因(必填,至少 5 字符) | |
| content | No | 整文件文本内容 | |
| problem | Yes | 解决的问题(必填,至少 10 字符) | |
| approach | Yes | 采用的方法(必填,至少 10 字符) | |
| from_file | No | 原文件路径(用于二进制) | |
| content_base64 | No | 整文件二进制内容(base64) |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already carry destructiveHint=true, indicating a mutating operation. The description adds useful behavioral context by requiring reason/problem/approach as an audit trail and by separating text and binary write modes. It does not contradict the annotations and provides meaningful extra process-level detail.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The entire description is one dense sentence that front-loads the tool's role as the core write command and packs all essential mode guidance into a compact, scannable format. There is no redundant or filler content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a 10-parameter destructive write tool with no output schema, the description covers mandatory fields and parameter mode groups but omits important constraints such as whether --old and --new must be supplied together, whether the text and binary modes are strictly exclusive, and what postcondition the write operation guarantees. It is useful but not fully complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
With 90% schema description coverage, the baseline is 3. The description adds value by grouping parameters into two mutually exclusive usage modes (text vs binary), which is not explicitly encoded in the schema. This helps the agent select the correct parameter group for the intended write operation.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool as an audit-driven write command ('审计写入(核心命令)'), stating the core action and the key mandatory audit fields. It does not explicitly differentiate from sibling tools like pandaone_ci or pandaone_lock, but the write intent is unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear mode-selection guidance: text should use --old/--new or --content, and binary should use --from-file or --content-base64. However, it does not explain when to use this tool versus sibling alternatives, beyond calling it the 'core command', so the alternatives guidance is only implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
11 tool updates
v0.7.14- First observed
pandaone_ci - First observed
pandaone_fingerprint_update - First observed
pandaone_init - First observed
pandaone_install_git - First observed
pandaone_install_hook - First observed
pandaone_lock - First observed
pandaone_log - First observed
pandaone_status - First observed
pandaone_unlock - First observed
pandaone_watch - First observed
pandaone_write
TDQS
Scored across 11 tools
每个工具都有清晰不同的目的:日志查看、hook安装、watch守护、git便携安装、指纹更新、CI验证、锁定/解锁、初始化、审计写入和状态查看。即使lock/unlock是配对的,描述也明确区分了动作方向,不会产生混淆。
所有工具都统一使用pandaone_前缀,且大部分采用动词+宾语模式(如install_hook、install_git、write、lock)。但pandaone_log和pandaone_ci是名词形式,fingerprint_update的词语顺序略有倒置,与其他动词开头的命名不完全一致,但整体可读性强,模式基本可预测。
11个工具对于文件审计和保护系统来说非常合适,每个工具都覆盖一个明确的职责,没有冗余或缺失,数量处于理想范围内。
从初始化、审计写入、锁定/解锁、日志查询、状态查看、watch守护、CI验证到hook和git安装,核心工作流覆盖完整。但缺少如系统卸载或重置等运维工具,以及更细粒度的文件历史查看,但通过日志过滤基本可以满足,整体没有明显死胡同。
Maintenance
Related MCP Connectors
Deterministic AI code review, with an audit record. Governance inside the agent loop.
AI-native git hosting — repos, PRs, issues, CI gates, and AI code review over MCP (60 tools).
Hash-chained HMAC-signed audit log MCP for A2A (agent-to-agent) calls. Every tool-call, agent-ha...
AI Reasoning Cache & Consensus Layer with 11 MCP tools via Streamable HTTP.
Related MCP Servers
- AlicenseAqualityAmaintenanceSelf-hosted memory and governance layer for AI coding agents. 28 MCP tools with hybrid search, structured knowledge capture, behavioral nudges, and git-native storage. Zero cloud dependencies.306Business Source 1.1
- AlicenseNot gradedqualityAmaintenanceAI Constraint Engine that enforces CLAUDE.md, .cursorrules, and AGENTS.md rules as laws. 51 MCP tools for semantic conflict detection, patch review, drift scoring, pre-commit hooks, and Guardian Mode. Catches euphemisms, temporal evasion, and hidden violations that keyword matching misses.52 npm25MIT
- AlicenseAqualityCmaintenanceAI agent identity, permissions, trust scores, and tamper-evident audit trails. 17 MCP tools: register agents (Ed25519 keypairs), check permissions (sub-5ms), emit audit events, verify trust scores (0-100), delegate credentials, ephemeral agents. IETF Internet-Draft filed. Works with LangChain, OpenAI, CrewAI, Stripe ACP. npx @vorim/mcp-server17101 npm73MIT
- AlicenseNot gradedqualityDmaintenanceQuantitative governance gate for AI agents. Six gates (risk, profit, novelty, complexity, quality, utility) return PROCEED/PAUSE/HALT/ESCALATE with confidence scores and hash-chained, tamper-evident audit trails. Generates NIST AI RMF and EU AI Act Annex IV artifacts. 10 MCP tools; local stdio and hosted Streamable HTTP with a free tier.MIT