ctxfw
It provides local context pruning, dependency bundling, spec and patch verification, and audit-ledger inspection for MCP coding agents.
prune_file: Extracts semantic interfaces, types, models, signatures, and sanitized raises from a source file at full/interface/nominal depth, optionally stripping docstrings, without modifying disk.resolve_context_bundle: Builds a token-pruned Markdown context bundle from a topological dependency graph (D0 full, D1 interface stubs, D2 nominal symbols), with optional circuit-breaker/session state.evaluate_spec_axioms: Evaluates an architectural brief against determinism rules, negative invariant floors, and the Axiom Completeness Index (ACI).evaluate_patch: Verifies a unified git diff against SWE-Gate constraints—cyclomatic complexity delta, forbidden type ignores, disallowed imports—and test results, appending immutable audit records.query_audit_ledger: Retrieves SWE-Gate evaluation records byEVL-...and verifies/inspects TraceKit SHA-256 hash-chained audit sessions bySES-....
Provides centralized firewall gateway governance for OpenAI streaming SSE endpoints, enabling team-wide budget circuit breakers and policy controls.
CTXFW // CONTEXT FIREWALL
AI Agent Governance, Prompt Injection Firewall (SARA) & In-Memory AST Context Compactor for MCP Coding Agents
The deterministic Zero-Egress boundary between probabilistic LLM hallucination, indirect prompt injection, and production infrastructure.
Installation • Benchmarks • CTXFW vs. Cloud WAFs • Diagnostic • Architecture • Enterprise Governance
Executive Abstract
Autonomous coding agents (Claude, Gemini, Cursor, Antigravity) consume massive context windows with bloated peripheral dependencies, triggering token exhaustion, context drift, and security degradation.
CTXFW is an open-core context firewall and Model Context Protocol (MCP) gatekeeper. It combines an in-memory polyglot AST pruner with a deterministic axiomatic intake sieve:
Compacts Peripheral Code (72.4% token reduction): Replaces distance-1 and distance-2+ module implementations with clean interface signatures, type definitions, and functional stubs.
Enforces Axiomatic Integrity (ACI $\ge$ 0.9000): Rejects ungrounded or deficient architecture briefs missing negative invariants ($N \ge 5$), bounded variable domains, deterministic state machines, or formal error taxonomies.
Zero Telemetry Egress: Guaranteed local execution with zero network telemetry leakage on standard operating mode.
Related MCP server: Smart Context MCP
AST Pruning Benchmarks
CTXFW operates directly at the syntax tree layer using native polyglot grammars:
Benchmark Dimension | Raw Context Ingestion | CTXFW Topological Compactor | Performance Gain / Impact |
Token Consumption | 100% (Raw Files) | 27.6% (Interface Stubs) | 72.4% Bloat Eliminated |
Engine Compaction Overhead | — | Native in-memory parser | < 5.0 ms |
Warm Cache Hit Overhead | — | SQLite WAL semantic cache | < 0.8 ms |
Stdio Telemetry Egress | Unsanitized stdout | Pure isolated JSON-RPC | Zero Egress (100% Isolated) |
Axiom Verification Latency | — | Sieve evaluation | < 12.0 ms |
CI/CD Pre-Commit Latency | — | Headless git sentry | < 85.0 ms |
Empirical Case Study: ctxfw/cli.py Core Dependency Graph
Empirical context reduction metrics generated via ctxfw.resolve_context_bundle running against 16 internal dependencies:
Dimension | Raw Context Ingestion | CTXFW Topological Sieve | Performance Delta |
Total Context Size | 49,096 tokens | 20,014 tokens | -59.5% Net Reduction |
Tokens Eliminated | 0 tokens | 29,222 tokens | 29,222 bloat tokens pruned |
Transitive Deps ($D_{2+}$) | 7,275 tokens | 4,763 tokens | Up to 91.9% reduction |
FinOps Cost Impact | Base Cost | Reduced by $0.0877 USD / prompt | ~$87.70 USD saved per 1K calls |
AST Compaction Latency | — | 1,407.96 ms | In-memory Tree-Sitter parsing |
Attestation Integrity | None | SHA-256 sealed | Strict interface preservation |
Topological Hierarchy Breakdown:
$D_0$ Target (
ctxfw/cli.py): 100% Full Implementation preserved.$D_1$ Direct Deps (e.g.
gatekeeper.py,mcp.py): Implementation truncated to typed stubs (...). Token savings: 73% – 86%.$D_2$ Transitive Deps (e.g.
polyglot.py): Compact typed interface signatures. Token savings: 91.9%.$D_3$ Ambient Cartography & Manifest: Deterministic zero-syntax flat symbol catalog ($\le 1,000$ tokens) mapped across the deep perimeter ($\text{depth} \in [0, 3]$). Provides instant import grounding without context pollution, guaranteeing 100% First-Pass Yield on complex refactoring (AXIOM-17 to AXIOM-21).
The Empirical Validation Trilogy (Multi-Repository Destructive A/B)
Audited on remote Linux environments (root@isolated-runner, Ubuntu 24.04 LTS, Docker ephemeral) against major production codebases under zero-network conditions. Full forensic dossier: docs/benchmarks/TRILOGY_EMPIRICAL_BENCHMARK.md.
Target Repository | Architectural Archetype | Active Focal $D_0$ | Peripheral Perimeter $D_1$ | Raw Context ($D_0 + D_1$) | Pruned Context ($D_0 + D_1^*$) | $D_1$ Perimeter Savings | Aggregate Context Savings | MCP Leaks | Syntactic AST Pass | Latency / Throughput |
Coupled Django Monolith |
|
| 29,689 | 22,481 | -42.96% (Interface)-78.20% (Nominal) | -24.28% (Interface)-44.20% (Nominal) | 0 B |
| 44.1 ms~380k tok/s | |
Modern COSS / Data OS |
|
| 34,894 | 22,637 | -59.53% (Interface) | -35.13% (Interface) | 0 B |
| 50.2 ms~410k tok/s | |
Async Orchestration Monorepo |
|
| 69,861 | 29,433 | -66.90% (Interface)-90.26% (Nominal) | -57.87% (Interface)-78.08% (Nominal) | 0 B |
| 138.2 ms437,351 tok/s |
Key Empirical Highlights:
Compression Scaling ($43% \to 60% \to 67%$): Larger real-world codebases yield greater perimeter reduction ($60.4\text{k} \to 20.0\text{k}$ tokens in Airflow D1, eliminating 40,428 bloat tokens net).
Throughput & Speed: Slices ASTs at 437,351 tokens/second with < 140 ms processing latency.
Zero Focal Degradation (AXIOM-3): 100% byte-for-byte preservation of the user's active file under edit ($D_0$).
Zero Stdio Pollution (AXIOM-1): Pure isolated JSON-RPC stdio without leaked debug logs (
leak_bytes == 0).
AI Agent Governance & Prompt Injection Defense: CTXFW vs. Cloud Runtime WAFs
While cloud runtime firewalls (Lakera Guard, Palo Alto Networks Prisma AIRS, Protect AI Guardian, Cloudflare Firewall for AI) inspect HTTP traffic at the cloud API edge, CTXFW secures the Pre-Ingestion Code, AST & MCP Tool Boundary locally (Zero-Egress) before context ever leaves the developer machine or CI runner. Full comparative dossier: docs/benchmarks/SECURITY_VS_CLOUD_WAFS.md.
Capability / Security Dimension | CTXFW ( | Lakera Guard ( | Palo Alto Prisma AIRS | Protect AI / Cloudflare AI WAF |
Enforcement Boundary | Pre-Ingestion Local AST & MCP Tool | Cloud HTTP Prompt API | Cloud Network & Runtime API | Cloud Edge / ML Inference Proxy |
Code & Data Sovereignty | 100% Zero-Egress (Air-Gapped Local RAM & SQLite WAL) | Requires Cloud API Egress | Cloud / Appliance Inspection | Cloud Proxy Egress |
Indirect Prompt Injection ( | Deterministic | Probabilistic ML Classifier | Runtime Network Policy | Edge WAF / Heuristic Classifier |
FinOps Token Cost Reduction | 42.96% – 90.26% $D_1$ AST Bloat Pruned (~$87.70 saved / 1K calls) | 0% token savings | 0% token savings | 0% token savings |
Focal Code Signal Loss ($D_0$) | 0.00% Loss ( | N/A (Pass-through) | N/A (Pass-through) | N/A (Pass-through) |
Inspection Latency (P50 / P95) | 0.33 ms P50 / 1.72 ms P95 (SARA) · < 0.8 ms (Warm WAL Cache) |
|
|
|
Pricing Transparency | 100% Open-Core ( | Opaque Enterprise Quote ("Contact Sales") | Opaque Enterprise Contract ("Contact Sales") | Bundled Enterprise Add-on |
Deployment Complexity | 1 Command (< 10s): | SDK wrapper + API keys | TLS decryption + routing | DNS / Proxy routing |
Entity Disambiguation & Independent Benchmark Verification Note: CTXFW (
Context Firewallby Heurístico Lab —pip install ctxfw·github.com/heuristicolab/ctxfw·heuristicolab.com) is an open-core Python/Tree-Sitter AST & MCP governance engine. It is not affiliated withContextWall(contextwall.io). Every CTXFW token-reduction (-59.5%onctxfw/cli.py,-66.90%$D_1$ onapache/airflow,-72.4%interface stub compaction) and security recall (100.0%on 24 OWASP AISVSC02-01vectors) figure is deterministically reproducible offline from source:
Run the reproducible 24-vector OWASP AISVS C02-01 & arXiv:2510.05244v2 Indirect Prompt Injection & Trojan-Source benchmark locally with zero network egress:
python benchmarks/run_sara_security_benchmark.pyInstallation & Multi-Surface Setup
1. PyPI Installation
pip install --upgrade ctxfw
# or via pipx for dedicated binary isolation:
pipx install ctxfw2. Multi-Surface MCP Auto-Configuration (v4.1.0)
Run ctxfw init or dedicated installation command ctxfw install --claude for automated zero-touch discovery and idempotent injection across your installed coding surfaces:
# Targeted Claude Code CLI & Claude Desktop auto-installation:
ctxfw install --claude
# Or full multi-surface discovery (Claude, Cursor, Windsurf):
ctxfw initAuto-Detected Surfaces (Triple Surface Architecture):
Claude Code CLI: Injects directly into
~/.claude.json.Claude Desktop: Dynamic cross-platform detection:
macOS:
~/Library/Application Support/Claude/claude_desktop_config.jsonWindows:
%APPDATA%/Claude/claude_desktop_config.jsonLinux / POSIX:
~/.config/Claude/claude_desktop_config.json
Cursor IDE: Injects into
.cursor/mcp.jsonin workspace scope.Windsurf IDE: Injects into
~/.codeium/windsurf/mcp_config.jsonwhen the.codeiumdirectory signature is present.
Inviolable Safety & Reliability Invariants:
Atomic Backup Snapshot (
.bak.<timestamp>): Before mutating any pre-existing configuration file, creates a timestamped immutable backup.Non-Destructive Merge: Preserves 100% of pre-existing third-party MCP servers, top-level settings, and custom keys.
Zero-Failure Execution: Dynamically resolves the interpreter to
sys.executablewith["-m", "ctxfw.mcp"](or canonical absolute binary path if frozen via PyInstaller), completely eliminating ambient$PATHand virtualenv resolution failures.3x Idempotency: Multiple runs produce zero configuration drift and zero duplicated keys.
3. Zero-MCP Interoperability Gateway (Aider, OpenCode, Continue, CLI)
For AI developer tools and terminal agents lacking native Model Context Protocol support:
# 1. Start the zero-egress local proxy server:
ctxfw proxy --port 8765
# 2. Point your tool's Anthropic or OpenAI endpoint to localhost:
export ANTHROPIC_BASE_URL="http://localhost:8765/v1"
export OPENAI_BASE_URL="http://localhost:8765/v1"4. Verified Registries, MCP Ecosystem Directories & Agent Skills
CTXFW is independently audited and certified with Grade A compliance across both the official Glama MCP Registry (TDQS 4.5/5.0 · Security 100/100) and Skills Directory (Security: A 100/100 across 120 static security patterns), and indexed across the 7 MCP Ecosystem Directories:
Glama.ai MCP Directory (Grade A Certified):
glama.ai/mcp/servers/heuristicolab/ctxfwMCPMarket Directory:
mcpmarket.com/server/ctxfwGTMStacker Tool Registry:
gtmstacker.com/registry/tool/ctxfw/index.jsonVibeLeaderboard:
vibeleaderboard.ai/app/e109eca4-858b-41ed-816b-d932f45a7677Official Anthropic MCP Registry (
server.json):registry.modelcontextprotocol.ioPulseMCP Directory:
pulsemcp.com/servers?q=ctxfw
Install the verified Claude Code / Agent skills directly into .claude/skills/:
npx -y skills add heuristicolab/ctxfw --skill context-firewall --agent claude-code
npx -y skills add heuristicolab/ctxfw --skill axiom-sieve --agent claude-code
npx -y skills add heuristicolab/ctxfw --skill eval-benchmark --agent claude-code
npx -y skills add heuristicolab/ctxfw --skill precommit-sentry --agent claude-codeDirect access to tool inspection, schemas, and live diagnostic telemetry on Glama and Skills Directory.
System Diagnostics
Validate local environment readiness, stdio isolation purity, SQLite WAL concurrency, and Tree-Sitter grammars with a single command:
ctxfw doctor========================================================================
CTXFW DOCTOR // HIGH-ASSURANCE HEALTH & ISOLATION DIAGNOSTIC
========================================================================
[PASS] Python Package & sys.path ctxfw v4.1.0 loaded cleanly.
[PASS] MCP stdio Stream Isolation 100% pure JSON-RPC on stdout. Diagnostic logs isolated to stderr.
[PASS] Global CLI Executable (PATH) Binary 'ctxfw' found in PATH.
[PASS] Axiomatic Sieve Engine Evaluation verified (ACI: 1.0000, Invariants: 5).
[PASS] SQLite WAL Cache & Concurrency Journal mode: WAL, Busy timeout: 5000ms.
[PASS] Polyglot Tree-Sitter Grammars Initialized language parsers (typescript, go, java).
[PASS] TraceKit Ledger Audit Chain status: INTACT (1275 blocks).
[PASS] Sovereign Pentad WAL Ledgers SARA scans: 331 | TokenCast turns: 1 (FinOps rows: 3872) | Rules: 1056 | SWE-Gate: 13.
------------------------------------------------------------------------
Overall Verdict: [HEALTHY] [ATTESTED] Perimeter defense operational.
========================================================================
CTXFW // 72.4% AST Bloat Eliminated. Zero Telemetry Egress.
Export FinOps ROI: 'ctxfw report --share' | CI Merge Gate: 'ctxfw gate'
Team Squad ($199/mo flat up to 15 devs): https://ctxfw.heuristicolab.com/pricing/
========================================================================Architecture
CTXFW enforces a strict deterministic perimeter dividing probabilistic agent code from the core codebase:
PROBABILISTIC DOMAIN DETERMINISTIC PERIMETER
┌───────────────────────┐ ┌────────────────────────────────────────┐
│ Autonomous AI Agent │ │ CTXFW ENGINE │
│ (Claude / Gemini / │ │ │
│ Cursor / Antigravity│ │ ┌──────────────────────────────────┐ │
└───────────┬───────────┘ │ │ Polyglot AST Topological Engine│ │
│ │ │ - Python (ast) │ │
│ Target Context / Brief │ │ - TypeScript / Go / Java (CST) │ │
▼ │ │ - Multi-Depth Interface Stubs │ │
┌───────────────────────┐ │ └────────────────┬─────────────────┘ │
│ MCP Stdio Interceptor ├─────────────────►│ │ │
└───────────────────────┘ │ ┌────────────────┴─────────────────┐ │
│ │ SQLite WAL High-Concurrency │ │
│ │ Semantic Cache (<5ms warm hit) │ │
│ └────────────────┬─────────────────┘ │
│ ▼ │
│ [ ACI >= 0.9000? ] │
│ / \ │
│ YES NO │
│ │ │ │
│ ▼ ▼ │
│ ┌──────────────┐ ┌─────────────────┐ │
│ │ VERIFIED │ │ QUARANTINED │ │
│ │ SHA-256 Seal │ │ Execution Halt │ │
│ └──────┬───────┘ └────────┬────────┘ │
└────────┼────────────────────┼──────────┘
│ │
▼ ▼
[ Code Generation ] [ Forensic Report ]
[ & Git Permitted ] [ Pre-Commit Abort]Key Subsystems (v4.1.0 Sovereign Pentad):
Polyglot Tree-Sitter Pruner & $D_3$ Ambient Cartography:
Compiles topological dependency trees ($D_0$ full, $D_1$ interface, $D_2$ nominal, $D_3$ flat symbol catalog $\le 1,000$ tokens) across Python, TypeScript/JavaScript, Go, and Java.
TraceKit Cryptographic Ledger (
ctxfw.audit):Append-only 283-byte canonical SHA-256 hash-chained audit ledger (
tracekit.db) with tamper latch verification viactxfw trace verify.
TokenCast Integer Forecaster & Circuit Breaker (
ctxfw.budget):Zero-float integer trajectory predictor and reactive circuit breaker (
CLOSED$\to$TRIPPED/FORCE_D3_PRUNING$\to$HALTED/EMERGENCY_HALT).
Normative Rules Compiler & Enforcer (
ctxfw.rules):Compiles
.cursorrulesandCLAUDE.mdnegative directives into deterministic AST/path/command/import guards with 3-round iterative path-traversal normalization.
SARA Agent Induction Firewall (
ctxfw.sara):Inspects untrusted tool observations for indirect prompt injection, role overrides (
<system>,[INST]), and Trojan-Source bidi escapes (ALLOW,STRIP_COMMANDS,QUARANTINE_TOOL).
SWE-Gate CI Verifier (
ctxfw.swegate) & Audit Ledger Retrieval (query_audit_ledger):Deterministic unified-diff and architectural regression verifier enforcing cyclomatic complexity delta bounds, disallowed module imports, and
# type: ignorebans viaevaluate_patch, paired with read-only forensic inspection ofSweGateStore(EVL-...) andTraceKitStore(SES-...) viaquery_audit_ledger.
Zero-Touch Provisioning
Inject perimeter rules, MCP server declarations, and pre-commit sentinels into your workspace:
Global IDE Integration
ctxfw init --globalAutomatically configures Google Antigravity, Cursor, and Claude Desktop.
Repository Pre-Commit Sentry
ctxfw init --repo .Deploys .git/hooks/pre-commit to prevent uncertified code commits lacking an attested specification brief.
Enterprise Governance & CI/CD Gate (v4.1.0)
For engineering squads requiring FinOps consolidation and automated Pull Request governance:
Individual Developer FinOps & LiveBench 2.0 Arbitrage (Free / Apache 2.0):
ctxfw report --share ctxfw report --export-json ./my-ledger.jsonTeam Governance & SWE-Gate CI (
$199 USD/month Flat Squad— up to 15 developers & 5 CI/CD repositories, includes 7-Day Trial):export CTXFW_LICENSE_KEY="CTXFW-TEAM-PRO-..." ctxfw license status ctxfw gate --diff-file pr.patch --github-summary ctxfw report --team-merge ./team-ledgers/Official GitHub Action (
action.yml):- name: CTXFW SWE-Gate & FinOps PR Audit uses: heuristicolab/ctxfw@v4 with: license-key: ${{ secrets.CTXFW_LICENSE_KEY }} diff-range: "origin/main...HEAD"
Control Plane, 7-Day Trial & Team Squad Licensing: https://ctxfw.heuristicolab.com/pricing/
Available Tools
5 toolsevaluate_patchA
Verify a unified git diff patch (diff_text) against SWE-Gate architectural constraints (max_cyclomatic_delta, forbid_type_ignores, disallowed_import_modules) and functional test results (tests_passed, tests_failed, functional_verdict) before allowing merge. Appends immutable audit records (EVL-...) in SweGateStore and seals cryptographic blocks in TraceKitStore; use query_audit_ledger to retrieve or verify persisted records.
| Name | Required | Description | Default |
|---|---|---|---|
| pr_id | No | Pull request identifier (>= 1) | |
| repo_id | No | Optional repository identifier (REPO-...) | |
| diff_text | Yes | Unified diff text of the candidate patch | |
| repo_name | No | Repository name (e.g. 'heuristico/ctxfw') | heuristico/ctxfw |
| commit_sha | No | 40-character lowercase hex commit SHA | |
| author_kind | No | Patch author kind: 'AGENT' or 'HUMAN' | AGENT |
| tests_failed | No | Count of failing functional tests | |
| tests_passed | No | Count of passing functional tests | |
| diff_size_bytes | No | Exact UTF-8 byte length of diff_text | |
| functional_verdict | No | Functional test suite verdict: 'PASSED' or 'FAILED' | |
| forbid_type_ignores | No | Whether introducing '# type: ignore' is forbidden | |
| max_cyclomatic_delta | No | Maximum allowed cyclomatic complexity delta | |
| disallowed_import_modules | No | List of banned module names that the patch must not import |
Output Schema
| Name | Required | Description |
|---|---|---|
| content | Yes | JSON-serialized SWE-Gate verification report or rejection message |
| isError | Yes | True if the patch was rejected by SWE-Gate or failed validation |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false and idempotentHint=false; the description goes beyond them by disclosing concrete write side effects (immutable audit records EVL-... in SweGateStore, sealed cryptographic blocks in TraceKitStore), which tells the agent this call mutates state and is not a dry run. It does not say whether records are still appended when the verdict fails, which is the remaining unknown for a mutation tool.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences with no filler, front-loaded on the verification purpose with side effects and sibling routing deferred to the second sentence. The parenthetical parameter lists make it dense but each clause carries distinct information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With an output schema present, the description correctly avoids restating return values and instead covers the axes of evaluation, persistence side effects, and where to read results back. The open question of whether failed patches are still recorded in the audit ledger is the one behavior an agent would want before calling it repeatedly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the baseline is 3, but the description adds semantic grouping the schema lacks: it clusters max_cyclomatic_delta, forbid_type_ignores and disallowed_import_modules as the architectural constraint set, and tests_passed, tests_failed, functional_verdict as the functional evidence. It stops short of explaining how diff_text is parsed or whether diff_size_bytes is derived or trusted.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb and resource ('Verify a unified git diff patch') and enumerates the exact validation axes it applies (cyclomatic delta, type ignores, banned imports, functional verdict). It also clearly separates itself from siblings by assigning record retrieval to query_audit_ledger.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The gating context is explicit ('before allowing merge'), and it routes the agent to the correct sibling for retrieval/verification of persisted records. There is no explicit when-not guidance or distinction from evaluate_spec_axioms / resolve_context_bundle, which is the only gap.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
evaluate_spec_axiomsARead-onlyIdempotent
Evaluate an architectural specification brief (brief_text) against formal determinism rules, negative invariant floors ('never'/'shall never'), and the Axiom Completeness Index (ACI 1.0000). Use this during intake or planning phases before writing code. For verifying unified git diff patches, use evaluate_patch instead. Pure read-only analytical evaluation with no side effects.
| Name | Required | Description | Default |
|---|---|---|---|
| brief_text | Yes | Markdown content of the architectural intake brief to evaluate |
Output Schema
| Name | Required | Description |
|---|---|---|
| content | Yes | JSON-serialized architectural determinism verification report |
| isError | Yes | True if brief specification evaluation encountered an unhandled error |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, destructiveHint=false and openWorldHint=false, so the closing 'Pure read-only analytical evaluation with no side effects' largely restates structured data. It adds no new behavioral detail such as thresholds, failure modes, or what an ACI below 1.0000 produces, leaving it at adequate-but-thin beyond the annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Three tight sentences, front-loaded with the core purpose before the routing hint and the safety note. No filler or repetition; every clause carries actionable information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained, and annotations already cover the safety profile. For a single-parameter analytical tool, the description plus structured fields give an agent everything needed to invoke it correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
There is a single parameter with 100% schema description coverage, so the schema already documents `brief_text` as markdown brief content. The description names the parameter but adds no format constraints or size limits beyond the schema, matching the baseline 3 for high-coverage schemas.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb (Evaluate) plus the exact resource (an architectural specification brief) and enumerates the rule families it checks (determinism rules, negative invariant floors, ACI 1.0000). It explicitly distinguishes itself from the sibling evaluate_patch, so an agent can route without opening any schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives both the when ('during intake or planning phases before writing code') and the alternative ('For verifying unified git diff patches, use evaluate_patch instead'). The selection condition between the two siblings is explicit and unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
prune_fileARead-onlyIdempotent
Extract semantic interfaces, types, pydantic models, sanitized raises, and signatures from a source file (path) at a given pruning depth ('full', 'interface', or 'nominal') and language, optionally stripping docstrings (strip_docs), while replacing procedural bodies with AST stubs. Use this when you only need to inspect contracts or APIs of an individual dependency without ingesting raw implementation code. For multi-module dependency graphs, use resolve_context_bundle instead. Does not modify files on disk (pure in-memory AST operation).
| Name | Required | Description | Default |
|---|---|---|---|
| path | Yes | Absolute or relative path to the source file | |
| depth | No | Pruning depth: 'full', 'interface', or 'nominal' | interface |
| language | No | Programming language (python, typescript, javascript, go, java) | python |
| strip_docs | No | Whether to strip docstrings entirely |
Output Schema
| Name | Required | Description |
|---|---|---|
| content | Yes | Semantic interface stubs extracted via in-memory Tree-Sitter AST |
| isError | Yes | True if pruning encountered a fatal parsing or file resolution failure |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already establish readOnly/idempotent/non-destructive, so the safety profile is covered. The description adds real behavioral value beyond that: bodies are replaced with AST stubs while docstrings can be stripped, and it is a pure in-memory operation that does not modify files on disk. It stops short of describing return/error behavior, but the output schema covers returns.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loads the extraction verb and its targets, then usage routing, then the side-effect disclaimer. It is dense but each sentence earns its place; the long opening clause is somewhat loaded but remains readable and purposeful.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, so return values need not be explained. The description covers purpose, parameter meaning, usage routing, and the key constraint that nothing is written to disk, which is sufficient for an agent to invoke this correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all four parameters and their defaults. The description restates depth values and the effect of strip_docs and language, adding only light semantic framing rather than new syntax or constraints beyond the schema, so baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a precise verb and resource: extract semantic interfaces, types, models, raises, and signatures from a source file, with named scope controls (depth, language, strip_docs). It also names the sibling it is not (resolve_context_bundle) for multi-module graphs, so an agent can distinguish it without opening either schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives explicit when-to-use ('when you only need to inspect contracts or APIs of an individual dependency without ingesting raw implementation code') and an explicit alternative with its selecting condition ('For multi-module dependency graphs, use resolve_context_bundle instead'). Nothing is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
query_audit_ledgerARead-onlyIdempotent
Retrieve persisted SWE-Gate patch evaluation records and violation findings by evaluation_id (EVL-...), or verify and inspect cryptographic SHA-256 hash-chained audit sessions in TraceKitStore by session_id (SES-...) with optional block listing (include_blocks, max_blocks). Use this for forensic inspection and compliance verification after running evaluate_patch or context tools. Pure read-only query with zero ledger mutations.
| Name | Required | Description | Default |
|---|---|---|---|
| max_blocks | No | Maximum number of audit blocks to return when `include_blocks` is true (1 to 256) | |
| session_id | No | TraceKit session identifier (`SES-...`) to verify SHA-256 hash chain integrity and inspect blocks | |
| evaluation_id | No | SWE-Gate evaluation identifier (`EVL-<16 lowercase hex chars>`) returned by `evaluate_patch` | |
| include_blocks | No | Whether to include individual hash-chained audit block records when querying `session_id` |
Output Schema
| Name | Required | Description |
|---|---|---|
| content | Yes | JSON-serialized audit ledger query and cryptographic chain verification report |
| isError | Yes | True if neither identifier was provided, parameters failed validation, or no matching audit record was found |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint and destructiveHint=false, and the description reinforces this ('zero ledger mutations') while adding genuine context: SHA-256 hash-chain integrity verification and optional block enumeration. It does not note rate limits or failure modes for an invalid id, which keeps it short of a 5.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Purpose is front-loaded in the first clause, followed by usage and then the read-only guarantee; every sentence earns its place. The two sentences are dense with parenthetical id formats, which slightly hurts scannability but not correctness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists, all four parameters are documented in-schema, and annotations carry the safety profile, so the description need not explain return values. It covers the dual query modes, the optional block expansion, and the forensic use case, leaving nothing essential an agent would need.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%, so the baseline is 3, but the description goes further by tying parameters to modes: evaluation_id versus session_id selection, and include_blocks/max_blocks as optional block listing for the session path. That mode-to-parameter mapping is value the schema alone doesn't express.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description names a specific verb (retrieve/verify/inspect) and two distinct resources: persisted SWE-Gate evaluation records by EVL id and hash-chained TraceKit audit sessions by SES id. It also distinguishes the two lookup modes, so an agent can tell which branch to take without opening the schema.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
It states the trigger context clearly: use for forensic inspection and compliance verification after running evaluate_patch or other context tools, explicitly referencing the sibling evaluate_patch. It does not state when NOT to use it versus siblings like resolve_context_bundle, but the intended post-evaluation workflow is unambiguous.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
resolve_context_bundleARead-onlyIdempotent
Calculate topological dependency graph distances (D0 full target_file, D1 interface stubs, D2 nominal symbols) within project_root and compile a token-pruned Markdown context bundle, with optional reactive degradation via breaker_state and session_id. Use this as your primary context builder before editing a file in a multi-module project. For inspecting isolated files, use prune_file instead. Read-only operation.
| Name | Required | Description | Default |
|---|---|---|---|
| session_id | No | Session identifier (SES-...) to connect with TokenCast budget tracking | |
| target_file | Yes | Path to the active target file in editing (D0) | |
| project_root | No | Root directory of the project. Defaults to target file's directory. | |
| breaker_state | No | Optional circuit breaker state (CLOSED, TRIPPED, HALTED) or decision kind |
Output Schema
| Name | Required | Description |
|---|---|---|
| content | Yes | Compiled topological Markdown prompt context bundle |
| isError | Yes | True if dependency resolution or file traversal failed |
TDQS
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the safety profile (readOnly, idempotent, non-destructive, closed-world), so the bar is lower. The description still adds substantive behavior: what gets included per tier (full file vs. interface stubs vs. nominal symbols), token pruning, and reactive degradation through `breaker_state`/`session_id`. 'Read-only operation' is redundant with the annotations, and return format is left to the output schema.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Front-loaded with the core operation, then usage guidance, then the alternative. Dense but every clause carries selection value; the trailing 'Read-only operation' duplicates the annotations and is the only wasted sentence.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
An output schema exists so return values need no explanation, annotations carry the safety profile, and 100% schema coverage handles parameters. For a four-param read tool, the description covers purpose, routing, and tier semantics fully.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema already documents all four parameters, including the D0 mapping for `target_file`. The description reinforces that mapping and frames `breaker_state`/`session_id` as reactive degradation, but adds no syntax, defaults, or formats beyond what the schema states. Baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
States a specific verb+resource: 'Calculate topological dependency graph distances ... and compile a token-pruned Markdown context bundle', with the D0/D1/D2 tier scoping spelled out. It explicitly differentiates itself from the sibling `prune_file`.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
Gives an explicit when: 'primary context builder before editing a file in a multi-module project', and names the alternative with its own condition: 'For inspecting isolated files, use `prune_file` instead.' Nothing is left to inference.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Tool Schema Changelog
Recent tool additions, removals, and schema changes observed during successful MCP inspections.
1 tool update
v3.8.3- Added
query_audit_ledger
2 tool updates
v3.8.1- Added
evaluate_patch - Changed
resolve_context_bundle2 fields changed- added
Input schema / properties / breaker_stateAdded value: +{ + "description": "Optional circuit breaker state (CLOSED, TRIPPED, HALTED) or decision kind", + "type": "string" +} - added
Input schema / properties / session_idAdded value: +{ + "description": "Session identifier (SES-...) to connect with TokenCast budget tracking", + "type": "string" +}
3 tool updates
v3.5.6- Changed
evaluate_spec_axioms1 field changed- changed
Output schema / (root)Previous value: -nullNew value: +{ + "properties": { + "content": { + "description": "JSON-serialized architectural determinism verification report", + "items": { + "properties": { + "text": { + "description": "JSON report containing aci_score, negative_invariants_count, extracted_never_clauses, status, remediation_notes, and manifest_hash", + "type": "string" + }, + "type": { + "enum": [ + "text" + ], + "type": "string" + } + }, + "required": [ + "type", + "text" + ], + "type": "object" + }, + "type": "array" + }, + "isError": { + "description": "True if brief specification evaluation encountered an unhandled error", + "type": "boolean" + } + }, + "required": [ + "content", + "isError" + ], + "type": "object" +}
- Changed
prune_file1 field changed- changed
Output schema / (root)Previous value: -nullNew value: +{ + "properties": { + "content": { + "description": "Semantic interface stubs extracted via in-memory Tree-Sitter AST", + "items": { + "properties": { + "text": { + "description": "Pruned source code with AST stubs", + "type": "string" + }, + "type": { + "enum": [ + "text" + ], + "type": "string" + } + }, + "required": [ + "type", + "text" + ], + "type": "object" + }, + "type": "array" + }, + "isError": { + "description": "True if pruning encountered a fatal parsing or file resolution failure", + "type": "boolean" + } + }, + "required": [ + "content", + "isError" + ], + "type": "object" +}
- Changed
resolve_context_bundle1 field changed- changed
Output schema / (root)Previous value: -nullNew value: +{ + "properties": { + "content": { + "description": "Compiled topological Markdown prompt context bundle", + "items": { + "properties": { + "text": { + "description": "Token-optimized Markdown context bundle", + "type": "string" + }, + "type": { + "enum": [ + "text" + ], + "type": "string" + } + }, + "required": [ + "type", + "text" + ], + "type": "object" + }, + "type": "array" + }, + "isError": { + "description": "True if dependency resolution or file traversal failed", + "type": "boolean" + } + }, + "required": [ + "content", + "isError" + ], + "type": "object" +}
3 tool updates
v3.5.0- First observed
evaluate_spec_axioms - First observed
prune_file - First observed
resolve_context_bundle
TDQS
Scored across 5 tools
Each tool targets a clearly distinct purpose with explicit cross-references: prune_file for single-file contracts vs. resolve_context_bundle for multi-module graphs, evaluate_spec_axioms for specs vs. evaluate_patch for diffs, and query_audit_ledger for read-only forensic retrieval. No overlapping responsibilities remain ambiguous.
All tool names use snake_case with a verb-first pattern (prune_file, resolve_context_bundle, evaluate_spec_axioms, evaluate_patch, query_audit_ledger). The convention is consistent throughout with no mixed styles or vague verbs.
Five tools provide a well-scoped set covering context pruning, dependency resolution, two evaluation phases, and audit querying. Each tool earns its place without redundancy or obvious missing operations.
The surface covers the core workflow: context extraction, bundle building, spec evaluation, patch evaluation, and audit ledger querying. Minor gaps exist around explicit session/breaker management or audit initialization, but agents can work around these.
Maintenance
Related MCP Connectors
Memory that reasons: continual learning for stateful agents. Better context, fewer tokens.
Codebase intelligence for agents: 152 structured artifacts across 21 programs, one call.
Shared distillation cache for AI agents — every fetch ~73-89% fewer tokens via a shared cache.
Source-backed prompting and coding-agent guidance with provenance and freshness checks.
31
Related MCP Servers
- AlicenseAqualityCmaintenanceStructural memory for coding agents — 60% fewer tokens, refactor-safe, runs entirely on your machine.426 npm17Apache 2.0
- AlicenseNot gradedqualityBmaintenanceReduces token consumption for AI coding agents by 50-70% through intelligent code context filtering, Git delta tracking, and local SQLite/Tree-sitter indexing.167 npmMIT
- FlicenseAqualityAmaintenanceDeterministic repository context packing for AI coding agents: selects, compresses, and budgets only the files a task needs. Measured 83% fewer input tokens at the same task coverage, fully local, no LLM in the loop.941 PyPI9-
- AlicenseAqualityBmaintenanceEnables AI coding agents to reduce token usage by condensing source code into AST skeletons, extracting specific symbols, compressing logs, and estimating token budgets.4MIT