Skip to main content
Glama

Tollgate — the governance gate for AI agents that move money

CI License Python Dependencies

Deterministic policy enforcement, human approvals with cryptographic non-repudiation, budget escrow with clawback, and a tamper-evident audit chain — a zero-dependency governance gateway for any agent that touches money. Exposed to any agent as an MCP server.

PyPI Python CI Zero dependencies License MCP

中文文档

Axiom: the LLM is an untrusted component. It proposes; deterministic code disposes. Every tool call an agent makes passes through the gate — and the gate never guesses.

Why

Teams won't give agents spending authority because three questions have no answer: what exactly can it do? who is accountable? can we audit it afterwards? Tollgate answers all three with a single enforcement point that every tool call must cross:

unknown tool → rate limit → circuit breaker → integrity check → read cache
→ accountability → blacklist → budget reserve → field-semantics contract
→ injection fence → financial guardrails → adaptive risk score
→ policy rules (with business-calendar context) → authenticated approval
→ execution → hash-chained audit

Denial reasons flow back to the model so it can adapt. Anything that isn't explicitly allowed is denied — and that default is measured, not assumed (see Red team).

Related MCP server: agent-security-gateway

60-second demo

git clone https://github.com/kkU1444/agent-governance-gateway.git && cd agent-governance-gateway
python -m tollgate demo-web        # no API key needed
# open http://127.0.0.1:8765 — approve the $4,200 transfer in the browser

A travel agent runs a 15-step adversarial scenario: read-only calls pass, external email is blocked, a replayed payment is caught, a negative amount is rejected, an unregistered agent is refused, an unknown payee forces human sign-off, and an over-limit transfer hits a hard cap. Then the ops team freezes and claws back a fraudulent transfer, and the payee lands on a blocklist.

The money lifecycle

Approving a transfer is not the same as money leaving the building:

reserve (atomic, concurrency-safe) → human approval → execution
→ holding period (24h, funds in escrow, reversible)
→ settle | freeze → recover (clawback) → payee blacklist (permanent escalation)

Budget pools use BEGIN IMMEDIATE critical sections so concurrent agents see "occupied", not a stale balance. Clawbacks are two-step (freeze, then recover), each with operator identity and reason written into the audit chain.

Security architecture

Threat

Mechanism

Prompt injection

deterministic fence + pattern guard + canary tokens planted in context (a canary in tool args is proof of hijack → hard deny)

Semantic misreading (risk_score: 0.87 read as "high confidence")

field-semantics contract — meaning and thresholds of risk fields are owned by code; upstream risk signals auto-flag payees

Model hallucination / loops

forced replanning protocol, loop breaker, goal-anchored compaction

Concurrency / stale state

atomic budget reservation (BEGIN IMMEDIATE)

Rogue or unattributed agents

accountability registry — no registered owner, no execution; per-agent caps; approver authority levels

Forged approvals

HMAC or Ed25519 signatures (pure-Python RFC 8032); private keys stay with approvers; verify-approval recomputes; four-eyes for large amounts

Tool supply-chain tampering

registration/runtime tool fingerprints vs sealed baseline

Credential theft

credential broker issues per-call, short-lived scoped credentials; secret scanning masks leaks in args/results

Audit tampering

SQLite hash chain + verify locates the exact tampered row; policy hot-reloads are themselves chain-anchored

Resource exhaustion (DoS)

per-agent sliding-window rate limits (money is capped by budget breakers, compute by rate limits)

Policy files hot-reload on change; every reload lands in the chain as a policy.reload entry (old hash → new hash), so changes to the law itself are auditable.

Learning loop: attacks are auto-recorded into an intel base, replayed on every change (tollgate drill), and live samples merge into the red-team corpus (tollgate redteam) — real attacks become permanent regression tests.

Red team

$ python -m tollgate redteam
恶意样本拦截: 32/32 (召回率 100%)      injection corpus: 32/32 blocked
良性样本误报: 0/8 (误报率 0%)          false positives: 0/8
策略不变量模糊测试: 300 例,四条不变量全部成立   300 fuzz cases, all invariants hold

Four fuzz invariants: the governance layer never crashes; execution is fail-closed (actual executions ≡ audited executions); the hash chain survives any input sequence; same seed reproduces exactly. THREAT_MODEL.md maps mechanisms to STRIDE, OWASP Agentic AI threats and MITRE ATLAS, and keeps an honest residual-risk list.

MCP server

python -m tollgate mcp          # stdio JSON-RPC 2.0, zero dependencies

Point any MCP client (Claude Desktop, Cursor, your own agent) at it — every tool call crosses the full enforcement chain. Policy denials come back as isError tool results with reasons, so the calling model can adapt.

MCP upstream proxy — govern any MCP server

Tollgate is also an MCP client: point it at any third-party MCP server and it spawns the upstream, pulls tools/list, and registers every tool under a namespaced prefix (upstream__tool) — each call then crosses the full enforcement chain, and upstream tools follow the same policy rules as local ones:

mcp_upstreams:
  - name: github
    command: ["npx", "-y", "@modelcontextprotocol/server-github"]
    allow_tools: ["get_*", "list_*"]
    risk: read

(A bundled demo upstream ships as python -m tollgate.mcp_demo_upstream; see the mcp_upstreams section in policies/demo.yaml. A runnable real-world example — a zero-dependency filesystem MCP server at examples/fs_server.py, wired read-only allow / write deny — is configured there too: fs_write_file is rejected fail-closed and never touches the disk.)

To use Tollgate as the governance hub for Claude Desktop (or any MCP client), see docs/claude-desktop.md — one config entry gives every tool call (yours and every upstream's) the full enforcement chain, with the audit hash chain as the receipt.

Install

Python ≥ 3.10, zero mandatory dependencies (a bundled YAML-subset parser is used unless PyYAML is installed):

pip install tollgate-gateway # PyPI (import / CLI name stays `tollgate`)
pip install -e .             # or from this repository
tollgate demo                # or: python -m tollgate demo

CLI surface

Command

Purpose

demo / demo-web

scripted adversarial scenario (terminal / web approvals)

serve

approvals console + audit replay UI

transfers, freeze, recover, release

settlement ledger operations (authenticated)

verify / verify-approval

hash-chain check / approval signature check

trace, reconcile

attribution timeline / cross-ledger reconciliation

explain, compliance

decision rationale / compliance report

budgets, usage

budget pools / token & latency metering

golden, redteam, drill

drift regression / adversarial suite / attack replay

agent

live agent against any OpenAI-compatible endpoint

onboard

risk-grade a new tool, draft policy YAML

seal, keygen

tool fingerprint baseline / Ed25519 keypairs

Docs

Roadmap

  • Ed25519 for terminal approvals & settlement ops (web approvals done)

  • Pluggable storage (Postgres) for multi-instance deployments

  • Delegation chains (agent acting on behalf of a department)

  • Policy-change approval workflow (policy as a first-class audited asset)

Contributing & security

See CONTRIBUTING.md. Security issues: follow SECURITY.md — please do not open public issues for vulnerabilities.

License

Apache-2.0

Available Tools

13 tools
demo__demo_echoA

[MCP:demo] 原样回显参数(演示只读工具)

NameRequiredDescriptionDefault
payloadYes任意文本

TDQS

A3.5/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description must carry the behavioral burden. It does disclose the key trait — output is the input returned unchanged ('原样回显'), and it is read-only with no side effects — but says nothing about error behavior for the required payload or any limits.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One short clause with the essential verb and qualifier front-loaded; nothing is padded. The '[MCP:demo]' prefix is a namespace marker rather than semantic content, a minor bit of noise.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness4/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-string-parameter demo tool with no output schema and no annotations, the description covers enough: what it does, that it is read-only, and that the return is the input echoed back. Only edge-case behavior (empty or oversized payload) is left unstated.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% ('payload' documented as '任意文本'), so the schema already explains the single parameter. The description adds no format, size, or content constraints beyond that, which is the expected baseline when the schema does the work.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a concrete verb and object — '原样回显参数' (echo the parameters verbatim) — plus the qualifier '演示只读工具' (demo read-only tool). It is clearer than the bare name demo_echo, but it makes no attempt to differentiate from siblings (none of which overlap, so the omission is tolerable).

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines3/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The parenthetical '演示' (demo) implies this is a sample/testing tool rather than a production action, which weakly signals when to use it. There is no explicit when-to-use, when-not, or alternative named, so the guidance remains implied only.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

demo__demo_gated_actionC

[MCP:demo] 受治理的写动作(演示:策略/审批如何作用于上游工具)

NameRequiredDescriptionDefault
actionYes动作名
amountNo金额

TDQS

C2.7/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the burden, and it does add one important trait: this write goes through policy/approval governance, so an agent can expect gating rather than an immediate effect. However it does not disclose what is mutated, whether it is reversible, what approval flow triggers, or what the result looks like.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

It is a single short line with no filler, which is structurally fine, but the brevity comes at the cost of under-specification rather than being dense with useful information.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a write tool with no annotations and no output schema, the description should explain the governance behavior, what the demo mutates, and what an agent gets back. It gestures at policy/approval but leaves the mechanics and the target of the write entirely unspecified.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, so both parameters (action, amount) are documented in the schema and the baseline is 3. The description adds nothing beyond the schema — it does not clarify the valid values for 'action' or what 'amount' governs, leaving '动作名' ambiguous.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description identifies the tool as a 'governed write action' and states it is a demo of how policy/approval applies to upstream tools, which conveys the general intent. But it never says what resource is being written to or what the action does, unlike siblings such as transfer_money or send_email which name a concrete operation. An agent knows it is a gated demo write, not what it operates on.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to call this versus demo__demo_echo or the real write tools like transfer_money. The parenthetical implies it is illustrative, but the description never says to use it only for testing policy/approval flows or when to prefer the production equivalent.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

erp_query_invoiceC

从 ERP 查询发票并归一化为规范字段(只读,含重试)

NameRequiredDescriptionDefault
invoice_idYes

TDQS

C2.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full behavioral burden. It usefully discloses that the operation is read-only and includes retry behavior. However, it does not explain authentication requirements, failure semantics, retry limits, or what 'normalization' does to the returned data.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single compact sentence with no filler and front-loads the core purpose. The parenthetical adds useful behavioral context, though it compresses several ideas (read-only, retry) without elaboration.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no annotations, no output schema, and a required parameter with 0% schema coverage, the description is too sparse. It does not describe the returned canonical fields, error behavior, or how invoice_id is interpreted.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is one required parameter, invoice_id, and schema description coverage is 0%. The description does not explain the expected invoice ID format, source system conventions, or lookup behavior. It leaves the only parameter entirely undocumented beyond its name.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific action and resource: querying invoices from ERP and normalizing them into canonical fields. Siblings are unrelated tools, so explicit sibling differentiation is less critical. It could be slightly clearer about whether it returns one invoice or many, since the name is singular but 'query' is broad.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool versus any alternative, nor any prerequisites or exclusions. The only clue is '从 ERP' (from ERP), which implies data origin but not invocation conditions.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fs__fs_list_directoryC

[MCP:fs] List files and directories.

NameRequiredDescriptionDefault
pathYesDirectory path relative to root

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full behavioral burden. It implies a read-only listing but does not disclose recursion behavior, hidden-file handling, permissions, ordering, or error behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The description is a single front-loaded sentence with little waste. The '[MCP:fs]' prefix is noise, but the core statement is efficient.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple one-parameter listing tool with no output schema, the description is minimally adequate. It does not explain the return shape or listing behavior, but the core operation is understandable.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 100%, and the single path parameter is documented as 'Directory path relative to root'. The description adds no additional parameter semantics, so the baseline of 3 is appropriate.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: list files and directories. It is clearly a listing operation, though it does not explicitly distinguish itself from the sibling fs__fs_read_file.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this tool versus alternatives such as fs__fs_read_file. Usage is only implied by the word 'List', with no exclusions or context about when listing is appropriate.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

fs__fs_read_fileC

[MCP:fs] Read the contents of a file.

NameRequiredDescriptionDefault
pathYesFile path relative to root

TDQS

C2.9/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden. It implies a read-only operation but says nothing about encoding, binary files, size limits, path resolution relative to root, or what happens on a missing file — all material for a filesystem read.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One short, front-loaded sentence with no filler. It is appropriately sized, though its brevity comes partly at the cost of the missing behavioral detail noted elsewhere.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

A one-parameter read tool is simple enough that the definition is minimally viable, but with no output schema the description should at least indicate what is returned (raw text, error on binary) and confirm read-only safety, which it does not.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

The single parameter has 100% schema description coverage ("File path relative to root"), so the baseline is 3. The description adds no syntax, relative-path rules, or constraints beyond what the schema already states.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ("Read the contents of a file") with the "[MCP:fs]" namespace marker. An agent can distinguish it from fs__fs_list_directory by inference, but the description never names the sibling or contrasts the two explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this versus fs__fs_list_directory or other fs tools, and no preconditions such as the file needing to exist or being text vs binary. The only cue is the implied "if you need contents, read".

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_calendarC

查看某日日程

NameRequiredDescriptionDefault
dateYes

TDQS

C2.4/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of behavioral disclosure and does not meet it: it does not say whether the call is read-only, whose calendar is returned, what time zone applies, or whether the result is empty when no events exist. Only the weak implication of "查看" (view) signals it is a read operation.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The single phrase is front-loaded and contains no filler, which is structurally fine. The brevity here reflects under-specification rather than efficient communication, so it cannot earn a top score.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

With no annotations and no output schema, the description is the only source of behavioral and return-shape information, and it supplies neither. For a one-parameter read tool the surface area is small, but an agent still lacks the date format and the identity of the calendar being read.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is one parameter with 0% schema description coverage, and the description does not compensate by stating the date format (e.g. YYYY-MM-DD), time zone, or whether relative expressions are accepted. "某日" only echoes the parameter name at a conceptual level.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

"查看某日日程" gives a verb (查看) and a resource (某日日程), so the operation is identifiable as a read of one day's calendar. However, it never says whose calendar or what a "日程" entry contains, and the phrase is so terse that it barely rises above a title.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance, no exclusion of alternatives, and no stated prerequisites. The sibling list (search_flights, get_weather, send_email, etc.) contains nothing comparable, so the agent gets no help at all in routing.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

get_weatherC

查询城市天气

NameRequiredDescriptionDefault
cityYes

TDQS

C2.6/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

Because no annotations are provided, the description carries the full burden of behavioral disclosure, and it discloses almost nothing. The word '查询' implies a read-only retrieval, but the description says nothing about the data source, freshness, or whether the tool returns current conditions or a forecast. No behavior is contradicted; it is simply undisclosed.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The definition is one short phrase with no filler and is fully front-loaded. However, the brevity reflects under-specification rather than disciplined conciseness, so it earns a middling score.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a simple single-parameter tool with no output schema, an agent still needs to know the return shape, such as temperature units, returned fields, and current conditions versus forecast, plus any constraints on the city parameter. None of this information is present, so the definition is insufficient for confident invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

schema_description_coverage is 0% for the single required parameter 'city', and the description adds no format guidance, such as city name versus city ID, or whether the parameter requires a Chinese or English name. The meaning of 'city' can be inferred from the parameter name alone, which raises the score above the floor but does not compensate for the documented gap.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb+resource: query city weather. That is clear, and because no sibling tool in the provided list overlaps with weather, no sibling differentiation is required. The description is clear but minimal; it does not say whether it returns the current weather or a forecast.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no guidance on when to use this tool, when not to use it, or how it relates to alternatives. With no overlapping sibling tools, this omission is less harmful than it would otherwise be, but the description still leaves every usage decision to inference.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

page_oncallC

呼叫值班工程师(凭证由网关按次注入,Agent 不可见)

NameRequiredDescriptionDefault
messageYes

TDQS

C2.7/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden, yet it only discloses that credentials are injected by the gateway and are invisible to the agent. It does not disclose the salient side effect (interrupting a human), whether the call blocks, whether repeated pages are throttled, or what is returned. For an alerting mutation this is a substantial gap.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

One compact sentence with the key constraint parenthesized immediately after the action, so nothing is buried. It earns its brevity, though the space saved is not reinvested in any operational detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a tool with no annotations, no output schema, and zero documented parameters, the description is too thin: the agent cannot tell when to invoke it, what to put in the message, or what happens on invocation. Only the auth-injection detail is complete.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0% and the single required 'message' parameter is never explained. There is no guidance on what the message should contain (severity, service name, symptom, link), which is exactly what the description should compensate for at this coverage level.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description states a specific verb and resource: page (呼叫) the on-call engineer. That is unambiguous and distinct from every sibling tool. It stops short of the top score because it offers no differentiation from notification-like siblings such as send_email, which an agent might reasonably choose instead.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description never says when paging is appropriate: no urgency threshold, no escalation condition, no 'use send_email instead for non-urgent'. The agent must infer entirely from the tool name.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

parse_invoice_textB

从非结构化文本抽取发票要素,带逐字段置信度(只读)

NameRequiredDescriptionDefault
textYes

TDQS

B3.2/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

With no annotations, the description carries the full burden; it does disclose two behavioral facts beyond the name — the operation is read-only and the response includes per-field confidence. It says nothing about what happens on unparseable or partial input, error behavior, or which fields are extracted, so significant gaps remain.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single compact clause with the action and the value-add (confidence) front-loaded; no filler. It is arguably too terse for what it omits, but nothing present is wasted.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness3/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a one-parameter extraction tool with no annotations and no output schema, the description should at least indicate return shape and failure modes. It hints at per-field confidence but not at the field set or what an empty/failed parse looks like.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

There is one required string parameter with 0% schema description coverage, so the description must compensate. It implies the parameter is raw invoice text ('从非结构化文本'), which is useful, but adds no constraints on language, size, or expected encoding.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource: extract invoice elements from unstructured text, plus an output characteristic (per-field confidence). It is clearly a parsing tool, not a query tool like erp_query_invoice, though it never names that sibling or states the boundary explicitly.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no guidance on when to use this versus erp_query_invoice, no note on input prerequisites (language, format, length), and no exclusion of cases. The parenthetical '(只读)' is the only contextual hint and it is about safety, not selection.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

risk_checkC

查询收款方风险评分(risk_score 越高越危险,解释权在治理层)

NameRequiredDescriptionDefault
payeeYes

TDQS

C2.9/5.0
Behavior3/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description bears the full disclosure burden. It does add behavioral meaning by explaining that a higher risk_score means greater danger and that interpretation of the score is the responsibility of the governance layer. However, it says nothing about what happens when the payee is unknown, whether the lookup is a live or cached read, or what the returned fields look like.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness4/5

Is the description appropriately sized, front-loaded, and free of redundancy?

A single compact sentence with the core purpose front-loaded and no wasted text. The parenthetical clarification adds useful context without bloat.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

The tool has no annotations and no output schema, so the description should explain the return shape and the known failure modes. It only hints at the meaning of risk_score (higher = worse) and omits the score range, the response structure, and the behavior for an unrecognized payee.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema description coverage is 0%, so the description must compensate for the schema gap, but it adds nothing about the 'payee' parameter. It is unclear whether it expects an account number, a name, or an identifier, which is a meaningful gap for a required parameter.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

The description names a specific verb and resource ('查询收款方风险评分'), so an agent immediately knows it retrieves a risk score for a payee. It is not confused with any sibling, but it does not explicitly contrast itself with related tools such as transfer_money, which the agent might expect it to precede.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description gives no guidance on when to call it: no mention of using it before transfer_money, no prerequisites, and no exclusions. The agent must infer the intended workflow entirely from the sibling list.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

search_flightsC

搜索航班

NameRequiredDescriptionDefault
dateYes出发日期 YYYY-MM-DD
originYes出发地三字码,如 PEK
destinationYes目的地三字码,如 SFO

TDQS

C2.8/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden of disclosure. 'Search' implies a read-only operation, but the description says nothing about the data source, whether results include live pricing/availability, rate limits, or how results are ordered or paged.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness3/5

Is the description appropriately sized, front-loaded, and free of redundancy?

Extremely short and front-loaded with no wasted words, but this tips into under-specification. The single phrase does not carry enough information for a 3-required-parameter search tool.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness2/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

All three required parameters are documented in the schema, but there is no output schema and the description says nothing about what a search returns (flight list, prices, availability) or the one-way-only semantics implied by a single date field. For a search tool with no annotations and no output schema, this leaves meaningful gaps.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters3/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 100% and each parameter has a clear description (date format YYYY-MM-DD, three-letter airport codes with examples), so the schema does the heavy lifting. The description contributes nothing beyond the schema, so the baseline 3 applies.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose4/5

Does the description clearly state what the tool does and how it differs from similar tools?

States a specific verb and resource ('搜索航班' / search flights), which is unambiguous. Sibling tools are unrelated domains (invoice, calendar, weather, email), so no differentiation is required, but the description adds no scope detail such as one-way vs. round-trip or what is returned.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

No guidance on when to use this tool or when not to. There is no mention of prerequisites, whether dates must be in the future, or whether it handles multi-city/round-trip searches via the single 'date' parameter.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

send_emailD

发送邮件

NameRequiredDescriptionDefault
toYes
bodyYes
subjectYes

TDQS

D1.3/5.0
Behavior1/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are provided, so the description carries the full burden, yet it discloses nothing about side effects, irreversibility (sent mail cannot be recalled), rate limits, auth/from-address requirements, or delivery failure behavior.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

It is short but only because it is empty; there is nothing to be front-loaded, and the four characters provide no information an agent could act on.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

For a side-effecting tool with three required, undocumented parameters, no annotations, and no output schema, the description is completely inadequate.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters1/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

All three parameters (to, subject, body) have 0% schema description coverage and the description supplies no meaning: no format for `to` (single vs multiple, comma-separated, display names), no subject/body length or HTML/text expectations.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose2/5

Does the description clearly state what the tool does and how it differs from similar tools?

The text "发送邮件" merely restates the tool name send_email; it names the resource and action but adds no distinguishing scope, recipient/format detail, or reason to prefer it.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines1/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

There is no when-to-use guidance, no prerequisites, no exclusions, and no reference to alternatives (none of the siblings send mail, but the agent is told nothing about that).

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

transfer_moneyC

向外转账付款

NameRequiredDescriptionDefault
toYes收款方账号或邮箱
amountYes
currencyNo

TDQS

C2.2/5.0
Behavior2/5

Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?

No annotations are supplied, so the description carries the full burden, yet it discloses almost nothing beyond the name. For a funds-movement operation it says nothing about irreversibility, required permissions or authorization, amount limits, idempotency, or failure modes such as insufficient balance — only the outward direction is added.

Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.

Conciseness2/5

Is the description appropriately sized, front-loaded, and free of redundancy?

The text is a single five-character fragment rather than a concise description; it is under-specified rather than tight. There is no structure to front-load because there is essentially one phrase with no supporting detail.

Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.

Completeness1/5

Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?

A high-stakes mutation tool with zero annotations, no output schema, and partial parameter documentation requires a far richer description to be callable correctly. Nothing about confirmation, effects, or return behavior is present, so the definition is not sufficient for safe invocation.

Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.

Parameters2/5

Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?

Schema coverage is 33%: only `to` is documented ('收款方账号或邮箱'), while `amount` and `currency` have no descriptions anywhere. The tool description adds nothing about expected formats, currency defaults, or decimal/precision conventions, so the coverage gap is not compensated.

Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.

Purpose3/5

Does the description clearly state what the tool does and how it differs from similar tools?

The phrase '向外转账付款' names a verb (transfer/pay) and resource (money) and adds the direction ('outbound'), so the core action is identifiable. However, it is a bare fragment with no scope, no counterparty model, and nothing that separates it from the only related sibling, risk_check, which an agent would plausibly need to call first.

Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.

Usage Guidelines2/5

Does the description explain when to use this tool, when not to, or what alternatives exist?

The description provides no when-to-use or when-not-to-use guidance and does not mention prerequisites, limits, or any alternative tool. An agent learns nothing about how this differs from risk_check or when a transfer should be preceded by a check.

Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.

Tool Schema Changelog

Recent tool additions, removals, and schema changes observed during successful MCP inspections.

  1. 4 tool updatesv0.1.3
    • Addeddemo__demo_echo
    • Addeddemo__demo_gated_action
    • Addedfs__fs_list_directory
    • Addedfs__fs_read_file
  2. 9 tool updatesv0.1.0
    • First observederp_query_invoice
    • First observedget_calendar
    • First observedget_weather
    • First observedpage_oncall
    • First observedparse_invoice_text
    • First observedrisk_check
    • First observedsearch_flights
    • First observedsend_email
    • First observedtransfer_money

TDQS

C2.6/5.0

Scored across 13 tools

Disambiguation4/5

Each tool mostly maps to a distinct resource/action, and the demo/fs namespaces clarify provenance. erp_query_invoice vs parse_invoice_text and risk_check vs transfer_money are related but separable; only the generic demo_gated_action could conceptually overlap with governed writes like send_email or transfer_money.

Naming Consistency3/5

Most names are snake_case, but prefix conventions are mixed: demo__demo_*, fs__fs_*, erp_query_invoice without a namespace separator, and bare names like get_calendar and send_email. The verb_noun pattern is common but not uniform, with page_oncall and risk_check deviating.

Tool Count5/5

Thirteen tools fit comfortably in a well-scoped range and cover demo governance, filesystem access, ERP invoice lookup, calendar/weather/flights, messaging, payments, and risk checks. No tool appears purely redundant, although the demo tools are scaffolding.

Completeness3/5

The surface spans many domains but most have only one operation: filesystem has read/list but no write, calendar only get, email only send, and flights only search. This may be acceptable for an illustrative governance gateway, but agents would encounter dead ends for update/delete/read workflows.

Maintenance

ActivityMaintained
ResponsivenessUnresponsive

Related MCP Connectors

Related MCP Servers