Skip to main content
Glama

Pandaone

🧑‍💼 Pandaone is your codebase's personal manager. / Pandaone 是你代码库的专属经理。

Every AI agent is an employee working in your company — your codebase. Without a personal manager, employees do what they want — edit files, push commits, break production — and you have no idea what they did, when, or why.

Pandaone is the personal manager you hired to protect your code. Every AI agent — Claude, Cursor, Trae, or any tool you adopt tomorrow — must report to Pandaone first. Nothing gets written, nothing gets committed, nothing gets deployed until Pandaone approves it with a signed, auditable receipt:

┌─────────────────────────────────────────────┐
│ [APPROVED]                  2026-09-11 03:47 │
│ File:      src/payment.py                    │
│ Agent:     Claude Code (employee #3)         │
│ Reason:    "Fix rounding"                    │
│ Problem:   "Charge $50,001 on $50,000 bill"  │
│ Approach:  "Round before transfer, not after"│
│ Commit:    a3f7b2c                           │
└─────────────────────────────────────────────┘

Without a personal manager, your agents move money — er, code — without receipts:

Without Pandaone          With Pandaone
──────────────          ──────────────
$50,000 ???            $50,000  src/payment.py
                        Reason:  "Fix rounding"
                        By:      Claude Code
                        When:    2026-09-11 03:47
                        Commit:  a3f7b2c

The left column is how most AI-agent-driven codebases look today. The right column is how yours will look with one command:

pip install pandaone-guard

Your personal manager is on duty 24/7 — before, during, and after every code change. Every AI agent — Claude, Cursor, Trae — operates under one auditable protocol. No exceptions. No bypass.

AI Agent 代码审计门禁 — 让每一次代码改动都留下合规、可追溯的证据链。

PyPI version Downloads Downloads/month Python License Tests Bugs i18n Lint & i18n CI OS Phase CI Lint M8ven Score

English | 中文


Related MCP server: SpecLock

中文 / Chinese

是什么? / What is it?

Pandaone 是一个 7 层防御体系,强制 AI Agent(或任何开发者)写代码前必须经过审计: 任何受保护文件的修改都必须通过 pandaone write 命令,留下 reason / problem / approach 三段式审计记录。

适用场景 / Use Cases

  • 🤖 AI Agent 开发:防止 Agent 绕过审查直接改代码

  • 🏢 企业合规:满足 SOC2 / ISO 27001 等代码变更审计要求

  • 👥 团队协作:所有 PR 必须有审计记录才能合入

核心特性 / Core Features

  • 17 种文本格式 + 24 种二进制格式保护.py / .md / .json / .yml / .env / .png / .pdf / ...)

  • 7 层防御体系 / 7-Layer Defense System (see Defense Layers)

  • MCP Server 原生支持 — Claude / Cursor / Trae 等 AI IDE 直连

  • 13 种审计日志导出格式(Excel / Word / PDF / SQLite / ...)

  • 纯 Python — Windows / macOS / Linux 通吃,无 C 扩展

  • 右键菜单集成 — 一行命令在 3 大平台安装原生右键菜单(HKCU / Quick Action / Nautilus + Dolphin)

  • i18n 国际化zh-CN / en 双语 CLI 自动检测 + --lang 强制 + 持久化偏好

快速开始 / Quick Start

安装 / Installation

方式 A:从 PyPI 安装(最简单)

pip install pandaone-guard

# 一键装上右键菜单(Windows / macOS / Linux 自动检测)
pandaone install-context

方式 B:从源码一键安装(推荐开发者使用,含最新 i18n + CI lint)

git clone https://github.com/hellob1889/Pandaone-AI-Agent.git
cd pandaone

# Windows
powershell -ExecutionPolicy Bypass -File scripts/install.ps1

# macOS / Linux
./scripts/install.sh

安装脚本自动做 / Install script auto-handles

  1. 检测 Python ≥ 3.10

  2. 探测 git(不在 PATH 时尝试常见安装路径)

  3. 卸载 site-packages 里可能存在的老 pandaone 版本(避免版本冲突)

  4. pip install -e . 本地源码 editable 安装

  5. 验证 pandaone 可用(python -m pandaone --version

  6. 调用 doctor.py --fix --persist-path 自动修复剩余问题(依赖、setuptools、指纹、PATH 持久化到 HKCU)

环境诊断(任何时候都能跑)/ Environment Diagnostics (run anytime)

python scripts/doctor.py                 # 人类可读
python scripts/doctor.py --json          # CI 用(返回 pass/fail)
python scripts/doctor.py --quiet         # 只显示 WARN / FAIL
python scripts/doctor.py --fix           # 自动修复 13 类问题(仅当前会话生效)
python scripts/doctor.py --fix --persist-path   # 持久化 PATH 到 HKCU(重启 shell 生效)
python scripts/doctor.py --fix-only      # 只跑修复 + 重测,跳过详细诊断

检测 9 个项目 + 自动修复 13 类问题(pip / git / pandaone 装在 site-packages / pandaone.exe PATH / 指纹污染 / setuptools / 5 个运行时依赖)。

--fix --persist-path 会做什么

  • 卸载 site-packages 老版本 → 重装本地源码

  • 删除污染的 ~/.pandaone_fp.txt

  • 自动 pip install 缺失的运行时依赖

  • Windows:用 setx PATH "%PATH%;<Scripts>" 持久化到 HKCU\Environment\Path(新开的 PowerShell 自动看到)

  • macOS / Linux:追加 export PATH="..."~/.bashrc / ~/.zshrc

初始化项目 / Initialize Project

cd /path/to/your-project
pandaone init --root .
# 自动:
#   - 创建 .pandaone/ 目录
#   - 生成 config.json(17 文本 + 24 二进制扩展名)
#   - 创建 binary_snapshots.json(SHA256 字典)
#   - 初始化 .gitignore 排除

写代码(合规路径)/ Write Code (Compliant Path)

# 修改 Python 文件
pandaone write \
    --file src/main.py \
    --reason "修复 user_id 类型注解" \
    --problem "原代码用 int,实际可能是 None" \
    --approach "改为 Optional[int]" \
    --old 'def get_user(user_id: int):' \
    --new 'def get_user(user_id: Optional[int]):'

# 替换二进制文件(图片/文档/PDF 等)
pandaone write \
    --file assets/logo.png \
    --reason "更新品牌 logo" \
    --problem "旧 logo 与新品牌色不匹配" \
    --approach "用新版 logo 替换" \
    --from-file /tmp/new_logo.png

查看审计日志 / View Audit Log

# 命令行查看
pandaone log --last 10

# 导出为 Excel
pandaone log --format xlsx --output audit_report.xlsx

# 导出为 PDF(含中文支持)
pandaone log --format pdf --output audit_report.pdf

# 全部 13 种格式:text / csv / tsv / json / yaml / md / html / xlsx / docx / pdf / sqlite / rst / asciidoc

项目状态仪表盘 / Project Status Dashboard

pandaone status --root .

显示 / Displays:项目路径、配置摘要、L1 锁定状态、二进制快照、最近审计、版本指纹等。 Project path, configuration summary, L1 lock state, binary snapshots, recent audits, version fingerprints, etc.

🆕 Web 实时仪表盘 / Web Real-time Dashboard:

pandaone serve   # 浏览器打开 http://localhost:8765

防御体系(7 层) / Defense Layers (7 Layers)

层 / Layer

组件 / Component

作用 / Function

被绕过后的兜底 / Fallback if Bypassed

L1

file chmod

文件级只读锁(attrib +r / chmod -w)File-level read-only lock

L2 watchdog

L2

watchdog

实时文件监控 + git checkout 回滚Real-time file monitor + git checkout rollback

L3 hook

L3

pre-commit hook

严格校验每个 staged 文件的 APPROVED 记录Strict validation of APPROVED record for every staged file

L4 / L5

L4

启动读 READMERead README on startup

CLI 启动时加载项目元数据CLI loads project metadata at startup

L5

L5

自指纹Self-fingerprint

CLI 自身 SHA256 检测篡改CLI's own SHA256 detects tampering

L6

L6

二进制 SHA256 snapshotBinary SHA256 snapshot

检测 .png/.pdf 等二进制篡改Detects tampering of .png/.pdf binaries

L7

L7

GitHub Actions CI

PR 合入前审计验证(最终兜底)Audit verification before PR merge (final fallback)

人工 reviewManual review

MCP Server(AI Agent 直连 / AI Agent Native)

// claude_desktop_config.json 或 Cursor MCP 配置
// claude_desktop_config.json or Cursor MCP configuration
{
  "mcpServers": {
    "pandaone": {
      "command": "pandaone-mcp",
      "env": {}
    }
  }
}

暴露 11 个工具pandaone_init / pandaone_lock / pandaone_unlock / pandaone_write / pandaone_log / pandaone_status / pandaone_install_hook / pandaone_watch / pandaone_install_git / pandaone_fingerprint_update / pandaone_ci

所有 11 个工具都已声明完整的 4 个 MCP annotationsreadOnlyHint / destructiveHint / idempotentHint / openWorldHint)—— OpenAI 目录合规(v0.7.14 修复)。

在 ChatGPT 中使用 / Use with ChatGPT

ChatGPT Desktop app 的 Developer Mode(开发者模式)原生支持 MCP server。把 pandaone 加进去:

步骤

  1. 打开 ChatGPT Desktop app

  2. SettingsBeta features开启 Developer Mode

  3. SettingsConnectorsCreate new connector

  4. 填入以下 JSON(字段名一字不差):

{
  "name": "pandaone-guard",
  "command": "pandaone-mcp",
  "args": [],
  "env": {}
}
  1. 第一次对话前,ChatGPT 会要求安装 pandaone-guard。如未自动装,在终端手动跑:

# macOS / Linux
pip3 install pandaone-guard

# Windows (PowerShell)
pip install pandaone-guard

进阶(自定义 venv / Python 路径 / 中文界面):

{
  "name": "pandaone-guard",
  "command": "/path/to/venv/bin/python",
  "args": ["-m", "pandaone_mcp"],
  "env": {
    "PANDAX_LANG": "zh"
  }
}

环境变量说明 / Environment variables:

变量

类型

默认

说明

PANDAX_FP_PASSWORD

🔐 secret

"0000"

pandaone_fingerprint_update / pandaone_watch 守护进程鉴权需要;本地设置,不上传

PANDAX_LANG

config

"zh"

界面语言(zh / en

PANDAONE_SKIP_GIT_CHECK

config

unset

1 跳过 git 检测(无 git 环境用)

NO_COLOR

config

unset

1 禁用彩色输出

只有一个 secretPANDAX_FP_PASSWORD。本地配置,永不上传到任何远程。

真实场景测试 / Real-World Validation

完整实战验证报告:实战验证报告.md

包含 / Includes:

  • 7 层防御每层实战证据 / 7-layer defense, each layer with real-world evidence

  • L3 hook 严重 bug 的发现 + 修复

  • 隐藏文件锁定 bug 的发现 + 修复

  • 13 种导出格式实测 / 13 export formats tested

  • MCP 协议完整工作流

详细示例集 / Detailed Examples

  • EXAMPLES.md — 10 个真实工作流 + 终端输出

  • examples/ — 5 个可运行的 Python demo 脚本

  • docs/ — 中英双语文档站(mkdocs)

  • docs/index.html — 交互式 HTML 文档首页(带终端动画)

命令清单 / Command List

命令 / Command

用途 / Purpose

pandaone init

初始化项目

pandaone lock / unlock

锁定 / 解锁所有受保护文件

pandaone write

核心:审计写入(支持文本/二进制)

pandaone log

查询审计历史(13 种导出格式)

pandaone status

项目状态仪表盘

pandaone install-hook

安装 L3 pre-commit hook

pandaone watch

启动 L2 watchdog 守护进程

pandaone serve

🆕 Web 实时仪表盘(浏览器打开 localhost:8765,watchdog + SSE <100ms 推送)

pandaone install-git

自动安装 git

pandaone ci

L7 CI 验证(git diff vs audit log)

pandaone-mcp

启动 MCP server(stdio JSON-RPC)

开发与测试 / Development & Testing

git clone https://github.com/hellob1889/Pandaone-AI-Agent
cd pandaone
pip install -e .[dev]
pytest tests/ -v

当前测试数:342 passed, 1 skipped(覆盖 i18n / write / status / lock / ci / watchdog / export / init / e2e / serve / desktop-icon / gitignore)

路线图 / Roadmap

版本 / Version

状态 / Status

关键能力 / Key Capability

v0.1.0

Phase 1-3 MVP(5 层防御)

v0.2.0

多格式导出(7 种)

v0.3.0

17 种文本保护

v0.4.0

24 种二进制 SHA256

v0.5.0

MCP Server

v0.6.0

GitHub Actions CI

v0.6.1

L3 hook 强化(实战验证)

v0.6.2

隐藏文件锁定 bug 修复

v0.7.0

Phase 9 OS 右键菜单 + Phase 10 i18n(zh-CN/en)+ doctor.py 环境自检 + auto-fix 13 类 + PATH 持久化

v0.7.1

28 个 bug 全修 + 4 大新功能:P0 安全(#8/#12×2/#22/#23)+ P1(#2/#5/#15/#29)+ P2(#21/#6/#20/#9-#10)+ P3(#13/#4/#26/#39)+ UX(#14/#17/#48/#25/#28)+ 工程化(#版本漂移 / #README 分组标签 / #CRLF 根因)+ 🆕 文件夹熊猫锁图标(desktop.ini + ICO)+ 🆕 Web 实时仪表盘(watchdog + SSE <100ms)+ 🆕 Git 兼容(init 自动写 .gitignore)+ 🆕 右键菜单真实可用验证,298 测试通过

v0.7.2

CI 工程化修复:publish.yml Tests job 在干净 ubuntu-latest 容器 25s exit 1(setuptools pin 缺失)→ pin setuptools==80.10.2 + --no-build-isolation,新增 pytest log artifact 上传。340 测试通过

v0.7.3

agent 身份 + diff 捕获 + 面板 UI--agent 参数追踪调用方(Claude / Cursor / Trae / user:name)+ --verbose 完整 diff + 彩色面板格式(状态 / 文件 / commit / 行数 / 原因 / 问题 / 方法 / 差异)+ status 加 agent 分组统计 + HTML 导出加卡片布局 + i18n 新增 16 个键。342 测试通过

完整历史:CHANGELOG.md

许可 / License

MIT License — 详见 LICENSE


English

What is it?

Pandaone is a 7-layer defense system that forces every code change through an audit gate. Any modification to a protected file (17 text + 24 binary formats) must go through pandaone write, which records reason / problem / approach as immutable audit evidence.

Use cases

  • 🤖 AI Agent development: prevent agents from bypassing review

  • 🏢 Enterprise compliance: meet SOC2 / ISO 27001 code change audit requirements

  • 👥 Team collaboration: every PR must have audit records before merging

Install

Option A: from PyPI (easiest)

pip install pandaone-guard

Option B: from source (recommended for developers, includes latest i18n + CI lint)

git clone https://github.com/hellob1889/Pandaone-AI-Agent.git
cd pandaone

# Windows
powershell -ExecutionPolicy Bypass -File scripts/install.ps1

# macOS / Linux
./scripts/install.sh

The install script automatically:

  1. Checks Python >= 3.10

  2. Locates git (scans common install paths if not in PATH)

  3. Removes stale pandaone from site-packages (prevents version conflicts)

  4. pip install -e . local source editable install

  5. Verifies pandaone works (python -m pandaone --version)

  6. Runs doctor.py --fix --persist-path (auto-fix remaining issues: deps / setuptools / fingerprint / persist PATH to HKCU)

Environment diagnostics (run anytime)

python scripts/doctor.py                 # human-readable
python scripts/doctor.py --json          # CI mode (returns pass/fail)
python scripts/doctor.py --quiet         # only WARN / FAIL
python scripts/doctor.py --fix           # auto-fix 13 issue classes (session only)
python scripts/doctor.py --fix --persist-path   # persist PATH to HKCU (new shell)
python scripts/doctor.py --fix-only      # just fix + re-check, skip detailed diagnosis

Checks 9 items + auto-fixes 13 issue classes (pip / git / pandaone-in-site-packages / pandaone.exe PATH / fingerprint pollution / setuptools / 5 runtime dependencies).

What --fix --persist-path does:

  • Uninstall stale site-packages version, reinstall local source

  • Remove polluted ~/.pandaone_fp.txt

  • Auto pip install for missing runtime deps

  • Windows: use setx PATH "%PATH%;<Scripts>" to persist to HKCU\Environment\Path (new PowerShell shells see it automatically)

  • macOS / Linux: append export PATH="..." to ~/.bashrc / ~/.zshrc

Quick start

cd /path/to/your-project
pandaone init --root .

pandaone write \
    --file src/main.py \
    --reason "Fix user_id type annotation" \
    --problem "Original used int, could be None" \
    --approach "Change to Optional[int]" \
    --old 'def get_user(user_id: int):' \
    --new 'def get_user(user_id: Optional[int]):'

7 Defense Layers

Layer

Component

Purpose

L1

file chmod

File-level read-only lock

L2

watchdog

Real-time file monitoring + git checkout rollback

L3

pre-commit hook

Strict per-file APPROVED validation

L4

startup README

CLI loads project metadata on startup

L5

self-fingerprint

CLI's own SHA256 detects tampering

L6

binary SHA256 snapshot

Detect .png/.pdf binary tampering

L7

GitHub Actions CI

Pre-merge audit verification (final backstop)

MCP Server

{
  "mcpServers": {
    "pandaone": {
      "command": "pandaone-mcp",
      "env": {}
    }
  }
}

Exposes 11 tools for AI agents (Claude / Cursor / Trae).

All 11 tools declare the full set of 4 MCP annotations (readOnlyHint / destructiveHint / idempotentHint / openWorldHint) — OpenAI directory compliant (fixed in v0.7.14).

Use with ChatGPT

ChatGPT Desktop app's Developer Mode natively supports MCP servers. To add pandaone:

Steps:

  1. Open ChatGPT Desktop app

  2. SettingsBeta featuresenable Developer Mode

  3. SettingsConnectorsCreate new connector

  4. Paste this JSON (field names must match exactly):

{
  "name": "pandaone-guard",
  "command": "pandaone-mcp",
  "args": [],
  "env": {}
}
  1. ChatGPT will offer to install pandaone-guard on first use. If it doesn't auto-install, run manually:

# macOS / Linux
pip3 install pandaone-guard

# Windows (PowerShell)
pip install pandaone-guard

Advanced (custom venv / Python path / English interface):

{
  "name": "pandaone-guard",
  "command": "/path/to/venv/bin/python",
  "args": ["-m", "pandaone_mcp"],
  "env": {
    "PANDAX_LANG": "en"
  }
}

Environment variables:

Variable

Type

Default

Purpose

PANDAX_FP_PASSWORD

🔐 secret

"0000"

Only needed for pandaone_fingerprint_update / pandaone_watch daemon auth; set locally, never uploaded

PANDAX_LANG

config

"zh"

UI language (zh / en)

PANDAONE_SKIP_GIT_CHECK

config

unset

Set to 1 to skip git detection (for git-less environments)

NO_COLOR

config

unset

Set to 1 to disable colored output

Only one secret: PANDAX_FP_PASSWORD. Local config only, never sent to any remote.

License

MIT — see LICENSE

Available Tools

11 tools
pandaone_ciA
Read-onlyIdempotent

CI 审计验证:对比 base..head 的所有改动,确认每条变更都通过 pandaone write 审计

ParametersJSON Schema
NameRequiredDescriptionDefault
baseNo基线分支origin/main
headNo对比分支HEAD
rootYes.

TDQS

A4.1/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint, idempotentHint, and destructiveHint false. The description adds behavioral context: it diffs all changes in the range and verifies each against the pandaone write audit. It does not mention failure/exit behavior, but safety characteristics are covered by annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One compact sentence conveys purpose, scope, and audit criterion without filler. The tool's role is front-loaded and every part of the sentence earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a read-only, idempotent audit tool with defaults for base and head, the description is mostly sufficient for selection and invocation. However, there is no output schema and the description does not state what happens when an audit fails or what the tool returns, leaving some ambiguity for CI result handling.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The description adds useful relational meaning by showing that base and head define the comparison range ('base..head'). However, schema coverage is 67% and the root parameter lacks a description in both the schema and the tool description, so parameter semantics are only partially compensated.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action and resource: CI audit validation that compares base..head and confirms every change passed pandaone write audit. This clearly distinguishes the tool from siblings like pandaone_write (the audited operation) and pandaone_status.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The 'CI 审计验证' framing gives an explicit context for when the tool is appropriate, and the base..head comparison defines its operational scope. It does not name alternatives or exclusions, but the intended usage is clear enough for an agent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

pandaone_fingerprint_updateA
Idempotent

更新密码指纹(用于 watch 守护进程鉴权)

ParametersJSON Schema
NameRequiredDescriptionDefault
passwordYes新密码

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already provide readOnlyHint=false, idempotentHint=true, and destructiveHint=false, indicating a non-destructive, idempotent mutation. The description adds the purpose context (authentication for watch daemon) but does not disclose any additional behavioral details beyond what annotations imply. It does not contradict annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence that states the action and purpose, with no redundant wording. It is front-loaded with the core action and immediately clarifies context.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with one parameter, no output schema, and annotations covering idempotency and destructiveness, the description is adequate. It explains what it does and why, leaving no major gaps for an agent to invoke it correctly. A slight gap exists in not specifying any prerequisites or effects on existing fingerprints, but given the tool's simplicity, this is acceptable.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The schema covers all parameters (password with description '新密码'), and the description does not add extra meaning beyond that. It does not explain password format, encoding, or any constraints, but with 100% schema coverage, the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb (update) and resource (password fingerprint), and clearly mentions the purpose (used for watch daemon authentication). This distinguishes it from all sibling tools, which focus on logging, hooks, git, CI, lock/unlock, init, write, and status operations.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description implies usage by mentioning the watch daemon authentication, but it does not explicitly say when to use this tool vs alternatives, nor does it exclude other tools. There is no mention of when not to use it or any prerequisites, leaving some ambiguity.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

pandaone_initB

在指定目录初始化 Pandaone AI Agent(创建 .pandaone/、config.json、pandaone.jsonl、可选 binary_snapshots.json)

ParametersJSON Schema
NameRequiredDescriptionDefault
extNo自定义受保护扩展名(如 ['.py', '.md'])
rootYes项目根目录路径.
no_binaryNo禁用二进制 SHA256 快照保护

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already signal that this is not read-only, not destructive, and not idempotent. The description adds value by enumerating what files get created, but it does not disclose behavior on repeated runs or whether existing files are preserved/overwritten, which matters given idempotentHint=false.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One compact sentence conveys the core action and key artifacts with no filler. It is not broken into sections, but for a small tool that is acceptable.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 3-parameter init tool with 100% schema coverage and annotations, the description is mostly sufficient, but it lacks details about rerun behavior, directory existence requirements, and outcome/output, especially with no output schema. It is adequate but not fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so the onus on the description is low. The free-text adds little beyond the schema; 'optional binary_snapshots.json' roughly echoes the no_binary flag but is not mapped to parameters, and ext/root are left to the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description opens with a specific verb-resource pair ('initialize Pandaone AI Agent in specified directory') and lists the concrete artifacts it creates (.pandaone/, config.json, pandaone.jsonl, optional binary_snapshots.json). It is clearly distinguishable from siblings like pandaone_status or pandaone_log, though it does not explicitly contrast itself with other setup-like siblings (pandaone_install_hook, pandaone_install_git).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is given on when to run init versus the sibling tools, nor when to toggle the optional features. The initialization purpose is implied by the name, but the description contains no explicit 'use when' or exclusion statements.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

pandaone_install_gitA
Idempotent

安装便携版 git(用于项目内 git hook,无需全局 git)

ParametersJSON Schema
NameRequiredDescriptionDefault
probe_onlyNo只探测,不下载
auto_downloadNo自动下载缺失的 git

TDQS

A3.8/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=false, idempotentHint=true, and destructiveHint=false. The description adds scope context ('project-internal', 'no global git') but does not disclose behavior such as download source, install location, or what probe_only returns. The description adds some value beyond annotations but not rich behavioral detail.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single compact sentence with no filler. The parenthetical adds meaningful context without redundancy. Every word earns its place.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple tool with two optional, clearly documented parameters and non-destructive/idempotent annotations, the description plus schema is largely sufficient. The main gap is that there is no output schema and the description does not indicate what the tool returns, especially in probe_only mode.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100% — both probe_only and auto_download have clear descriptions. The main description does not add further parameter semantics, so the baseline score of 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the action ('安装便携版 git' / install portable git) and the resource (portable git). The parenthetical ('用于项目内 git hook,无需全局 git') adds context that ties it to project-internal hooks, but it does not explicitly differentiate from the sibling tool pandaone_install_hook, so it stops short of a 5.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines4/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives a clear usage context: this is for project-internal git hooks and does not require global git. This tells the agent when the tool is appropriate, though it does not explicitly state exclusions or name alternative sibling tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

pandaone_install_hookB
Idempotent

安装/卸载 pre-commit hook

ParametersJSON Schema
NameRequiredDescriptionDefault
rootYes.
uninstallNoTrue 则卸载

TDQS

B3.1/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

注释提供了 idempotentHint=true 和 destructiveHint=false,说明该操作是幂等的且非破坏性,但描述未提供额外行为信息。例如,是否会影响现有配置、是否需要在特定目录下运行等。注释已经涵盖了幂等性和安全性,描述未增加太多,但也没有矛盾。由于描述未补充任何行为细节,评分为 3。

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

描述非常简洁,仅一句话,没有冗余。但信息量较低,未包含任何使用场景或上下文。简洁但可能过度简化,不过仍然清晰地传达了核心功能。

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

工具没有输出模式,注释提供了幂等性和非破坏性,但描述未提供安装/卸载的具体影响、是否需要 root 权限、是否修改配置文件等。对于这样一个可能影响项目配置的工具,描述不够完整,无法让代理完全理解其副作用。考虑到复杂度较低(2 个参数),但缺少关键上下文。

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

输入模式描述了两个参数:root(默认 '.')和 uninstall(默认 false,描述为'True 则卸载')。描述本身没有为参数提供额外语义,但模式中已经包含了必要的描述。覆盖率为 50%,即 uninstall 参数有描述,root 参数仅有默认值但无描述。描述也未在正文中解释参数含义,因此未超出模式本身。基线为 3。

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

描述清晰说明了工具的功能:安装/卸载 pre-commit hook。动词明确(安装/卸载),资源明确(pre-commit hook)。但未与兄弟工具区分,例如 pandaone_install_git 可能涉及类似的安装操作,但此处描述未明确说明与安装 git 或其它安装类工具的区别。

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

描述未提供使用时机指导,例如何时安装 vs 卸载,或者与兄弟工具(如 pandaone_init)的关联。虽然参数 uninstall 暗示了两种用法,但描述未明确说明何时应使用此工具而非其他工具,也未提及任何前提条件或上下文。

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

pandaone_lockB
Idempotent

锁定所有受保护扩展名的文件(attrib +r / chmod -w)

ParametersJSON Schema
NameRequiredDescriptionDefault
rootYes.

TDQS

B3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already indicate this is a non-read-only, idempotent, non-destructive operation. The description adds the concrete behavior of setting files read-only via attrib +r or chmod -w. However, it does not disclose whether the operation recurses, which extensions are considered protected, or what happens to already-locked files, so the transparency is only partial.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single dense sentence with the operation stated first and the technical mechanism in parentheses. There is no filler, no repetition of the schema, and the format is appropriately sized for a tool of this complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool is simple, but the context remains incomplete: 'protected extensions' is never defined, root semantics are absent, and there is no output schema. The agent would need external knowledge to know exactly which files are affected and what the operation returns or reports.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The only parameter, root, has 0% schema description coverage and is not explained in the description. The phrase 'all files' implies a scope, but the description never connects it to root or clarifies whether root is a directory, a search root, or a direct file target. The description fails to compensate for the schema gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb, '锁定', and a clear target, '所有受保护扩展名的文件', and even gives the mechanism ('attrib +r / chmod -w'). This makes the core purpose clear and distinct from the obvious inverse sibling pandaone_unlock, though it does not explicitly name or differentiate from other siblings.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no guidance about when to use this tool instead of pandaone_unlock or pandaone_write. It does not state preconditions, exclusions, or contexts where the tool should be avoided. The agent must infer usage purely from the name and the bare operation.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

pandaone_logB
Read-onlyIdempotent

查看审计日志(按文件/recent/格式过滤)

ParametersJSON Schema
NameRequiredDescriptionDefault
fileNo按文件路径过滤
rootYes.
formatNo
outputNo导出文件路径
recentNo最近 N 条
rejectedNo只看被拒绝的变更
unauthorizedNo只看未授权的变更

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the safety profile is covered. The description adds that it filters by file/recent/format, which is behavioral but not beyond the parameters. It does not disclose any additional traits such as return format, pagination, or potential performance implications, but given the annotations, a score of 3 is appropriate.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, concise sentence with no filler. It front-loads the core purpose and the main filtering options. Every word earns its place, making it an ideal example of conciseness for a tool with this complexity.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given the tool has 7 parameters and no output schema, the description is incomplete. It fails to mention the 'rejected', 'unauthorized', and 'output' parameters, which are significant for the tool's functionality. An agent might not know these capabilities exist, and there is no information about the output format or how filters combine. The description is too sparse for full contextual coverage.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 71%, with descriptions for most parameters. The description mentions three filter options (file, recent, format) but does not add new meaning beyond what the schema already provides. It omits the 'rejected' and 'unauthorized' filters and the 'output' parameter, so it does not fully summarize all capabilities. Since coverage is high, the baseline of 3 is correct.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly states the verb 'view' and the resource 'audit logs', and mentions filtering by file/recent/format. It distinguishes itself from sibling tools because none of the siblings are related to logs, so the purpose is unambiguous. It could be more specific about what the logs contain, but it is not tautological or vague.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no guidance on when to use this tool versus alternatives. It does not mention exclusions, conditions, or any context where another tool would be preferred. The only implicit usage is that it is the log viewer, but there is no explicit comparison to other tools.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

pandaone_statusB
Read-onlyIdempotent

查看 Pandaone 状态(保护文件 / 审计次数 / 锁定状态等)

ParametersJSON Schema
NameRequiredDescriptionDefault
rootYes.

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, and the description's '查看' is consistent with those. It adds useful scope about what status categories are visible, but it does not disclose failure modes, prerequisites, or output behavior. No contradiction with annotations.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single front-loaded sentence with no filler: it names the action, the resource, and informative status categories. It is appropriately sized for a simple read-only tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter read-only tool with strong safety annotations, the description covers the main status contents. However, it omits root semantics and any return/output details despite there being no output schema, which leaves some ambiguity when an agent needs to target a specific root.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the description never explains the required root parameter or what it means. The parameter name and default provide only minimal inference, so the description does not compensate for the missing schema-level documentation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action (查看/view) and a clear resource (Pandaone status), with concrete example categories: protected files, audit counts, and lock status. It is unambiguous, though it does not explicitly differentiate itself from sibling tools such as pandaone_log or pandaone_watch by name.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The status-checking wording implies when to use the tool, but the description gives no explicit guidance about alternatives, exclusions, or conditions. It earns the implied-usage level rather than the clear-context level.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

pandaone_unlockC
Idempotent

解锁所有受保护扩展名的文件

ParametersJSON Schema
NameRequiredDescriptionDefault
rootYes.

TDQS

C2.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already declare idempotentHint=true and destructiveHint=false, and the description adds no behavioral context beyond the literal action of 'unlocking'. It does not disclose side effects (e.g., what changes are made to file permissions), prerequisites, or what 'protected' means. Since annotations carry the safety profile, the description adds minimal value, and no additional behavior is revealed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single, short sentence with no redundant phrases. It is front-loaded with the verb and target. While concise, it is so brief that it sacrifices useful detail, but as a standalone statement it is appropriately sized and has no fluff.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

Given that this is a mutating operation (readOnlyHint=false) with no output schema and an unexplained parameter, the description is notably incomplete. It does not explain the meaning of 'root', the process of unlocking, any required permissions, or the potential impact on files. The agent would need to guess important details, making the description inadequate for safe and correct invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The input schema has one parameter, 'root', with zero description coverage (schema_description_coverage=0%). The tool description does not mention 'root' at all, so the agent has no guidance on what this parameter controls (e.g., directory scope, default behavior, file selection). With no description coverage and no parameter explanation, the agent cannot properly understand how to set this parameter, resulting in a critical gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb ('unlock') and resource ('files with protected extensions'), which clearly distinguishes it from sibling tools like pandaone_lock. It conveys the core action and scope, though it does not explicitly tie the action to the 'root' parameter (it says 'all files' without noting the root scope). Slight ambiguity remains, but the purpose is generally clear.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No explicit guidance on when to use this tool versus alternatives. The sibling pandaone_lock implies the inverse, but the description does not mention it or any conditions for choosing unlock over lock. Usage context is only implied by the name and action, leaving the agent to infer when this is appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

pandaone_watchB

启动 watchdog 守护进程(监控文件改动)

ParametersJSON Schema
NameRequiredDescriptionDefault
rootYes.
daemonNo后台守护模式

TDQS

B3.3/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations are all false and provide no meaningful safety profile, so the description carries most of the behavioral burden. It adds the useful fact that this starts a daemon (long-running watcher), but it does not disclose whether the process blocks, how to stop it, what happens to existing watchers, or whether monitoring has side effects. This is minimal but not contradictory context.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single concise sentence with the action front-loaded: '启动 watchdog 守护进程' before the explanatory parenthetical. There is no filler or redundant restatement of the tool name.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a state-changing daemon tool with no effective annotation coverage and no output schema, this description is incomplete. It does not explain the root parameter's role, default execution mode, or how an agent should observe or terminate the daemon. The core purpose is stated, but the operational contract is under-specified.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is only 50%: 'root' has no description and only 'daemon' is explained as '后台守护模式' (background daemon mode). The tool description adds no parameter-level meaning, failing to state that root is the directory to watch or clarify the daemon flag's behavior beyond the schema.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose5/5

Does the description clearly state what the tool does and how it differs from similar tools?

Description states a specific verb and resource: '启动 watchdog 守护进程' (start watchdog daemon) and clarifies its intent with '监控文件改动' (monitor file changes). This clearly differentiates it from sibling tools like pandaone_status or pandaone_ci, which imply status reporting or CI execution rather than long-running file watching.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance is provided on when to use this tool versus alternatives. It does not mention related siblings such as pandaone_install_hook or pandaone_log, even though file-change monitoring could plausibly overlap with hook installation or logging. The agent is left to infer usage context from the name alone.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

pandaone_writeA
Destructive

审计写入(核心命令):reason/problem/approach 必填;文本用 --old/--new 或 --content;二进制用 --from-file 或 --content-base64

ParametersJSON Schema
NameRequiredDescriptionDefault
newNo新字符串(仅文本)
oldNo原字符串(仅文本)
fileYes目标文件路径(相对 root)
rootNo.
reasonYes改动原因(必填,至少 5 字符)
contentNo整文件文本内容
problemYes解决的问题(必填,至少 10 字符)
approachYes采用的方法(必填,至少 10 字符)
from_fileNo原文件路径(用于二进制)
content_base64No整文件二进制内容(base64)

TDQS

A3.8/5.0
Behavior4/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Annotations already carry destructiveHint=true, indicating a mutating operation. The description adds useful behavioral context by requiring reason/problem/approach as an audit trail and by separating text and binary write modes. It does not contradict the annotations and provides meaningful extra process-level detail.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness5/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The entire description is one dense sentence that front-loads the tool's role as the core write command and packs all essential mode guidance into a compact, scannable format. There is no redundant or filler content.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a 10-parameter destructive write tool with no output schema, the description covers mandatory fields and parameter mode groups but omits important constraints such as whether --old and --new must be supplied together, whether the text and binary modes are strictly exclusive, and what postcondition the write operation guarantees. It is useful but not fully complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters4/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

With 90% schema description coverage, the baseline is 3. The description adds value by grouping parameters into two mutually exclusive usage modes (text vs binary), which is not explicitly encoded in the schema. This helps the agent select the correct parameter group for the intended write operation.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description clearly identifies the tool as an audit-driven write command ('审计写入(核心命令)'), stating the core action and the key mandatory audit fields. It does not explicitly differentiate from sibling tools like pandaone_ci or pandaone_lock, but the write intent is unambiguous.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives clear mode-selection guidance: text should use --old/--new or --content, and binary should use --from-file or --content-base64. However, it does not explain when to use this tool versus sibling alternatives, beyond calling it the 'core command', so the alternatives guidance is only implied.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 11 tool updatesv0.7.14
    • First observedpandaone_ci
    • First observedpandaone_fingerprint_update
    • First observedpandaone_init
    • First observedpandaone_install_git
    • First observedpandaone_install_hook
    • First observedpandaone_lock
    • First observedpandaone_log
    • First observedpandaone_status
    • First observedpandaone_unlock
    • First observedpandaone_watch
    • First observedpandaone_write

TDQS

A3.5/5.0

Scored across 11 tools

Disambiguation5/5

每个工具都有清晰不同的目的:日志查看、hook安装、watch守护、git便携安装、指纹更新、CI验证、锁定/解锁、初始化、审计写入和状态查看。即使lock/unlock是配对的,描述也明确区分了动作方向,不会产生混淆。

Naming Consistency4/5

所有工具都统一使用pandaone_前缀,且大部分采用动词+宾语模式(如install_hook、install_git、write、lock)。但pandaone_log和pandaone_ci是名词形式,fingerprint_update的词语顺序略有倒置,与其他动词开头的命名不完全一致,但整体可读性强,模式基本可预测。

Tool Count5/5

11个工具对于文件审计和保护系统来说非常合适,每个工具都覆盖一个明确的职责,没有冗余或缺失,数量处于理想范围内。

Completeness4/5

从初始化、审计写入、锁定/解锁、日志查询、状态查看、watch守护、CI验证到hook和git安装,核心工作流覆盖完整。但缺少如系统卸载或重置等运维工具,以及更细粒度的文件历史查看,但通过日志过滤基本可以满足,整体没有明显死胡同。

Maintenance

ActivityMaintained
ResponsivenessNo issues

Related MCP Connectors

Related MCP Servers

  • A
    license
    A
    quality
    A
    maintenance
    Self-hosted memory and governance layer for AI coding agents. 28 MCP tools with hybrid search, structured knowledge capture, behavioral nudges, and git-native storage. Zero cloud dependencies.
    30
    6
    Business Source 1.1
  • A
    license
    Not graded
    quality
    A
    maintenance
    AI Constraint Engine that enforces CLAUDE.md, .cursorrules, and AGENTS.md rules as laws. 51 MCP tools for semantic conflict detection, patch review, drift scoring, pre-commit hooks, and Guardian Mode. Catches euphemisms, temporal evasion, and hidden violations that keyword matching misses.
    52 npm
    25
    MIT
  • A
    license
    A
    quality
    C
    maintenance
    AI agent identity, permissions, trust scores, and tamper-evident audit trails. 17 MCP tools: register agents (Ed25519 keypairs), check permissions (sub-5ms), emit audit events, verify trust scores (0-100), delegate credentials, ephemeral agents. IETF Internet-Draft filed. Works with LangChain, OpenAI, CrewAI, Stripe ACP. npx @vorim/mcp-server
    17
    101 npm
    73
    MIT
  • A
    license
    Not graded
    quality
    D
    maintenance
    Quantitative governance gate for AI agents. Six gates (risk, profit, novelty, complexity, quality, utility) return PROCEED/PAUSE/HALT/ESCALATE with confidence scores and hash-chained, tamper-evident audit trails. Generates NIST AI RMF and EU AI Act Annex IV artifacts. 10 MCP tools; local stdio and hosted Streamable HTTP with a free tier.
    MIT